tickmarkr 2.5.6 → 2.5.8

package/dist/run/daemon.js

@@ -31,7 +31,8 @@ import { failureDisposition, reserveInfrastructureRetry } from "./recovery.js";
 import { runEnvironment } from "./environment.js";
 import { cleanupRunWorktrees, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, preserveWorktree, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shGit, SUITE_PARENT_ENV, verificationProtocol, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
-import { applyScopeAmendments, activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, outstandingReviewFindings, pendingRechecks, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
+import { classifyRepairDisposition, resolveScopeHints } from "./repair-disposition.js";
+import { applyScopeAmendments, activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, outstandingReviewFindings, pendingApprovalActions, pendingRechecks, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
 import { isDiffCapPark, pickReviewer } from "../gates/review.js";
 import { acquireApprovalSerialization, acquireRunLock, isPidLive, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, verifyIntegrationTip } from "./merge.js";
@@ -51,6 +52,79 @@ export async function closeLiveSlot(liveSlots, driver, slot) {
         throw error;
     }
 }
+// A transport timeout says nothing about whether a mutation reached the terminal.
+class HeldProbeExhausted extends Error {
+}
+function isTransportTimeout(error) {
+    if (!(error instanceof Error))
+        return false;
+    const e = error;
+    return e.timedOut === true || ["ETIMEDOUT", "transport_timeout", "timeout"].includes(e.code ?? "")
+        || /\b(?:timed? out|timeout)\b/i.test(e.reason ?? e.message);
+}
+export function heldWorkerTransport(driver, slot, dispatchId, held, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
+    const delays = [250, 500, 1_000];
+    const probe = async (operation, call) => {
+        for (let retry = 0;; retry++) {
+            try {
+                return await call();
+            }
+            catch (error) {
+                if (!isTransportTimeout(error))
+                    throw error;
+                held({ operation, retry, state: "held", error: String(error), backoffMs: delays[retry] });
+                if (retry === delays.length)
+                    throw new HeldProbeExhausted(`${operation} transport retry budget exhausted`);
+                await sleep(delays[retry]);
+            }
+        }
+    };
+    return {
+        read: (s, n) => probe("read", () => driver.read(s, n)),
+        status: (s) => probe("status", () => driver.status(s)),
+        waitOutput: (s, p, ms, o) => probe("waitOutput", () => driver.waitOutput(s, p, ms, o)),
+        waitAgentStatus: (s, st, ms) => probe("waitAgentStatus", () => driver.waitAgentStatus(s, st, ms)),
+        run: async (s, command) => {
+            const observer = driver;
+            // A second delivery needs a receipt for THIS mutation, not an empty or idle terminal.
+            for (let delivery = 0; delivery < 2; delivery++) {
+                try {
+                    await driver.run(s, command);
+                    return;
+                }
+                catch (error) {
+                    if (!isTransportTimeout(error))
+                        throw error;
+                    let notAccepted = false;
+                    for (let retry = 0; retry <= delays.length; retry++) {
+                        held({ operation: "run", retry, delivery, state: "held", dispatchId, error: String(error), backoffMs: delays[retry] });
+                        try {
+                            const receipt = await observer.observeDispatch?.(slot, command, dispatchId);
+                            if (receipt?.authoritative === true && receipt.slotId === slot.id
+                                && receipt.command === command && receipt.dispatchId === dispatchId) {
+                                if (receipt.outcome === "accepted")
+                                    return;
+                                if (receipt.outcome === "not-accepted") {
+                                    notAccepted = true;
+                                    break;
+                                }
+                            }
+                            const text = await driver.read(slot, PANE_READ_ROWS);
+                            if (text.split(/\r?\n/).some((line) => line === `TICKMARKR_DISPATCH_${dispatchId}`))
+                                return;
+                        }
+                        catch { /* failed observations prove neither acceptance nor nonacceptance */ }
+                        if (retry < delays.length)
+                            await sleep(delays[retry]);
+                    }
+                    if (!notAccepted)
+                        break;
+                }
+            }
+            throw new HeldProbeExhausted("dispatch outcome remained uncertain; no delivery authorized");
+        },
+    };
+}
 // A fixed attempt ceiling is independent of the rolling inactivity clock.
 let attemptHardTimeoutMs;
 export function setAttemptHardTimeoutMsForTests(ms) { attemptHardTimeoutMs = ms; }
@@ -102,6 +176,17 @@ const RECHECK_ENACTMENT = "recheck-battery";
 // persisted task branch after the approved gate (execTask's satisfiedGate branch), whose first act
 // for the task is worktree-recreation. That event is causal for this path, not incidental.
 const GATE_SATISFIED_ENACTMENT = "worktree-recreation";
+// Older daemons enacted rechecks through worker-launch, before recheck-battery existed.
+// Preserve that consumption at every scheduling read without changing continuing permission.
+function pendingDaemonApprovalActions(events) {
+    const actions = pendingApprovalActions(events);
+    const rechecks = pendingRechecks(events);
+    for (const [id, action] of actions) {
+        if (action.authority === "battery" && !rechecks.has(id))
+            actions.delete(id);
+    }
+    return actions;
+}
 /**
  * T14, amended by v2.2 T3: approvals the run accepted and never acted on. `approved` above is still
  * built ONCE at startup — replay determinism depends on it — but a live approval is no longer inert:
@@ -284,6 +369,14 @@ function repairDiffFilesCut(diff, cap, names) {
     });
     return files;
 }
+/** Assertion evidence is context, never part of the normalized failure identity. */
+function repairFindingsBrief(results) {
+    return results.filter(gateFailed).map((g) => {
+        const evidence = g.meta?.failureEvidence;
+        return `${g.gate}: ${g.details}` + (Array.isArray(evidence) && evidence.length
+            ? `\nAssertion evidence:\n${JSON.stringify(evidence, null, 2)}` : "");
+    }).join("\n\n");
+}
 /** The fix-only contract: the findings verbatim, then the diff content of the work already landed. */
 function repairBrief(findings, diff, baseRef) {
     const repair = { findings, diff };
@@ -474,7 +567,9 @@ async function captureWorkerStream(journalDir, taskId, attempt, driver, slot, fa
     try {
         captured = await driver.read(slot, PANE_READ_ROWS);
     }
-    catch {
+    catch (error) {
+        if (error instanceof HeldProbeExhausted)
+            throw error;
         // Earlier successful reads are still a captured stream. Persist them rather than losing the
         // only failure evidence because the pane vanished between its terminal read and this snapshot.
     }
@@ -613,6 +708,47 @@ function lastVerifyCycle(events) {
     }
     return cur;
 }
+/**
+ * OBS-1077 close rider: what the engagement's LATEST verification cycle proved — its
+ * `tip-verify-start` row and what followed, never a commit comparison. Exactly one kind per close:
+ * fresh (every tip command ran AND passed), reused (an eligible cached cycle carried forward),
+ * failed, or incomplete (cancelled, cut short, mixed or undelimited). Nothing before the start row
+ * is read, so an unfinished cycle inherits nothing from an earlier green one.
+ */
+export function runEndTipProof(events) {
+    const start = events.map((e) => e.event).lastIndexOf("tip-verify-start");
+    if (start < 0)
+        return { kind: "incomplete" };
+    const { tip: rawTip, gates: rawGates } = events[start].data;
+    const tip = typeof rawTip === "string" ? rawTip : undefined;
+    const proof = (kind) => ({ kind, ...(tip ? { tip } : {}) });
+    const after = events.slice(start + 1);
+    if (after.some((e) => e.event === "tip-verify-failed"))
+        return proof("failed");
+    if (after.some((e) => e.event === "tip-verify-cancelled"))
+        return proof("incomplete");
+    const rows = after.filter((e) => e.event === "tip-verify" && e.data.pass === true && e.data.tip === tip);
+    const gates = Array.isArray(rawGates) ? rawGates : [];
+    if (!tip || gates.length === 0 || !gates.every((g) => rows.some((r) => r.data.gate === g)))
+        return proof("incomplete");
+    const carried = rows.filter((r) => r.data.cached === true).length;
+    const cachedRow = after.some((e) => e.event === "tip-verify-cached");
+    // A whole-cycle carry must be declared by the start row, stated by the cache row and borne by every verdict row.
+    if ((events[start].data.cached === true) !== cachedRow || (cachedRow && carried !== rows.length))
+        return proof("incomplete");
+    // D-131: fresh only when EVERY command executed; one per-gate persisted verdict makes the cycle reused.
