tickmarkr 2.5.5 → 2.5.6

package/dist/run/execution-budget.d.ts

@@ -0,0 +1,25 @@
+export declare class ExecutionBudgetExceeded extends Error {
+    readonly taskId: string;
+    constructor(taskId: string, reason?: string);
+}
+export interface ExecutionBudgetEvent {
+    event: string;
+    taskId?: string;
+    data: Record<string, unknown>;
+}
+export interface ExecutionBudgetOptions {
+    limitMs: number;
+    taskId: string;
+    readEvents: () => readonly ExecutionBudgetEvent[];
+    append: (event: string, taskId: string, data: Record<string, unknown>) => void;
+}
+export declare const executionSignal: () => AbortSignal | undefined;
+/** Cleanup only: the caller must bound cleanup and must not authorize task work here. */
+export declare const withoutExecutionBudget: <T>(run: () => T) => T;
+export declare const remainingExecutionMs: () => number | undefined;
+/** One wall-clock interval around task execution, shared by parallel children. Cancellation is
+ * cooperative: callers must stop on executionSignal(), and this wrapper waits for their cleanup.
+ * Durable slices are bought before work: at least one minute or 1% of the task ceiling, capped
+ * by what remains. This avoids a per-second journal stream. An interrupted slice stays fully
+ * charged, conservatively consuming its unused portion; daemon-offline time is never charged. */
+export declare function withExecutionBudget<T>(opts: ExecutionBudgetOptions, run: () => Promise<T>): Promise<T>;

