tickmarkr 2.5.5 → 2.5.6

package/dist/config/fleet-overlay.js

@@ -23,7 +23,8 @@ function allowFormFromExclusions(universe, edited) {
     }
     // LEG2-T3 round 2 finding 1: every staged entry excludes what it NAMES — a bare model id every
     // adapter serving it, an identity its alias — never only an adapter id or an adapter:model key.
-    const entries = [...edited.denyAdapters, ...edited.denyModels];
+    // OBS-1046: the staged allow complement is a reason of its own, beside the authored deny lists.
+    const entries = [...edited.denyAdapters, ...edited.denyModels, ...(edited.allowOut ?? [])];
     const adapters = [];
     const models = [];
     let excluded = false;
@@ -56,9 +57,12 @@ function residualDeny(universe, entries) {
 // list keeps its node. A staged entry the allow form cannot express as a membership key (outside the
 // probe universe, or a bare-model/identity spelling) is written verbatim too; canonical keys the
 // session added ride the allow form alone.
-function flatDenyAfterWrite(doc, path, after, universe) {
+function authoredEntries(doc, path) {
     const node = doc.getIn(path, true);
-    const authored = isSeq(node) ? node.items.flatMap((item) => (isScalar(item) ? [String(item.value)] : [])) : [];
+    return isSeq(node) ? node.items.flatMap((item) => (isScalar(item) ? [String(item.value)] : [])) : [];
+}
+function flatDenyAfterWrite(doc, path, after, universe) {
+    const authored = authoredEntries(doc, path);
     const canonical = (entry) => universe.some((row) => entry === row.adapter || row.models.some((m) => entry === `${row.adapter}:${m}`));
     const kept = authored.filter((entry) => after.includes(entry));
     const verbatim = sortedUnique(after.filter((entry) => !kept.includes(entry)
@@ -183,9 +187,12 @@ export function renderFleetOverlayWrite(priorBytes, write) {
     if (doc.errors.length)
         throw doc.errors[0];
     const { initial, edited } = write;
-    const denyChanged = sortedUnique(initial.denyAdapters).join() !== sortedUnique(edited.denyAdapters).join()
-        || sortedUnique(initial.denyModels).join() !== sortedUnique(edited.denyModels).join();
-    if (denyChanged) {
+    // OBS-1046: each flat scope (and the allow complement) is compared on its own — a scope the
+    // session never edited keeps its node byte for byte, whatever its sibling did.
+    const changed = (before = [], after = []) => sortedUnique(before).join() !== sortedUnique(after).join();
+    const adaptersChanged = changed(initial.denyAdapters, edited.denyAdapters);
+    const modelsChanged = changed(initial.denyModels, edited.denyModels);
+    if (adaptersChanged || modelsChanged || changed(initial.allowOut, edited.allowOut)) {
         if (write.universe) {
             // Membership write: the allow form IS the fleet; deny adapters/models scopes are tombstoned
             // so a lower layer can never re-exclude behind the operator's back (workers untouched).
@@ -215,18 +222,44 @@ export function renderFleetOverlayWrite(priorBytes, write) {
                 // Whole fleet in: no restriction to express — the allow block goes away entirely.
                 deleteAt(doc, ["routing", "allow"]);
             }
-            // Authored and non-canonical entries stay in deny (LEG2-T3 finding 4, round 2 finding 2); a
-            // list left with nothing is tombstoned so a lower layer can never re-exclude behind the
-            // operator's back (workers untouched).
-            for (const [scope, after] of [["adapters", edited.denyAdapters], ["models", edited.denyModels]]) {
+            // Authored and non-canonical entries stay in deny (LEG2-T3 finding 4, round 2 finding 2).
+            // OBS-1046: only an EDITED scope is rewritten, and only when its bytes must change — an
+            // addition the allow form carries leaves the list (an explicit `[]` included) untouched; a
+            // scope the press CLEARED down to nothing is tombstoned so a lower layer can never
+            // re-exclude behind the operator's back (workers untouched).
+            // LEG2-T3 finding 4: an authored entry the edit admits (staged nowhere any more) must go
+            // even from a scope whose own set did not change, or the admitted channel stays excluded
+            // behind the preserved bytes.
