tickmarkr 2.5.3 → 2.5.5

package/dist/run/daemon.js

@@ -1,3 +1,4 @@
+import { commandLeaseEnvironment, CommandLeases, currentCommandLeaseToken, isRunnerCommand, runWithCommandLease, withCommandLease } from "./lease.js";
 import { execFileSync, spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { shq } from "../adapters/types.js";
@@ -9,7 +10,7 @@ import { fileURLToPath } from "node:url";
 import { stringify } from "yaml";
 import { classifyDeadChannel, NO_TRAILER_SUMMARY, trailerPattern, UNPARSEABLE_TRAILER_SUMMARY, writePrompt } from "../adapters/prompt.js";
 import { allAdapters, getAdapter, probeAll, readDoctor, rolePools } from "../adapters/registry.js";
-import { SettledTrailerTracker, addUsage, channelKey, matchesTrustDialog, QUOTA_RE } from "../adapters/types.js";
+import { SettledTrailerTracker, addUsage, channelKey, matchesInputBox, matchesTrustDialog, QUOTA_RE } from "../adapters/types.js";
 import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { collateralHits } from "../compile/collateral.js";
 import { DEFAULT_DIFF_CAP, globalConfigDir, loadConfigWithMode, readOverlayFile, repoOverlayPath, } from "../config/config.js";
@@ -27,12 +28,13 @@ import { augmentRetryBrief, consult, renderRetryGuidance } from "./consult.js";
 import { runEnvironment } from "./environment.js";
 import { cleanupRunWorktrees, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, preserveWorktree, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sh, shGit, SUITE_PARENT_ENV, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
-import { activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, outstandingReviewFindings, pendingRechecks, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
+import { applyScopeAmendments, activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, outstandingReviewFindings, pendingRechecks, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
 import { isDiffCapPark, pickReviewer } from "../gates/review.js";
 import { acquireApprovalSerialization, acquireRunLock, isPidLive, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, verifyIntegrationTip } from "./merge.js";
-import { nextChannel, route } from "../route/router.js";
+import { climbChannel, marginalCostRank, nextChannel, route } from "../route/router.js";
 import { desiredPanes } from "./reconcile.js";
+import { readTierLiveness, readWatchBoard, supervisionBeatPath } from "./supervision.js";
 import { harvestCpuFlatWindowMs, NUDGEABLE_ADAPTERS, PANE_READ_ROWS, StallProgressTracker, stallSnapshotBannerRows, WorkerTreeCpuAccountant, } from "./stall.js";
 // The live set is also the ownership claim shared by task cleanup and termination.
 export async function closeLiveSlot(liveSlots, driver, slot) {
@@ -378,14 +380,67 @@ export function setWorkerStartupWindowMsForTests(ms) {
 export function resetWorkerStartupWindowMsForTests() {
     workerStartupWindowMs = WORKER_STARTUP_WINDOW_MS;
 }
-function startupFailureInWindow(output, launchedAt) {
-    if (launchedAt === undefined || Date.now() - launchedAt > workerStartupWindowMs)
-        return false;
-    const bytes = Buffer.from(output);
-    const bounded = bytes.length <= WORKER_STARTUP_WINDOW_BYTES
-        ? output
-        : bytes.subarray(0, WORKER_STARTUP_WINDOW_BYTES).toString("utf8");
-    return WORKER_STARTUP_FAILURE_RE.test(stallSnapshotBannerRows(bounded));
+/** One seat, one startup prefix. Once execution or its input box is seen, later panes are ineligible. */
+export class StartupFailureDetector {
+    adapter;
+    closed = false;
+    constructor(adapter) {
+        this.adapter = adapter;
+    }
+    sample(output, launchedAt) {
+        if (this.closed || launchedAt === undefined || Date.now() - launchedAt > workerStartupWindowMs)
+            return;
+        // read() returns a tail, not a guaranteed transcript origin. A saturated read cannot
+        // establish startup ownership: the first tool frame may already have scrolled out.
+        if (Buffer.byteLength(output) >= WORKER_STARTUP_WINDOW_BYTES || output.split("\n").length >= 500) {
+            this.closed = true;
+            return;
+        }
+        const bounded = output;
+        const rows = bounded.split("\n");
+        let inputStart = rows.length;
+        const input = this.adapter.inputBox;
+        if (input && matchesInputBox(bounded, input)) {
+            // Locate the beginning, including multi-row composers whose footer proves the matcher.
+            let end = rows.length;
+            let low = 1;
+            while (low < end) {
+                const mid = Math.floor((low + end) / 2);
+                if (matchesInputBox(rows.slice(0, mid).join("\n"), input))
+                    end = mid;
+                else
+                    low = mid + 1;
+            }
+            inputStart = 0;
+            let high = end;
+            while (inputStart + 1 < high) {
+                const mid = Math.floor((inputStart + high) / 2);
+                if (matchesInputBox(rows.slice(mid, end).join("\n"), input))
+                    inputStart = mid;
+                else
+                    high = mid;
+            }
+        }
+        let offset = 0;
+        for (const [index, row] of rows.entries()) {
+            const cleanRow = row.replace(/\u001b\[[0-?]*[ -/]*[@-~]/g, "");
+            // Structured tool frames and the terminal's tool headings close the prefix BEFORE their body.