package/dist/run/execution-budget.js

@@ -0,0 +1,142 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { randomUUID } from "node:crypto";
+export class ExecutionBudgetExceeded extends Error {
+    taskId;
+    constructor(taskId, reason = "automated execution ceiling exhausted") {
+        super(`${taskId}: ${reason}`);
+        this.taskId = taskId;
+        this.name = "ExecutionBudgetExceeded";
+    }
+}
+const context = new AsyncLocalStorage();
+const MIN_SLICE_MS = 60_000;
+const finite = (n) => typeof n === "number" && Number.isFinite(n) && n >= 0;
+function consumed(opts) {
+    const reservations = new Map();
+    for (const e of opts.readEvents()) {
+        if (e.taskId !== opts.taskId || !["execution-budget-reserved", "execution-budget-settled"].includes(e.event))
+            continue;
+        const d = e.data;
+        if (!d || d.limitMs !== opts.limitMs || typeof d.id !== "string" || !d.id) {
+            throw new ExecutionBudgetExceeded(opts.taskId, "invalid execution budget accounting");
+        }
+        if (e.event === "execution-budget-reserved") {
+            if (!finite(d.reservedMs) || d.reservedMs === 0 || reservations.has(d.id)) {
+                throw new ExecutionBudgetExceeded(opts.taskId, "invalid execution reservation");
+            }
+            reservations.set(d.id, { reserved: d.reservedMs });
+        }
+        else {
+            const prior = reservations.get(d.id);
+            if (!prior || prior.used !== undefined || !finite(d.usedMs) || d.usedMs > prior.reserved) {
+                throw new ExecutionBudgetExceeded(opts.taskId, "invalid execution settlement");
+            }
+            prior.used = d.usedMs;
+        }
+    }
+    const total = [...reservations.values()].reduce((sum, r) => sum + (r.used ?? r.reserved), 0);
+    if (!finite(total) || total > opts.limitMs)
+        throw new ExecutionBudgetExceeded(opts.taskId, "invalid execution total");
+    return total;
+}
+export const executionSignal = () => {
+    const budget = context.getStore();
+    budget?.check();
+    return budget?.signal;
+};
+/** Cleanup only: the caller must bound cleanup and must not authorize task work here. */
+export const withoutExecutionBudget = (run) => context.exit(run);
+export const remainingExecutionMs = () => context.getStore()?.remaining();
+/** One wall-clock interval around task execution, shared by parallel children. Cancellation is
+ * cooperative: callers must stop on executionSignal(), and this wrapper waits for their cleanup.
+ * Durable slices are bought before work: at least one minute or 1% of the task ceiling, capped
+ * by what remains. This avoids a per-second journal stream. An interrupted slice stays fully
+ * charged, conservatively consuming its unused portion; daemon-offline time is never charged. */
+export async function withExecutionBudget(opts, run) {
+    if (!finite(opts.limitMs) || opts.limitMs === 0 || !opts.taskId)
+        throw new ExecutionBudgetExceeded(opts.taskId, "invalid execution ceiling");
+    const parent = context.getStore();
+    if (parent) {
+        if (parent.taskId !== opts.taskId || parent.limitMs !== opts.limitMs)
+            throw new ExecutionBudgetExceeded(opts.taskId, "nested execution budget mismatch");
+        parent.check();
+        parent.signal.throwIfAborted();
+        return run();
+    }
+    const prior = consumed(opts);
+    const available = opts.limitMs - prior;
+    const sliceMs = Math.max(MIN_SLICE_MS, opts.limitMs / 100);
+    if (available <= 0)
+        throw new ExecutionBudgetExceeded(opts.taskId);
+    const controller = new AbortController();
+    const start = performance.now();
+    let reserved = 0;
+    let current;
+    let timer;
+    const elapsed = () => Math.max(0, performance.now() - start);
+    const remaining = () => Math.max(0, available - elapsed());
+    const stop = (error) => controller.abort(error instanceof Error ? error : new ExecutionBudgetExceeded(opts.taskId));
+    const buy = (amount) => {
+        if (amount <= 0)
+            return;
+        const next = { id: randomUUID(), before: reserved, amount };
+        opts.append("execution-budget-reserved", opts.taskId, { id: next.id, limitMs: opts.limitMs, reservedMs: amount });
+        current = next;
+        reserved += amount;
+    };
+    // JS timers cannot preempt a blocked event loop. Charge elapsed overruns before another
+    // observable operation or completion; expiration consumes the whole allowance across resume.
+    const check = () => {
+        try {
+            const used = Math.min(available, elapsed());
+            if (used > reserved)
+                buy(used - reserved);
+            if (used >= available)
+                stop(new ExecutionBudgetExceeded(opts.taskId));
+        }
+        catch (error) {
+            stop(error);
+        }
+    };
+    const reserve = () => {
+        if (elapsed() >= available)
+            check();
+        if (controller.signal.aborted)
+            return;
+        buy(Math.min(available - reserved, Math.max(sliceMs, elapsed() - reserved + sliceMs)));
+        timer = setTimeout(() => {
+            try {
+                reserve();
+            }
+            catch (error) {
+                stop(error);
+            }
+        }, Math.max(0, reserved - elapsed()));
+    };
+    reserve();
+    controller.signal.throwIfAborted();
+    const budget = { taskId: opts.taskId, limitMs: opts.limitMs, signal: controller.signal, remaining, check };
+    try {
+        return await context.run(budget, async () => {
+            controller.signal.throwIfAborted();
+            const result = await run();
+            check();
+            controller.signal.throwIfAborted();
+            return result;
+        });
+    }
+    catch (error) {
+        check();
+        controller.signal.throwIfAborted();
+        throw error;
+    }
+    finally {
+        clearTimeout(timer);
+        check();
+        if (current) {
+            const usedMs = Math.min(current.amount, Math.max(0, elapsed() - current.before));
+            opts.append("execution-budget-settled", opts.taskId, { id: current.id, limitMs: opts.limitMs, usedMs });
+        }
+        controller.signal.throwIfAborted();
+    }
+}

