tickmarkr 2.5.4 → 2.5.5

package/dist/route/router.js

@@ -103,6 +103,32 @@ function withoutExcluded(channels, exclude) {
     // OBS-57: in-run demotion after consecutive no-trailer windows — route around poisoned channels for the rest of the run.
     return channels.filter((c) => !exclude.has(channelKey(c)));
 }
+// Pools spread providers before tier, independently within each marginal-cost run. Stable
+// cost sorting preserves declaration order when forming groups; gateways share the served
+// model's provider, so adding a second transport does not buy that provider another turn.
+function rankAnyPool(live, task) {
+    const sorted = [...live].sort((a, b) => marginalCostRank(a) - marginalCostRank(b));
+    const out = [];
+    for (let i = 0; i < sorted.length;) {
+        let j = i + 1;
+        while (j < sorted.length && marginalCostRank(sorted[j]) === marginalCostRank(sorted[i]))
+            j++;
+        const groups = new Map();
+        for (const c of sorted.slice(i, j)) {
+            const provider = routingModelProvider(c.model, c.vendor);
+            const group = groups.get(provider) ?? [];
+            group.push(c);
+            groups.set(provider, group);
+        }
+        const ordered = [...groups.values()];
+        const k = spreadOffset(task) % ordered.length;
+        for (const group of [...ordered.slice(k), ...ordered.slice(0, k)]) {
+            out.push(...group.sort((a, b) => TIER_RANK[a.tier] - TIER_RANK[b.tier]));
+        }
+        i = j;
+    }
+    return out;
+}
 const maybeSlaLint = (lints, task, profile, slaMinutes, c) => {
     if (slaMinutes === undefined || !profile)
         return;
@@ -206,21 +232,20 @@ export function route(task, cfg, channels, profile, preferCtx, exclude, exploreC
         // live preserves pool declaration order — ordered mode and any-mode stable-sort ties depend on it
         const live = pool.channels
             .map((id) => channels.find((c) => channelKey(c) === id))
-            .filter((c) => c !== undefined);
+            .filter((c) => c !== undefined && (!taskFloor || TIER_RANK[c.tier] >= TIER_RANK[taskFloor]));
         if (!live.length) {
-            throw new RoutingError(`${task.id}: routing.map.${task.shape}.pool has no live channel — declared: ${pool.channels.join(", ")}; doctor found: ${channels.map(channelKey).join(", ") || "(nothing)"}`);
+            throw new RoutingError(`${task.id}: routing.map.${task.shape}.pool has no live channel${taskFloor ? ` at task floor ${taskFloor}` : ""} — declared: ${pool.channels.join(", ")}; doctor found: ${channels.map(channelKey).join(", ") || "(nothing)"}`);
         }
-        // ponytail: no learned/explore/spread inside pools in v1 — a pool pick is fully static; the
-        // upgrade path is feeding the pool-filtered set through the learned path below.
+        // No learned/explore inside pools: any spreads deterministically; ordered keeps declaration order.
         const chosen = pool.mode === "ordered"
             ? live[0]
-            : [...live].sort((a, b) => marginalCostRank(a) - marginalCostRank(b) || TIER_RANK[a.tier] - TIER_RANK[b.tier])[0];
+            : rankAnyPool(live, task)[0];
         lintMapPinFloor(chosen.tier, "pool");
         maybeSlaLint(lints, task, profile, slaMinutes, chosen);
         return { assignment: toAssignment(chosen), ladder: ladderFor(task, entry), lints, provenance: `${degraded}pool ${pool.mode} ${channelKey(chosen)} (config routing.map)` };
     }
     const baseTier = floor ?? "cheap";
-    // D-04: a task floor is hard only on floor/auto paths; the map-pin branch above stays supreme.