+            const stagedAfter = new Set([...edited.denyAdapters, ...edited.denyModels, ...(edited.allowOut ?? [])]);
+            const admitted = [...initial.denyAdapters, ...initial.denyModels, ...(initial.allowOut ?? [])]
+                .filter((entry) => !stagedAfter.has(entry));
+            const scopes = [
+                ["adapters", initial.denyAdapters, edited.denyAdapters, adaptersChanged],
+                ["models", initial.denyModels, edited.denyModels, modelsChanged],
+            ];
+            for (const [scope, before, after, touched] of scopes) {
                 const path = ["routing", "deny", scope];
+                const authored = authoredEntries(doc, path);
+                const stale = authored.some((entry) => admitted.includes(entry));
+                if (!touched && !stale)
+                    continue;
                 const remaining = flatDenyAfterWrite(doc, path, after, write.universe);
-                setStringSequencePreservingComments(doc, path, remaining.length ? remaining : null);
+                if (remaining.length) {
+                    if (remaining.join("\n") !== authored.join("\n"))
+                        setStringSequencePreservingComments(doc, path, remaining);
+                }
+                else if (stale || before.some((entry) => !after.includes(entry))) {
+                    setStringSequencePreservingComments(doc, path, null);
+                }
             }
         }
         else {
-            setStringSequencePreservingComments(doc, ["routing", "deny", "adapters"], edited.denyAdapters.length ? sortedUnique(edited.denyAdapters) : null);
-            setStringSequencePreservingComments(doc, ["routing", "deny", "models"], edited.denyModels.length ? sortedUnique(edited.denyModels) : null);
+            if (adaptersChanged) {
+                setStringSequencePreservingComments(doc, ["routing", "deny", "adapters"], edited.denyAdapters.length ? sortedUnique(edited.denyAdapters) : null);
+            }
+            if (modelsChanged) {
+                setStringSequencePreservingComments(doc, ["routing", "deny", "models"], edited.denyModels.length ? sortedUnique(edited.denyModels) : null);
+            }
         }
     }
     // OBS-994/FL-1: routing.deny.workers is a literal deny list, never a universe-derived
@@ -360,15 +393,19 @@ export function renderFleetOverlayWrite(priorBytes, write) {
     // operator reviews. commentString has no position context, but this writer owns the document:
     // scalar-trailing single-line comments (the only inline form fleet emits) are marked with a
     // private-use sentinel (the FIRST_TOUCH envelope precedent above), everything else renders
-    // byte-identical to yaml's own stringifyComment.
+    // byte-identical to yaml's own stringifyComment. OBS-1046: a scalar parsed from the prior bytes
+    // keeps the exact whitespace it had before its hash sign (yaml itself emits one space, so the
+    // sentinel carries the rest); only a comment fleet authored gets the two-space style.
     visit(doc, (_key, node) => {
         if (isScalar(node) && typeof node.comment === "string" && !node.comment.includes("\n")) {
-            node.comment = `${INLINE_COMMENT_SENTINEL}${node.comment}`;
+            const tail = node.range ? priorBytes.slice(node.range[1], node.range[2]) : "";
+            const gap = /^([ \t]+)#/.exec(tail)?.[1] ?? "  ";
+            node.comment = `${INLINE_COMMENT_SENTINEL}${gap.slice(1)}#${node.comment}`;
         }
     });
     return doc.toString({
         commentString: (comment) => comment.startsWith(INLINE_COMMENT_SENTINEL)
-            ? ` #${comment.slice(1)}`
+            ? comment.slice(1)
             : comment.replace(/^(?!$)(?: $)?/gm, "#"),
         // OBS-518: yaml's default pads flow collections (`[kimi]` → `[ kimi ]`), churning untouched
         // lines on the one confirmation surface an operator reviews. Hand-written overlays use the
@@ -384,7 +421,8 @@ export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}, fi
     const routing = { ...out.routing };
     let routingTouched = false;
     const denyChanged = sortedUnique(initial.denyAdapters).join() !== sortedUnique(edited.denyAdapters).join()
-        || sortedUnique(initial.denyModels).join() !== sortedUnique(edited.denyModels).join();
+        || sortedUnique(initial.denyModels).join() !== sortedUnique(edited.denyModels).join()
+        || sortedUnique(initial.allowOut ?? []).join() !== sortedUnique(edited.allowOut ?? []).join();
     if (denyChanged) {
         if (universe) {
             const form = allowFormFromExclusions(universe, edited);

package/dist/drivers/index.js

@@ -15,7 +15,8 @@ const hostByDriver = new WeakMap();
 export function classifyHost(env = process.env) {
     if (env.HERDR_ENV === "1")
         return "herdr";
-    if (env.TERM_PROGRAM === "Orca" && env.ORCA_TERMINAL_HANDLE !== undefined && env.ORCA_TERMINAL_HANDLE !== "")
+    // A whitespace-only handle is no handle: the narrator trims it and would refuse the split.