package/dist/run/git.d.ts

@@ -76,6 +76,46 @@ export declare function readCapacity(value: unknown): CapacityRead;
  * different capacity, or a current capacity the caller could not state → no.
  */
 export declare function sameCapacity(recorded: unknown, current: RunCapacity | undefined): boolean;
+/**
+ * R41: the verification PROTOCOL a verdict was produced under — which implementation of the manifest
+ * discovery/report contract judged it, and the npm lifecycle policy its runner children ran with.
+ * Two verdicts are comparable only when both match: a manifest built from module collection ("vl1.1",
+ * the pre-stamp implementation) and one built from file specifications ("vl1.2") certify different
+ * sets, and a suite whose `pretest` hook ran (ignore-scripts=false) is a different measurement from
+ * one where npm skipped it. Bump VERIFICATION_PROTOCOL whenever discovery or report semantics change.
+ */
+export declare const VERIFICATION_PROTOCOL = "vl1.2";
+export type RunnerLifecycle = "hooks" | "ignore-scripts" | "unknown";
+export interface VerificationProtocol {
+    protocol: string;
+    /** The EFFECTIVE npm lifecycle policy a runner child receives: `hooks` (pretest/prebuild run),
+     * `ignore-scripts` (npm skips them), or `unknown` (could not be measured — never comparable). */
+    lifecycle: RunnerLifecycle;
+    /** Provenance only, never part of compatibility: an explicit process-scoped env export, or npm's
+     * own resolved config for that checkout (user/project npmrc). */
+    source: "explicit" | "npm-config" | "unknown";
+}
+/**
+ * R41: the lifecycle policy a runner child spawned from `env` in `cwd` receives. An explicit
+ * process-scoped `npm_config_ignore_scripts` export decides (npm reads env over every npmrc) and is
+ * recorded as such; otherwise the policy is MEASURED from npm's own resolved config for that checkout
+ * (`npm config get ignore-scripts` — user npmrc, project npmrc, env), so the identity binds what
+ * npm will actually do rather than a guess. A policy that cannot be measured is `unknown`, and an
+ * unknown policy is never compatible with anything, itself included. No env or npmrc is written here.
+ */
+export declare function runnerLifecycle(env?: NodeJS.ProcessEnv, cwd?: string): Pick<VerificationProtocol, "lifecycle" | "source">;
+export declare function verificationProtocol(env?: NodeJS.ProcessEnv, cwd?: string): VerificationProtocol;
+/**
+ * May a verdict recorded under `recorded` be reused — cached, replayed — by a session running
+ * `current`? Unlike capacity, ABSENT is NOT compatible: a row with no protocol stamp was produced by
+ * the pre-stamp implementation (module-collection discovery, lifecycle unstated), which is exactly
+ * the evidence a changed protocol must not inherit — positive or negative. Malformed → no. An
+ * `unknown` lifecycle on either side → no: two unmeasured policies are not the same policy.
+ * `source` is provenance and never enters the comparison — an explicit `false` and an npmrc `false`
+ * are the same effective policy.
+ */
+export declare function sameVerification(recorded: unknown, current: VerificationProtocol): boolean;
+export declare const describeVerification: (value: unknown) => string;
 export declare const describeCapacity: (value: unknown) => string;
 /**
  * The capacity a child spawned on THIS async context would receive: the same precedence `shell`