+    return carried > 0 ? proof("reused") : proof("fresh");
+}
+/** The close notification's statement of the proof — one clause per kind. */
+export function formatTipProof(p) {
+    const at = p.tip ? ` ${p.tip.slice(0, 12)}` : "";
+    switch (p.kind) {
+        case "fresh": return `tip proof: fresh — every tip command ran and passed on${at || " the integration tip"}`;
+        case "reused": return `tip proof: reused — carried from verified commit${at}, commands not re-run`;
+        case "failed": return `tip proof: failed —${at ? ` commit${at}` : ""} latest verification cycle is red`;
+        case "incomplete": return `tip proof: incomplete —${at ? ` commit${at}` : ""} latest verification cycle did not finish`;
+    }
+}
 // Isolate the battery so cancellation can stop its control flow as well as its shell children.
 // The child uses the same verifier and capacity; only the daemon writes lifecycle verdict rows.
 async function cancellableTipBattery(intWt, commands, runDir, baseline, signal) {
@@ -784,7 +920,7 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
         const measuredCapacity = r.capacity ?? capacity;
         if (r.pass) {
             // Q121s: a forgiven pass journals its fingerprints — honest about what was carried, never a silent green.
-            journal.append("tip-verify", undefined, { gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints } : {}), tip, cmdHash, capacity: measuredCapacity });
+            journal.append("tip-verify", undefined, { gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.reused ? { cached: true } : {}), ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints } : {}), tip, cmdHash, capacity: measuredCapacity });
         }
         else {
             journal.append("tip-verify-failed", undefined, {
@@ -1336,11 +1472,23 @@ const terminateTornJournalTail = (journalPath) => {
 // a persistently unwritable sink reports a crash naming the journal path and carrying NO terminal
 // record, rather than fabricating an ended run on evidence the harness could not write. (OBS-313:
 // with the sink dead the crash CAUSE is unrecordable — recorded as an observation, not papered over.)
-function recordFatalRunEnd(journal, runId, branch, err) {
+export function recordFatalRunEnd(journal, runId, branch, err, graph, phase = "setup") {
     const original = err instanceof Error ? err.message : String(err);
+    // A fatal close never finished a cycle: fresh/reused green is withheld, a recorded red still stands.
+    let tipProof = { kind: "incomplete" };
     try {
-        if (journal.read().some((e) => e.event === "run-end"))
-            return; // already terminal — nothing to add
+        // Only the latest engagement can already own this terminal outcome.
+        const events = journal.read();
+        let from = events.length;
+        while (from > 0) {
+            const event = events[--from];
+            if (event.event === "run-start" || event.event === "run-resume")
+                break;
+            if (event.event === "run-end")
+                return undefined;
+        }
+        const latest = runEndTipProof(events.slice(from));
+        tipProof = { ...latest, kind: latest.kind === "failed" ? "failed" : "incomplete" };
     }
     catch (readErr) {
         console.error(`tickmarkr ${runId}: journal read failed while recording the fatal run-end (${readErr instanceof Error ? readErr.message : String(readErr)}) — original error: ${original}`);
@@ -1348,18 +1496,19 @@ function recordFatalRunEnd(journal, runId, branch, err) {
     const record = {
         runId,
         branch,
-        done: [],
-        failed: [],
-        human: [],
-        blocked: [],
-        pending: [],
-        phase: "setup",
+        done: graph?.tasks.filter((t) => t.status === "done").map((t) => t.id) ?? [],
+        failed: graph?.tasks.filter((t) => t.status === "failed").map((t) => t.id) ?? [],
+        human: graph?.tasks.filter((t) => t.status === "human").map((t) => t.id) ?? [],
+        blocked: graph ? blockedTasks(graph).map((t) => t.id) : [],
+        pending: graph ? pendingTasks(graph).map((t) => t.id) : [],
+        phase,
         fatal: true,
         error: original,
+        tipProof,
     };
     try {
         journal.append("run-end", undefined, record);
-        return;
+        return tipProof;
     }
     catch {
         // one retry below — the first failure is reported only if the retry also fails
@@ -1368,6 +1517,7 @@ function recordFatalRunEnd(journal, runId, branch, err) {
     try {
         terminateTornJournalTail(journalPath);
         journal.append("run-end", undefined, record);
+        return tipProof;
     }
     catch (retryErr) {
         console.error(`tickmarkr ${runId}: run crashed — no terminal record written; journal sink unwritable at ${journalPath} (${retryErr instanceof Error ? retryErr.message : String(retryErr)}) — original error: ${original}`);
@@ -1437,12 +1587,18 @@ export async function runDaemon(repoRoot, opts = {}) {
     let journal;
     let runStarted = false;
     let taskLoopStarted = false;
+    let graph;
+    let fatalPhase = "setup";
+    let deliberateTermination = false;
+    const fatalStop = new AbortController();
+    const inflight = new Map();
+    let retireFatalSlots;
     let branch = "";
     let releaseApprovalSerialization;
     let baselineCapture = Promise.resolve();
     let baselineFailed = false;
     try {
-        let graph = loadGraph(repoRoot);
+        graph = loadGraph(repoRoot);
         // One bounded snapshot supplies every dispatch. On resume the current journal still participates
         // in the fold so its task-done/ordinary-approval events can retire older evidence, but findings it
         // produced are suppressed: same-run feedback already replays those bytes and must not deliver them
@@ -1554,6 +1710,14 @@ export async function runDaemon(repoRoot, opts = {}) {
                         await reapWorker(slot);
                         await driver.close(slot);
                     } }, s);
+                retireFatalSlots = async () => {
+                    for (const slot of Array.from(liveSlots)) {
+                        try {
+                            await closeSlot(slot);
+                        }
+                        catch { /* preserve the original fatal error */ }
+                    }
+                };
                 const budgetSlots = new Map();
                 const trackedDriver = {
                     id: driver.id,
@@ -1562,19 +1726,24 @@ export async function runDaemon(repoRoot, opts = {}) {
                     ...(driver.describe ? { describe: driver.describe.bind(driver) } : {}),
                     ...(driver.focus ? { focus: driver.focus.bind(driver) } : {}),
                     slot: async (cwd, name, o) => {
+                        fatalStop.signal.throwIfAborted();
                         const signal = executionSignal();
                         signal?.throwIfAborted();
                         const s = await driver.slot(cwd, name, o);
                         liveSlots.add(s);
                         if (signal)
                             budgetSlots.get(signal)?.add(s);
-                        if (signal?.aborted) {
+                        if (signal?.aborted || fatalStop.signal.aborted) {
                             await withoutExecutionBudget(() => closeSlot(s));
-                            signal.throwIfAborted();
+                            fatalStop.signal.throwIfAborted();
+                            signal?.throwIfAborted();
                         }
                         return s;
                     },
-                    run: (s, cmd) => driver.run(s, cmd),
+                    run: (s, cmd) => {
+                        fatalStop.signal.throwIfAborted();
+                        return driver.run(s, cmd);
+                    },
                     waitOutput: (s, p, ms, o) => driver.waitOutput(s, p, ms, o),
                     waitAgentStatus: (s, st, ms) => driver.waitAgentStatus(s, st, ms),
                     status: (s) => driver.status(s),
@@ -1617,6 +1786,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                 const exit = opts.exit ?? ((code) => process.exit(code));
                 onTermination = (sig) => {
                     termSignal = sig;
+                    deliberateTermination = true;
                     void (async () => {
                         if (!reaping) {
                             reaping = true;
@@ -1719,7 +1889,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                 // flag. Startup approvals seed the first scheduling pass; live approvals are folded at task
                 // boundaries below so a sibling can release parked work without waiting for run-end + resume.
                 const approvalStartupEvents = journal.read();
-                const approved = new Set(approvalStartupEvents.filter((e) => e.event === "task-approved" && e.taskId).map((e) => e.taskId));
+                // Continuing human-gate permission survives enactment; malformed releases grant none.
+                const validApproval = (e) => e.event === "task-approved" && e.taskId
+                    && pendingApprovalActions([e]).get(e.taskId)?.authority !== "inert";
+                const approved = new Set(approvalStartupEvents.filter(validApproval).map((e) => e.taskId));
+                const startupActions = pendingDaemonApprovalActions(approvalStartupEvents);
                 let approvalSweepCursor = approvalStartupEvents.length;
                 const commands = detectGateCommands(repoRoot, cfg);
                 const watchName = formatOwnedName({ role: "watch", taskId: "run", attempt: 0, runId });
@@ -1825,6 +1999,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     const startedAt = Date.now();
                     for (;;) {
                         signal?.throwIfAborted();
+                        fatalStop.signal.throwIfAborted();
                         executionSignal()?.throwIfAborted();
                         const count = await liveSuiteCount(repoRoot);
                         if (count === 0)
@@ -1866,11 +2041,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                 // Empty Map on fresh runs — every seed below conditions on resume.get(t.id), never on opts.resume (the
                 // GATE-08 lesson at the humanGate guard: condition on the data, not the code path). Dead-code
                 // equivalence to the router.ts:194 profile⇒undefined pattern: no map entry ⇒ today's literal.
