tickmarkr 2.5.5 → 2.5.7

package/dist/drivers/orca.js

@@ -1,4 +1,4 @@
-import { existsSync, linkSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, linkSync, mkdirSync, readdirSync, readFileSync, readlinkSync, realpathSync, renameSync, rmdirSync, rmSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { dirname, join, resolve } from "node:path";
 import { shq } from "../adapters/types.js";
@@ -300,26 +300,57 @@ function readBoard(path, repo, runId) {
  * excludes other writers, then create-only `link`s the new inode (fails if anything exists) or
  * `rename`s the new file over the live path (POSIX atomic replace — readers see old or new, never
  * absence). A crash that leaves a `.tmp` or `.lock` does not drop the previous record.
+ * Each lock generation publishes its pid and nonce atomically in a symlink target. A holder that died
+ * between taking and releasing it is recovered at once (its lock is taken over in place); a live
+ * holder bounds the wait on injected time and is then refused with the record untouched. A legacy
+ * pid-less or malformed generation is recoverable too: a contender atomically creates the next owner
+ * generation, and release removes the directory only while that exact generation is still current.
  * ponytail: observeNamedRun (supervision.ts) renames without CAS. It cannot interleave with a swap
  * because the narrator writes nothing between reserve and claim, and no transition here swaps one.
  */
-export function casBoard(family, path, expected, next) {
+export async function casBoard(family, path, expected, next, time = SYSTEM_TIME) {
     const raw = JSON.stringify(next) + "\n";
     const refused = () => new OrcaError(family, `watch owner record ${path} changed underneath; swap refused and the current record kept`, "");
     mkdirSync(dirname(path), { recursive: true });
     const lock = `${path}.lock`;
-    const deadline = Date.now() + 2_000;
+    const deadline = time.now() + LOCK_WAIT_MS;
+    const ownerTarget = `${process.pid}:${randomUUID()}`;
+    let ownerEntry = "";
+    let acquiredEntries = [];
     for (;;) {
         try {
             mkdirSync(lock);
-            break;
         }
         catch (error) {
             if (error.code !== "EEXIST")
                 throw error;
-            if (Date.now() >= deadline)
+        }
+        // The marker's directory entry and target appear as one filesystem operation. If the creator
+        // dies after mkdir but before this call, a contender claims owner.0; if both race, only one
+        // symlink wins and the loser judges that published owner before entering the CAS section.
+        const holder = lockHolder(lock);
+        if (holder?.pid !== undefined && pidLive(holder.pid)) {
+            if (time.now() >= deadline)
                 throw new OrcaError(family, `watch owner record ${path} lock not acquired; current record kept`, "");
-            Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
+            await time.sleep(10);
+            continue;
+        }
+        ownerEntry = `owner.${(holder?.gen ?? -1) + 1}`;
+        try {
+            symlinkSync(ownerTarget, join(lock, ownerEntry));
+            // Snapshot only generations that this takeover superseded, with our marker last. Release must
+            // never recursively scan: after our final unlink a contender may publish a replacement marker
+            // before rmdir, and that marker belongs to the contender, not to this generation.
+            acquiredEntries = readdirSync(lock)
+                .filter((entry) => entry === ownerEntry || lockEntryGeneration(entry) !== undefined)
+                .sort((a, b) => Number(a === ownerEntry) - Number(b === ownerEntry));
+            break;
+        }
+        catch (error) {
+            const code = error.code;
+            if (code !== "EEXIST" && code !== "ENOENT")
+                throw error;
+            continue; // another contender published this generation, or the prior holder just released
         }
     }
     try {
@@ -354,9 +385,69 @@ export function casBoard(family, path, expected, next) {
         return raw;
     }
     finally {
-        rmSync(lock, { recursive: true, force: true });
+        releaseBoardLock(lock, ownerEntry, ownerTarget, acquiredEntries);
+    }
+}
+const LOCK_WAIT_MS = 2_000;
+/** Best-effort release cannot invalidate a committed CAS. Superseded entries go first and our marker
+ * goes last; after that unlink, a non-recursive rmdir either removes the empty old generation or
+ * leaves a contender's newly published marker untouched. Any abnormal filesystem error leaves the
+ * lock for the next generation's stale-owner recovery instead of escaping from the caller's finally. */
+function releaseBoardLock(lock, ownerEntry, ownerTarget, acquiredEntries) {
+    const holder = lockHolder(lock);
+    if (holder?.entry !== ownerEntry || holder.target !== ownerTarget)
+        return;
+    for (const entry of acquiredEntries) {
+        try {
+            unlinkSync(join(lock, entry));
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                return;
+        }
+    }
+    try {
+        rmdirSync(lock);