package/dist/run/git.js

@@ -1,8 +1,9 @@
+import { executionSignal } from "./execution-budget.js";
 import { commandLeaseEnvironment, withCommandLease } from "./lease.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { spawn } from "node:child_process";
-import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, readlinkSync, realpathSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
-import { availableParallelism, tmpdir } from "node:os";
+import { execFileSync, spawn } from "node:child_process";
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
+import { availableParallelism, homedir, tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { StringDecoder } from "node:string_decoder";
 import { shq } from "../adapters/types.js";
@@ -82,6 +83,86 @@ export function sameCapacity(recorded, current) {
         return false;
     return read.capacity.forkCap === current.forkCap && read.capacity.cores === current.cores;
 }
+/**
+ * R41: the verification PROTOCOL a verdict was produced under — which implementation of the manifest
+ * discovery/report contract judged it, and the npm lifecycle policy its runner children ran with.
+ * Two verdicts are comparable only when both match: a manifest built from module collection ("vl1.1",
+ * the pre-stamp implementation) and one built from file specifications ("vl1.2") certify different
+ * sets, and a suite whose `pretest` hook ran (ignore-scripts=false) is a different measurement from
+ * one where npm skipped it. Bump VERIFICATION_PROTOCOL whenever discovery or report semantics change.
+ */
+export const VERIFICATION_PROTOCOL = "vl1.2";
+const lifecycleOf = (raw) => {
+    const v = raw?.trim().toLowerCase();
+    return v === "false" ? "hooks" : v === "true" ? "ignore-scripts" : undefined;
+};
+// Measured effective policy, keyed on everything npm resolves it from that this process can see:
+// the checkout, its project npmrc and the user npmrc (path + mtime), and the explicit env. A
+// rewritten npmrc changes the key, so a later battery in the same process re-measures.
+const measuredLifecycle = new Map();
+const mtimeOf = (p) => { try {
+    return String(statSync(p).mtimeMs);
+}
+catch {
+    return "-";
+} };
+/**
+ * R41: the lifecycle policy a runner child spawned from `env` in `cwd` receives. An explicit
+ * process-scoped `npm_config_ignore_scripts` export decides (npm reads env over every npmrc) and is
+ * recorded as such; otherwise the policy is MEASURED from npm's own resolved config for that checkout
+ * (`npm config get ignore-scripts` — user npmrc, project npmrc, env), so the identity binds what
+ * npm will actually do rather than a guess. A policy that cannot be measured is `unknown`, and an
+ * unknown policy is never compatible with anything, itself included. No env or npmrc is written here.
+ */
+export function runnerLifecycle(env = process.env, cwd = process.cwd()) {
+    const explicit = lifecycleOf(env.npm_config_ignore_scripts ?? env.NPM_CONFIG_IGNORE_SCRIPTS);
+    if (explicit)
+        return { lifecycle: explicit, source: "explicit" };
+    const userconfig = env.NPM_CONFIG_USERCONFIG ?? env.npm_config_userconfig ?? join(homedir(), ".npmrc");
+    const key = [cwd, mtimeOf(join(cwd, ".npmrc")), userconfig, mtimeOf(userconfig),
+        env.npm_config_ignore_scripts ?? env.NPM_CONFIG_IGNORE_SCRIPTS ?? ""].join("\0");
+    let lifecycle = measuredLifecycle.get(key);
+    if (lifecycle === undefined) {
+        try {
+            const out = execFileSync("npm", ["config", "get", "ignore-scripts"], {
+                cwd: existsSync(cwd) ? cwd : process.cwd(), env, encoding: "utf8", timeout: 15_000, stdio: ["ignore", "pipe", "ignore"],
+            });
+            lifecycle = lifecycleOf(out) ?? "unknown";
+        }
+        catch {
+            lifecycle = "unknown";
+        }
+        measuredLifecycle.set(key, lifecycle);
+    }
+    return { lifecycle, source: lifecycle === "unknown" ? "unknown" : "npm-config" };
+}
+export function verificationProtocol(env = process.env, cwd = process.cwd()) {
+    return { protocol: VERIFICATION_PROTOCOL, ...runnerLifecycle(env, cwd) };
+}
+/**
+ * May a verdict recorded under `recorded` be reused — cached, replayed — by a session running
+ * `current`? Unlike capacity, ABSENT is NOT compatible: a row with no protocol stamp was produced by
+ * the pre-stamp implementation (module-collection discovery, lifecycle unstated), which is exactly
+ * the evidence a changed protocol must not inherit — positive or negative. Malformed → no. An
+ * `unknown` lifecycle on either side → no: two unmeasured policies are not the same policy.
+ * `source` is provenance and never enters the comparison — an explicit `false` and an npmrc `false`
+ * are the same effective policy.
+ */
+export function sameVerification(recorded, current) {
+    if (recorded === null || typeof recorded !== "object")
+        return false;
+    const { protocol, lifecycle } = recorded;
+    if (lifecycle === "unknown" || current.lifecycle === "unknown")
+        return false;
+    return protocol === current.protocol && lifecycle === current.lifecycle;
+}
+export const describeVerification = (value) => {
+    if (value === null || typeof value !== "object")
+        return "an unrecorded verification protocol";
+    const { protocol, lifecycle, source } = value;
+    return typeof protocol === "string" && typeof lifecycle === "string"
+        ? `protocol ${protocol}, lifecycle ${lifecycle}${typeof source === "string" ? ` (${source})` : ""}` : "a malformed verification protocol";
+};
 export const describeCapacity = (value) => {
     const read = readCapacity(value);
     return read.state === "present"
@@ -131,7 +212,10 @@ export const SPAWN_RETRY_BACKOFF_MS = 50;
 const SHELL_REAP_GRACE_MS = 2000;
 /** Shared command seam, including invocation-bound manifested runners. */
 export function shell(cmd, cwd, timeoutMs, login = false, options = {}) {
-    return withCommandLease(cmd, () => executeShell(cmd, cwd, timeoutMs, login, options));
+    const inherited = executionSignal();
+    const signal = inherited && options.signal ? AbortSignal.any([inherited, options.signal]) : inherited ?? options.signal;
+    signal?.throwIfAborted();
+    return withCommandLease(cmd, () => executeShell(cmd, cwd, timeoutMs, login, { ...options, signal }));
 }
 function executeShell(cmd, cwd, timeoutMs, login, options) {
     options.signal?.throwIfAborted();
@@ -289,6 +373,7 @@ function executeShell(cmd, cwd, timeoutMs, login, options) {
     return (async () => {
         const startedAt = Date.now();
         for (let n = 1;; n++) {
+            options.signal?.throwIfAborted();
             const r = await attempt();
             if (!("refused" in r))
                 return r;