+    // A task floor is hard on pool and floor/auto paths; the map-pin branch above stays supreme.
     const minTier = taskFloor && TIER_RANK[taskFloor] > TIER_RANK[baseTier] ? taskFloor : baseTier;
     if (prefActive)
         for (const p of prefer ?? [])

package/dist/run/daemon.d.ts

@@ -126,6 +126,19 @@ export declare const WORKER_STARTUP_WINDOW_BYTES: number;
 /** Test seam — exercises both sides of the startup boundary without a production-length fixture. */
 export declare function setWorkerStartupWindowMsForTests(ms: number): void;
 export declare function resetWorkerStartupWindowMsForTests(): void;
+export interface StartupFailureEvidence {
+    matchedBytes: string;
+    offset: number;
+    row: string;
+    rowNumber: number;
+}
+/** One seat, one startup prefix. Once execution or its input box is seen, later panes are ineligible. */
+export declare class StartupFailureDetector {
+    private readonly adapter;
+    private closed;
+    constructor(adapter: Pick<WorkerAdapter, "inputBox" | "harnessBannerRows">);
+    sample(output: string, launchedAt: number | undefined): StartupFailureEvidence | undefined;
+}
 /** Test seam — shrink the quota-banner silence gate without minute-long sleeps. */
 export declare function setQuotaBannerSilentMsForTests(ms: number): void;
 export declare function resetQuotaBannerSilentMsForTests(): void;

package/dist/run/daemon.js

@@ -1,3 +1,4 @@
+import { commandLeaseEnvironment, CommandLeases, currentCommandLeaseToken, isRunnerCommand, runWithCommandLease, withCommandLease } from "./lease.js";
 import { execFileSync, spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { shq } from "../adapters/types.js";
@@ -9,7 +10,7 @@ import { fileURLToPath } from "node:url";
 import { stringify } from "yaml";
 import { classifyDeadChannel, NO_TRAILER_SUMMARY, trailerPattern, UNPARSEABLE_TRAILER_SUMMARY, writePrompt } from "../adapters/prompt.js";
 import { allAdapters, getAdapter, probeAll, readDoctor, rolePools } from "../adapters/registry.js";
-import { SettledTrailerTracker, addUsage, channelKey, matchesTrustDialog, QUOTA_RE } from "../adapters/types.js";
+import { SettledTrailerTracker, addUsage, channelKey, matchesInputBox, matchesTrustDialog, QUOTA_RE } from "../adapters/types.js";
 import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { collateralHits } from "../compile/collateral.js";
 import { DEFAULT_DIFF_CAP, globalConfigDir, loadConfigWithMode, readOverlayFile, repoOverlayPath, } from "../config/config.js";
@@ -27,7 +28,7 @@ import { augmentRetryBrief, consult, renderRetryGuidance } from "./consult.js";
 import { runEnvironment } from "./environment.js";
 import { cleanupRunWorktrees, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, preserveWorktree, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sh, shGit, SUITE_PARENT_ENV, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
-import { activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, outstandingReviewFindings, pendingRechecks, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
+import { applyScopeAmendments, activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, outstandingReviewFindings, pendingRechecks, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
 import { isDiffCapPark, pickReviewer } from "../gates/review.js";
 import { acquireApprovalSerialization, acquireRunLock, isPidLive, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, verifyIntegrationTip } from "./merge.js";
@@ -379,14 +380,67 @@ export function setWorkerStartupWindowMsForTests(ms) {
 export function resetWorkerStartupWindowMsForTests() {
     workerStartupWindowMs = WORKER_STARTUP_WINDOW_MS;
 }
-function startupFailureInWindow(output, launchedAt) {
-    if (launchedAt === undefined || Date.now() - launchedAt > workerStartupWindowMs)
-        return false;
-    const bytes = Buffer.from(output);
-    const bounded = bytes.length <= WORKER_STARTUP_WINDOW_BYTES
-        ? output
-        : bytes.subarray(0, WORKER_STARTUP_WINDOW_BYTES).toString("utf8");
-    return WORKER_STARTUP_FAILURE_RE.test(stallSnapshotBannerRows(bounded));
+/** One seat, one startup prefix. Once execution or its input box is seen, later panes are ineligible. */
+export class StartupFailureDetector {
+    adapter;
+    closed = false;
+    constructor(adapter) {
+        this.adapter = adapter;
+    }
+    sample(output, launchedAt) {
+        if (this.closed || launchedAt === undefined || Date.now() - launchedAt > workerStartupWindowMs)
+            return;
+        // read() returns a tail, not a guaranteed transcript origin. A saturated read cannot
+        // establish startup ownership: the first tool frame may already have scrolled out.