+    }
+    catch { /* ENOTEMPTY means a contender owns it; any other failure is recoverable stale state. */ }
+}
+/** The highest published generation. `pid*` files are accepted for recovery compatibility; new
+ * owners use atomic `owner.N -> pid:nonce` symlinks. Missing or malformed contents return a
+ * generation with no pid, which is stale and can only be superseded by creating the next marker. */
+function lockHolder(lock) {
+    try {
+        const candidates = readdirSync(lock).flatMap((entry) => {
+            const owner = /^owner\.(\d+)$/.exec(entry);
+            const gen = lockEntryGeneration(entry);
+            return gen === undefined ? [] : [{ gen, entry, owner: owner !== null }];
+        }).sort((a, b) => b.gen - a.gen || Number(b.owner) - Number(a.owner));
+        const current = candidates[0];
+        if (!current)
+            return undefined;
+        let target;
+        try {
+            target = current.owner
+                ? readlinkSync(join(lock, current.entry))
+                : readFileSync(join(lock, current.entry), "utf8").trim();
+        }
+        catch {
+            return { gen: current.gen, entry: current.entry };
+        }
+        const pidText = current.owner ? /^([1-9]\d*):.+$/.exec(target)?.[1] : target;
+        const pid = Number(pidText);
+        return Number.isInteger(pid) && pid > 0
+            ? { gen: current.gen, entry: current.entry, target, pid }
+            : { gen: current.gen, entry: current.entry, target };
+    }
+    catch {
+        return undefined;
     }
 }
+function lockEntryGeneration(entry) {
+    const owner = /^owner\.(\d+)$/.exec(entry);
+    const legacy = /^pid(?:\.(\d+))?$/.exec(entry);
+    return owner ? Number(owner[1]) : legacy ? Number(legacy[1] ?? 0) : undefined;
+}
 function pidLive(pid) {
     try {
         process.kill(pid, 0);
@@ -463,6 +554,13 @@ function collectTabs(node, out) {
 export function joinWrapped(raw) {
     return raw.split("\n").map((l) => l.replace(/^[\s│|]+/, "").replace(/[\s│|]+$/, "")).join("");
 }
+/** The OBS-1011 add.1 capture: `status:"exited", tail:[], returnedLineCount 0` from a stream read. */
+export function isBlindStreamPage(term) {
+    return str(term.status) === "exited"
+        && term.source !== "screen"
+        && Array.isArray(term.tail) && term.tail.length === 0
+        && (term.returnedLineCount === undefined || term.returnedLineCount === 0);
+}
 export class OrcaDriver {
     id = "orca";
     interactive = true; // a visible terminal the operator can watch and answer
@@ -637,8 +735,8 @@ export class OrcaDriver {
         // terminalOp proves the runtime binding before the handle goes on the wire.
         await this.sendText(st, cmd);
     }
-    async sendText(st, text) {
-        const env = await this.terminalOp("send", st, (h) => this.call("send", ["terminal", "send", "--terminal", h, "--text", text, "--enter"], this.cliCwd(st)), { mutating: true });
+    async sendText(st, text, waitSubmit = false) {
+        const env = await this.terminalOp("send", st, (h) => this.call("send", ["terminal", "send", "--terminal", h, "--text", text, "--enter", ...(waitSubmit ? ["--wait-submit", "15"] : [])], this.cliCwd(st)), { mutating: true });
         // Recorded 1.4.195 send receipt: result.send = {handle, accepted, bytesWritten}. `ok:true`
         // alone is not delivery: the accepted receipt must name this handle and account for the bytes.
         const receipt = this.sendReceipt(env, st);
@@ -646,6 +744,7 @@ export class OrcaDriver {
         if (receipt.accepted !== true || typeof receipt.bytesWritten !== "number" || receipt.bytesWritten !== expectedBytes) {
             throw new OrcaError("send", `send receipt does not report expected byte delivery (accepted: ${JSON.stringify(receipt.accepted)}, bytesWritten: ${receipt.bytesWritten}, expected: ${expectedBytes})`, env.raw);
         }
+        return receipt;
     }
     sendReceipt(env, st) {
         const receipt = env.result.send;
@@ -989,8 +1088,35 @@ export class OrcaDriver {
             ...(cursor === undefined || recovered ? [] : ["--cursor", cursor]),
             "--limit", String(lines),
         ], this.cliCwd(st)), { onRecovered: () => { recovered = true; } });
+        if (isBlindStreamPage(requireTerminal(family, env))) {
+            return { term: await this.screenBehindBlindStream(family, st, env), raw: env.raw, recovered };
+        }
         return { term: this.validated(family, st, env), raw: env.raw, recovered };
     }
+    /**
+     * OBS-1011 add.1 / OBS-1016: the captured incident shape — a stream page answering status exited
+     * with an empty tail on a terminal that accepted a send seconds earlier — is BLIND, not dead, when
+     * the same handle's show record on the same runtime reports connected and not orphaned (show carries
+     * no status field; none is demanded) and its screen read reports running. Then the rendered frame is
+     * the terminal's bytes. Anything less — disconnected, orphaned, another handle or runtime, a screen
+     * that is unavailable or exited — is refused as unavailable, exactly as the dead record would be.