package/dist/run/journal.d.ts

@@ -60,6 +60,7 @@ export interface ConsultGuidanceCarry {
  */
 export declare function outstandingConsultGuidance(events: JournalEvent[], taskId: string): ConsultGuidanceCarry | undefined;
 export declare const UNIDENTIFIED = "<unidentified>";
+export declare function boundedSymbol(note: string): string;
 /**
  * Structured findings for a BLOCKING review/judge gate result, parsed from the details the gate
  * already writes (D-03: no gate-module change, so an older gate's prose degrades to one unclassified
@@ -192,7 +193,7 @@ export declare function pendingRepairFindings(events: JournalEvent[], taskId: st
  * a channel it is no longer using, and a later unrelated failure is not parked under a stale reason.
  */
 export declare function activeRetryBan(events: JournalEvent[], taskId: string, channel: string): string | undefined;
-export declare const PARK_KINDS: readonly ["human-gate", "ladder-exhausted", "attempt-cap", "gate-fail", "quota", "reroute-exhausted", "setup", "stall", "merge-conflict", "tip-moved", "infra", "dispatch", "authoring", "scope-request"];
+export declare const PARK_KINDS: readonly ["human-gate", "ladder-exhausted", "attempt-cap", "gate-fail", "quota", "reroute-exhausted", "setup", "stall", "merge-conflict", "tip-moved", "infra", "dispatch", "authoring", "scope-request", "diff-cap"];
 export type ParkKind = (typeof PARK_KINDS)[number];
 export declare const RETRY_MODES: readonly ["resume", "fresh", "repair"];
 export type RetryMode = (typeof RETRY_MODES)[number];
@@ -244,6 +245,7 @@ export declare const TelemetryRowSchema: z.ZodObject<{
         "tip-moved": "tip-moved";
         authoring: "authoring";
         "scope-request": "scope-request";
+        "diff-cap": "diff-cap";
     }>>;
     tokens: z.ZodCatch<z.ZodOptional<z.ZodObject<{
         input: z.ZodNumber;