+        if (Buffer.byteLength(output) >= WORKER_STARTUP_WINDOW_BYTES || output.split("\n").length >= 500) {
+            this.closed = true;
+            return;
+        }
+        const bounded = output;
+        const rows = bounded.split("\n");
+        let inputStart = rows.length;
+        const input = this.adapter.inputBox;
+        if (input && matchesInputBox(bounded, input)) {
+            // Locate the beginning, including multi-row composers whose footer proves the matcher.
+            let end = rows.length;
+            let low = 1;
+            while (low < end) {
+                const mid = Math.floor((low + end) / 2);
+                if (matchesInputBox(rows.slice(0, mid).join("\n"), input))
+                    end = mid;
+                else
+                    low = mid + 1;
+            }
+            inputStart = 0;
+            let high = end;
+            while (inputStart + 1 < high) {
+                const mid = Math.floor((inputStart + high) / 2);
+                if (matchesInputBox(rows.slice(mid, end).join("\n"), input))
+                    inputStart = mid;
+                else
+                    high = mid;
+            }
+        }
+        let offset = 0;
+        for (const [index, row] of rows.entries()) {
+            const cleanRow = row.replace(/\u001b\[[0-?]*[ -/]*[@-~]/g, "");
+            // Structured tool frames and the terminal's tool headings close the prefix BEFORE their body.
+            const toolFrame = /"(?:type|role)"\s*:\s*"(?:tool[^" ]*|function_call[^" ]*|command_execution)"|^\s*(?:[•⏺]\s*(?:Ran|Explored|Searched|Called|Bash|Read|Write|Edit|Shell|Exec|Tool)\b|⎋ |(?:tool[-_ ](?:call|output|result)|function_call)\b)/i.test(cleanRow);
+            if (toolFrame || index >= inputStart) {
+                this.closed = true;
+                return;
+            }
+            if (!this.adapter.harnessBannerRows?.includes(cleanRow)) {
+                const match = WORKER_STARTUP_FAILURE_RE.exec(row);
+                if (match)
+                    return {
+                        matchedBytes: match[0], offset: offset + Buffer.byteLength(row.slice(0, match.index)),
+                        row, rowNumber: index + 1,
+                    };
+            }
+            offset += Buffer.byteLength(row) + 1;
+        }
+    }
 }
 // OBS-901/906: one daemon-owned writer for every execution surface. Drivers expose one retained
 // stream through read(); the daemon persists that exact surface before any close/reconcile can make
@@ -570,17 +624,54 @@ async function cancellableTipBattery(intWt, commands, runDir, baseline, signal)
     });
     const { verifyIntegrationTip } = await import(${JSON.stringify(new URL(`./merge.${extension}`, import.meta.url).href)});
     const { runWithVerificationBudget } = await import(${JSON.stringify(new URL(`./git.${extension}`, import.meta.url).href)});
+    const { runWithCommandLease } = await import(${JSON.stringify(new URL(`./lease.${extension}`, import.meta.url).href)});
+    let sequence = 0;
+    const grants = new Map();
+    const commandCapacities = new Map();
+    process.on('message', (message) => {
+      if (message.type === 'lease-grant') { grants.get(message.id)?.(message); grants.delete(message.id); }
+    });
+    const lease = async (command, execute) => {
+      const id = ++sequence;
+      const grant = new Promise(resolve => grants.set(id, resolve));
+      process.send({ type: 'lease-acquire', id, command });
+      const { capacity, token } = await grant;
+      commandCapacities.set(command, capacity);