+     */
+    async screenBehindBlindStream(family, st, blind) {
+        const handle = str(requireTerminal(family, blind).handle);
+        if (handle !== st.handle) {
+            throw new OrcaUnavailableError(family, `terminal record names ${handle ?? "no handle"}, not the addressed ${st.handle}`, blind.raw);
+        }
+        const show = await this.call("show", ["terminal", "show", "--terminal", st.handle], this.cliCwd(st));
+        if (show.runtimeId !== st.runtimeId) {
+            throw new OrcaUnavailableError(family, `exited-shaped stream page: show answered by runtime ${show.runtimeId}, not the bound ${st.runtimeId}`, show.raw, "exited");
+        }
+        this.liveShowTerm(family, st, show);
+        const screen = await this.readScreen(st);
+        if (screen.source !== "screen") {
+            throw new OrcaUnavailableError(family, `exited-shaped stream page and no rendered screen for ${st.handle}`, blind.raw, "exited");
+        }
+        return screen.term;
+    }
     /** A rendered-frame liveness read. `--screen` and `--cursor` are mutually exclusive in Orca. */
     async readScreen(st) {
         const env = await this.terminalOp("status", st, (h) => this.call("read", [
@@ -1238,17 +1364,26 @@ export class OrcaDriver {
             const st = this.state(slot);
             if (!await this.waitCondition(st, "tui-idle", 1))
                 return false;
-            // Drain to the current stream cursor before sending. A message already present makes the
-            // proof ambiguous, so decline rather than reporting delivery from old scrollback.
-            const before = await this.sweep(st);
-            if (before.includes(message) || joinWrapped(before).includes(message))
-                return false;
-            await this.sendText(st, message);
+            const receipt = await this.sendText(st, message, true);
+            // OBS-1016: delivery is proven by the receipt — a prompt stage of turn_started — or by the
+            // composer emptying on a screen read, never by stream echo: the stream is blind on a live Orca
+            // terminal (OBS-1011 add.1), so an echo sweep fails every nudge and latches the harvest hold.
+            const prompt = typeof receipt.prompt === "object" && receipt.prompt !== null && !Array.isArray(receipt.prompt)
+                ? receipt.prompt
+                : {};
+            const stages = Array.isArray(prompt.stages) ? prompt.stages : [];
+            if (stages.includes("turn_started"))
+                return true;
             const deadline = this.time.now() + NUDGE_ECHO_TIMEOUT_MS;
             for (;;) {
-                const after = await this.sweep(st);
-                if (after.includes(message) || joinWrapped(after).includes(message))
-                    return true;
+                const screen = await this.readScreen(st);
+                // ponytail: "composer emptied" is "the text is no longer on the frame" — a TUI that keeps the
+                // submitted turn on screen reads as undelivered until the timeout; the receipt stage is primary.
+                if (screen.source === "screen") {
+                    const frame = this.tailText("status", screen.term, "");
+                    if (!frame.includes(message) && !joinWrapped(frame).includes(message))
+                        return true;
+                }
                 const left = deadline - this.time.now();
                 if (left <= 0)
                     return false;
@@ -1280,7 +1415,36 @@ export class OrcaDriver {
             else if (current) {
                 const state = boardState(current.record);
                 if (state === "reserved" || state === "claimed") {
-                    throw new OrcaError("split", `Orca narrator placement remains unresolved for ${name} (${state}, no bound pane); ${kept}`, "");
+                    // A reservation or claim with no bound pane is the placing narrator's normal intermediate
+                    // state while that narrator lives (awaiting its receipt, listing, claim or bind): refused
+                    // untouched, its observer never asked to stop. Only a DEAD placer (or one unrecorded) makes
+                    // it a crash to recover.