+            const toolFrame = /"(?:type|role)"\s*:\s*"(?:tool[^" ]*|function_call[^" ]*|command_execution)"|^\s*(?:[•⏺]\s*(?:Ran|Explored|Searched|Called|Bash|Read|Write|Edit|Shell|Exec|Tool)\b|⎋ |(?:tool[-_ ](?:call|output|result)|function_call)\b)/i.test(cleanRow);
+            if (toolFrame || index >= inputStart) {
+                this.closed = true;
+                return;
+            }
+            if (!this.adapter.harnessBannerRows?.includes(cleanRow)) {
+                const match = WORKER_STARTUP_FAILURE_RE.exec(row);
+                if (match)
+                    return {
+                        matchedBytes: match[0], offset: offset + Buffer.byteLength(row.slice(0, match.index)),
+                        row, rowNumber: index + 1,
+                    };
+            }
+            offset += Buffer.byteLength(row) + 1;
+        }
+    }
 }
 // OBS-901/906: one daemon-owned writer for every execution surface. Drivers expose one retained
 // stream through read(); the daemon persists that exact surface before any close/reconcile can make
@@ -569,17 +624,54 @@ async function cancellableTipBattery(intWt, commands, runDir, baseline, signal)
     });
     const { verifyIntegrationTip } = await import(${JSON.stringify(new URL(`./merge.${extension}`, import.meta.url).href)});
     const { runWithVerificationBudget } = await import(${JSON.stringify(new URL(`./git.${extension}`, import.meta.url).href)});
+    const { runWithCommandLease } = await import(${JSON.stringify(new URL(`./lease.${extension}`, import.meta.url).href)});
+    let sequence = 0;
+    const grants = new Map();
+    const commandCapacities = new Map();
+    process.on('message', (message) => {
+      if (message.type === 'lease-grant') { grants.get(message.id)?.(message); grants.delete(message.id); }
+    });
+    const lease = async (command, execute) => {
+      const id = ++sequence;
+      const grant = new Promise(resolve => grants.set(id, resolve));
+      process.send({ type: 'lease-acquire', id, command });
+      const { capacity, token } = await grant;
+      commandCapacities.set(command, capacity);
+      try { return await runWithVerificationBudget(capacity, () => execute(token)); }
+      finally { process.send({ type: 'lease-release', id }); }
+    };
     let input = ''; for await (const chunk of process.stdin) input += chunk;
     const { intWt, commands, runDir, baseline, capacity } = JSON.parse(input);
     try {
-      const result = await runWithVerificationBudget(capacity, () => verifyIntegrationTip(intWt, commands, runDir, baseline));
-      if (!cancelled) process.stdout.write(JSON.stringify(result));
+      const result = await runWithVerificationBudget(capacity, () => runWithCommandLease(lease, () => verifyIntegrationTip(intWt, commands, runDir, baseline)));
+      if (!cancelled) process.stdout.write(JSON.stringify(result.map(row => ({ ...row, capacity: [...commandCapacities].reverse().find(([command]) => command === row.cmd || command.startsWith(row.cmd + " "))?.[1] ?? capacity }))));
     } catch (error) { if (!cancelled) throw error; }
+    finally { process.disconnect(); }
   `;
     const child = spawn(process.execPath, [
         ...(extension === "ts" ? ["--import", createRequire(import.meta.url).resolve("tsx")] : []),
         "--input-type=module", "-e", script,
-    ], { stdio: ["pipe", "pipe", "pipe"], detached: true });
+    ], { env: commandLeaseEnvironment(process.env), stdio: ["pipe", "pipe", "pipe", "ipc"], detached: true });
+    const releases = new Map();
+    const leases = new Set();
+    let closed = false;
+    child.on("message", (message) => {
+        if (message.type === "lease-release") {
+            releases.get(message.id)?.();
+            releases.delete(message.id);
+        }
+        if (message.type !== "lease-acquire")
+            return;
+        const held = withCommandLease(message.command, async () => {
+            if (closed || signal.aborted)
+                return;
+            const released = new Promise((resolve) => releases.set(message.id, resolve));
+            child.send({ type: "lease-grant", id: message.id, capacity: resolvedCapacity(), token: currentCommandLeaseToken() });
+            await released;
+        });
+        leases.add(held);
+        void held.catch(() => { }).finally(() => leases.delete(held));
+    });
     let output = "";
     let errors = "";
     child.stdout.on("data", (chunk) => { output += chunk; });
@@ -588,6 +680,10 @@ async function cancellableTipBattery(intWt, commands, runDir, baseline, signal)
     const finished = new Promise((resolve, reject) => {
         child.once("error", reject);
         child.once("close", (code) => {
+            closed = true;
+            for (const release of releases.values())
+                release();
+            releases.clear();
             if (signal.aborted && (code === 143 || code === null))
                 reject(signal.reason);
             else if (code !== 0)
@@ -607,6 +703,7 @@ async function cancellableTipBattery(intWt, commands, runDir, baseline, signal)
     }
     finally {
         signal.removeEventListener("abort", cancel);
+        await Promise.allSettled(leases);
     }
 }
 /**
@@ -661,9 +758,10 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
     for (const r of await (opts.signal
         ? cancellableTipBattery(intWt, commands, journal.dir, opts.baseline, opts.signal)
         : verifyIntegrationTip(intWt, commands, journal.dir, opts.baseline))) {
+        const measuredCapacity = r.capacity ?? capacity;
         if (r.pass) {
             // Q121s: a forgiven pass journals its fingerprints — honest about what was carried, never a silent green.
-            journal.append("tip-verify", undefined, { gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints } : {}), tip, cmdHash, capacity });
+            journal.append("tip-verify", undefined, { gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints } : {}), tip, cmdHash, capacity: measuredCapacity });
         }
         else {
             journal.append("tip-verify-failed", undefined, {
@@ -676,7 +774,7 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
                 lastMergedTask: opts.lastMergedTask,
                 tip,
                 cmdHash,
-                capacity,
+                capacity: measuredCapacity,
             });
             tipFailed = true;
         }
@@ -733,7 +831,6 @@ async function observeWorkerProcessTree(marker, cwd) {
     }
     return tree.size === 0 ? "empty" : "running";
 }
-const SUITE_COMMAND_RE = /(?:^|[\s/])(vitest(?:\.mjs)?|jest|mocha)(?:[\s/]|$)|\bnpm(?:\s+run)?\s+test\b/i;
 function processCwd(pid) {
     try {
         return realpathSync(readlinkSync(`/proc/${pid}/cwd`));
@@ -801,7 +898,7 @@ export function countLiveSuites(snapshot, repoRoot, daemonPid = process.pid, cwd
     // runner ("…as a vitest test whose…"), so a finished interactive worker counted as a live suite and
     // held a task's gates for 9 min 46 s. A runner is named in a command's HEAD — `node <bin>`,
     // `npm test`, `npx vitest`, `sh -c npm test` — never 140 KB into it: read the first four tokens only.
-    const candidates = rows.filter((row) => !ancestors.has(row.pid) && SUITE_COMMAND_RE.test(row.command.split(/\s+/, 4).join(" ")));
+    const candidates = rows.filter((row) => !ancestors.has(row.pid) && isRunnerCommand(row.command));
     const attributable = new Set(candidates.filter((row) => {
         if (descendants.has(row.pid))
             return true;
@@ -1346,7 +1443,7 @@ export async function runDaemon(repoRoot, opts = {}) {
         const rm = resolveRunMode(repoRoot, { flag: opts.mode, spec: graph.mode, globalDir: opts.globalDir });
         const cfg = rm.cfg;
         // Resolve both budgets once: worker fan-out divides by dispatch concurrency; verification
-        // divides by one suite occupying the serialized window. Explicit operator caps still win.