package/dist/run/journal.js

@@ -1,4 +1,5 @@
 import { AsyncLocalStorage } from "node:async_hooks";
+import { createHash } from "node:crypto";
 import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
@@ -60,8 +61,8 @@ export function formatJournalNarration({ event, taskId, data }) {
 // replayResumeState(), consumed by the daemon on resume to re-seed demotedChannels.
 export const CHANNEL_EXCLUSION_KINDS = ["dead-channel"];
 // v1.24 OBS-18: explicit data on task-approved when the operator releases an attempt-cap park.
-// Approve stamps this; replayResumeState zeros the attempt counter (fresh budget) while keeping
-// tried (consult bans / burned channels). Absent on pre-v1.24 events ⇒ inert (corpus outcome-identical).
+// Approve stamps this; replayResumeState resets both the attempt counter and tried seats for a fresh
+// budget. Absent on pre-v1.24 events ⇒ inert (corpus outcome-identical).
 export const ATTEMPT_CAP_RELEASE = "attempt-cap";
 // OBS-130: task-approved carries the exact failed gate the operator satisfied. The release tag keeps
 // ordinary humanGate and attempt-cap approvals byte-compatible while making this authority explicit.
@@ -74,8 +75,8 @@ export const REVIEW_UPHELD_RELEASE = "review-upheld";
 // gate before it — daemon.ts remainingGates), which is wrong when the gate failed against a stale task
 // DECLARATION rather than a bad diff: amend the spec's files[], recompile, and the gate now passes
 // honestly. This release runs the whole gate suite over the parked commit before any worker and
-// marks no gate satisfied: green merges directly, red returns to the ladder. Budget semantics match attempt-cap
-// (fresh attempts, tried survives) because the park cost the task its remaining budget.
+// marks no gate satisfied: green merges directly, red returns to the existing ladder with attempts
+// and tried seats intact.
 export const RECHECK_RELEASE = "recheck";
 // OBS-738: one authority for every recovery surface. The ref is accepted only from the row that
 // preservation itself writes; task-human prose, branch heads and commit history are deliberately
@@ -217,9 +218,20 @@ function identifierIn(note) {
 // code identity still has one stable identity of its own: its own words, with the volatile tokens
 // swept out so line/path churn cannot mint a new symbol for the same finding. It is the reviewer's
 // own bytes, never a guess, and it can never fuse two different findings into one.
+// OBS-1013 add.3: the words are BOUNDED — the first sentence, or a short hash when even that is long.
+// A whole-note symbol made a 600-byte fingerprint no reviewer could echo, so a real closure read as
+// malformed and bought a worker. A sentence a reviewer can copy is the identity; the hash is the fallback.
+const SYMBOL_SENTENCE_CAP = 160;
+export function boundedSymbol(note) {
+    const words = normalizeGateFailure(note);
+    if (!words)
+        return "";
+    const sentence = words.split(/(?<=[.!?])\s+|\n/)[0].trim();
+    return sentence.length <= SYMBOL_SENTENCE_CAP ? sentence : createHash("sha256").update(words).digest("hex").slice(0, 12);
+}
 function toFinding(cls, note, path, symbol, rationale) {
     const p = path || UNIDENTIFIED;
-    const s = symbol || normalizeGateFailure(note) || UNIDENTIFIED;
+    const s = symbol || boundedSymbol(note) || UNIDENTIFIED;
     return {
         class: cls, path: p, symbol: s, note,
         ...(rationale !== undefined ? { rationale } : {}),
@@ -773,7 +785,7 @@ const DispatchAssignmentSchema = z.object({
 // routing profile's QUALITY_FAIL_PARKS (route/profile.ts): the channel did nothing wrong.
 export const PARK_KINDS = ["human-gate", "ladder-exhausted", "attempt-cap", "gate-fail", "quota",
     "reroute-exhausted", "setup", "stall", "merge-conflict", "tip-moved", "infra", "dispatch",
-    "authoring", "scope-request"];
+    "authoring", "scope-request", "diff-cap"];
 // v1.85 T3: "repair" is a third dispatch mode beside the v1.29 session pair — a fix-only attempt that
 // carries the failing findings and the diff CONTENT of the work already landed, instead of re-buying
 // ~20m of onboarding to rediscover them (62 of 68 measured re-dispatches were fresh).
@@ -1483,24 +1495,32 @@ export class Journal {
                 // A reroute bans the in-force channel; retry/decompose/human verdicts ban nothing (D-03).
                 pendingReroute.add(e.taskId);
             }
-            else if (e.event === "task-approved"
-                && (e.data.release === ATTEMPT_CAP_RELEASE || e.data.release === RECHECK_RELEASE)) {
+            else if (e.event === "task-approved" && e.data.release === ATTEMPT_CAP_RELEASE) {
                 // v1.24 OBS-18: operator released an attempt-cap park. Pre-v1.24 task-approved events have no
                 // `release` key ⇒ this branch never fires (corpus criterion: identical statuses + resume state).
-                // attempts reset to 0 so the daemon's attempt-cap check does not re-park in the same tick;
-                // tried survives (consult bans and burned channels are not forgotten); lastAssignment is
-                // cleared so the daemon's nextChannel-over-tried path skips burned channels on first dispatch
-                // (restoring the last burned assignment would re-try it first — the failure the tried-list exists to prevent).
+                // attempts and tried reset so the daemon's attempt-cap check does not re-park in the same tick
+                // and the newly funded engagement starts with a cleared seat list; lastAssignment clears too.
+                // OBS-1028: a RECHECK release is deliberately NOT here — it marks no gate satisfied and funds no
+                // attempt, so the ladder (attempts AND tried) survives it untouched. Only THIS fresh-budget
+                // release resets the ladder, and it resets both halves: a fresh budget on a cleared seat list.
                 const st = m.get(e.taskId);
                 if (st) {
                     st.attempts = 0;
+                    st.tried = [];
                     st.lastAssignment = undefined;
                 }
             }
+            else if (e.event === "task-approved" && e.data.release === RECHECK_RELEASE) {
+                // OBS-1028: the ladder survives a recheck (attempts AND tried); only the seat memory is cleared
+                // so a red battery's next dispatch is picked over the exclusions instead of restoring the parked seat.
+                const st = m.get(e.taskId);
+                if (st)
+                    st.lastAssignment = undefined;
+            }
             else if (e.event === "task-approved" && e.data.release === REVIEW_UPHELD_RELEASE) {
-                // OBS-189: the operator upheld the reviewer. Same budget semantics as the attempt-cap release
-                // (fresh attempts, tried survives, no burned-channel restore) PLUS the findings carry: the
-                // newest failed review's details ride into the funded attempt as its retry brief.
+                // OBS-189: the operator upheld the reviewer. It funds fresh attempts without forgetting tried
+                // seats (unlike an attempt-cap fresh-budget release), and carries the newest failed review's
+                // details into the funded attempt as its retry brief.
                 const st = m.get(e.taskId);
                 if (st) {
                     st.attempts = 0;
@@ -1608,7 +1628,9 @@ export class Journal {
     replayExcludedChannels() {
         const excluded = new Set();
         for (const e of this.read()) {
-            if (e.event === "channel-exclusion" && typeof e.data.channel === "string") {
+            // OBS-1010: an in-run no-trailer demotion is a WORKER exclusion too; review-pool-demotion is
+            // the reviewer seat's own fold (daemon demotedReviewers) and never benches the worker channel.
+            if ((e.event === "channel-exclusion" || e.event === "channel-demotion") && typeof e.data.channel === "string") {
                 excluded.add(e.data.channel);
             }
             else if (e.event === "dead-channel-failover" && typeof e.data.from === "string") {