+    if (env.TERM_PROGRAM === "Orca" && (env.ORCA_TERMINAL_HANDLE ?? "").trim() !== "")
         return "orca";
     return "none";
 }

package/dist/drivers/orca.d.ts

@@ -124,19 +124,28 @@ export declare function mapAgentState(term: Record<string, unknown>, tuiIdle: bo
  * is proven gone. Everything else — a reservation or claim with no bound pane, a failed cleanup, a
  * record another driver holds with a live observer — refuses and keeps the record exactly as it is.
  */
+/** `placer` is the pid of the narrator that wrote the reservation: a reserved or claimed record is a
+ *  normal intermediate state while that pid lives (another driver awaiting listing or bind) and a
+ *  crash to recover only once it is dead. */
 type BoardRecord = WatchBoardOwner & {
     retired?: true;
     runtimeId?: string;
+    placer?: number;
 };
 /**
  * Whole-record compare-and-swap. The canonical path stays readable until commit: a mkdir lock
  * excludes other writers, then create-only `link`s the new inode (fails if anything exists) or
  * `rename`s the new file over the live path (POSIX atomic replace — readers see old or new, never
  * absence). A crash that leaves a `.tmp` or `.lock` does not drop the previous record.
+ * Each lock generation publishes its pid and nonce atomically in a symlink target. A holder that died
+ * between taking and releasing it is recovered at once (its lock is taken over in place); a live
+ * holder bounds the wait on injected time and is then refused with the record untouched. A legacy
+ * pid-less or malformed generation is recoverable too: a contender atomically creates the next owner
+ * generation, and release removes the directory only while that exact generation is still current.
  * ponytail: observeNamedRun (supervision.ts) renames without CAS. It cannot interleave with a swap
  * because the narrator writes nothing between reserve and claim, and no transition here swaps one.
  */
-export declare function casBoard(family: string, path: string, expected: string | undefined, next: BoardRecord): string;
+export declare function casBoard(family: string, path: string, expected: string | undefined, next: BoardRecord, time?: OrcaTimeSource): Promise<string>;
 /**
  * The renderer hard-wraps long lines, paints margin chrome, and a cursor page boundary splits a
  * marker exactly like a wrap does. `parseWorkerResult` (src/adapters/prompt.ts) already de-wraps
@@ -146,6 +155,8 @@ export declare function casBoard(family: string, path: string, expected: string
  * never depends on this.
  */
 export declare function joinWrapped(raw: string): string;
+/** The OBS-1011 add.1 capture: `status:"exited", tail:[], returnedLineCount 0` from a stream read. */
+export declare function isBlindStreamPage(term: Record<string, unknown>): boolean;
 export interface OrcaDriverOpts {
     bin?: string;
     env?: NodeJS.ProcessEnv | Record<string, string | undefined>;
@@ -242,6 +253,15 @@ export declare class OrcaDriver implements ExecutorDriver {
     private liveShowTerm;
     private tailText;
     private readPage;
+    /**
+     * OBS-1011 add.1 / OBS-1016: the captured incident shape — a stream page answering status exited
+     * with an empty tail on a terminal that accepted a send seconds earlier — is BLIND, not dead, when
+     * the same handle's show record on the same runtime reports connected and not orphaned (show carries
+     * no status field; none is demanded) and its screen read reports running. Then the rendered frame is
+     * the terminal's bytes. Anything less — disconnected, orphaned, another handle or runtime, a screen
+     * that is unavailable or exited — is refused as unavailable, exactly as the dead record would be.
+     */
+    private screenBehindBlindStream;
     /** A rendered-frame liveness read. `--screen` and `--cursor` are mutually exclusive in Orca. */
     private readScreen;
     /** A single UNPAGED tail read — exactly what the caller asked for and nothing more. Markers split

package/dist/drivers/orca.js

@@ -1,4 +1,4 @@
-import { existsSync, linkSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, linkSync, mkdirSync, readdirSync, readFileSync, readlinkSync, realpathSync, renameSync, rmdirSync, rmSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { dirname, join, resolve } from "node:path";
 import { shq } from "../adapters/types.js";
@@ -300,26 +300,57 @@ function readBoard(path, repo, runId) {
  * excludes other writers, then create-only `link`s the new inode (fails if anything exists) or
  * `rename`s the new file over the live path (POSIX atomic replace — readers see old or new, never
  * absence). A crash that leaves a `.tmp` or `.lock` does not drop the previous record.
+ * Each lock generation publishes its pid and nonce atomically in a symlink target. A holder that died
+ * between taking and releasing it is recovered at once (its lock is taken over in place); a live
+ * holder bounds the wait on injected time and is then refused with the record untouched. A legacy
+ * pid-less or malformed generation is recoverable too: a contender atomically creates the next owner
+ * generation, and release removes the directory only while that exact generation is still current.