+        // divides by one runner command holding a lease. Explicit operator caps still win.
         const concurrency = opts.concurrency ?? cfg.concurrency;
         return await runWithForkBudget(concurrency, async () => {
             const conservativeCapacity = resolvedCapacity();
@@ -1358,7 +1455,7 @@ export async function runDaemon(repoRoot, opts = {}) {
             return await runWithVerificationBudget(occupancyCapacity, async () => {
                 // v1.51 T4: every dispatch provenance line begins with the mode and its source; when a pin won
                 // the route (the final "→ " segment is a pin, not a degraded-to-auto tail) it names the mode it bypassed.
-                const dispatchProvenance = (p) => `mode ${rm.mode.mode} (${rm.source})${p.split("→ ").pop().startsWith("pin ") ? ` — pin bypasses mode ${rm.mode.mode}` : ""} · ${p}`;
+                const dispatchProvenance = (p) => `mode ${rm.mode.mode} (${rm.source})${p.split("→ ").pop().startsWith("pin ") && !p.includes("not re-tried") ? ` — pin bypasses mode ${rm.mode.mode}` : ""} · ${p}`;
                 // v1.87 T2: one pool per seat role, built once. `channels` stays the WORKER pool — every routing
                 // call below reads it exactly as before — while the judge, review and consult seats each receive
                 // the pool their own deny scope allows, so routing.deny.workers benches a channel for dispatch
@@ -1395,6 +1492,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             liveSlots.add(s);
                             return s;
                         } } : {}),
+                    ...(driver.retireLostWatch ? { retireLostWatch: driver.retireLostWatch.bind(driver) } : {}),
                     ...(driver.project ? { project: driver.project.bind(driver) } : {}),
                     ...(driver.reconcile ? { reconcile: driver.reconcile.bind(driver) } : {}),
                     notify: (m, o) => driver.notify(m, o),
@@ -1468,6 +1566,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                 const reviewHistory = journal.read()
                     .filter((event) => event.event === "gate-result" && event.data.gate === "review" && typeof event.data.reviewer === "string")
                     .map((event) => event.data.reviewer);
+                // RF-1 (OBS-922 add.3): the seats THIS task's review rows name — the prior reviewers a later round's
+                // floor holds. Task-scoped on purpose: reviewHistory rotates seats run-wide and is never floor evidence.
+                // Each row's journaled dispatch tier travels with it, so a seat that left the pool on resume still counts.
+                // Leg-2 T4 M2: a `review-no-verdict` note is dispatch evidence too — it lands BEFORE the in-gate retry's
+                // gate-result, so a daemon killed between the two leaves it as the task's only record of that seat.
+                const taskReviewers = (taskId) => journal.read()
+                    .filter((event) => event.taskId === taskId && typeof event.data.reviewer === "string"
+                    && ((event.event === "gate-result" && event.data.gate === "review") || event.event === "review-no-verdict"))
+                    .map((event) => ({ reviewer: event.data.reviewer, tier: event.data.reviewerTier }));
                 // Capture this before this observer appends run-resume. A prior run-end belongs to a completed
                 // lifecycle and must use the ordinary resume/redispatch rules; only an interrupted live attempt
                 // owns reusable measurements or unclean-death residue.
@@ -1499,66 +1606,124 @@ export async function runDaemon(repoRoot, opts = {}) {
                 const commands = detectGateCommands(repoRoot, cfg);
                 const watchName = formatOwnedName({ role: "watch", taskId: "run", attempt: 0, runId });
                 let watchSlot;
-                const openBoard = async () => {
-                    if (!trackedDriver.narrator) {
-                        noteCapabilityAbsent("narrator");
-                        return;
-                    }
+                let boardOpened = false; // WB-1: only a board this daemon placed is watched below
+                // Leg-2 T7 M1 (OBS-988): a reopen first retires the ghost through the driver's seam so the narrator
+                // launches a NEW pane; a driver that answers with the lost pane anyway (no seam, or a cache it
+                // would not drop) has not reopened anything, and that answer is a FAILED reopen, never a success.
+                const openBoard = async (ghost) => {
                     try {
-                        watchSlot = await trackedDriver.narrator(repoRoot, watchCommand(runId), runId);
+                        if (ghost?.slot)
+                            await trackedDriver.retireLostWatch?.(ghost.slot);
+                        const slot = await trackedDriver.narrator(repoRoot, watchCommand(runId), runId);
+                        if (ghost && slot.id === ghost.pane) {
+                            liveSlots.delete(slot); // the ghost again: no close is ever aimed at it
+                            return { ok: false, error: `narrator answered with the lost pane ${ghost.pane}` };
+                        }
+                        watchSlot = slot;
+                        boardOpened = true;
+                        return { ok: true, slot };
                     }
                     catch (error) {
-                        const reason = error instanceof Error ? error.message : String(error);
-                        journal.append("watch-placement-failed", undefined, { error: reason });
-                        console.error(`tickmarkr: narrator not opened: ${reason}`);
+                        return { ok: false, error: error instanceof Error ? error.message : String(error) };
+                    }
+                };
+                const placeBoard = async () => {
+                    if (!trackedDriver.narrator) {
+                        noteCapabilityAbsent("narrator");
+                        return undefined;
                     }
+                    const placed = await openBoard();
+                    if (placed.ok)
+                        return placed.slot;
+                    journal.append("watch-placement-failed", undefined, { error: placed.error });
+                    console.error(`tickmarkr: narrator not opened: ${placed.error}`);
+                    return undefined;
                 };
-                // OBS-829/OBS-854: one full-suite verdict round at a time in this run, and do not begin beside an
-                // externally live suite attributable to this repository. The process scan catches nested scratch
-                // suites through daemon parentage even after cwd stops naming a worktree.
-                let suiteChain = Promise.resolve();
-                let suitePending = 0;
-                const withSuiteWindow = async (taskId, enabled, run, signal) => {
-                    if (!enabled)
-                        return run();
-                    const previous = suiteChain;
-                    let release;
-                    suiteChain = new Promise((resolve) => { release = resolve; });
-                    const queued = suitePending++ > 0;
-                    if (queued) {
-                        const count = Math.max(1, await liveSuiteCount(repoRoot));
-                        journal.append("suite-wait", taskId, { count });
+                // WB-1 (OBS-988): the daemon watches its own cockpit. A board is lost when the watch tier's beat
+                // aged past the supervision stale bound, the recorded arm has no presence, or the owner pid is dead.
+                // The beat and presence checks wait for the UI to have armed (armId recorded) — a freshly reopened
+                // board that has not armed yet is not a second loss. Reopens are bounded per run; past the bound
+                // the loss is journaled `boardless` and the narrator is never called again.