+                    const { placer } = current.record;
+                    if (typeof placer !== "number" || pidLive(placer)) {
+                        throw new OrcaError("split", `Orca narrator placement remains unresolved for ${name} (${state}, no bound pane) while placing narrator ${placer ?? "unrecorded"} lives; ${kept}`, "");
+                    }
+                }
+                if (state === "claimed") {
+                    // The placing driver crashed between the observer's claim and its bind. The record is
+                    // replaced only once that observer is proven gone: dead outright, or live and stopped with
+                    // its acknowledgement awaited on injected time — unacknowledged, it is refused untouched.
+                    const pid = current.record.pid;
+                    if (pidLive(pid)) {
+                        try {
+                            await stopWatchBoard(current.record, this.time);
+                        }
+                        catch (error) {
+                            throw new OrcaError("split", `Orca narrator placement refused for ${name}: claimed board's live observer unacknowledged; ${kept}; ${errorText(error)}`, "");
+                        }
+                    }
+                    const retired = { ...current.record, retired: true };
+                    current = { raw: await casBoard("split", path, current.raw, retired, this.time), record: retired };
+                }
+                if (state === "reserved") {
+                    // The placer died before any claim: no observer exists, its split pane (if any) is unknown
+                    // to the record. Tombstoned in place so the generic tail below replaces it.
+                    const retired = { ...current.record, retired: true };
+                    current = { raw: await casBoard("split", path, current.raw, retired, this.time), record: retired };
                 }
                 if (state === "bound") {
                     // The bound record is the durable truth of placement: the child handle PLUS the split
@@ -1290,7 +1454,7 @@ export class OrcaDriver {
                     }
                     // Lost: this runtime no longer has that pane. Tombstone before anything else.
                     const retired = { ...current.record, retired: true };
-                    current = { raw: casBoard("split", path, current.raw, retired), record: retired };
+                    current = { raw: await casBoard("split", path, current.raw, retired, this.time), record: retired };
                 }
                 // A tombstone can be an acknowledgement timeout, not completed observer cleanup. A live
                 // observer must stop and ack on injected time before the handle-bound close; timeout keeps
@@ -1316,7 +1480,19 @@ export class OrcaDriver {
             // Reserve before any command can read the token: create-only, or a swap of the exact record
             // judged replaceable above.
             const token = randomUUID();
-            casBoard("split", path, current?.raw, { repo: realpathSync(cwd), runId, driver: this.id, workspace: ORCA_SPACE, pane: "", name, token });
+            await casBoard("split", path, current?.raw, { repo: realpathSync(cwd), runId, driver: this.id, workspace: ORCA_SPACE, pane: "", name, token, placer: process.pid }, this.time);
+            // A reservation that can never be bound — no usable receipt, or no claim — is tombstoned so the
+            // next narrator call splits afresh instead of refusing forever. Only THIS reservation, and only
+            // while it is still the untouched reservation; a record anyone else moved is left to them.
+            const tombstone = async (extra = {}) => {
+                try {
+                    const now = readBoard(path, cwd, runId);
+                    if (now?.record.token === token && boardState(now.record) === "reserved") {
+                        await casBoard("split", path, now.raw, { ...now.record, ...extra, retired: true }, this.time);
+                    }
+                }
+                catch { /* the record is kept as it stands; the next narrator judges it */ }
+            };
             // Exactly one terminal split of the launching handle, horizontal, carrying token and command.
             // An unknown receipt (transport failure, refusal, unparseable output) after the verb was issued
             // is as indeterminate as a handle-less one: the pane may exist, so the reservation stays.
@@ -1325,7 +1501,8 @@ export class OrcaDriver {
                 "--terminal", launchingHandle,
                 "--direction", "horizontal",
                 "--command", `${WATCH_OWNER_ENV}=${shq(token)} ${command}`,
-            ], cwd).catch((error) => {
+            ], cwd).catch(async (error) => {
+                await tombstone();
                 throw new OrcaError("split", `Orca narrator placement failed for ${name}: split receipt is unknown (${error instanceof OrcaError ? error.reason : errorText(error)}); ${kept}`, error instanceof OrcaError ? error.raw : "");
             });
             let child;
@@ -1333,6 +1510,7 @@ export class OrcaDriver {
                 child = splitReceipt(env);
             }
             catch {
+                await tombstone();
                 throw new OrcaError("split", `Orca narrator placement failed for ${name}: split receipt is unknown, malformed or handle-less; ${kept}`, env.raw);
             }
             // Parent tabId must name the launching terminal's tab, and the child must actually appear
@@ -1343,6 +1521,7 @@ export class OrcaDriver {
                 listing = await this.listAll(cwd);
             }
             catch (error) {
+                await tombstone();
                 throw new OrcaError("split", `Orca narrator placement failed for ${name}: split receipt is unknown, malformed or handle-less; ${kept}`, error instanceof OrcaError ? error.raw : env.raw);
             }
             const launchingTabId = terminalTabId(listing, launchingHandle);
@@ -1350,6 +1529,7 @@ export class OrcaDriver {
                 || child.tabId !== launchingTabId
                 || child.handle === launchingHandle
                 || terminalTabId(listing, child.handle) !== launchingTabId) {
+                await tombstone();
                 throw new OrcaError("split", `Orca narrator placement failed for ${name}: split receipt is unknown, malformed or handle-less; ${kept}`, env.raw);
             }
             const childHandle = child.handle;
@@ -1370,7 +1550,9 @@ export class OrcaDriver {
                 await this.time.sleep(20);
             }
             if (!claim) {
-                // The receipt's handle may be closed, but the refused placement's record stays as it is.