  * ponytail: observeNamedRun (supervision.ts) renames without CAS. It cannot interleave with a swap
  * because the narrator writes nothing between reserve and claim, and no transition here swaps one.
  */
-export function casBoard(family, path, expected, next) {
+export async function casBoard(family, path, expected, next, time = SYSTEM_TIME) {
     const raw = JSON.stringify(next) + "\n";
     const refused = () => new OrcaError(family, `watch owner record ${path} changed underneath; swap refused and the current record kept`, "");
     mkdirSync(dirname(path), { recursive: true });
     const lock = `${path}.lock`;
-    const deadline = Date.now() + 2_000;
+    const deadline = time.now() + LOCK_WAIT_MS;
+    const ownerTarget = `${process.pid}:${randomUUID()}`;
+    let ownerEntry = "";
+    let acquiredEntries = [];
     for (;;) {
         try {
             mkdirSync(lock);
-            break;
         }
         catch (error) {
             if (error.code !== "EEXIST")
                 throw error;
-            if (Date.now() >= deadline)
+        }
+        // The marker's directory entry and target appear as one filesystem operation. If the creator
+        // dies after mkdir but before this call, a contender claims owner.0; if both race, only one
+        // symlink wins and the loser judges that published owner before entering the CAS section.
+        const holder = lockHolder(lock);
+        if (holder?.pid !== undefined && pidLive(holder.pid)) {
+            if (time.now() >= deadline)
                 throw new OrcaError(family, `watch owner record ${path} lock not acquired; current record kept`, "");
-            Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
+            await time.sleep(10);
+            continue;
+        }
+        ownerEntry = `owner.${(holder?.gen ?? -1) + 1}`;
+        try {
+            symlinkSync(ownerTarget, join(lock, ownerEntry));
+            // Snapshot only generations that this takeover superseded, with our marker last. Release must
+            // never recursively scan: after our final unlink a contender may publish a replacement marker
+            // before rmdir, and that marker belongs to the contender, not to this generation.
+            acquiredEntries = readdirSync(lock)
+                .filter((entry) => entry === ownerEntry || lockEntryGeneration(entry) !== undefined)
+                .sort((a, b) => Number(a === ownerEntry) - Number(b === ownerEntry));
+            break;
+        }
+        catch (error) {
+            const code = error.code;
+            if (code !== "EEXIST" && code !== "ENOENT")
+                throw error;
+            continue; // another contender published this generation, or the prior holder just released
         }
     }
     try {
@@ -354,9 +385,69 @@ export function casBoard(family, path, expected, next) {
         return raw;
     }
     finally {
-        rmSync(lock, { recursive: true, force: true });
+        releaseBoardLock(lock, ownerEntry, ownerTarget, acquiredEntries);
+    }
+}
+const LOCK_WAIT_MS = 2_000;
+/** Best-effort release cannot invalidate a committed CAS. Superseded entries go first and our marker
+ * goes last; after that unlink, a non-recursive rmdir either removes the empty old generation or
+ * leaves a contender's newly published marker untouched. Any abnormal filesystem error leaves the
+ * lock for the next generation's stale-owner recovery instead of escaping from the caller's finally. */
+function releaseBoardLock(lock, ownerEntry, ownerTarget, acquiredEntries) {
+    const holder = lockHolder(lock);
+    if (holder?.entry !== ownerEntry || holder.target !== ownerTarget)
+        return;
+    for (const entry of acquiredEntries) {
+        try {
+            unlinkSync(join(lock, entry));
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                return;
+        }
+    }
+    try {
+        rmdirSync(lock);
+    }
+    catch { /* ENOTEMPTY means a contender owns it; any other failure is recoverable stale state. */ }
+}
+/** The highest published generation. `pid*` files are accepted for recovery compatibility; new
+ * owners use atomic `owner.N -> pid:nonce` symlinks. Missing or malformed contents return a
+ * generation with no pid, which is stale and can only be superseded by creating the next marker. */
+function lockHolder(lock) {
+    try {
+        const candidates = readdirSync(lock).flatMap((entry) => {
+            const owner = /^owner\.(\d+)$/.exec(entry);
+            const gen = lockEntryGeneration(entry);