+                // Leg-2 T7 M2: one `watch-board-lost` row per LOSS. A loss is identified by the pane and pid the
+                // owner record names; a reopen that fails leaves that record in place, so the next poll sees the
+                // same loss, journals only its own reopen attempt, and the bound retires the run boardless from the
+                // last failed attempt rather than from a repeated lost row.
+                const MAX_BOARD_REOPENS = 3;
+                let boardReopens = journal.read().filter((e) => e.event === "watch-board-reopened" || e.event === "watch-board-reopen-failed").length;
+                let boardless = false;
+                let journaledLoss;
+                const boardLoss = () => {
+                    const owner = readWatchBoard(repoRoot, runId);
+                    if (!owner)
+                        return undefined;
+                    const lost = { pane: owner.pane, ...(owner.pid !== undefined ? { pid: owner.pid } : {}) };
+                    if (owner.armId !== undefined) {
+                        const beat = readTierLiveness(repoRoot, "watch");
+                        if (beat.state === "STALE")
+                            return { ...lost, beatAgeMs: beat.beatAgeMs };
+                        // ponytail: presence path math mirrors supervision.ts's private helper (`<tier>.live.<armId>`)
+                        if (!existsSync(join(dirname(supervisionBeatPath(repoRoot, "watch")), `watch.live.${owner.armId}`)))
+                            return lost;
                     }
-                    await previous;
-                    try {
-                        let lastCount = -1;
-                        const startedAt = Date.now();
-                        for (;;) {
-                            signal?.throwIfAborted();
-                            const count = await liveSuiteCount(repoRoot);
-                            if (count === 0)
-                                break;
-                            // OBS-889: a census that never reaches zero held T5's gates with no row and no end. Proceed at
-                            // the ceiling, flagged: the verdict that follows was produced beside whatever is still counted.
-                            if (Date.now() - startedAt >= suiteWaitCeilingMs) {
-                                journal.append("suite-wait-ceiling", taskId, { count, waitedMs: Date.now() - startedAt });
-                                journal.append("suite-budget", taskId, {
-                                    count, occupancyCap: occupancyCapacity.forkCap, conservativeCap: conservativeCapacity.forkCap,
-                                });
-                                return await runWithVerificationBudget(conservativeCapacity, run);
-                            }
-                            if (count !== lastCount)
-                                journal.append("suite-wait", taskId, { count });
-                            lastCount = count;
-                            await new Promise((wake) => setTimeout(wake, SUITE_POLL_MS));
-                        }
-                        return await run();
+                    if (owner.pid !== undefined && !isPidLive(owner.pid))
+                        return lost;
+                    return undefined;
+                };
+                const watchBoard = async () => {
+                    if (!boardOpened || boardless || !trackedDriver.narrator)
+                        return;
+                    const loss = boardLoss();
+                    if (!loss) {
+                        journaledLoss = undefined;
+                        return;
+                    }
+                    const identity = `${loss.pane}:${loss.pid ?? ""}`;
+                    if (identity !== journaledLoss) {
+                        journaledLoss = identity;
+                        boardless = boardReopens >= MAX_BOARD_REOPENS;
+                        journal.append("watch-board-lost", undefined, { ...loss, ...(boardless ? { boardless: true } : {}) });
+                        if (boardless)
+                            return;
                     }
-                    finally {
-                        suitePending--;
-                        release();
+                    const attempt = ++boardReopens;
+                    // The ghost pane is gone: drop it from this run's live set so no close is ever aimed at it.
+                    const ghost = watchSlot;
+                    if (ghost)
+                        liveSlots.delete(ghost);
+                    watchSlot = undefined;
+                    const reopened = await openBoard({ slot: ghost, pane: loss.pane });
+                    if (reopened.ok) {
+                        journal.append("watch-board-reopened", undefined, { pane: readWatchBoard(repoRoot, runId)?.pane ?? reopened.slot.id, attempt });
+                        return;
                     }
+                    boardless = attempt >= MAX_BOARD_REOPENS;
+                    journal.append("watch-board-reopen-failed", undefined, { pane: loss.pane, attempt, error: reopened.error, ...(boardless ? { boardless: true } : {}) });
+                    console.error(`tickmarkr: board not reopened (attempt ${attempt}): ${reopened.error}`);
                 };
+                // Context carries attribution through gates and remote inference; only shell commands acquire.
+                const commandLeases = new CommandLeases();
+                const withCommandContext = (taskId, run, signal) => runWithCommandLease((_command, execute) => commandLeases.run(async () => {
+                    let lastCount = -1;
+                    const startedAt = Date.now();
+                    for (;;) {
+                        signal?.throwIfAborted();
+                        const count = await liveSuiteCount(repoRoot);
+                        if (count === 0)
+                            break;
+                        if (count !== lastCount)
+                            journal.append("suite-wait", taskId, { count });
+                        lastCount = count;
+                        if (Date.now() - startedAt >= suiteWaitCeilingMs) {
+                            journal.append("suite-wait-ceiling", taskId, { count, waitedMs: Date.now() - startedAt });
+                            journal.append("suite-budget", taskId, {
+                                count, occupancyCap: occupancyCapacity.forkCap, conservativeCap: conservativeCapacity.forkCap,
+                            });
+                            return await runWithVerificationBudget(conservativeCapacity, execute);
+                        }
+                        await new Promise((wake) => setTimeout(wake, SUITE_POLL_MS));
+                    }
+                    return await execute();
+                }, (count) => journal.append("suite-wait", taskId, { count }), SUITE_POLL_MS, signal), run);
                 let baseRef;
                 let baseline;
                 let baselinePending = false;
@@ -1596,6 +1761,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // The SAME comparator status uses (engagementComparable); one decision, two consumers. Fail closed:
                     // no resume path silently accepts a mismatched or unbound journal. --graph-changed is the operator's
                     // audited release for the stop-amend-resume workflow, journaling a graph-rehash naming both hashes.
+                    graph = applyScopeAmendments(graph, journal, true);
                     const loadedHash = graphDefinitionHash(graph);
                     const cmp = engagementComparable(journal.read(), loadedHash);
                     if (!cmp.comparable) {
@@ -1632,16 +1798,16 @@ export async function runDaemon(repoRoot, opts = {}) {
                         ...(replayedExclusions.size > 0 ? { excludedChannels: [...replayedExclusions].sort() } : {}),
                         ...(opts.retryFailed ? { retryFailed: true } : {}),
                     });
-                    await openBoard();
+                    await placeBoard();
                 }
                 else {
                     baseRef = await gitHead(repoRoot);
                     journal.append("baseline-start", undefined, { baseRef, commands, capacity: resolvedCapacity() });
-                    await openBoard();
+                    await placeBoard();
                     baselinePending = true;
                     // Workers can run beside capture, but no gate may observe an absent or partial baseline.