+      try { return await runWithVerificationBudget(capacity, () => execute(token)); }
+      finally { process.send({ type: 'lease-release', id }); }
+    };
     let input = ''; for await (const chunk of process.stdin) input += chunk;
     const { intWt, commands, runDir, baseline, capacity } = JSON.parse(input);
     try {
-      const result = await runWithVerificationBudget(capacity, () => verifyIntegrationTip(intWt, commands, runDir, baseline));
-      if (!cancelled) process.stdout.write(JSON.stringify(result));
+      const result = await runWithVerificationBudget(capacity, () => runWithCommandLease(lease, () => verifyIntegrationTip(intWt, commands, runDir, baseline)));
+      if (!cancelled) process.stdout.write(JSON.stringify(result.map(row => ({ ...row, capacity: [...commandCapacities].reverse().find(([command]) => command === row.cmd || command.startsWith(row.cmd + " "))?.[1] ?? capacity }))));
     } catch (error) { if (!cancelled) throw error; }
+    finally { process.disconnect(); }
   `;
     const child = spawn(process.execPath, [
         ...(extension === "ts" ? ["--import", createRequire(import.meta.url).resolve("tsx")] : []),
         "--input-type=module", "-e", script,
-    ], { stdio: ["pipe", "pipe", "pipe"], detached: true });
+    ], { env: commandLeaseEnvironment(process.env), stdio: ["pipe", "pipe", "pipe", "ipc"], detached: true });
+    const releases = new Map();
+    const leases = new Set();
+    let closed = false;
+    child.on("message", (message) => {
+        if (message.type === "lease-release") {
+            releases.get(message.id)?.();
+            releases.delete(message.id);
+        }
+        if (message.type !== "lease-acquire")
+            return;
+        const held = withCommandLease(message.command, async () => {
+            if (closed || signal.aborted)
+                return;
+            const released = new Promise((resolve) => releases.set(message.id, resolve));
+            child.send({ type: "lease-grant", id: message.id, capacity: resolvedCapacity(), token: currentCommandLeaseToken() });
+            await released;
+        });
+        leases.add(held);
+        void held.catch(() => { }).finally(() => leases.delete(held));
+    });
     let output = "";
     let errors = "";
     child.stdout.on("data", (chunk) => { output += chunk; });
@@ -589,6 +680,10 @@ async function cancellableTipBattery(intWt, commands, runDir, baseline, signal)
     const finished = new Promise((resolve, reject) => {
         child.once("error", reject);
         child.once("close", (code) => {
+            closed = true;
+            for (const release of releases.values())
+                release();
+            releases.clear();
             if (signal.aborted && (code === 143 || code === null))
                 reject(signal.reason);
             else if (code !== 0)
@@ -608,6 +703,7 @@ async function cancellableTipBattery(intWt, commands, runDir, baseline, signal)
     }
     finally {
         signal.removeEventListener("abort", cancel);
+        await Promise.allSettled(leases);
     }
 }
 /**
@@ -662,9 +758,10 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
     for (const r of await (opts.signal
         ? cancellableTipBattery(intWt, commands, journal.dir, opts.baseline, opts.signal)
         : verifyIntegrationTip(intWt, commands, journal.dir, opts.baseline))) {
+        const measuredCapacity = r.capacity ?? capacity;
         if (r.pass) {
             // Q121s: a forgiven pass journals its fingerprints — honest about what was carried, never a silent green.