+            return gen === undefined ? [] : [{ gen, entry, owner: owner !== null }];
+        }).sort((a, b) => b.gen - a.gen || Number(b.owner) - Number(a.owner));
+        const current = candidates[0];
+        if (!current)
+            return undefined;
+        let target;
+        try {
+            target = current.owner
+                ? readlinkSync(join(lock, current.entry))
+                : readFileSync(join(lock, current.entry), "utf8").trim();
+        }
+        catch {
+            return { gen: current.gen, entry: current.entry };
+        }
+        const pidText = current.owner ? /^([1-9]\d*):.+$/.exec(target)?.[1] : target;
+        const pid = Number(pidText);
+        return Number.isInteger(pid) && pid > 0
+            ? { gen: current.gen, entry: current.entry, target, pid }
+            : { gen: current.gen, entry: current.entry, target };
+    }
+    catch {
+        return undefined;
     }
 }
+function lockEntryGeneration(entry) {
+    const owner = /^owner\.(\d+)$/.exec(entry);
+    const legacy = /^pid(?:\.(\d+))?$/.exec(entry);
+    return owner ? Number(owner[1]) : legacy ? Number(legacy[1] ?? 0) : undefined;
+}
 function pidLive(pid) {
     try {
         process.kill(pid, 0);
@@ -463,6 +554,13 @@ function collectTabs(node, out) {
 export function joinWrapped(raw) {
     return raw.split("\n").map((l) => l.replace(/^[\s│|]+/, "").replace(/[\s│|]+$/, "")).join("");
 }
+/** The OBS-1011 add.1 capture: `status:"exited", tail:[], returnedLineCount 0` from a stream read. */
+export function isBlindStreamPage(term) {
+    return str(term.status) === "exited"
+        && term.source !== "screen"
+        && Array.isArray(term.tail) && term.tail.length === 0
+        && (term.returnedLineCount === undefined || term.returnedLineCount === 0);
+}
 export class OrcaDriver {
     id = "orca";
     interactive = true; // a visible terminal the operator can watch and answer
@@ -637,8 +735,8 @@ export class OrcaDriver {
         // terminalOp proves the runtime binding before the handle goes on the wire.
         await this.sendText(st, cmd);
     }
-    async sendText(st, text) {
-        const env = await this.terminalOp("send", st, (h) => this.call("send", ["terminal", "send", "--terminal", h, "--text", text, "--enter"], this.cliCwd(st)), { mutating: true });
+    async sendText(st, text, waitSubmit = false) {
+        const env = await this.terminalOp("send", st, (h) => this.call("send", ["terminal", "send", "--terminal", h, "--text", text, "--enter", ...(waitSubmit ? ["--wait-submit", "15"] : [])], this.cliCwd(st)), { mutating: true });
         // Recorded 1.4.195 send receipt: result.send = {handle, accepted, bytesWritten}. `ok:true`
         // alone is not delivery: the accepted receipt must name this handle and account for the bytes.
         const receipt = this.sendReceipt(env, st);
@@ -646,6 +744,7 @@ export class OrcaDriver {
         if (receipt.accepted !== true || typeof receipt.bytesWritten !== "number" || receipt.bytesWritten !== expectedBytes) {
             throw new OrcaError("send", `send receipt does not report expected byte delivery (accepted: ${JSON.stringify(receipt.accepted)}, bytesWritten: ${receipt.bytesWritten}, expected: ${expectedBytes})`, env.raw);
         }
+        return receipt;
     }
     sendReceipt(env, st) {
         const receipt = env.result.send;
@@ -989,8 +1088,35 @@ export class OrcaDriver {
             ...(cursor === undefined || recovered ? [] : ["--cursor", cursor]),
             "--limit", String(lines),
         ], this.cliCwd(st)), { onRecovered: () => { recovered = true; } });
+        if (isBlindStreamPage(requireTerminal(family, env))) {
+            return { term: await this.screenBehindBlindStream(family, st, env), raw: env.raw, recovered };
+        }
         return { term: this.validated(family, st, env), raw: env.raw, recovered };
     }
+    /**
+     * OBS-1011 add.1 / OBS-1016: the captured incident shape — a stream page answering status exited
+     * with an empty tail on a terminal that accepted a send seconds earlier — is BLIND, not dead, when
+     * the same handle's show record on the same runtime reports connected and not orphaned (show carries
+     * no status field; none is demanded) and its screen read reports running. Then the rendered frame is
+     * the terminal's bytes. Anything less — disconnected, orphaned, another handle or runtime, a screen
+     * that is unavailable or exited — is refused as unavailable, exactly as the dead record would be.