                     // Keep publication and warnings inside the same barrier as the suite's final verdict.
-                    baselineCapture = withSuiteWindow(undefined, commands.test !== undefined || commands.tipTest !== undefined, async () => {
+                    baselineCapture = withCommandContext(undefined, async () => {
                         const captured = await captureBaseline(repoRoot, commands);
                         writeFileSync(join(journal.dir, "baseline.json"), JSON.stringify(captured, null, 2));
                         baseline = captured;
@@ -1773,15 +1939,17 @@ export async function runDaemon(repoRoot, opts = {}) {
                     ];
                     return `${identity} — release with ${commands.map((command) => `\`${command}\``).join(" or ")}`;
                 };
+                const namedPaths = (text) => [...text.matchAll(/(?:^|[\s`'"(])((?:[A-Za-z0-9_@.()[\]-]+\/)+[A-Za-z0-9_@.[\]-]+|[A-Za-z0-9_@-]+(?:\.[A-Za-z0-9_-]+)+)(?=$|[\s`'"),:;.!?])/g)]
+                    .map((match) => match[1].replace(/^\.\//, "").replace(/\.$/, ""))
+                    .filter((path) => !path.split("/").includes("..")
+                    && (/\.[A-Za-z][A-Za-z0-9_-]*$/.test(basename(path)) || existsSync(join(repoRoot, path))));
                 const park = async (t, reason, kind, assignment, attempts, startMs, gateFails = 0, consults = 0, tokens, metered = 0, retryMode = "fresh", details = {}) => {
                     // OBS-979: a worker refusal can identify the missing authoring scope even when gates
                     // subsequently supply the park's disposition. Keep that actionable path on the park itself.
                     const worker = journal.read().reverse().find((e) => e.taskId === t.id && e.event === "worker-result");
                     if (t.files.length > 0 && worker?.data.ok === false && typeof worker.data.summary === "string") {
                         const allowed = filesGlob(t.files);
-                        const paths = [...worker.data.summary.matchAll(/(?:^|[\s`'"(])((?:[A-Za-z0-9_@.()[\]-]+\/)+[A-Za-z0-9_@.[\]-]+|[A-Za-z0-9_@-]+(?:\.[A-Za-z0-9_-]+)+)(?=$|[\s`'"),:;.!?])/g)]
-                            .map((match) => match[1].replace(/^\.\//, "").replace(/\.$/, ""))
-                            .filter((path) => !path.split("/").includes("..") && !allowed(path));
+                        const paths = namedPaths(worker.data.summary).filter((path) => !allowed(path));
                         if (paths.length)
                             reason += ` — files[] repair hint: ${[...new Set(paths)].join(", ")}`;
                     }
@@ -1814,6 +1982,35 @@ export async function runDaemon(repoRoot, opts = {}) {
                 const dispositionScopeRed = async (t, results, assignment, attempts, startMs, gateFails, consults, tokens, metered, retryMode) => {
                     const scopeRed = results.find((g) => g.gate === "scope" && gateFailed(g));
                     const verdict = scopeRed?.meta?.collateral;
+                    if (!verdict && t.files.length > 0) {
+                        const allowed = filesGlob(t.files);
+                        const worker = journal.read().reverse().find((e) => e.taskId === t.id && e.event === "worker-result");
+                        const refusal = worker?.data.ok === false && typeof worker.data.summary === "string"
+                            && /outside|out.of.scope|allowlist|scope expansion|not (?:in|own)|unowned/i.test(worker.data.summary)
+                            ? namedPaths(worker.data.summary).filter((path) => !allowed(path)) : [];
+                        const reds = results.filter(gateFailed);
+                        // A scope verdict already attributes actual out-of-scope EDITS using the collateral map.
+                        // Path-only diagnostics from the other gates name code that needs fixing, not an edit the
+                        // worker made. Do not replace the scope gate's stronger attribution with that inference.
+                        const paths = reds.filter((g) => g.gate !== "scope" || !g.meta?.collateral).flatMap((g) => namedPaths(g.details));
+                        if (refusal.length || (paths.length > 0 && paths.every((path) => !allowed(path)))) {
+                            const classification = {
+                                gate: refusal.length ? "worker" : reds[0]?.gate,
+                                paths: [...new Set(refusal.length ? refusal : paths)],
+                                repair: `files[] repair hint: ${[...new Set(refusal.length ? refusal : paths)].join(", ")}`,
+                                attempt: attempts + 1, chargeable: false, source: "diagnostic",
+                            };
+                            if (refusal.length)
+                                journal.append("scope-request", t.id, classification);
+                            else
+                                journal.append("scope-authoring", t.id, classification);
+                            // OBS-547 (Leg-2 T3 material): unchargeable ⇒ metered 0, exactly as the predicted path below —
+                            // passing the physical count would write `meteredAttempts: 1` beside `attempts: 0`.
+                            const approveCommand = `tickmarkr approve ${runId} ${t.id} --files ${[...new Set(refusal)].map((path) => /^[\w./-]+$/.test(path) ? path : shq(path)).join(",")}`;
+                            await park(t, `${refusal.length ? "scope request" : "authoring defect"} — files[] repair hint: ${[...new Set(refusal.length ? refusal : paths)].join(", ")}; current files[]: ${t.files.join(", ")}`, refusal.length ? "scope-request" : "authoring", assignment, attempts, startMs, gateFails, consults, tokens, 0, retryMode, refusal.length ? { paths: [...new Set(refusal)], approveCommand, graphDefinitionHash: graphDefinitionHash(graph) } : {});
+                            return true;
+                        }
+                    }
                     if (!verdict)
                         return false;
                     if (verdict.authoring) {
@@ -1850,6 +2047,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     approvalSweepCursor = events.length;
                     if (approvals.length === 0)
                         return;
+                    graph = applyScopeAmendments(graph, journal);
                     resume = journal.replayResumeState();
                     satisfiedGates = journal.replaySatisfiedGates();
                     replayedGateResults = resumeLifecycleOpen
@@ -1932,12 +2130,28 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // not re-tried first (consult bans / prior failovers survive the release).