-            journal.append("tip-verify", undefined, { gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints } : {}), tip, cmdHash, capacity });
+            journal.append("tip-verify", undefined, { gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints } : {}), tip, cmdHash, capacity: measuredCapacity });
         }
         else {
             journal.append("tip-verify-failed", undefined, {
@@ -677,7 +774,7 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
                 lastMergedTask: opts.lastMergedTask,
                 tip,
                 cmdHash,
-                capacity,
+                capacity: measuredCapacity,
             });
             tipFailed = true;
         }
@@ -734,7 +831,6 @@ async function observeWorkerProcessTree(marker, cwd) {
     }
     return tree.size === 0 ? "empty" : "running";
 }
-const SUITE_COMMAND_RE = /(?:^|[\s/])(vitest(?:\.mjs)?|jest|mocha)(?:[\s/]|$)|\bnpm(?:\s+run)?\s+test\b/i;
 function processCwd(pid) {
     try {
         return realpathSync(readlinkSync(`/proc/${pid}/cwd`));
@@ -802,7 +898,7 @@ export function countLiveSuites(snapshot, repoRoot, daemonPid = process.pid, cwd
     // runner ("…as a vitest test whose…"), so a finished interactive worker counted as a live suite and
     // held a task's gates for 9 min 46 s. A runner is named in a command's HEAD — `node <bin>`,
     // `npm test`, `npx vitest`, `sh -c npm test` — never 140 KB into it: read the first four tokens only.
-    const candidates = rows.filter((row) => !ancestors.has(row.pid) && SUITE_COMMAND_RE.test(row.command.split(/\s+/, 4).join(" ")));
+    const candidates = rows.filter((row) => !ancestors.has(row.pid) && isRunnerCommand(row.command));
     const attributable = new Set(candidates.filter((row) => {
         if (descendants.has(row.pid))
             return true;
@@ -1347,7 +1443,7 @@ export async function runDaemon(repoRoot, opts = {}) {
         const rm = resolveRunMode(repoRoot, { flag: opts.mode, spec: graph.mode, globalDir: opts.globalDir });
         const cfg = rm.cfg;
         // Resolve both budgets once: worker fan-out divides by dispatch concurrency; verification
-        // divides by one suite occupying the serialized window. Explicit operator caps still win.
+        // divides by one runner command holding a lease. Explicit operator caps still win.
         const concurrency = opts.concurrency ?? cfg.concurrency;
         return await runWithForkBudget(concurrency, async () => {
             const conservativeCapacity = resolvedCapacity();
@@ -1604,52 +1700,30 @@ export async function runDaemon(repoRoot, opts = {}) {
                     journal.append("watch-board-reopen-failed", undefined, { pane: loss.pane, attempt, error: reopened.error, ...(boardless ? { boardless: true } : {}) });
                     console.error(`tickmarkr: board not reopened (attempt ${attempt}): ${reopened.error}`);
                 };
-                // OBS-829/OBS-854: one full-suite verdict round at a time in this run, and do not begin beside an
-                // externally live suite attributable to this repository. The process scan catches nested scratch
-                // suites through daemon parentage even after cwd stops naming a worktree.
-                let suiteChain = Promise.resolve();
-                let suitePending = 0;
-                const withSuiteWindow = async (taskId, enabled, run, signal) => {
-                    if (!enabled)
-                        return run();
-                    const previous = suiteChain;
-                    let release;
-                    suiteChain = new Promise((resolve) => { release = resolve; });
-                    const queued = suitePending++ > 0;
-                    if (queued) {
-                        const count = Math.max(1, await liveSuiteCount(repoRoot));
-                        journal.append("suite-wait", taskId, { count });
-                    }
-                    await previous;
-                    try {
-                        let lastCount = -1;
-                        const startedAt = Date.now();
-                        for (;;) {
-                            signal?.throwIfAborted();
-                            const count = await liveSuiteCount(repoRoot);
-                            if (count === 0)
-                                break;
-                            // OBS-889: a census that never reaches zero held T5's gates with no row and no end. Proceed at
-                            // the ceiling, flagged: the verdict that follows was produced beside whatever is still counted.