-                let resume = opts.resume ? journal.replayResumeState() : new Map();
-                let satisfiedGates = opts.resume ? journal.replaySatisfiedGates() : new Map();
-                let replayedGateResults = resumeLifecycleOpen
+                const resume = opts.resume ? journal.replayResumeState() : new Map();
+                const satisfiedGates = opts.resume ? journal.replaySatisfiedGates() : new Map();
+                const replayedGateResults = resumeLifecycleOpen
                     ? journal.replayCurrentAttemptGateResults()
                     : new Map();
+                for (const [taskId, action] of startupActions) {
+                    if (action.authority === "worker")
+                        replayedGateResults.delete(taskId);
+                }
                 // T7: the capacity THIS session resolved — read inside the run's fork budget, so it is the number
                 // every shell this run spawns will divide the machine by. Recorded evidence from another session
                 // is only reusable against this.
@@ -1907,7 +2086,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // The SAME comparator status uses (engagementComparable); one decision, two consumers. Fail closed:
                     // no resume path silently accepts a mismatched or unbound journal. --graph-changed is the operator's
                     // audited release for the stop-amend-resume workflow, journaling a graph-rehash naming both hashes.
-                    graph = applyScopeAmendments(graph, journal, true);
+                    graph = applyScopeAmendments(graph, journal, true, opts.graphChanged === true);
                     const loadedHash = graphDefinitionHash(graph);
                     const cmp = engagementComparable(journal.read(), loadedHash);
                     if (!cmp.comparable) {
@@ -1923,7 +2102,29 @@ export async function runDaemon(repoRoot, opts = {}) {
                     }
                     baseline = JSON.parse(readFileSync(join(journal.dir, "baseline.json"), "utf8"));
                     const replayEvents = journal.read();
-                    for (const [id, st] of journal.replayStatuses()) {
+                    // journal.replayStatuses predates typed releases and re-pends even inert rows. Keep that
+                    // legacy reader intact; scheduling accepts only the fold's recognised authorities.
+                    const statuses = new Map();
+                    for (const e of replayEvents) {
+                        if (!e.taskId)
+                            continue;
+                        if (e.event === "task-dispatch")
+                            statuses.set(e.taskId, "pending");
+                        else if (e.event === "task-done")
+                            statuses.set(e.taskId, "done");
+                        else if (e.event === "task-failed")
+                            statuses.set(e.taskId, "failed");
+                        else if (e.event === "task-human")
+                            statuses.set(e.taskId, "human");
+                        else if (validApproval(e))
+                            statuses.set(e.taskId, "pending");
+                    }
+                    for (const [id, action] of startupActions) {
+                        // Legacy gate-only approvals can finish and merge without a dispatch consuming funding.
+                        if (action.authority !== "inert" && statuses.get(id) !== "done")
+                            statuses.set(id, "pending");
+                    }
+                    for (const [id, st] of statuses) {
                         if (opts.retryFailed && st === "failed" && recordedTaskFailureKind(replayEvents, id) === "dispatch") {
                             graph = setStatus(graph, id, "pending");
                             // OBS-254: clear ATTEMPT AND CHANNEL STATE ONLY. Deleting the whole entry also deleted
@@ -1944,7 +2145,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                         pid: process.pid, // v1.13 (VIS-11): record the live daemon pid for status liveness
                         ...(replayedExclusions.size > 0 ? { excludedChannels: [...replayedExclusions].sort() } : {}),
                         ...(opts.retryFailed ? { retryFailed: true } : {}),
+                        ...(opts.graphChanged ? { graphChanged: true } : {}), // OBS-1073: the release is the engagement's
                     });
+                    runStarted = true;
                     await placeBoard();
                 }
                 else {
@@ -2066,6 +2269,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                 let mergeChain = Promise.resolve();
                 const mergeSerial = (taskBranch, t, gated) => {
                     const next = mergeChain.then(() => {
+                        fatalStop.signal.throwIfAborted();
                         executionSignal()?.throwIfAborted();
                         journal.phaseStart(t.id, "merge");
                         return mergeTask(intWt, taskBranch, `tickmarkr: merge ${t.id} ${t.title}`, gated);
@@ -2083,15 +2287,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                     ];
                     return `${identity} — release with ${commands.map((command) => `\`${command}\``).join(" or ")}`;
                 };
-                // `present`: OBS-1007 add.4/5 — a gate DIAGNOSTIC may name only paths that exist in the tree or the
-                // diff (`f.filepath`, `scripted.sh`, `gates.diffCap` lifted from review prose are not paths). A
-                // worker's own scope refusal keeps the lexical rule: the file it needs may not exist yet.
-                const namedPaths = (text, present) => [...text.matchAll(/(?:^|[\s`'"(])((?:[A-Za-z0-9_@.()[\]-]+\/)+[A-Za-z0-9_@.[\]-]+|[A-Za-z0-9_@-]+(?:\.[A-Za-z0-9_-]+)+)(?=$|[\s`'"),:;.!?])/g)]
+                // Lexing never starts in the middle of a word. Resolution is separate so missing hints
+                // remain visible evidence without becoming executable approval advice.
+                const namedPaths = (text) => [...text.matchAll(/(?:^|[\s`'"])((?:[A-Za-z0-9_@.()[\]-]+\/)+[A-Za-z0-9_@.[\]-]+|[A-Za-z0-9_@-]+(?:\.[A-Za-z0-9_-]+)+)(?=$|[\s`'"),:;.!?])/g)]
                     .map((match) => match[1].replace(/^\.\//, "").replace(/\.$/, ""))
-                    .filter((path) => !path.split("/").includes("..")
-                    && (present
-                        ? present.has(path)
-                        : (/\.[A-Za-z][A-Za-z0-9_-]*$/.test(basename(path)) || existsSync(join(repoRoot, path)))));
+                    .filter((path) => !path.split("/").includes(".."));
                 const diffPaths = async (base, wt) => {
                     const out = await shGit(`git diff --name-only -z ${shq(base)}..HEAD`, wt);
                     return new Set(out.code === 0 ? out.stdout.split("\0").filter(Boolean) : []);
@@ -2101,15 +2301,22 @@ export async function runDaemon(repoRoot, opts = {}) {
                     const tree = await shGit("git ls-files -z", wt);
                     return new Set([...(tree.code === 0 ? tree.stdout.split("\0").filter(Boolean) : []), ...await diffPaths(base, wt)]);
                 };
+                // The base each task was dispatched on: the integration branch moves when a sibling merges, the pin does not.
+                const taskBases = new Map();
                 const park = async (t, reason, kind, assignment, attempts, startMs, gateFails = 0, consults = 0, tokens, metered = 0, retryMode = "fresh", details = {}) => {
                     // OBS-979: a worker refusal can identify the missing authoring scope even when gates
                     // subsequently supply the park's disposition. Keep that actionable path on the park itself.
                     const worker = journal.read().reverse().find((e) => e.taskId === t.id && e.event === "worker-result");
-                    if (t.files.length > 0 && worker?.data.ok === false && typeof worker.data.summary === "string") {
+                    if (!details.approveCommand && t.files.length > 0 && worker?.data.ok === false && typeof worker.data.summary === "string") {
                         const allowed = filesGlob(t.files);
-                        const paths = namedPaths(worker.data.summary).filter((path) => !allowed(path));
+                        // OBS-1072 residual: the same inventory as the main path — the task tree and its diff from the
+                        // task's PINNED base, never the main checkout and never the moving integration branch.
+                        const wt = worktreePath(repoRoot, `${branch}--${t.id}`);
+                        const inventory = existsSync(wt) ? await treeOrDiffPaths(taskBases.get(t.id) ?? "HEAD", wt) : new Set();
+                        const paths = resolveScopeHints(namedPaths(worker.data.summary).filter((path) => !allowed(path)), inventory)
+                            .resolved.filter((path) => !allowed(path));
                         if (paths.length)
-                            reason += ` — files[] repair hint: ${[...new Set(paths)].join(", ")}`;
+                            reason += ` — files[] repair hint: ${paths.join(", ")}`;
                     }
                     graph = setStatus(graph, t.id, "human");
                     saveGraph(repoRoot, graph);
@@ -2140,35 +2347,34 @@ export async function runDaemon(repoRoot, opts = {}) {
                 const dispositionScopeRed = async (t, results, assignment, attempts, startMs, gateFails, consults, tokens, metered, retryMode, changed = new Set()) => {
                     const scopeRed = results.find((g) => g.gate === "scope" && gateFailed(g));
                     const verdict = scopeRed?.meta?.collateral;
-                    if (!verdict && t.files.length > 0) {
-                        const allowed = filesGlob(t.files);
-                        const worker = journal.read().reverse().find((e) => e.taskId === t.id && e.event === "worker-result");
-                        const refusal = worker?.data.ok === false && typeof worker.data.summary === "string"
-                            && /outside|out.of.scope|allowlist|scope expansion|not (?:in|own)|unowned/i.test(worker.data.summary)
-                            ? namedPaths(worker.data.summary).filter((path) => !allowed(path)) : [];
-                        const reds = results.filter(gateFailed);
-                        // A scope verdict already attributes actual out-of-scope EDITS using the collateral map.