                     const rs = resume.get(t.id);
                     const contentDigest = taskContentDigest(t);
-                    if (rs?.lastAssignment && rs.attempts > 0
+                    const previousDispatch = journal.read().reverse().find((e) => e.taskId === t.id && e.event === "task-dispatch");
+                    const recordedGraphPath = join(journal.dir, "graph.json");
+                    const recordedTask = existsSync(recordedGraphPath)
+                        ? JSON.parse(readFileSync(recordedGraphPath, "utf8")).tasks.find((task) => task.id === t.id)
+                        : undefined;
+                    const previousHints = previousDispatch && "routingHints" in previousDispatch.data
+                        ? previousDispatch.data.routingHints : recordedTask?.routingHints;
+                    const hintsChanged = !!rs && (!!recordedTask || !!previousDispatch && "routingHints" in previousDispatch.data)
+                        && (JSON.stringify(previousHints?.pin) !== JSON.stringify(t.routingHints?.pin)
+                            || previousHints?.floor !== t.routingHints?.floor);
+                    if (hintsChanged)
+                        journal.append("restore-rerouted", t.id, {
+                            from: rs.lastAssignment ? channelKey(rs.lastAssignment) : rs.tried.at(-1) ?? null,
+                            to: channelKey(assignment),
+                            reason: JSON.stringify(previousHints?.pin) !== JSON.stringify(t.routingHints?.pin) ? "pin changed" : "floor changed",
+                        });
+                    if (!hintsChanged && rs?.lastAssignment && rs.attempts > 0
                         && channels.some((c) => channelKey(c) === channelKey(rs.lastAssignment))
                         && !demotedChannels.has(channelKey(rs.lastAssignment))) {
                         assignment = rs.lastAssignment; // restore the consult-chosen assignment (bypasses route()'s static re-pick)
                     }
-                    else if (rs && rs.tried.length) {
+                    else if (!hintsChanged && rs && rs.tried.length) {
                         // trailing-reroute edge (kill between verdict and dispatch), a stale fleet, OR a fresh-budget
                         // release (attempts 0 + non-empty tried): pick a failover over the replayed exclusions via the
                         // EXISTING nextChannel `tried` parameter — zero router changes (D-03).
@@ -1948,6 +2162,14 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // assignment and proceed. Dispatching on a previously-tried channel beats deadlocking a resumed
                         // run; a park-instead policy can come later if it ever bites.
                     }
+                    const taskHistory = journal.read().filter((e) => e.taskId === t.id);
+                    const lastApproval = taskHistory.map((e) => e.event).lastIndexOf("task-approved");
+                    const priorClimb = taskHistory.slice(lastApproval + 1).reverse().find((e) => e.event === "tier-escalated");
+                    if (!hintsChanged && priorClimb && taskHistory.indexOf(priorClimb) > taskHistory.map((e) => e.event).lastIndexOf("task-dispatch")) {
+                        const target = channels.find((c) => channelKey(c) === priorClimb.data.to && !demotedChannels.has(channelKey(c)));
+                        if (target)
+                            assignment = { adapter: target.adapter, model: target.model, channel: target.channel, tier: target.tier };
+                    }
                     // pre-kill invariant: tried always contains the current assignment. Spread, never alias the
                     // journal-derived array (no hidden mutation of replayed state).
                     const tried = rs?.tried.length ? [...rs.tried] : [channelKey(assignment)];
@@ -2070,7 +2292,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             ...(g.meta?.reapedGroup === true ? { reapedGroup: true } : {}),
                             ...(g.gate === "review" && typeof g.meta?.reviewer === "string" ? {
                                 reviewer: g.meta.reviewer,
-                                ...Object.fromEntries(["cause", "seatAuthoredBytes", "bytes", "rawPath", "briefPath", "timeoutMs", "unparseable", "noVerdict", "resolved", "reraised"]
+                                ...Object.fromEntries(["cause", "seatAuthoredBytes", "bytes", "rawPath", "briefPath", "timeoutMs", "unparseable", "noVerdict", "resolved", "reraised", "reviewerFloor", "reviewerFloorCause", "reviewerTier"]
                                     .filter((key) => g.meta?.[key] !== undefined).map((key) => [key, g.meta[key]])),
                                 ...(typeof g.meta.vendor === "string" ? { vendor: g.meta.vendor } : {}),
                                 ...(typeof g.meta.provider === "string" ? { provider: g.meta.provider } : {}),
@@ -2170,6 +2392,43 @@ export async function runDaemon(repoRoot, opts = {}) {
                         ? `The operator UPHELD the reviewer's findings — address them without discarding landed work.\nreview: ${upheldFeedback}`
                         : "");
                     let ladderIdx = 0;
+                    const engagementRows = () => {
+                        const rows = journal.read().filter((e) => e.taskId === t.id);
+                        const approval = rows.map((e) => e.event).lastIndexOf("task-approved");
+                        return rows.slice(approval + 1);
+                    };
+                    let ownedGateFailures = engagementRows().filter((e) => e.event === "escalation" && e.data.workerAttributed === true).length;
+                    let climbProvenance = !hintsChanged && priorClimb
+                        ? `tier-escalated ${priorClimb.data.from} → ${priorClimb.data.to} (${priorClimb.data.cause})` : "";
+                    const climbSkips = new Set(!hintsChanged && priorClimb
+                        ? channels.filter((c) => c.tier === priorClimb.data.fromTier).map(channelKey) : []);
+                    const climb = async (cause, gate, attempt) => {
+                        if (cfg.routing.escalateTier === "off" || engagementRows().some((e) => e.event === "tier-escalated"))
+                            return;
+                        const pin = t.routingHints?.pin;
+                        if (pin) {
+                            await park(t, `pin ${pin.via}:${pin.model} held: ${cause}`, "gate-fail", assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode);
+                            return "parked";
+                        }
+                        const next = climbChannel(assignment, t, cfg, channels, tried, profile, demotedChannels);
+                        if (!next?.climbed)
+                            return;
+                        const from = channelKey(assignment);
+                        const to = channelKey(next);
+                        const poolBefore = channels.filter((c) => !tried.includes(channelKey(c)) && !demotedChannels.has(channelKey(c))).map(channelKey);
+                        journal.append("tier-escalated", t.id, {
+                            attempt, cause, gate: gate.gate, fingerprint: normalizeGateFailure(gate.details).slice(0, 500),
+                            from, to, fromTier: assignment.tier, toTier: next.tier, poolBefore,
+                            costDelta: marginalCostRank(channels.find((c) => channelKey(c) === to)) - marginalCostRank(channels.find((c) => channelKey(c) === from)),
+                        });
+                        for (const c of channels)
+                            if (c.tier === assignment.tier && channelKey(c) !== to)
+                                climbSkips.add(channelKey(c));
+                        climbProvenance = `tier-escalated ${from} → ${to} (${cause})`;
+                        assignment = { adapter: next.adapter, model: next.model, channel: next.channel, tier: next.tier };
+                        tried.push(to);
+                        return "climbed";
+                    };
                     let modeFallbackNoted = false; // v1.2: journal the interactive→print fallback once per task, not per attempt
                     let gateFails = 0; // TEL-02: incremented ONLY where feedback is built from failing gates — never derived from attempts (quota failovers bump attempts too, Pitfall 6)