package/dist/run/lease.d.ts

@@ -12,3 +12,47 @@ export declare class CommandLeases {
     private readonly owners;
     run<T>(run: () => Promise<T>, waiting: (count: number) => void, pollMs: number, signal?: AbortSignal): Promise<T>;
 }
+/**
+ * OBS-1042: the standalone battery's cross-process lease. Two `tickmarkr verify` runs in two linked
+ * worktrees of one clone share NO daemon and NO state directory, so the in-process `CommandLeases`
+ * above never saw each other and both full suites ran on one host. This reservation is keyed on the
+ * repository's COMMON git dir (`git rev-parse --git-common-dir`), which every linked worktree of a
+ * clone shares and an unrelated repository never does. One file, created exclusively; the holder
+ * writes its pid and cwd so a waiter can journal who it waits on and reclaim a reservation whose
+ * holder is dead. Each reservation releases only itself: a waiter that never acquired removes nothing,
+ * so cancelling it never frees the holder. The daemon's adoption is deferred to 2.5.7.
+ */
+export interface RepositoryLeaseHolder {
+    pid: number;
+    cwd: string;
+    at: number;
+    token: string;
+}
+export interface RepositoryLeaseOptions {
+    pollMs?: number;
+    signal?: AbortSignal;
+    /** Called once per distinct holder the waiter is queued behind. */
+    onWait?: (holder: RepositoryLeaseHolder) => void;
+}
+export declare function repositoryLeasePath(cwd: string): Promise<string>;
+/** OBS-1057: dev+ino alone is not an identity across unlink/recreate — Linux hands the freed inode
+ * number straight to the next file, so a stale observation of a dead or corrupt reservation matched
+ * the fresh reservation that replaced it and reclaimDead removed the live winner (public CI, ubuntu).
+ * The bytes are the generation: a fragment never hashes like a complete record, and two complete
+ * records differ by token. Size and mtime are not enough (a same-length reservation written within
+ * the filesystem's timestamp resolution — Leg-2 review of the first cut). */
+export declare const inodeIdentity: (st: {
+    dev: number | bigint;
+    ino: number | bigint;
+}, bytes: string | Buffer) => string;
+/** The identity a reclaimer would observe at a path right now, or undefined when nothing is there. */
+export declare const observeIdentity: (path: string) => string | undefined;
+export declare const readHolder: (path: string) => RepositoryLeaseHolder | undefined;
+/** Publish `mine` at `path` atomically: the record is written whole to a private file and linked
+ * into place — `link` is exclusive (EEXIST when the path is taken) and a reader never sees a partial
+ * record, so a process killed at any point of its acquisition leaves either nothing or a complete
+ * record naming a pid a waiter can check. Returns false when the path is taken. */
+export declare function tryReserve(path: string, mine: RepositoryLeaseHolder): boolean;
+/** Exposed for recovery regressions; the standalone verify uses the combined critical section. */
+export declare const reclaimDead: (path: string, identity: string, pollMs?: number) => Promise<boolean>;
+export declare function withRepositoryLease<T>(cwd: string, run: () => Promise<T>, opts?: RepositoryLeaseOptions): Promise<T>;