-                            if (Date.now() - startedAt >= suiteWaitCeilingMs) {
-                                journal.append("suite-wait-ceiling", taskId, { count, waitedMs: Date.now() - startedAt });
-                                journal.append("suite-budget", taskId, {
-                                    count, occupancyCap: occupancyCapacity.forkCap, conservativeCap: conservativeCapacity.forkCap,
-                                });
-                                return await runWithVerificationBudget(conservativeCapacity, run);
-                            }
-                            if (count !== lastCount)
-                                journal.append("suite-wait", taskId, { count });
-                            lastCount = count;
-                            await new Promise((wake) => setTimeout(wake, SUITE_POLL_MS));
+                // Context carries attribution through gates and remote inference; only shell commands acquire.
+                const commandLeases = new CommandLeases();
+                const withCommandContext = (taskId, run, signal) => runWithCommandLease((_command, execute) => commandLeases.run(async () => {
+                    let lastCount = -1;
+                    const startedAt = Date.now();
+                    for (;;) {
+                        signal?.throwIfAborted();
+                        const count = await liveSuiteCount(repoRoot);
+                        if (count === 0)
+                            break;
+                        if (count !== lastCount)
+                            journal.append("suite-wait", taskId, { count });
+                        lastCount = count;
+                        if (Date.now() - startedAt >= suiteWaitCeilingMs) {
+                            journal.append("suite-wait-ceiling", taskId, { count, waitedMs: Date.now() - startedAt });
+                            journal.append("suite-budget", taskId, {
+                                count, occupancyCap: occupancyCapacity.forkCap, conservativeCap: conservativeCapacity.forkCap,
+                            });
+                            return await runWithVerificationBudget(conservativeCapacity, execute);
                         }
-                        return await run();
-                    }
-                    finally {
-                        suitePending--;
-                        release();
+                        await new Promise((wake) => setTimeout(wake, SUITE_POLL_MS));
                     }
-                };
+                    return await execute();
+                }, (count) => journal.append("suite-wait", taskId, { count }), SUITE_POLL_MS, signal), run);
                 let baseRef;
                 let baseline;
                 let baselinePending = false;
@@ -1687,6 +1761,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // The SAME comparator status uses (engagementComparable); one decision, two consumers. Fail closed:
                     // no resume path silently accepts a mismatched or unbound journal. --graph-changed is the operator's
                     // audited release for the stop-amend-resume workflow, journaling a graph-rehash naming both hashes.
+                    graph = applyScopeAmendments(graph, journal, true);
                     const loadedHash = graphDefinitionHash(graph);
                     const cmp = engagementComparable(journal.read(), loadedHash);
                     if (!cmp.comparable) {
@@ -1732,7 +1807,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     baselinePending = true;
                     // Workers can run beside capture, but no gate may observe an absent or partial baseline.
                     // Keep publication and warnings inside the same barrier as the suite's final verdict.
-                    baselineCapture = withSuiteWindow(undefined, commands.test !== undefined || commands.tipTest !== undefined, async () => {
+                    baselineCapture = withCommandContext(undefined, async () => {
                         const captured = await captureBaseline(repoRoot, commands);
                         writeFileSync(join(journal.dir, "baseline.json"), JSON.stringify(captured, null, 2));
                         baseline = captured;
@@ -1919,15 +1994,20 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // worker made. Do not replace the scope gate's stronger attribution with that inference.
                         const paths = reds.filter((g) => g.gate !== "scope" || !g.meta?.collateral).flatMap((g) => namedPaths(g.details));
                         if (refusal.length || (paths.length > 0 && paths.every((path) => !allowed(path)))) {
-                            journal.append("scope-authoring", t.id, {
+                            const classification = {
                                 gate: refusal.length ? "worker" : reds[0]?.gate,
                                 paths: [...new Set(refusal.length ? refusal : paths)],
                                 repair: `files[] repair hint: ${[...new Set(refusal.length ? refusal : paths)].join(", ")}`,
                                 attempt: attempts + 1, chargeable: false, source: "diagnostic",
-                            });
+                            };
+                            if (refusal.length)
+                                journal.append("scope-request", t.id, classification);
+                            else
+                                journal.append("scope-authoring", t.id, classification);
                             // OBS-547 (Leg-2 T3 material): unchargeable ⇒ metered 0, exactly as the predicted path below —
                             // passing the physical count would write `meteredAttempts: 1` beside `attempts: 0`.