-                        // Path-only diagnostics from the other gates name code that needs fixing, not an edit the
-                        // worker made. Do not replace the scope gate's stronger attribution with that inference.
-                        const paths = reds.filter((g) => g.gate !== "scope" || !g.meta?.collateral).flatMap((g) => namedPaths(g.details, changed));
-                        if (refusal.length || (paths.length > 0 && paths.every((path) => !allowed(path)))) {
-                            const classification = {
-                                gate: refusal.length ? "worker" : reds[0]?.gate,
-                                paths: [...new Set(refusal.length ? refusal : paths)],
-                                repair: `files[] repair hint: ${[...new Set(refusal.length ? refusal : paths)].join(", ")}`,
-                                attempt: attempts + 1, chargeable: false, source: "diagnostic",
-                            };
-                            if (refusal.length)
-                                journal.append("scope-request", t.id, classification);
-                            else
-                                journal.append("scope-authoring", t.id, classification);
-                            // OBS-547 (Leg-2 T3 material): unchargeable ⇒ metered 0, exactly as the predicted path below —
-                            // passing the physical count would write `meteredAttempts: 1` beside `attempts: 0`.
-                            const approveCommand = `tickmarkr approve ${runId} ${t.id} --files ${[...new Set(refusal)].map((path) => /^[\w./-]+$/.test(path) ? path : shq(path)).join(",")}`;
-                            await park(t, `${refusal.length ? "scope request" : "authoring defect"} — files[] repair hint: ${[...new Set(refusal.length ? refusal : paths)].join(", ")}; current files[]: ${t.files.join(", ")}`, refusal.length ? "scope-request" : "authoring", assignment, attempts, startMs, gateFails, consults, tokens, 0, retryMode, refusal.length ? { paths: [...new Set(refusal)], approveCommand, graphDefinitionHash: graphDefinitionHash(graph) } : {});
-                            return true;
-                        }
+                    const worker = journal.read().reverse().find((e) => e.taskId === t.id && e.event === "worker-result");
+                    const disposition = classifyRepairDisposition({
+                        results, files: t.files, inventory: changed,
+                        refusalSummary: worker?.data.ok === false && typeof worker.data.summary === "string" ? worker.data.summary : undefined,
+                    });
+                    for (const diagnostic of disposition.diagnostics) {
+                        journal.append("scope-hint-unresolved", t.id, {
+                            paths: [diagnostic.candidate], reason: diagnostic.reason, diagnostic, attempt: attempts + 1,
+                        });
                     }
+                    if (disposition.blocker === "infra")
+                        return false;
+                    if (!disposition.blocker && (disposition.kind === "scope-request" || disposition.kind === "authoring")) {
+                        const paths = disposition.paths;
+                        const scopeRequest = disposition.kind === "scope-request";
+                        const classification = {
+                            gate: disposition.source, paths, repair: `files[] repair hint: ${paths.join(", ")}`,
+                            attempt: attempts + 1, chargeable: false, source: "diagnostic",
+                        };
+                        if (scopeRequest)
+                            journal.append("scope-request", t.id, classification);
+                        else
+                            journal.append("scope-authoring", t.id, classification);
+                        const approveCommand = `tickmarkr approve ${runId} ${t.id} --files ${paths.map((path) => /^[\w./-]+$/.test(path) ? path : shq(path)).join(",")}`;
+                        await park(t, `${scopeRequest ? "scope request" : "authoring defect"} — files[] repair hint: ${paths.join(", ")}; current files[]: ${t.files.join(", ")}${scopeRequest ? `\n${approveCommand}` : ""}`, scopeRequest ? "scope-request" : "authoring", assignment, attempts, startMs, gateFails, consults, tokens, 0, retryMode, scopeRequest ? { paths, approveCommand, graphDefinitionHash: graphDefinitionHash(graph) } : {});
+                        return true;
+                    }
+                    // A detection site permits the ordinary chargeable policy; it does not itself grant budget.
                     if (!verdict)
                         return false;
                     if (verdict.authoring) {
@@ -2205,17 +2411,33 @@ export async function runDaemon(repoRoot, opts = {}) {
                     approvalSweepCursor = events.length;
                     if (approvals.length === 0)
                         return;
-                    graph = applyScopeAmendments(graph, journal);
-                    resume = journal.replayResumeState();
-                    satisfiedGates = journal.replaySatisfiedGates();
-                    replayedGateResults = resumeLifecycleOpen
-                        ? journal.replayCurrentAttemptGateResults()
-                        : new Map();
+                    // Replay every authority from this pass's single snapshot. In particular, helper reads must
+                    // neither rescan the file under load nor observe approvals beyond approvalSweepCursor.
+                    // Keep audit writes on the live journal so narration and persistence retain their owner.
+                    const sweepJournal = Journal.open(repoRoot, runId);
+                    sweepJournal.read = () => events;
+                    sweepJournal.append = journal.append.bind(journal);
+                    graph = applyScopeAmendments(graph, sweepJournal, false, opts.graphChanged === true); // OBS-1073: same release as launch
+                    const actions = pendingDaemonApprovalActions(events);
+                    const nextResume = sweepJournal.replayResumeState();
+                    const nextSatisfied = sweepJournal.replaySatisfiedGates();
                     let changed = false;
-                    for (const e of approvals) {
-                        const taskId = e.taskId;
+                    for (const taskId of new Set(approvals.map((e) => e.taskId))) {
+                        const action = actions.get(taskId);
+                        if (!action || action.authority === "inert")
+                            continue;
                         approved.add(taskId);
-                        if (e.data.release !== GATE_SATISFIED_RELEASE)
+                        const state = nextResume.get(taskId);
+                        if (state)
+                            resume.set(taskId, state);
+                        else
+                            resume.delete(taskId);
+                        const gate = nextSatisfied.get(taskId);
+                        if (gate)
+                            satisfiedGates.set(taskId, gate);
+                        else
+                            satisfiedGates.delete(taskId);
+                        if (action.authority !== "waiver")
                             replayedGateResults.delete(taskId);
                         try {
                             const task = getTask(graph, taskId);
@@ -2232,6 +2454,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                         saveGraph(repoRoot, graph);
                 };
                 const execTask = async (t) => {
+                    const approvalAction = pendingDaemonApprovalActions(journal.read()).get(t.id);
+                    const fundedRerun = approvalAction?.authority === "worker";
                     const startMs = Date.now();
                     let stallSeat;
                     let stallReaps = 0;
@@ -2363,6 +2587,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                             ctx.requiredRepairTests = decision.requiredFiles;
                             ctx.selectionReason = decision.reason;
                         }
+                        // Resume and ordinary verification share this boundary. Count persisted rounds so a
+                        // resumed daemon cannot reuse a previous round's identity within the same attempt.