+     */
+    async screenBehindBlindStream(family, st, blind) {
+        const handle = str(requireTerminal(family, blind).handle);
+        if (handle !== st.handle) {
+            throw new OrcaUnavailableError(family, `terminal record names ${handle ?? "no handle"}, not the addressed ${st.handle}`, blind.raw);
+        }
+        const show = await this.call("show", ["terminal", "show", "--terminal", st.handle], this.cliCwd(st));
+        if (show.runtimeId !== st.runtimeId) {
+            throw new OrcaUnavailableError(family, `exited-shaped stream page: show answered by runtime ${show.runtimeId}, not the bound ${st.runtimeId}`, show.raw, "exited");
+        }
+        this.liveShowTerm(family, st, show);
+        const screen = await this.readScreen(st);
+        if (screen.source !== "screen") {
+            throw new OrcaUnavailableError(family, `exited-shaped stream page and no rendered screen for ${st.handle}`, blind.raw, "exited");
+        }
+        return screen.term;
+    }
     /** A rendered-frame liveness read. `--screen` and `--cursor` are mutually exclusive in Orca. */
     async readScreen(st) {
         const env = await this.terminalOp("status", st, (h) => this.call("read", [
@@ -1238,17 +1364,26 @@ export class OrcaDriver {
             const st = this.state(slot);
             if (!await this.waitCondition(st, "tui-idle", 1))
                 return false;
-            // Drain to the current stream cursor before sending. A message already present makes the
-            // proof ambiguous, so decline rather than reporting delivery from old scrollback.
-            const before = await this.sweep(st);
-            if (before.includes(message) || joinWrapped(before).includes(message))
-                return false;
-            await this.sendText(st, message);
+            const receipt = await this.sendText(st, message, true);
+            // OBS-1016: delivery is proven by the receipt — a prompt stage of turn_started — or by the
+            // composer emptying on a screen read, never by stream echo: the stream is blind on a live Orca
+            // terminal (OBS-1011 add.1), so an echo sweep fails every nudge and latches the harvest hold.
+            const prompt = typeof receipt.prompt === "object" && receipt.prompt !== null && !Array.isArray(receipt.prompt)
+                ? receipt.prompt
+                : {};
+            const stages = Array.isArray(prompt.stages) ? prompt.stages : [];
+            if (stages.includes("turn_started"))
+                return true;
             const deadline = this.time.now() + NUDGE_ECHO_TIMEOUT_MS;
             for (;;) {
-                const after = await this.sweep(st);
-                if (after.includes(message) || joinWrapped(after).includes(message))
-                    return true;
+                const screen = await this.readScreen(st);
+                // ponytail: "composer emptied" is "the text is no longer on the frame" — a TUI that keeps the
+                // submitted turn on screen reads as undelivered until the timeout; the receipt stage is primary.
+                if (screen.source === "screen") {
+                    const frame = this.tailText("status", screen.term, "");
+                    if (!frame.includes(message) && !joinWrapped(frame).includes(message))
+                        return true;
+                }
                 const left = deadline - this.time.now();
                 if (left <= 0)
                     return false;
@@ -1280,7 +1415,36 @@ export class OrcaDriver {
             else if (current) {
                 const state = boardState(current.record);
                 if (state === "reserved" || state === "claimed") {
-                    throw new OrcaError("split", `Orca narrator placement remains unresolved for ${name} (${state}, no bound pane); ${kept}`, "");
+                    // A reservation or claim with no bound pane is the placing narrator's normal intermediate
+                    // state while that narrator lives (awaiting its receipt, listing, claim or bind): refused
+                    // untouched, its observer never asked to stop. Only a DEAD placer (or one unrecorded) makes
+                    // it a crash to recover.
+                    const { placer } = current.record;
+                    if (typeof placer !== "number" || pidLive(placer)) {
+                        throw new OrcaError("split", `Orca narrator placement remains unresolved for ${name} (${state}, no bound pane) while placing narrator ${placer ?? "unrecorded"} lives; ${kept}`, "");
+                    }
+                }
+                if (state === "claimed") {
+                    // The placing driver crashed between the observer's claim and its bind. The record is
+                    // replaced only once that observer is proven gone: dead outright, or live and stopped with
+                    // its acknowledgement awaited on injected time — unacknowledged, it is refused untouched.
+                    const pid = current.record.pid;
+                    if (pidLive(pid)) {
+                        try {
+                            await stopWatchBoard(current.record, this.time);
+                        }
+                        catch (error) {
+                            throw new OrcaError("split", `Orca narrator placement refused for ${name}: claimed board's live observer unacknowledged; ${kept}; ${errorText(error)}`, "");
+                        }
+                    }
+                    const retired = { ...current.record, retired: true };
+                    current = { raw: await casBoard("split", path, current.raw, retired, this.time), record: retired };
+                }
+                if (state === "reserved") {
+                    // The placer died before any claim: no observer exists, its split pane (if any) is unknown
+                    // to the record. Tombstoned in place so the generic tail below replaces it.