+                // The receipt's handle may be closed; the reservation is tombstoned naming that pane so the
+                // next narrator can prove it gone (or close it) and split afresh.
+                await tombstone({ pane: childHandle, runtimeId: env.runtimeId });
                 let pane;
                 try {
                     await this.closeRecordedPane(cwd, name, childHandle, env.runtimeId);
@@ -1381,7 +1563,7 @@ export class OrcaDriver {
                 }
                 throw new OrcaError("split", `Orca narrator board unclaimed for ${name}: the observer never claimed the record (unclaimed board); ${kept}; ${pane}`, env.raw);
             }
-            casBoard("split", path, claim.raw, { ...claim.record, pane: childHandle, runtimeId: env.runtimeId });
+            await casBoard("split", path, claim.raw, { ...claim.record, pane: childHandle, runtimeId: env.runtimeId }, this.time);
             return watchSlot(cwd, name, childHandle);
         });
     }
@@ -1401,7 +1583,7 @@ export class OrcaDriver {
     }
     /** bound → retired, decided from the record alone: it must be this driver's board for exactly this
      *  slot's pane. Already retired is returned as it is. */
-    retireBoard(family, slot) {
+    async retireBoard(family, slot) {
         const runId = parseOwnedName(slot.name)?.runId;
         const path = runId ? this.boardPath(slot.cwd, runId) : undefined;
         const current = path && runId ? readBoard(path, slot.cwd, runId) : undefined;
@@ -1412,7 +1594,7 @@ export class OrcaDriver {
         if (r.retired)
             return r;
         const retired = { ...r, retired: true };
-        casBoard(family, path, current.raw, retired);
+        await casBoard(family, path, current.raw, retired, this.time);
         return retired;
     }
     /** bound → retired first: whatever fails below, no later call answers this board again. A live
@@ -1421,7 +1603,7 @@ export class OrcaDriver {
      *  so it is only asked. */
     async retireAndClose(slot) {
         await this.serial(async () => {
-            const retired = this.retireBoard("close", slot);
+            const retired = await this.retireBoard("close", slot);
             if (typeof retired.pid === "number" && pidLive(retired.pid))
                 await stopWatchBoard(retired, this.time);
             else

package/dist/gates/baseline.d.ts

@@ -1,6 +1,6 @@
 import type { TickmarkrConfig } from "../config/config.js";
 import type { AcceptanceItem } from "../graph/schema.js";
-import { type RunCapacity, type ShResult } from "../run/git.js";
+import { type RunCapacity, type ShellOptions, type ShResult } from "../run/git.js";
 import type { GateResult } from "./types.js";
 /**
  * T7: the capacity a gate's own command ran under rides the RESULT, beside the verdict it explains,
@@ -31,8 +31,12 @@ export interface BaselineCommand {
     durationMs?: number;
     /** Sum of the per-file durations named by the runner; null when its output names none. */
     fileDurationSumMs?: number | null;
-    /** Total files reported by the runner summary; null when unavailable. */
+    /** Total files the runner would collect; null when unavailable. */
     fileCount?: number | null;
+    /** OBS-1044: `manifest` when `fileCount` came from the runner's own listing (test-manifest.ts's
+     * discovery seam) rather than a stdout summary sum. Absent on every pre-2.5.6 entry and on every
+     * scripted non-runner command, whose summary count keeps the stdout deficit rule byte-identically. */
+    fileCountSource?: "manifest";
     /** fileDurationSumMs / durationMs — average implied file concurrency, not a configured fork count. */
     impliedParallelism?: number | null;
     /** The slowest per-file entry named by the runner; null when per-file timing is unavailable. */
@@ -150,7 +154,15 @@ export declare function ceilingKillResult(gate: string, r: ShResult, ceilingMs:
  * shell asks it to finish faster than the thing it is measuring.