+                        ctx.buildReceiptIdentity = {
+                            runId, taskId: task.id, attempt: gateSubject?.attempt ?? 0,
+                            gateRound: journal.read().filter((row) => row.taskId === task.id
+                                && row.event === "phase-start" && row.data.phase === "gates").length,
+                        };
                         const round = await runGates(task, ctx);
                         let review = round.results.find((g) => g.gate === "review");
                         while (review?.meta?.noVerdict === true) {
@@ -2454,7 +2685,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 ...(typeof g.meta.preservedRef === "string" ? { preservedRef: g.meta.preservedRef } : {}),
                             } : {}),
                             ...(cfg.executionPolicy && !g.pass ? { disposition: failureDisposition(g) } : {}),
-                            ...Object.fromEntries(["runnerInfraRerun", "hostStarvedRerun", "recoveryBlocked", "failingFiles", "selectionDecision"]
+                            ...Object.fromEntries(["runnerInfraRerun", "hostStarvedRerun", "recoveryBlocked", "failingFiles", "selectionDecision", "failureEvidence"]
                                 .filter((key) => g.meta?.[key] !== undefined).map((key) => [key, g.meta[key]])),
                             // OBS-540: preserve terminal-vs-retryable infra exactly. normalizeGateOutcome deliberately
                             // defaults a legacy infra row to retryable, so dropping an explicit false here reverses the
@@ -2730,10 +2961,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // An operator approval skips its exact failed gate by authority; observed results skip only the
                     // contiguous green prefix whose recorded commit is still the task branch tip.
                     const satisfiedGate = satisfiedGates.get(t.id);
-                    const replayedGates = replayedGateResults.get(t.id);
-                    const recheck = pendingRechecks(journal.read()).has(t.id);
+                    const replayedGates = fundedRerun ? undefined : replayedGateResults.get(t.id);
+                    const recheck = approvalAction?.authority === "battery";
                     resumeGateReplay: if (satisfiedGate || replayedGates || recheck) {
                         const taskBase = await integrationHead(intWt);
+                        taskBases.set(t.id, taskBase);
                         const taskBranch = `${branch}--${t.id}`;
                         const priorWt = worktreePath(repoRoot, taskBranch);
                         // OBS-1022: the ref `approve --recheck` validated (commits ahead of the base) is the tree the
@@ -2895,13 +3127,42 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 else
                                     reused.push(gate);
                             }
+                            // OBS-1049: build outputs are not commits. A replayed build verdict says the tree WAS green;
+                            // it says nothing about whether the RECREATED checkout holds what that build produced (dist),
+                            // and the host's npm lifecycle (ignore-scripts) may never rebuild it before the suite runs.
+                            // So a replayed build re-runs its own command here as provisioning, journaled by name; a red
+                            // provisioning is not reused — build (and everything behind it) re-enters the battery as a gate.
+                            // Every resume on this path recreates the checkout (recreateTaskWorktree above), so "reused
+                            // build" is exactly "build replayed onto a recreated tree".
+                            // Journal order is the criterion's order: a GREEN provisioning is recorded AFTER the reuse
+                            // rows it belongs to (gate-reused build, then gate-provisioned build); a RED provisioning is
+                            // recorded alone, and no reuse row follows it.
+                            let provisionedRow;
+                            if (reused.includes("build") && commands.build !== undefined) {
+                                // Provisioning is a verification command like any gate: it waits for the run's baseline and
+                                // takes the command lease (suite admission), never a bare shell beside sibling gates.
+                                await waitForBaseline(t.id);
+                                const startedAt = Date.now();
+                                const provisioned = await withCommandContext(t.id, () => sh(commands.build, wt));
+                                provisionedRow = {
+                                    gate: "build", commit: replayedGates.commit, exitCode: provisioned.code, durationMs: Date.now() - startedAt,
+                                };
+                                if (provisioned.code !== 0) {
+                                    reused.splice(reused.indexOf("build"));
+                                    journal.append("gate-provisioned", t.id, provisionedRow);
+                                    provisionedRow = undefined;
+                                }
+                            }
                             for (const gate of reused) {
                                 journal.append("gate-reused", t.id, { gate, commit: replayedGates.commit });
                             }
+                            if (provisionedRow !== undefined)
+                                journal.append("gate-provisioned", t.id, provisionedRow);
                             remainingGates = declaredGates.slice(reused.length);
                         }
                         const resumedTask = { ...t, gates: remainingGates };
                         gateLoop: while (true) {
+                            fatalStop.signal.throwIfAborted();
                             executionSignal()?.throwIfAborted();
                             const gated = await gitHead(wt);
                             gateSubject = {
@@ -2935,6 +3196,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // Leg-2 (OBS-1052): the run-scoped two-strike tally — without it retirement is inert and a
                                 // flaking seat is re-asked on every task. (carriedAuthors is held back: see SURGEON-LEG2-REPORT.)
                                 reviewNoVerdicts,
+                                recheck, // OBS-1055: a recheck discards cached reds — the battery re-measures what the operator questioned
                                 onGate: async (e) => {
                                     if (e.phase === "start") {
                                         notePhaseStart(e);
@@ -2958,7 +3220,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 },
                             }, false));
                             results.forEach(classifySignalOnlyTest);
-                            if (pendingRechecks(journal.read()).has(t.id)) {
+                            if (pendingDaemonApprovalActions(journal.read()).get(t.id)?.authority === "battery") {
                                 journal.append("recheck-battery", t.id, {
                                     commit: gateSubject.commit,
                                     gates: resumedTask.gates,
@@ -2997,8 +3259,41 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // Observed green gates are only measurements. If the resumed suffix is red, preserve that
                                 // result in the journal and return to the ordinary attempt/consult ladder, which rebuilds
                                 // feedback from those rows. Only an operator-authorized gate release parks on a new red.
-                                if (!satisfiedGate)
+                                if (!satisfiedGate) {
+                                    // OBS-1055: a recheck red funds a repair of the pin's own work. A pinned task's repair sits
+                                    // on the pin (OBS-1034's exemption keeps the tried list from excluding it); a pin the fleet
+                                    // cannot seat parks naming the pin — never the ladder.
+                                    const pin = recheck ? t.routingHints?.pin : undefined;
+                                    if (pin) {
+                                        const seat = channels.find((c) => c.adapter === pin.via && c.model === pin.model && !demotedChannels.has(channelKey(c)));
+                                        if (!seat) {
+                                            await park(t, `recheck red: pinned ${pin.via}:${pin.model} is unavailable to host the repair — refusing the ladder`, "gate-fail", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
+                                            return;
+                                        }
+                                        assignment = { adapter: seat.adapter, model: seat.model, channel: seat.channel, tier: seat.tier };
+                                    }
+                                    // Carry completeness was verified before this replay battery. Apply the ordinary
+                                    // repair bounds here too; a restored red must fund the same findings-bearing dispatch.
+                                    // Funding is durable intent only: repairReachSinceApproval charges it after launch
+                                    // reaches a funded gate, and a restart before launch must not duplicate that intent.
+                                    const failing = results.filter(gateFailed);
+                                    const battery = failing.some((g) => g.gate !== "review") ? failing.filter((g) => g.gate !== "review") : failing;
+                                    const landed = await commitsAheadOf(taskBase, wt);
+                                    const events = journal.read();
+                                    const drawn = repairsSinceApproval(events, t.id);
+                                    const repeated = failing.some((g) => isDeterministicFailure(g)
+                                        && identicalGateFailures(events, t.id, g.gate, normalizeGateFailure(g.details)) >= GATE_FINGERPRINT_CAP);
+                                    if (narrowRepairBattery(battery) && landed.length > 0 && drawn < MAX_REPAIRS
+                                        && (rs?.attempts ?? 0) < MAX_ATTEMPTS && !repeated
+                                        && pendingRepairFindings(events, t.id) === undefined) {
+                                        journal.append("repair-attempt", t.id, {
+                                            repair: repairReachSinceApproval(events, t.id).length + 1, charge: drawn + 1, of: MAX_REPAIRS,
+                                            gates: failing.map((g) => g.gate), commits: landed.length,
+                                            findings: withCarriedEvidence(repairFindingsBrief(results)),
+                                        });
+                                    }
                                     break gateLoop;
+                                }
                                 await park(t, gateFailApprovalReason(t.id, "post-approval gate failed", results.some((g) => g.gate === "review" && gateFailed(g))), "gate-fail", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
                                 return;
                             }
@@ -3042,6 +3337,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // the same worktree. The next loop iteration retires it before reading/recreating the tree.
                     let supersededWorkerSlot;
                     attempts: for (let attempt = rs?.attempts ?? 0;; attempt++) {
+                        // Funding belongs to the next attempt. Later automatic repairs retain ordinary red reuse.
+                        const explicitlyFundedAttempt = fundedRerun && attempt === (rs?.attempts ?? 0);
+                        fatalStop.signal.throwIfAborted();
                         executionSignal()?.throwIfAborted();
                         if (attempt !== providerDeathAttempt) {
                             providerDeathRequeues = 0;
@@ -3216,6 +3514,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // T6: a dispatch that carries an outstanding finding says so, and names it. Without this the
                         // ledger cannot tell a carried dispatch from an amnesiac one — the exact question a run that
                         // spends two frontier attempts re-deriving a known defect has to be able to answer afterwards.