                     let consults = 0; // TEL-02: bumped in the runConsult wrapper so one counter covers all three trigger sites, across the attempt loop
@@ -2448,7 +2707,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             await trackedDriver.project?.(t.id, "in-review");
                             await waitForBaseline(t.id);
                             journal.phaseStart(t.id, "gates");
-                            const { results } = await withSuiteWindow(t.id, resumedTask.gates.includes("test") && commands.test !== undefined, () => runReviewRecovery(resumedTask, {
+                            const { results } = await withCommandContext(t.id, () => runReviewRecovery(resumedTask, {
                                 carriedFindings: outstandingReviewFindings(journal.read(), t.id),
                                 worktree: wt, baseRef: taskBase, result: priorResult, author: gateAuthor,
                                 commands, baseline, channels: pools.review, judgeChannels: pools.judge, adapters, cfg, artifactDir: journal.dir,
@@ -2465,7 +2724,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     }
                                     : undefined,
                                 excludeReviewers: badReviewers,
-                                reviewHistory, demotedReviewers,
+                                reviewHistory, demotedReviewers, priorReviewers: taskReviewers(t.id),
                                 onGate: async (e) => {
                                     if (e.phase === "start") {
                                         notePhaseStart(e);
@@ -2714,7 +2973,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 feedback = feedback ? `${feedback}\n\n${consultBrief}` : consultBrief;
                             }
                         }
-                        retryMode = repairFindings
+                        const scopeApproval = [...journaledSoFar].reverse().find((e) => e.taskId === t.id && (e.event === "task-approved" || e.event === "task-dispatch"));
+                        retryMode = scopeApproval?.data.release === "scope-request" ? "fresh" : repairFindings
                             ? "repair"
                             : priorSession
                                 && priorSession.channel === channelKey(assignment)
@@ -2741,8 +3001,18 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // ledger cannot tell a carried dispatch from an amnesiac one — the exact question a run that
                         // spends two frontier attempts re-deriving a known defect has to be able to answer afterwards.
                         journal.append("task-dispatch", t.id, {
-                            assignment, attempt, provenance: dispatchProvenance(r.provenance), retryMode,
-                            excludedChannels: [...demotedChannels].sort(),
+                            ...(scopeApproval?.data.release === "scope-request" ? { files: t.files, graphDefinitionHash: graphDefinitionHash(graph) } : {}),
+                            assignment, attempt, provenance: dispatchProvenance([
+                                channelKey(assignment) === channelKey(r.assignment) ? r.provenance
+                                    : t.routingHints?.pin ? `pin ${t.routingHints.pin.via}:${t.routingHints.pin.model} not re-tried` : "ladder assignment",
+                                `dispatch ${channelKey(assignment)}`, climbProvenance,
+                            ].filter(Boolean).join(" · ")), retryMode,
+                            routingHints: t.routingHints ?? {},
+                            excludedChannels: [...new Set([...demotedChannels, ...tried, ...climbSkips])]
+                                .filter((key) => key !== channelKey(assignment)).sort(),
+                            exclusionReasons: Object.fromEntries([...new Set([...demotedChannels, ...tried, ...climbSkips])]
+                                .filter((key) => key !== channelKey(assignment))
+                                .map((key) => [key, demotedChannels.has(key) ? "demoted" : tried.includes(key) ? "already tried" : "tier climb skipped"])),
                             ...(outstandingFindings.length > 0 ? { carriedFindings: outstandingFindings } : {}),
                             ...(carriedConsultGuidance ? { carriedConsultGuidance } : {}),
                         });
@@ -3056,6 +3326,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                         let processExited = false;
                         let earlyLaunchDead = false;
                         let startupFailure = false;
+                        let startupEvidence;
+                        const startupDetector = new StartupFailureDetector(adapter);
+                        const startupFailureInWindow = (text, launchedAt) => {
+                            startupEvidence ??= startupDetector.sample(text, launchedAt);
+                            return startupEvidence !== undefined;
+                        };
                         let deadWorkerPark;
                         let settleParsed;
                         const trailerFrames = interactive && adapter.busyFrameMarkers
@@ -3852,6 +4128,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 if (!workerFinished) {
                                     journal.append("worker-reaped-before-harvest", t.id, {
                                         slot: slot.name, attempt, cause: workerCause ?? "stall-timeout",
+                                        ...(startupEvidence ? { evidence: startupEvidence } : {}),
                                     });
                                 }
                             }
@@ -3896,6 +4173,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // (provider outage, quota banner, dead CLI) must still route; the harvest synthesis only
                         // decides whether THIS attempt's worktree goes to gates, and when routing wins instead, the
                         // commits survive via the existing commitsToCarry/cherryPickCommits carry-forward.
+                        if (workerFinished && !result.ok && await dispositionScopeRed(t, [], assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode))
+                            return;
                         const preHarvestResult = result;
                         // T2 (OBS-264): recognize committed no-trailer work BEFORE any no-trailer streak, provider,
                         // quota or dead-channel routing. Gates never trusted the trailer, so this successful synthesis
@@ -4185,7 +4464,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 }
                             }
                             else {
-                                ({ results, commits } = await withSuiteWindow(t.id, t.gates.includes("test") && commands.test !== undefined, () => runReviewRecovery(t, {
+                                ({ results, commits } = await withCommandContext(t.id, () => runReviewRecovery(t, {
                                     carriedFindings: outstandingFindings,
                                     worktree: wt, baseRef: taskBase, result, author: assignment,
                                     commands, baseline, channels: pools.review, judgeChannels: pools.judge, adapters, cfg, artifactDir: journal.dir,
@@ -4208,7 +4487,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         }
                                         : undefined,
                                     excludeReviewers: badReviewers,
-                                    reviewHistory, demotedReviewers,
+                                    reviewHistory, demotedReviewers, priorReviewers: taskReviewers(t.id),
                                     onGate,
                                 })));
                             }
@@ -4300,6 +4579,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                             && !isDiffCapPark(reviewFail)
                             && results.every((g) => gateSatisfied(g) || g.gate === "review");
                         const failing = results.filter(gateFailed);
+                        const deterministic = failing.find(isDeterministicFailure);
+                        if (deterministic)
+                            ownedGateFailures++;
                         // Decided before the cap, because the cap's question is whether the NEXT move would re-buy a
                         // measurement already made — and a funded repair is one of the moves that would.