  */
 export declare const CAPTURE_CEILING_MS = 1800000;
-export declare function captureBaseline(cwd: string, commands: Record<string, string>): Promise<Baseline>;
+/** OBS-1044: a cached vitest entry whose count is a stdout sum may be inflated; only a manifest-derived
+ * count is safe to apply as a deficit floor. A null count compares nothing and is safe as-is. */
+export declare function staleFileCountCommands(baseline: Baseline, commands: Record<string, string>, cwd: string): string[];
+export interface BaselineReceiptOptions {
+    onReceipt?: ShellOptions["onReceipt"];
+    /** Only comparison's build command may carry task-build identity; capture never does. */
+    taskBuildAttribution?: ShellOptions["receiptAttribution"];
+}
+export declare function captureBaseline(cwd: string, commands: Record<string, string>, opts?: BaselineReceiptOptions): Promise<Baseline>;
 export interface VacuousOracleWarning {
     kind: "vacuous-oracle";
     taskId: string;
@@ -161,7 +173,10 @@ export declare function detectVacuousOracles(cwd: string, tasks: ReadonlyArray<{
     id: string;
     acceptance: AcceptanceItem[];
 }>): Promise<VacuousOracleWarning[]>;
-export declare function compareToBaseline(cwd: string, commands: Record<string, string>, baseline: Baseline, enabled: string[], opts?: {
+export interface RetryOptions {
+    authorizeRetry?: (cause: "infra" | "host-starved") => boolean;
+}
+export declare function compareToBaseline(cwd: string, commands: Record<string, string>, baseline: Baseline, enabled: string[], opts?: RetryOptions & BaselineReceiptOptions & {
     rerunOf?: HostStarvedRerun;
     infraRerun?: HostStarvedRerun;
     selected?: readonly string[];
@@ -185,7 +200,8 @@ interface CalmWindow {
 }
 export declare function setCalmWindowForTests(over: Partial<CalmWindow>): void;
 export declare function resetCalmWindowForTests(): void;
-export declare function waitForCalmWindow(): Promise<number>;
+export declare function calmWindowReady(): boolean;
+export declare function waitForCalmWindow(signal?: AbortSignal): Promise<number>;
 /** Summary totals survive digit-normalized fingerprints and exclude test-owned echoed output. */
 export declare function runnerFileCount(raw: string): number | null;
 export declare function fileCountDeficit(entry: BaselineCommand | undefined, raw: string, opts?: {

package/dist/gates/baseline.js

@@ -2,6 +2,8 @@ import { existsSync, readFileSync } from "node:fs";
 import { availableParallelism, loadavg } from "node:os";
 import { join } from "node:path";
 import { DEFAULT_SHELL_TIMEOUT_MS, describeCapacity, sameCapacity, sh } from "../run/git.js";
+import { executionSignal } from "../run/execution-budget.js";
+import { isVitestTestCommand, manifestFileCount } from "./test-manifest.js";
 // incident #2 (run-20260709-104447): a vitest ✓ PASS line with "error" in the test NAME, wrapped in ANSI
 // codes that varied between baseline and worktree runs, was reported as a "new failure". Strip ANSI first;
 // a pass-marker line is never a failure. [\d;#] covers raw ANSI and digit-normalized ANSI ("\x1b[#m") from
@@ -464,13 +466,34 @@ const invalidCaptureEntry = (durationMs, invalidCause, invalidatingLines = []) =
     ceilingMs: effectiveCeilingMs({ durationMs }),
     ...(invalidatingLines.length ? { invalidatingLines } : {}),
 });
-export async function captureBaseline(cwd, commands) {
+// OBS-1044: a vitest command's count is the manifest discovery seam's (the same listing the gate
+// asks the report to certify), never a sum of every summary line in stdout — tests that spawn
+// nested runners echo their own summaries through the filter and inflated a baseline by two files,
+// so any diff that changed the nested echo read as a deficit. The listing is a collection, not a
+// run: the suite still runs exactly once here. Any other command keeps the stdout sum.