+                        fatalStop.signal.throwIfAborted();
                         journal.append("task-dispatch", t.id, {
                             ...(scopeApproval?.data.release === "scope-request" ? { files: t.files, graphDefinitionHash: graphDefinitionHash(graph) } : {}),
                             assignment, attempt, provenance: dispatchProvenance([
@@ -3234,6 +3533,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         });
                         journal.phaseStart(t.id, "worker", { attempt, assignment });
                         const taskBase = await integrationHead(intWt); // deps are merged → visible to this task
+                        taskBases.set(t.id, taskBase);
                         const taskBranch = `${branch}--${t.id}`; // "--": a ref can't nest under the existing integration branch (locked decision 10)
                         const priorWt = worktreePath(repoRoot, taskBranch);
                         const recreating = existsSync(priorWt);
@@ -3396,9 +3696,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                             `if [ -n "$worker_pgid" ] && [ -n "$daemon_pgid" ] && [ "$worker_pgid" != "$daemon_pgid" ]; then printf '%s\\n' "$worker_pgid" > ${shq(groupFile)}; fi`,
                             "export BASH_SILENCE_DEPRECATION_WARNING=1",
                             bannerShell(),
+                            `printf '%s\\n' 'TICKMARKR_DISPATCH_${nonce}'`,
                             workerCmd,
                             exitMarkerCmd,
                         ].join("\n"));
+                        const workerTransport = heldWorkerTransport(driver, slot, nonce, (data) => journal.append("held-probe", t.id, { ...data, slot: slot.id, attempt }));
                         // T2 (OBS-264): the liveness triad, shared by BOTH wait loops (a headless worker stalls on
                         // finished work exactly as a visible one does — and rode the whole window before this). It
                         // sits ABOVE the fast-kill and the nudge because the population it governs is the opposite
@@ -3559,6 +3861,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                         let driverProbeFailed = false;
                         let heldLegs = [];
                         const noteDriverUnreadable = (error) => {
+                            if (error instanceof HeldProbeExhausted)
+                                throw error;
                             driverProbeFailed = true;
                             heldLegs = ["quota:driver-unreadable", "stall:driver-unreadable"];
                             journal.append("contact-unreadable", t.id, { slot: slot.name, attempt, source: "driver", concludes: false,
@@ -3657,8 +3961,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     try {
                                         seedResult = await runInteractiveSeed({
                                             driver: trustAnswered ? {
-                                                run: driver.run.bind(driver), waitOutput: driver.waitOutput.bind(driver), read: driver.read.bind(driver),
-                                            } : driver,
+                                                run: workerTransport.run.bind(workerTransport), waitOutput: workerTransport.waitOutput.bind(workerTransport), read: workerTransport.read.bind(workerTransport),
+                                            } : { ...trackedDriver, ...workerTransport },
                                             slot, adapter, assignment, promptFile, taskTimeoutMinutes,
                                             onTrustAnswered: noteSeedTrustAnswered,
                                         });
@@ -3675,7 +3979,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 }
                                 else {
                                     try {
-                                        await driver.run(slot, paneDispatchCommand(dispatchScript));
+                                        await workerTransport.run(slot, paneDispatchCommand(dispatchScript));
                                     }
                                     catch (error) {
                                         if (!(error instanceof DeliveryReadinessError))
@@ -3685,7 +3989,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         return;
                                     }
                                     await noteLaunched();
-                                    output = await driver.read(slot, PANE_READ_ROWS);
+                                    output = await workerTransport.read(slot, PANE_READ_ROWS);
                                 }
                                 // The returning paths report the same fact on the result; both callbacks land on the one
                                 // latch, and the second is a no-op. A seed that answered is never re-answered by the loop.
@@ -3737,6 +4041,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     while (Date.now() < hardDeadline) {
                                         if (termSignal)
                                             throw new Error(`terminated by ${termSignal}`);
+                                        fatalStop.signal.throwIfAborted();
                                         executionSignal()?.throwIfAborted();
                                         driverProbeFailed = false;
                                         const sliceStart = Date.now();
@@ -3758,11 +4063,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         // every slice before the gate exactly as long as it already was.
                                         slice = Math.min(slice, harvestSliceMs(sliceStart - lastProgressAt));
                                         slice = Math.min(slice, remainingExecutionMs() ?? slice);
-                                        if (await driver.waitOutput(slot, `(${trailerPattern(nonce)})|TICKMARKR_EXIT_${nonce}:\\d`, slice, { regex: true }).catch((error) => { noteDriverUnreadable(error); return false; })) {
+                                        if (await workerTransport.waitOutput(slot, `(${trailerPattern(nonce)})|TICKMARKR_EXIT_${nonce}:\\d`, slice, { regex: true }).catch((error) => { noteDriverUnreadable(error); return false; })) {
                                             // verify before accepting: a worker that merely DISPLAYS a marker (e.g. editing tickmarkr's
                                             // own source, where "TICKMARKR_EXIT:" is a string literal) must not end the wait. Only a
                                             // parseable trailer or a digit-suffixed exit marker in the harvest is completion.
-                                            output = await driver.read(slot, PANE_READ_ROWS).catch((error) => { noteDriverUnreadable(error); return output; }); // TUI transcripts carry chrome — read deeper than print's 500
+                                            output = await workerTransport.read(slot, PANE_READ_ROWS).catch((error) => { noteDriverUnreadable(error); return output; }); // TUI transcripts carry chrome — read deeper than print's 500
                                             finished = sampleTrailer(output);
                                             const exit = exitRe.exec(output);
                                             if (finished || (exit && !(trailerFrames && new RegExp(trailerPattern(nonce)).test(output)))) {
@@ -3786,7 +4091,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         // rolling taskTimeoutMinutes window as the backstop and name the held probe once.
                                         let paneText;
                                         try {
-                                            paneText = await driver.read(slot, PANE_READ_ROWS);
+                                            paneText = await workerTransport.read(slot, PANE_READ_ROWS);
                                         }
                                         catch (error) {
                                             noteDriverUnreadable(error);
@@ -3903,7 +4208,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         // "unknown"/"working" never page.
                                         let st;
                                         try {
-                                            st = await driver.status(slot);
+                                            st = await workerTransport.status(slot);
                                         }
                                         catch (error) {
                                             noteDriverUnreadable(error);
@@ -3929,7 +4234,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             // text matches. tickmarkr created the worktree from the operator's own repo — safe by construction.
                                             if (!trustAnswered && adapter.trustDialog && driver.sendKey) {
                                                 try {
-                                                    const paneText = await driver.read(slot, 80);
+                                                    const paneText = await workerTransport.read(slot, 80);
                                                     if (matchesTrustDialog(paneText, adapter.trustDialog)) {
                                                         trustAnswered = true;
                                                         trustAnsweredSlots.add(slot.id);
@@ -3943,7 +4248,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                                                         continue; // do not page — keep waiting for the trailer
                                                     }
                                                 }
-                                                catch {
+                                                catch (error) {
+                                                    if (error instanceof HeldProbeExhausted)
+                                                        throw error;
                                                     /* read/send failed — fall through to page the operator */
                                                 }
                                             }
@@ -3975,7 +4282,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         let paneAbsent = paneAbsentCandidate;
                                         if (paneAbsent) {
                                             try {
-                                                const confirmation = await driver.read(slot, PANE_READ_ROWS);
+                                                const confirmation = await workerTransport.read(slot, PANE_READ_ROWS);
                                                 paneAbsent = confirmation.trim().length === 0;
                                                 if (!paneAbsent) {
                                                     everHadOutput = true;
@@ -3984,6 +4291,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                                 }
                                             }
                                             catch (error) {
+                                                if (error instanceof HeldProbeExhausted)
+                                                    throw error;
                                                 paneAbsent = false;
                                                 if (!paneReadHeld) {
                                                     paneReadHeld = true;
@@ -3999,7 +4308,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             : "unmeasurable";
                                         if (processTree === "empty") {
                                             try {
-                                                const confirmation = await driver.read(slot, PANE_READ_ROWS);
+                                                const confirmation = await workerTransport.read(slot, PANE_READ_ROWS);
                                                 paneAbsent = confirmation.trim().length === 0;
                                                 if (!paneAbsent) {
                                                     everHadOutput = true;
@@ -4008,6 +4317,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                                 }
                                             }
                                             catch (error) {
+                                                if (error instanceof HeldProbeExhausted)
+                                                    throw error;
                                                 paneAbsent = false;
                                                 if (!paneReadHeld) {
                                                     paneReadHeld = true;
@@ -4167,7 +4478,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             if (delivered) {
                                                 // absorb the nudge's own echo BEFORE arming the grace timer — post-nudge progress
                                                 // is measured against this baseline, not against the echo.