-                            await park(t, `authoring defect — files[] repair hint: ${[...new Set(refusal.length ? refusal : paths)].join(", ")}; current files[]: ${t.files.join(", ")}`, "authoring", assignment, attempts, startMs, gateFails, consults, tokens, 0, retryMode);
+                            const approveCommand = `tickmarkr approve ${runId} ${t.id} --files ${[...new Set(refusal)].map((path) => /^[\w./-]+$/.test(path) ? path : shq(path)).join(",")}`;
+                            await park(t, `${refusal.length ? "scope request" : "authoring defect"} — files[] repair hint: ${[...new Set(refusal.length ? refusal : paths)].join(", ")}; current files[]: ${t.files.join(", ")}`, refusal.length ? "scope-request" : "authoring", assignment, attempts, startMs, gateFails, consults, tokens, 0, retryMode, refusal.length ? { paths: [...new Set(refusal)], approveCommand, graphDefinitionHash: graphDefinitionHash(graph) } : {});
                             return true;
                         }
                     }
@@ -1967,6 +2047,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     approvalSweepCursor = events.length;
                     if (approvals.length === 0)
                         return;
+                    graph = applyScopeAmendments(graph, journal);
                     resume = journal.replayResumeState();
                     satisfiedGates = journal.replaySatisfiedGates();
                     replayedGateResults = resumeLifecycleOpen
@@ -2626,7 +2707,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             await trackedDriver.project?.(t.id, "in-review");
                             await waitForBaseline(t.id);
                             journal.phaseStart(t.id, "gates");
-                            const { results } = await withSuiteWindow(t.id, resumedTask.gates.includes("test") && commands.test !== undefined, () => runReviewRecovery(resumedTask, {
+                            const { results } = await withCommandContext(t.id, () => runReviewRecovery(resumedTask, {
                                 carriedFindings: outstandingReviewFindings(journal.read(), t.id),
                                 worktree: wt, baseRef: taskBase, result: priorResult, author: gateAuthor,
                                 commands, baseline, channels: pools.review, judgeChannels: pools.judge, adapters, cfg, artifactDir: journal.dir,
@@ -2892,7 +2973,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 feedback = feedback ? `${feedback}\n\n${consultBrief}` : consultBrief;
                             }
                         }
-                        retryMode = repairFindings
+                        const scopeApproval = [...journaledSoFar].reverse().find((e) => e.taskId === t.id && (e.event === "task-approved" || e.event === "task-dispatch"));
+                        retryMode = scopeApproval?.data.release === "scope-request" ? "fresh" : repairFindings
                             ? "repair"
                             : priorSession
                                 && priorSession.channel === channelKey(assignment)
@@ -2919,6 +3001,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // ledger cannot tell a carried dispatch from an amnesiac one — the exact question a run that
                         // spends two frontier attempts re-deriving a known defect has to be able to answer afterwards.