+const captureFileCount = async (cwd, cmd, raw) => {
+    if (!isVitestTestCommand(cmd, cwd))
+        return { fileCount: runnerFileCount(raw) };
+    const fileCount = await manifestFileCount(cmd, cwd);
+    return fileCount === null ? { fileCount } : { fileCount, fileCountSource: "manifest" };
+};
+/** OBS-1044: a cached vitest entry whose count is a stdout sum may be inflated; only a manifest-derived
+ * count is safe to apply as a deficit floor. A null count compares nothing and is safe as-is. */
+export function staleFileCountCommands(baseline, commands, cwd) {
+    return Object.entries(commands)
+        .filter(([name, cmd]) => {
+        const entry = baseline.commands[name];
+        return entry?.fileCount != null && entry.fileCountSource !== "manifest" && isVitestTestCommand(cmd, cwd);
+    })
+        .map(([name]) => name);
+}
+export async function captureBaseline(cwd, commands, opts = {}) {
     const base = { commands: {} };
     for (const [name, cmd] of Object.entries(commands)) {
         if (name === "tipTest" && commands.test !== undefined && cmd === commands.test) {
             continue;
         }
-        const r = await sh(cmd, cwd, CAPTURE_CEILING_MS);
+        const r = await sh(cmd, cwd, CAPTURE_CEILING_MS, { onReceipt: opts.onReceipt });
         // ponytail: strip the executing cwd so repo-root capture and worktree compare fingerprint identically; /private-vs-/tmp symlink variance is out of scope
         // ponytail: a capture that was itself killed records the ceiling as its "measurement", which
         // scales the next ceiling up — the right direction for a suite that never finished once.
@@ -495,7 +518,7 @@ export async function captureBaseline(cwd, commands) {
             console.error(`tickmarkr: baseline capture for "${name}" was killed at its ${CAPTURE_CEILING_MS}ms ceiling — `
                 + `it recorded NO fingerprints, so nothing is forgiven and every gate will treat a pre-existing `
                 + `failure as a fresh one. Raise the ceiling or shorten the command.`);
-            base.commands[name] = { ...invalidCaptureEntry(durationMs, "ceiling-kill"), fileCount: runnerFileCount(raw) };
+            base.commands[name] = { ...invalidCaptureEntry(durationMs, "ceiling-kill"), ...await captureFileCount(cwd, cmd, raw) };
             continue;
         }
         // Run 2137: the child exited and printed ordinary FAIL/AssertionError lines, so the gate-side
@@ -509,7 +532,7 @@ export async function captureBaseline(cwd, commands) {
                 + `it recorded NO exit-code verdict and NO fingerprints, so nothing is forgiven for this command; `
                 + `the measurement cannot distinguish a pre-existing failure from one caused by exhaustion. `
                 + `First invalidating line: ${invalidatingLines[0]}`);
-            base.commands[name] = { ...invalidCaptureEntry(durationMs, "resource-exhaustion", invalidatingLines), fileCount: runnerFileCount(raw) };
+            base.commands[name] = { ...invalidCaptureEntry(durationMs, "resource-exhaustion", invalidatingLines), ...await captureFileCount(cwd, cmd, raw) };
             continue;
         }
         // OBS-966: a worker RPC timeout is infra even beside an all-green summary.
@@ -517,7 +540,7 @@ export async function captureBaseline(cwd, commands) {
         const runnerVerdict = classifyRunnerOutput(raw, r.code);
         if (runnerVerdict === "infra") {
             console.error(`tickmarkr: baseline capture for "${name}" carries runner-infrastructure evidence — it recorded NO verdict; nothing is forgiven for this command`);
-            base.commands[name] = { ...invalidCaptureEntry(durationMs, "infra", withoutVitestEchoBlocks(combinedOutput).filter((line) => isInfraLine(line.replace(ANSI_RE, "")))), fileCount: runnerFileCount(raw) };
+            base.commands[name] = { ...invalidCaptureEntry(durationMs, "infra", withoutVitestEchoBlocks(combinedOutput).filter((line) => isInfraLine(line.replace(ANSI_RE, "")))), ...await captureFileCount(cwd, cmd, raw) };
             continue;
         }
         base.commands[name] = {
@@ -529,7 +552,7 @@ export async function captureBaseline(cwd, commands) {
             missingCommand: missingConfiguredCommand(cmd, r),
             durationMs,
             ...fileTiming(raw, durationMs),
-            fileCount: runnerFileCount(raw),
+            ...await captureFileCount(cwd, cmd, raw),
             ceilingMs: effectiveCeilingMs({ durationMs }),
             // T7: the world this measurement was taken in, so a later reader can ask whether its own world
             // is the same one. Recorded from THIS command's own shell result, never re-derived here.
@@ -611,11 +634,17 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
         }
         const entry = baseline.commands[name];
         const ceilingMs = effectiveCeilingMs(entry);
-        const r = await sh(cmd, cwd, ceilingMs);
+        const r = await sh(cmd, cwd, ceilingMs, {
+            onReceipt: opts.onReceipt,
+            ...(name === "build" ? { receiptAttribution: opts.taskBuildAttribution } : {}),
+        });
         // T7: every verdict below carries the capacity ITS OWN command ran under, taken off the shell
         // result rather than re-derived after the fact. The skip row above ran no command and therefore
         // states no capacity — a row that never divided the machine must not claim that it did.