-                                                const echo = await driver.read(slot, PANE_READ_ROWS).catch((error) => { noteDriverUnreadable(error); return undefined; });
+                                                const echo = await workerTransport.read(slot, PANE_READ_ROWS).catch((error) => { noteDriverUnreadable(error); return undefined; });
                                                 if (echo !== undefined)
                                                     stallProgress.observe({ paneText: echo, contextTokens });
                                                 nudgeDeadline = Date.now() + workerNudgeGraceMs;
@@ -4184,7 +4495,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             // grace spent, still no post-nudge progress: re-harvest once (the trailer may have
                                             // landed between polls), then conclude the wait as a stall NOW — the consult sees the
                                             // un-answered nudge instead of the remainder of the window.
-                                            const finalPane = await driver.read(slot, PANE_READ_ROWS).catch((error) => { noteDriverUnreadable(error); return undefined; });
+                                            const finalPane = await workerTransport.read(slot, PANE_READ_ROWS).catch((error) => { noteDriverUnreadable(error); return undefined; });
                                             if (finalPane === undefined)
                                                 continue;
                                             nudgeDeadline = undefined;
@@ -4239,9 +4550,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         if (hardTimedOut)
                                             journal.append("worker-hard-timeout", t.id, { slot: slot.name, attempt, heldLegs });
                                         try {
-                                            output = await driver.read(slot, PANE_READ_ROWS);
+                                            output = await workerTransport.read(slot, PANE_READ_ROWS);
                                         }
-                                        catch {
+                                        catch (error) {
+                                            if (error instanceof HeldProbeExhausted)
+                                                throw error;
                                             // The poll loop already recorded the unreadable pane. Retain the last readable bytes
                                             // so this ambiguous path still reaches the ordinary timeout/consult backstop.
                                         }
@@ -4251,8 +4564,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         processExited = exit !== null;
                                     }
                                     if (finished && !trailerFrames) {
-                                        await driver.waitAgentStatus(slot, "idle", 5_000).catch(noteDriverUnreadable);
-                                        const settled = await driver.read(slot, PANE_READ_ROWS).catch((error) => { noteDriverUnreadable(error); return output; });
+                                        await workerTransport.waitAgentStatus(slot, "idle", 5_000).catch(noteDriverUnreadable);
+                                        const settled = await workerTransport.read(slot, PANE_READ_ROWS).catch((error) => { noteDriverUnreadable(error); return output; });
                                         if (sampleTrailer(settled))
                                             output = settled;
                                     }
@@ -4271,7 +4584,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             if (remaining <= 0)
                                                 break;
                                             await new Promise((r) => setTimeout(r, Math.min(settleDelayMs, remaining)));
-                                            output = await driver.read(slot, PANE_READ_ROWS);
+                                            output = await workerTransport.read(slot, PANE_READ_ROWS);
                                             trailerFrames?.sample(output, new RegExp(trailerPattern(nonce)).test(output));
                                             settleParsed = adapter.parse(output, nonce);
                                             settleTries++;
@@ -4284,7 +4597,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             }
                             else {
                                 try {
-                                    await driver.run(slot, paneDispatchCommand(dispatchScript));
+                                    await workerTransport.run(slot, paneDispatchCommand(dispatchScript));
                                 }
                                 catch (error) {
                                     if (!(error instanceof DeliveryReadinessError))
@@ -4297,7 +4610,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // OBS-54: headless workers have the same output-inactivity budget as visible panes.
                                 // v1.76: same monotonic-progress measure as the interactive site; harvest stays raw.
                                 const stallWindowMs = taskTimeoutMinutes * 60_000;
-                                const initialPane = await driver.read(slot, 500);
+                                const initialPane = await workerTransport.read(slot, 500);
                                 startupFailure = startupFailureInWindow(initialPane, workerLaunchedAt);
                                 let everHadOutput = initialPane.length > 0;
                                 const stallProgress = new StallProgressTracker();
@@ -4312,6 +4625,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // there is the trailer regex; the exit marker only sets exitCode), and the cause taxonomy
                                 // already names this shape "clean-exit-no-trailer" — unreachable in print mode until now.
                                 while (!startupFailure && Date.now() - lastProgressAt < stallWindowMs) {
+                                    fatalStop.signal.throwIfAborted();
                                     executionSignal()?.throwIfAborted();
                                     const remaining = stallWindowMs - (Date.now() - lastProgressAt);
                                     let slice = Math.min(BLOCKED_POLL_MS, Math.max(100, Math.min(stallWindowMs / 2, remaining)));
@@ -4328,11 +4642,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     // T2 (OBS-264): same probe cadence the interactive loop uses — see harvestSliceMs.
                                     slice = Math.min(slice, harvestSliceMs(Date.now() - lastProgressAt));
                                     slice = Math.min(slice, remainingExecutionMs() ?? slice);
-                                    if (await driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, slice, { regex: true })) {
+                                    if (await workerTransport.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, slice, { regex: true })) {
                                         processExited = true;
                                         break;
                                     }
-                                    const paneText = await driver.read(slot, 500);
+                                    const paneText = await workerTransport.read(slot, 500);
                                     if (paneText.length > 0)
                                         everHadOutput = true;
                                     if (startupFailureInWindow(paneText, workerLaunchedAt)) {
@@ -4357,7 +4671,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     if (await harvestConcludes(Date.now() - lastProgressAt))
                                         break;
                                 }
-                                output = await driver.read(slot, 500);
+                                output = await workerTransport.read(slot, 500);
                                 exitCode = Number(exitRe.exec(output)?.[1] ?? 1);
                                 // Completion is the trailer, exactly as in the interactive loop. A process that exited
                                 // without one is finished:false with a non-null exitCode — the harvest synthesis then owns
@@ -4375,13 +4689,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // interactive attempts to the same exit marker before close and the post-hoc usage disk read
                         // so a writer never races the reader (real CLIs can flush usage asynchronously after the trailer).
                         if (interactive && finished && !exitRe.test(output)) {
-                            await driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, 2_000, { regex: true }).catch(noteDriverUnreadable);
+                            await workerTransport.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, 2_000, { regex: true }).catch(noteDriverUnreadable);
                         }
                         // Free availability reroutes deliberately reuse the charged-attempt ordinal. Stream artifacts
                         // cannot: every dispatch owns bytes that must remain independently recoverable, so derive the
                         // append-only dispatch ordinal from the journal instead of overwriting an earlier a<n>.out.
                         const streamAttempt = journal.read().filter((event) => event.event === "task-dispatch" && event.taskId === t.id).length - 1;
-                        const capturedStream = await captureWorkerStream(journal.dir, t.id, streamAttempt, driver, slot, output);
+                        const capturedStream = await captureWorkerStream(journal.dir, t.id, streamAttempt, { ...trackedDriver, ...workerTransport }, slot, output);
                         // An interactive settle already selected the bounded parse it is allowed to use. Every other
                         // path parses the common final stream snapshot — notably envelope adapters whose trailer is
                         // encoded and therefore invisible to the raw wait regex. Keep `output` bounded: every text
@@ -4466,7 +4780,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // (provider outage, quota banner, dead CLI) must still route; the harvest synthesis only
                         // decides whether THIS attempt's worktree goes to gates, and when routing wins instead, the
                         // commits survive via the existing commitsToCarry/cherryPickCommits carry-forward.
-                        if (workerFinished && !result.ok && await dispositionScopeRed(t, [], assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode))
+                        if (workerFinished && !result.ok && await dispositionScopeRed(t, [], assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode, await treeOrDiffPaths(taskBase, wt)))
                             return;
                         if (!workerFinished && !processExited && (timedOut || deadChannelKilled || quotaBannerKilled)) {
                             const seat = channelKey(assignment);
@@ -4741,6 +5055,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         let results = [];
                         let commits = [];
                         gateLoop: while (true) {
+                            fatalStop.signal.throwIfAborted();
                             executionSignal()?.throwIfAborted();
                             const gated = await gitHead(wt);
                             gateSubject = { commit: await gateCommitSubject(taskBase, gated, wt), attempt };
@@ -4755,7 +5070,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     && e.data.attempt === attempt - 1)
                                 : [];
                             journal.phaseStart(t.id, "gates");
-                            const replay = previousRows.length > 0
+                            const replay = !explicitlyFundedAttempt && previousRows.length > 0
                                 && previousRows.every((e) => e.data.commit === gateSubject.commit)
                                 && previousRows.some((e) => e.data.pass === false && e.data.skipped !== true);
                             if (replay) {
@@ -4782,6 +5097,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     commands, baseline, channels: pools.review, judgeChannels: pools.judge, adapters, cfg, artifactDir: journal.dir,
                                     collateral: collateral.get(t.id) ?? [],
                                     selectTests: !testGateFailed,
+                                    cachedRedBypass: explicitlyFundedAttempt ? "operator-rerun" : undefined,
                                     via: cfg.visibility.llm === "pane"
                                         ? {
                                             driver: trackedDriver,
@@ -4820,6 +5136,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // gate-fail brief is, so prior-RUN evidence (retired by its own rule, not by this reviewer)
                                 // survives and only this run's settled findings go.