                         journal.append("task-dispatch", t.id, {
+                            ...(scopeApproval?.data.release === "scope-request" ? { files: t.files, graphDefinitionHash: graphDefinitionHash(graph) } : {}),
                             assignment, attempt, provenance: dispatchProvenance([
                                 channelKey(assignment) === channelKey(r.assignment) ? r.provenance
                                     : t.routingHints?.pin ? `pin ${t.routingHints.pin.via}:${t.routingHints.pin.model} not re-tried` : "ladder assignment",
@@ -3243,6 +3326,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                         let processExited = false;
                         let earlyLaunchDead = false;
                         let startupFailure = false;
+                        let startupEvidence;
+                        const startupDetector = new StartupFailureDetector(adapter);
+                        const startupFailureInWindow = (text, launchedAt) => {
+                            startupEvidence ??= startupDetector.sample(text, launchedAt);
+                            return startupEvidence !== undefined;
+                        };
                         let deadWorkerPark;
                         let settleParsed;
                         const trailerFrames = interactive && adapter.busyFrameMarkers
@@ -4039,6 +4128,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 if (!workerFinished) {
                                     journal.append("worker-reaped-before-harvest", t.id, {
                                         slot: slot.name, attempt, cause: workerCause ?? "stall-timeout",
+                                        ...(startupEvidence ? { evidence: startupEvidence } : {}),
                                     });
                                 }
                             }
@@ -4374,7 +4464,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 }
                             }
                             else {
-                                ({ results, commits } = await withSuiteWindow(t.id, t.gates.includes("test") && commands.test !== undefined, () => runReviewRecovery(t, {
+                                ({ results, commits } = await withCommandContext(t.id, () => runReviewRecovery(t, {
                                     carriedFindings: outstandingFindings,
                                     worktree: wt, baseRef: taskBase, result, author: assignment,
                                     commands, baseline, channels: pools.review, judgeChannels: pools.judge, adapters, cfg, artifactDir: journal.dir,
@@ -4767,7 +4857,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         poll = setTimeout(pollApprovals, APPROVAL_POLL_MS);
                         let tipFailed;
                         try {
-                            const verification = withSuiteWindow(undefined, commands.test !== undefined || commands.tipTest !== undefined, () => verifyIntegrationTipCached(intWt, commands, journal, { lastMergedTask, baseline, signal: controller.signal }), controller.signal);
+                            const verification = withCommandContext(undefined, () => verifyIntegrationTipCached(intWt, commands, journal, { lastMergedTask, baseline, signal: controller.signal }), controller.signal);
                             activeTipVerify = { controller, settled: verification.then(() => { }, () => { }) };
                             tipFailed = await verification;
                         }

package/dist/run/git.d.ts

@@ -4,7 +4,7 @@ export { ROUTING_ENV_SEAMS };
 export declare const FORK_CAP_ENV = "VITEST_MAX_FORKS";
 export declare const SUITE_PARENT_ENV = "TICKMARKR_SUITE_PARENT";
 export declare const DEFAULT_FORK_CAP = "6";
-/** Verification owns the serialized suite window; workers keep their concurrency budget. */
+/** Verification uses command leases; workers keep their concurrency budget. */
 export declare const runWithVerificationBudget: <T>(capacity: RunCapacity, fn: () => Promise<T>) => Promise<T>;
 /**
  * OBS-618: how many PROCESSES one vitest fork can hold at its peak — the fork, a daemon it spawns,
@@ -89,6 +89,7 @@ export declare const resolvedCapacity: () => RunCapacity;
 export declare const DEFAULT_SHELL_TIMEOUT_MS = 600000;
 export interface ShResult {
     code: number;
+    signalExit?: boolean;
     stdout: string;
     stderr: string;
     timedOut?: boolean;
@@ -104,6 +105,14 @@ export declare const setSpawnForTests: (fn: typeof spawn) => void;
 export declare const resetSpawnForTests: () => void;
 export declare const SPAWN_ATTEMPT_LIMIT = 4;
 export declare const SPAWN_RETRY_BACKOFF_MS = 50;
+export interface ShellOptions {
+    env?: NodeJS.ProcessEnv;
+    signal?: AbortSignal;
+    onSpawn?: (pid: number | undefined) => void;
+    onTimeout?: () => void;
+}
+/** Shared command seam, including invocation-bound manifested runners. */
+export declare function shell(cmd: string, cwd: string, timeoutMs: number, login?: boolean, options?: ShellOptions): Promise<ShResult>;
 export declare function sh(cmd: string, cwd: string, timeoutMs?: number): Promise<ShResult>;
 export declare function shGit(cmd: string, cwd: string, timeoutMs?: number): Promise<ShResult>;
 export declare function shOk(cmd: string, cwd: string): Promise<string>;