+                    const retired = { ...current.record, retired: true };
+                    current = { raw: await casBoard("split", path, current.raw, retired, this.time), record: retired };
                 }
                 if (state === "bound") {
                     // The bound record is the durable truth of placement: the child handle PLUS the split
@@ -1290,7 +1454,7 @@ export class OrcaDriver {
                     }
                     // Lost: this runtime no longer has that pane. Tombstone before anything else.
                     const retired = { ...current.record, retired: true };
-                    current = { raw: casBoard("split", path, current.raw, retired), record: retired };
+                    current = { raw: await casBoard("split", path, current.raw, retired, this.time), record: retired };
                 }
                 // A tombstone can be an acknowledgement timeout, not completed observer cleanup. A live
                 // observer must stop and ack on injected time before the handle-bound close; timeout keeps
@@ -1316,7 +1480,19 @@ export class OrcaDriver {
             // Reserve before any command can read the token: create-only, or a swap of the exact record
             // judged replaceable above.
             const token = randomUUID();
-            casBoard("split", path, current?.raw, { repo: realpathSync(cwd), runId, driver: this.id, workspace: ORCA_SPACE, pane: "", name, token });
+            await casBoard("split", path, current?.raw, { repo: realpathSync(cwd), runId, driver: this.id, workspace: ORCA_SPACE, pane: "", name, token, placer: process.pid }, this.time);
+            // A reservation that can never be bound — no usable receipt, or no claim — is tombstoned so the
+            // next narrator call splits afresh instead of refusing forever. Only THIS reservation, and only
+            // while it is still the untouched reservation; a record anyone else moved is left to them.
+            const tombstone = async (extra = {}) => {
+                try {
+                    const now = readBoard(path, cwd, runId);
+                    if (now?.record.token === token && boardState(now.record) === "reserved") {
+                        await casBoard("split", path, now.raw, { ...now.record, ...extra, retired: true }, this.time);
+                    }
+                }
+                catch { /* the record is kept as it stands; the next narrator judges it */ }
+            };
             // Exactly one terminal split of the launching handle, horizontal, carrying token and command.
             // An unknown receipt (transport failure, refusal, unparseable output) after the verb was issued
             // is as indeterminate as a handle-less one: the pane may exist, so the reservation stays.
@@ -1325,7 +1501,8 @@ export class OrcaDriver {
                 "--terminal", launchingHandle,
                 "--direction", "horizontal",
                 "--command", `${WATCH_OWNER_ENV}=${shq(token)} ${command}`,
-            ], cwd).catch((error) => {
+            ], cwd).catch(async (error) => {
+                await tombstone();
                 throw new OrcaError("split", `Orca narrator placement failed for ${name}: split receipt is unknown (${error instanceof OrcaError ? error.reason : errorText(error)}); ${kept}`, error instanceof OrcaError ? error.raw : "");
             });
             let child;
@@ -1333,6 +1510,7 @@ export class OrcaDriver {
                 child = splitReceipt(env);
             }
             catch {
+                await tombstone();
                 throw new OrcaError("split", `Orca narrator placement failed for ${name}: split receipt is unknown, malformed or handle-less; ${kept}`, env.raw);
             }
             // Parent tabId must name the launching terminal's tab, and the child must actually appear
@@ -1343,6 +1521,7 @@ export class OrcaDriver {
                 listing = await this.listAll(cwd);
             }
             catch (error) {
+                await tombstone();
                 throw new OrcaError("split", `Orca narrator placement failed for ${name}: split receipt is unknown, malformed or handle-less; ${kept}`, error instanceof OrcaError ? error.raw : env.raw);
             }
             const launchingTabId = terminalTabId(listing, launchingHandle);
@@ -1350,6 +1529,7 @@ export class OrcaDriver {
                 || child.tabId !== launchingTabId
                 || child.handle === launchingHandle
                 || terminalTabId(listing, child.handle) !== launchingTabId) {
+                await tombstone();
                 throw new OrcaError("split", `Orca narrator placement failed for ${name}: split receipt is unknown, malformed or handle-less; ${kept}`, env.raw);
             }
             const childHandle = child.handle;
@@ -1370,7 +1550,9 @@ export class OrcaDriver {
                 await this.time.sleep(20);
             }
             if (!claim) {
-                // The receipt's handle may be closed, but the refused placement's record stays as it is.
+                // The receipt's handle may be closed; the reservation is tombstoned naming that pane so the
+                // next narrator can prove it gone (or close it) and split afresh.