                         const landed = await commitsAheadOf(taskBase, wt);
@@ -4341,13 +4623,18 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 channel: channelKey(assignment), // the ban is bound to the channel that produced the repeat
                                 attempt: attempt + 1,
                             });
-                            await driver.notify(`tickmarkr ${runId}: ${t.id} ${repeated.gate} failed identically twice — consulting, identical retry banned`, { tier: "attention" });
+                            await driver.notify(`tickmarkr ${runId}: ${t.id} ${repeated.gate} failed identically twice — identical retry banned`, { tier: "attention" });
                             // The cap takes the ladder's MOVE, never its accounting: this failure still spends the rung it
                             // would have spent, so a task that cannot converge still reaches ladder exhaustion on exactly
                             // the budget it always had and the cap can never hand a stuck task extra rounds.
                             capStep = r.ladder[Math.min(ladderIdx++, r.ladder.length - 1)];
-                            journal.append("escalation", t.id, { step: capStep, attempt: attempt + 1, fingerprintCap: true });
+                            journal.append("escalation", t.id, { step: capStep, attempt: attempt + 1, fingerprintCap: true, workerAttributed: !!deterministic });
                             await driver.notify(`tickmarkr ${runId}: ${t.id} escalation: ${capStep}`, { tier: "attention" });
+                            const climbed = await climb("gate-fingerprint-cap", repeated, attempt + 1);
+                            if (climbed === "parked")
+                                return;
+                            if (climbed === "climbed")
+                                continue;
                             const v = await runConsult("gate-fail-repeat", output, feedback, results);
                             // Rule: a terminal cap consult vetoes a same-channel retry, but cannot veto an `escalate`
                             // rung that already satisfies retry-same-banned by changing channel. Thus terminal+retry
@@ -4397,12 +4684,21 @@ export async function runDaemon(repoRoot, opts = {}) {
                             : r.ladder[Math.min(ladderIdx++, r.ladder.length - 1)]);
                         if (!capStep) { // a capped failure already journaled and announced the rung it spent
                             journal.append("escalation", t.id, {
-                                step, attempt: attempt + 1,
+                                step, attempt: attempt + 1, workerAttributed: !!deterministic,
                                 ...(reviewFixRetry && !repairExhausted ? { reviewFix: true } : {}),
                                 ...(repair ? { repair: repairHistory.length + 1, repairCharge: repairsDrawn + 1 } : {}),
                             });
                             await driver.notify(`tickmarkr ${runId}: ${t.id} escalation: ${step}`, { tier: "attention" });
                         }
+                        const climbCause = repairExhausted ? "repair-exhausted"
+                            : deterministic && ownedGateFailures === 2 ? "gate-fail" : undefined;
+                        if (climbCause) {
+                            const climbed = await climb(climbCause, deterministic ?? failing[0], attempt + 1);
+                            if (climbed === "parked")
+                                return;
+                            if (climbed === "climbed")
+                                continue;
+                        }
                         if (step === "retry")
                             continue;
                         if (step === "escalate") {
@@ -4428,14 +4724,18 @@ export async function runDaemon(repoRoot, opts = {}) {
                 const inflight = new Map();
                 // A settled worker can release a dependency or an approval in the same poll tick.
                 // Audit the current graph at every empty-flight boundary, never a prior ready snapshot.
-                const holdEndCondition = () => {
+                // WB-1 rider: `end-condition-held` names a CLOSE the daemon refused, so only a close attempt journals
+                // it — the post-race sweep still dispatches what it finds but says nothing.
+                const holdEndCondition = (closing = true) => {
                     sweepLiveApprovals();
                     const freeSlots = Math.max(0, concurrency - inflight.size);
                     const dispatchable = readyTasks(graph).filter((t) => !inflight.has(t.id));
                     if (freeSlots === 0 || dispatchable.length === 0)
                         return false;
-                    for (const task of dispatchable) {
-                        journal.append("end-condition-held", task.id, { deps: task.deps, freeSlots });
+                    if (closing) {
+                        for (const task of dispatchable) {
+                            journal.append("end-condition-held", task.id, { deps: task.deps, freeSlots });
+                        }
                     }
                     return true;
                 };
@@ -4446,6 +4746,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // must still stop the run before it can dispatch more work or write run-end.
                         if (termSignal)
                             throw new Error(`terminated by ${termSignal}`);
+                        await watchBoard();
                         sweepLiveApprovals();
                         const ready = readyTasks(graph)
                             .filter((t) => !inflight.has(t.id))
@@ -4500,12 +4801,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const waiters = [...inflight.values(), aborted];
                         // A free slot is itself a scheduling boundary: poll the append-only approval stream instead of
                         // sleeping until an unrelated long-running task settles.
-                        if (inflight.size < concurrency) {
+                        // An open board is polled on the same cadence, so a dead cockpit is noticed mid-task.
+                        if (inflight.size < concurrency || boardOpened) {
                             waiters.push(new Promise((wake) => setTimeout(wake, APPROVAL_POLL_MS)));
                         }
                         await Promise.race(waiters); // aborted rejects on termination — unwinds the run
                         if (inflight.size === 0)
-                            holdEndCondition();
+                            holdEndCondition(false);
                     }
                     // D-07: the sweep now closes only what's LEFT in keptSlots — done-closed worker slots were removed
                     // (no double-close) and self-cleaned LLM/consult panes were never added under keepLlm:false. This
@@ -4555,7 +4857,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         poll = setTimeout(pollApprovals, APPROVAL_POLL_MS);
                         let tipFailed;
                         try {
-                            const verification = withSuiteWindow(undefined, commands.test !== undefined || commands.tipTest !== undefined, () => verifyIntegrationTipCached(intWt, commands, journal, { lastMergedTask, baseline, signal: controller.signal }), controller.signal);
+                            const verification = withCommandContext(undefined, () => verifyIntegrationTipCached(intWt, commands, journal, { lastMergedTask, baseline, signal: controller.signal }), controller.signal);
                             activeTipVerify = { controller, settled: verification.then(() => { }, () => { }) };
                             tipFailed = await verification;
                         }