+        let recoveryBlocked;
         const record = (g) => {
+            if (recoveryBlocked)
+                g = { ...g, meta: { ...g.meta, recoveryBlocked } };
             const withReap = r.reapedGroup ? { ...g, meta: { ...g.meta, reapedGroup: true } } : g;
             const withReapError = r.reapError ? { ...withReap, meta: { ...withReap.meta, reapError: r.reapError } } : withReap;
             const withRerun = rerunOf ? {
@@ -697,19 +726,37 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
         // retain the whole-output read so a repeated infra abort can never be baseline-forgiven as green.
         const classification = classifyFreshRunnerOutput(entry, raw, r.code);
         if (name === "test" && classification === "infra" && !rerunOf && !opts.infraRerun) {
-            const waitedMs = await waitForCalmWindow();
-            const provenance = { durationMs: r.durationMs ?? 0, referenceMs: entry?.durationMs ?? 0, waitedMs };
-            results.push(...await compareToBaseline(cwd, { [name]: cmd }, baseline, [name], { ...opts, infraRerun: provenance }));
-            continue;
+            const waitedMs = await waitForCalmWindow(executionSignal());
+            if (opts.authorizeRetry && !calmWindowReady()) {
+                recoveryBlocked = "calm window unavailable within the existing wait ceiling";
+            }
+            else if (opts.authorizeRetry && !opts.authorizeRetry("infra")) {
+                recoveryBlocked = "infrastructure retry allowance exhausted or subject unavailable";
+            }
+            else {
+                const provenance = { durationMs: r.durationMs ?? 0, referenceMs: entry?.durationMs ?? 0, waitedMs };
+                results.push(...await compareToBaseline(cwd, { [name]: cmd }, baseline, [name], { ...opts, infraRerun: provenance }));
+                continue;
+            }
         }
         // OBS-896: every fresh failure must be timeout-class, and the suite must take at least twice its
         // own baseline measurement. The first read buys one calm rerun here, never a worker repair.
         if (name === "test" && classification !== "infra" && failing.length && !rerunOf && !opts.infraRerun
             && hostStarved(failing.join("\n"), r.durationMs ?? 0, entry?.durationMs)) {
-            const waitedMs = await waitForCalmWindow();
-            const provenance = { durationMs: r.durationMs ?? 0, referenceMs: entry?.durationMs ?? 0, waitedMs };
-            results.push(...await compareToBaseline(cwd, { [name]: cmd }, baseline, [name], { ...opts, rerunOf: provenance }));
-            continue;
+            const waitedMs = await waitForCalmWindow(executionSignal());
+            if (opts.authorizeRetry && !calmWindowReady()) {
+                recoveryBlocked = "calm window unavailable within the existing wait ceiling";
+            }
+            else if (opts.authorizeRetry && !opts.authorizeRetry("host-starved")) {
+                recoveryBlocked = "verification retry allowance exhausted or subject unavailable";
+            }
+            else {
+                // Compatibility with OBS-896, not an infrastructure reclassification: a persistent
+                // timeout remains the ordinary conservative verdict after the single bounded remeasure.
+                const provenance = { durationMs: r.durationMs ?? 0, referenceMs: entry?.durationMs ?? 0, waitedMs };
+                results.push(...await compareToBaseline(cwd, { [name]: cmd }, baseline, [name], { ...opts, rerunOf: provenance }));
+                continue;
+            }
         }
         if (classification === "infra") {
             const evidence = failing.length
@@ -827,11 +874,14 @@ const DEFAULT_CALM = {
 let calm = DEFAULT_CALM;
 export function setCalmWindowForTests(over) { calm = { ...calm, ...over }; }
 export function resetCalmWindowForTests() { calm = DEFAULT_CALM; }
-export async function waitForCalmWindow() {
+export function calmWindowReady() { return calm.loadProvider() <= calm.calmLoad(); }
+export async function waitForCalmWindow(signal) {
     const started = Date.now();
     while (calm.loadProvider() > calm.calmLoad() && Date.now() - started < calm.maxWaitMs) {
-        await new Promise((resolve) => setTimeout(resolve, calm.pollMs));
+        signal?.throwIfAborted();
+        await new Promise((resolve) => setTimeout(resolve, signal ? Math.min(calm.pollMs, 100) : calm.pollMs));
     }
+    signal?.throwIfAborted();
     return Date.now() - started;
 }
 /** Summary totals survive digit-normalized fingerprints and exclude test-owned echoed output. */