                                 feedback = withCarriedEvidence("");
+                                fatalStop.signal.throwIfAborted();
                                 executionSignal()?.throwIfAborted();
                                 const m = await mergeSerial(taskBranch, t, gated);
                                 if (m.tipMoved) {
@@ -4889,7 +5206,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // v1.53 T3: prefer the CLI's own session id captured from this attempt's output (kimi's resume
                         // trailer) over the harness slot name; absent hook or no capture keeps today's slot-name id.
                         retrySession = { channel: channelKey(assignment), id: adapter.sessionIdFrom?.(output) ?? sessionId, contextTokens };
-                        feedback = withCarriedEvidence(results.filter(gateFailed).map((g) => `${g.gate}: ${g.details}`).join("\n\n"));
+                        feedback = withCarriedEvidence(repairFindingsBrief(results));
                         // OBS-189/G3 (park-economics patch): a request-changes review is a findings brief, not a worker
                         // defect — the fix attempt stays on the same channel with the findings as feedback and consumes
                         // no escalation-ladder rung. Bounded by the engagement round cap at the top of this loop.
@@ -4917,7 +5234,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const repairable = narrowRepairBattery(repairBattery) && lostCommits.length === 0 && landed.length > 0;
                         const repairHistory = repairReachSinceApproval(journal.read(), t.id);
                         const repairsDrawn = repairsSinceApproval(journal.read(), t.id);
-                        const repair = repairable && repairsDrawn < MAX_REPAIRS;
+                        const repair = repairable && repairsDrawn < MAX_REPAIRS && attempt + 1 < MAX_ATTEMPTS;
                         // v1.85 T3: the fingerprint cap. Two normalized-identical failures of one DETERMINISTIC gate on
                         // one task (volatile tokens — worktree prefixes, line refs, durations, run ids — are not
                         // information) mean the round about to be bought is a re-measurement: ~663m across 5 runs went to
@@ -5077,7 +5394,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     });
                 };
                 taskLoopStarted = true;
-                const inflight = new Map();
+                fatalPhase = "scheduler";
                 // A settled worker can release a dependency or an approval in the same poll tick.
                 // Audit the current graph at every empty-flight boundary, never a prior ready snapshot.
                 // WB-1 rider: `end-condition-held` names a CLOSE the daemon refused, so only a close attempt journals
@@ -5096,6 +5413,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     return true;
                 };
                 closeLoop: while (true) {
+                    fatalPhase = "scheduler";
                     let approvalDeadline;
                     while (true) {
                         // v1.54 T2: a signal that landed while nothing was racing `aborted` (empty inflight window)
@@ -5122,7 +5440,23 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         cleanupErrors.push({ slot: slot.name, attempt: owner.attempt, error: String(error) });
                                     }
                                 }
+                                if (fatalStop.signal.aborted)
+                                    return;
                                 const cleanupEvidence = cleanupErrors.length ? { cleanupErrors } : {};
+                                if (err instanceof HeldProbeExhausted) {
+                                    const wt = worktreePath(repoRoot, `${branch}--${t.id}`);
+                                    let ref = await withoutExecutionBudget(() => preserveWorktree(wt));
+                                    if (!ref) {
+                                        const head = await gitHead(wt);
+                                        ref = `refs/tickmarkr/preserved/${head}`;
+                                        const saved = await shGit(`git update-ref ${shq(ref)} ${shq(head)}`, wt);
+                                        if (saved.code !== 0)
+                                            throw new Error(`could not preserve ${head}: ${saved.stderr}`);
+                                    }
+                                    journal.append("worktree-preserved", t.id, { ref });
+                                    await park(t, err.message, "infra", null, 0, Date.now(), 0, 0, undefined, 0, "fresh", { disposition: "transport-uncertain", ref, ...cleanupEvidence });
+                                    return;
+                                }
                                 if (err instanceof ExecutionBudgetExceeded) {
                                     const wt = worktreePath(repoRoot, `${branch}--${t.id}`);
                                     const ref = await preserveWorktree(wt);
@@ -5210,7 +5544,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                         blocked: blockedTasks(graph).map((t) => t.id),
                         pending: pendingTasks(graph).map((t) => t.id),
                     };
+                    fatalPhase = "baseline";
                     await baselineCapture; // also drain capture when every worker parks or fails before its gates
+                    fatalPhase = "tip-verify";
                     // OBS-34: post-merge integration-tip verify — strict exit codes, no baseline forgiveness.
                     const lastMergedTask = [...journal.read()].reverse().find((e) => e.event === "merge" && e.taskId)?.taskId;
                     if (summary.done.length > 0 && Object.keys(commands).length > 0) {
@@ -5253,9 +5589,14 @@ export async function runDaemon(repoRoot, opts = {}) {
                             clearTimeout(poll);
                         }
                         summary.tipVerify = tipFailed ? "failed" : "passed";
+                        summary.tipProof = runEndTipProof(journal.read());
                         if (tipFailed && lastMergedTask)
                             summary.lastMergedTask = lastMergedTask;
                     }
+                    else {
+                        // Exactly one proof per close: no cycle ran for THIS close, and an earlier one is not inherited.
+                        summary.tipProof = { kind: "incomplete" };
+                    }
                     // T14: read the journal, not the startup `approved` set — an approval appended DURING this run is
                     // exactly the one the set cannot see, and it is the one the record has to name.
                     //
@@ -5263,6 +5604,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // graph.lock release in the outer finally: an approval that wins first is included below, while an
                     // approval that loses cannot append until the live owner is gone and reports recorded-no-owner.
                     // Thus no accepted approval can land after this sample while still being attributed to this run.
+                    fatalPhase = "scheduler";
                     const approvalSerialization = await acquireApprovalSerialization(repoRoot, runId);
                     releaseApprovalSerialization = approvalSerialization.release;
                     // Close the last poll-to-run-end race while holding the same serializer as approve.
@@ -5294,7 +5636,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     const tipFail = summary.tipVerify === "failed"
                         ? ` — TIP VERIFY FAILED on ${summary.lastMergedTask ? `last merge ${summary.lastMergedTask}` : "integration tip"}`
                         : "";
-                    await driver.notify(`tickmarkr ${runId}: ${summary.done.length} done, ${summary.failed.length} failed, ${summary.human.length} awaiting human, ${summary.blocked.length} blocked, ${summary.pending.length} pending${attribution ? ` (${attribution})` : ""}${tipFail} — integration branch ${branch} (merge to main is yours)`, { tier: summary.tipVerify === "failed" ? "attention" : "routine" });
+                    await driver.notify(`tickmarkr ${runId}: ${summary.done.length} done, ${summary.failed.length} failed, ${summary.human.length} awaiting human, ${summary.blocked.length} blocked, ${summary.pending.length} pending${attribution ? ` (${attribution})` : ""}${tipFail} — ${formatTipProof(summary.tipProof)} — integration branch ${branch} (merge to main is yours)`, { tier: summary.tipVerify === "failed" ? "attention" : "routine" });
                     return summary;
                 }
             });
@@ -5304,8 +5646,22 @@ export async function runDaemon(repoRoot, opts = {}) {
         // T7 (v1.86): guarded — a journal read/append failure while recording the fatal run-end is
         // reported alongside err, never instead of it; recordFatalRunEnd never throws, so the original
         // error (message, stack, cause) always reaches the caller verbatim.
-        if (runStarted && (!taskLoopStarted || baselineFailed))
-            recordFatalRunEnd(journal, runId, branch, err);
+        // Freeze failure-time buckets, stop new dispatch, and drain all journal writers before closing.
+        if (!deliberateTermination) {
+            const failedGraph = graph;
+            const phase = taskLoopStarted ? (baselineFailed ? "baseline" : fatalPhase) : "setup";
+            fatalStop.abort(err);
+            await retireFatalSlots?.();
+            await Promise.allSettled(inflight.values());
+            await baselineCapture.catch(() => { });
+            if (runStarted && !deliberateTermination) {
+                const tipProof = recordFatalRunEnd(journal, runId, branch, err, taskLoopStarted || opts.resume ? failedGraph : undefined, phase);
+                // The fatal close states its proof too; a dead notifier never replaces the original error.
+                if (tipProof) {
+                    await driver.notify(`tickmarkr ${runId}: run crashed — ${formatTipProof(tipProof)} — integration branch ${branch}`, { tier: "attention" }).catch(() => { });
+                }
+            }
+        }
         throw err;
     }
     finally {