+                await tombstone({ pane: childHandle, runtimeId: env.runtimeId });
                 let pane;
                 try {
                     await this.closeRecordedPane(cwd, name, childHandle, env.runtimeId);
@@ -1381,7 +1563,7 @@ export class OrcaDriver {
                 }
                 throw new OrcaError("split", `Orca narrator board unclaimed for ${name}: the observer never claimed the record (unclaimed board); ${kept}; ${pane}`, env.raw);
             }
-            casBoard("split", path, claim.raw, { ...claim.record, pane: childHandle, runtimeId: env.runtimeId });
+            await casBoard("split", path, claim.raw, { ...claim.record, pane: childHandle, runtimeId: env.runtimeId }, this.time);
             return watchSlot(cwd, name, childHandle);
         });
     }
@@ -1401,7 +1583,7 @@ export class OrcaDriver {
     }
     /** bound → retired, decided from the record alone: it must be this driver's board for exactly this
      *  slot's pane. Already retired is returned as it is. */
-    retireBoard(family, slot) {
+    async retireBoard(family, slot) {
         const runId = parseOwnedName(slot.name)?.runId;
         const path = runId ? this.boardPath(slot.cwd, runId) : undefined;
         const current = path && runId ? readBoard(path, slot.cwd, runId) : undefined;
@@ -1412,7 +1594,7 @@ export class OrcaDriver {
         if (r.retired)
             return r;
         const retired = { ...r, retired: true };
-        casBoard(family, path, current.raw, retired);
+        await casBoard(family, path, current.raw, retired, this.time);
         return retired;
     }
     /** bound → retired first: whatever fails below, no later call answers this board again. A live
@@ -1421,7 +1603,7 @@ export class OrcaDriver {
      *  so it is only asked. */
     async retireAndClose(slot) {
         await this.serial(async () => {
-            const retired = this.retireBoard("close", slot);
+            const retired = await this.retireBoard("close", slot);
             if (typeof retired.pid === "number" && pidLive(retired.pid))
                 await stopWatchBoard(retired, this.time);
             else

package/dist/gates/baseline.d.ts

@@ -31,8 +31,12 @@ export interface BaselineCommand {
     durationMs?: number;
     /** Sum of the per-file durations named by the runner; null when its output names none. */
     fileDurationSumMs?: number | null;
-    /** Total files reported by the runner summary; null when unavailable. */
+    /** Total files the runner would collect; null when unavailable. */
     fileCount?: number | null;
+    /** OBS-1044: `manifest` when `fileCount` came from the runner's own listing (test-manifest.ts's
+     * discovery seam) rather than a stdout summary sum. Absent on every pre-2.5.6 entry and on every
+     * scripted non-runner command, whose summary count keeps the stdout deficit rule byte-identically. */
+    fileCountSource?: "manifest";
     /** fileDurationSumMs / durationMs — average implied file concurrency, not a configured fork count. */
     impliedParallelism?: number | null;
     /** The slowest per-file entry named by the runner; null when per-file timing is unavailable. */
@@ -150,6 +154,9 @@ export declare function ceilingKillResult(gate: string, r: ShResult, ceilingMs:
  * shell asks it to finish faster than the thing it is measuring.
  */
 export declare const CAPTURE_CEILING_MS = 1800000;
+/** OBS-1044: a cached vitest entry whose count is a stdout sum may be inflated; only a manifest-derived
+ * count is safe to apply as a deficit floor. A null count compares nothing and is safe as-is. */
+export declare function staleFileCountCommands(baseline: Baseline, commands: Record<string, string>, cwd: string): string[];
 export declare function captureBaseline(cwd: string, commands: Record<string, string>): Promise<Baseline>;
 export interface VacuousOracleWarning {
     kind: "vacuous-oracle";
@@ -161,7 +168,10 @@ export declare function detectVacuousOracles(cwd: string, tasks: ReadonlyArray<{
     id: string;
     acceptance: AcceptanceItem[];
 }>): Promise<VacuousOracleWarning[]>;
-export declare function compareToBaseline(cwd: string, commands: Record<string, string>, baseline: Baseline, enabled: string[], opts?: {
+export interface RetryOptions {
+    authorizeRetry?: (cause: "infra" | "host-starved") => boolean;
+}
+export declare function compareToBaseline(cwd: string, commands: Record<string, string>, baseline: Baseline, enabled: string[], opts?: RetryOptions & {
     rerunOf?: HostStarvedRerun;
     infraRerun?: HostStarvedRerun;
     selected?: readonly string[];
@@ -185,7 +195,8 @@ interface CalmWindow {
 }
 export declare function setCalmWindowForTests(over: Partial<CalmWindow>): void;
 export declare function resetCalmWindowForTests(): void;
-export declare function waitForCalmWindow(): Promise<number>;
+export declare function calmWindowReady(): boolean;
+export declare function waitForCalmWindow(signal?: AbortSignal): Promise<number>;
 /** Summary totals survive digit-normalized fingerprints and exclude test-owned echoed output. */
 export declare function runnerFileCount(raw: string): number | null;
 export declare function fileCountDeficit(entry: BaselineCommand | undefined, raw: string, opts?: {