tickmarkr 2.5.7 → 2.5.9

package/dist/run/daemon.js

@@ -31,10 +31,11 @@ import { failureDisposition, reserveInfrastructureRetry } from "./recovery.js";
 import { runEnvironment } from "./environment.js";
 import { cleanupRunWorktrees, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, preserveWorktree, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shGit, SUITE_PARENT_ENV, verificationProtocol, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
-import { applyScopeAmendments, activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, outstandingReviewFindings, pendingRechecks, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
+import { classifyRepairDisposition, resolveScopeHints } from "./repair-disposition.js";
+import { applyScopeAmendments, activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, outstandingReviewFindings, pendingApprovalActions, pendingRechecks, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
 import { isDiffCapPark, pickReviewer } from "../gates/review.js";
 import { acquireApprovalSerialization, acquireRunLock, isPidLive, releaseRunLock } from "./lock.js";
-import { ensureIntegration, integrationBranch, integrationHead, mergeTask, verifyIntegrationTip } from "./merge.js";
+import { ensureIntegration, integrationBranch, integrationHead, mergeTask, reusedTipEvidence, verifyIntegrationTip } from "./merge.js";
 import { climbChannel, marginalCostRank, nextChannel, route } from "../route/router.js";
 import { desiredPanes } from "./reconcile.js";
 import { readTierLiveness, readWatchBoard, supervisionBeatPath } from "./supervision.js";
@@ -163,6 +164,27 @@ export function resolveRunMode(repoRoot, opts = {}) {
         : undefined;
     return { cfg: resolved.cfg, mode: resolved.mode, source, ...(conflict ? { conflict } : {}) };
 }
+// Bind approval context before dispatch consumes the release. Restore reconstructs the same
+// binding from journal order; a newer approval, including one without a reason, supersedes it.
+function approvalReviewContext(events, taskId, restore = false) {
+    let pending;
+    let bound;
+    let approved = false;
+    for (const row of events) {
+        if (row.taskId !== taskId)
+            continue;
+        if (row.event === "task-approved") {
+            pending = typeof row.data.reason === "string" ? row.data.reason.trim() || undefined : undefined;
+            approved = true;
+        }
+        else if (row.event === "task-dispatch" || (row.event === "recheck-battery" && approved)) {
+            bound = pending;
+            pending = undefined;
+            approved = false;
+        }
+    }
+    return restore && !approved ? bound : pending;
+}
 // T14: the events that prove an approval was ENACTED — narrowly causal, never merely subsequent.
 // Ordinary, attempt-cap and review-upheld approvals buy a WORKER, so their proof is a dispatch;
 // recheck has its own battery enactment below. Generic terminal events are deliberately NOT proof: an approved human-gate
@@ -175,6 +197,17 @@ const RECHECK_ENACTMENT = "recheck-battery";
 // persisted task branch after the approved gate (execTask's satisfiedGate branch), whose first act
 // for the task is worktree-recreation. That event is causal for this path, not incidental.
 const GATE_SATISFIED_ENACTMENT = "worktree-recreation";
+// Older daemons enacted rechecks through worker-launch, before recheck-battery existed.
+// Preserve that consumption at every scheduling read without changing continuing permission.
+function pendingDaemonApprovalActions(events) {
+    const actions = pendingApprovalActions(events);
+    const rechecks = pendingRechecks(events);
+    for (const [id, action] of actions) {
+        if (action.authority === "battery" && !rechecks.has(id))
+            actions.delete(id);
+    }
+    return actions;
+}
 /**
  * T14, amended by v2.2 T3: approvals the run accepted and never acted on. `approved` above is still
  * built ONCE at startup — replay determinism depends on it — but a live approval is no longer inert:
@@ -357,6 +390,14 @@ function repairDiffFilesCut(diff, cap, names) {
     });
     return files;
 }
+/** Assertion evidence is context, never part of the normalized failure identity. */
+function repairFindingsBrief(results) {
+    return results.filter(gateFailed).map((g) => {
+        const evidence = g.meta?.failureEvidence;
+        return `${g.gate}: ${g.details}` + (Array.isArray(evidence) && evidence.length
+            ? `\nAssertion evidence:\n${JSON.stringify(evidence, null, 2)}` : "");
+    }).join("\n\n");
+}
 /** The fix-only contract: the findings verbatim, then the diff content of the work already landed. */
 function repairBrief(findings, diff, baseRef) {
     const repair = { findings, diff };
@@ -644,7 +685,7 @@ function lastVerifyCycle(events) {
         if (e.event === "tip-verify-start") {
             const { tip, cmdHash } = e.data;
             cur = typeof tip === "string" && typeof cmdHash === "string"
-                ? { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [e.data.capacity] }
+                ? { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [e.data.capacity], evidenceByGate: new Map() }
                 : undefined;
             afterRunEnd = false;
             continue;
@@ -667,7 +708,7 @@ function lastVerifyCycle(events) {
             continue;
         }
         if (!cur || afterRunEnd || cur.tip !== tip || cur.cmdHash !== cmdHash) {
-            cur = { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [] };
+            cur = { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [], evidenceByGate: new Map() };
         }
         afterRunEnd = false;
         // T7: EVERY verdict row's own capacity, not just the start row's. The start row is a statement of
@@ -679,6 +720,7 @@ function lastVerifyCycle(events) {
             cur.failed = true;
         else {
             cur.gates.add(gate);
+            cur.evidenceByGate.set(gate, e.data);
             // Q121s review M1: a forgiven green depends on the baseline that forgave it. Baselines are not
             // part of the cache key, so a forgiven cycle is NEVER cache-eligible — an unchanged tip whose
             // baseline later vanishes or changes must re-run the full verify, not inherit the green.
@@ -688,6 +730,47 @@ function lastVerifyCycle(events) {
     }
     return cur;
 }
+/**
+ * OBS-1077 close rider: what the engagement's LATEST verification cycle proved — its
+ * `tip-verify-start` row and what followed, never a commit comparison. Exactly one kind per close:
+ * fresh (every tip command ran AND passed), reused (an eligible cached cycle carried forward),
+ * failed, or incomplete (cancelled, cut short, mixed or undelimited). Nothing before the start row
+ * is read, so an unfinished cycle inherits nothing from an earlier green one.
+ */
+export function runEndTipProof(events) {
+    const start = events.map((e) => e.event).lastIndexOf("tip-verify-start");
+    if (start < 0)
+        return { kind: "incomplete" };
+    const { tip: rawTip, gates: rawGates } = events[start].data;
+    const tip = typeof rawTip === "string" ? rawTip : undefined;
+    const proof = (kind) => ({ kind, ...(tip ? { tip } : {}) });
+    const after = events.slice(start + 1);
+    if (after.some((e) => e.event === "tip-verify-failed"))
+        return proof("failed");
+    if (after.some((e) => e.event === "tip-verify-cancelled"))
+        return proof("incomplete");
+    const rows = after.filter((e) => e.event === "tip-verify" && e.data.pass === true && e.data.tip === tip);
+    const gates = Array.isArray(rawGates) ? rawGates : [];
+    if (!tip || gates.length === 0 || !gates.every((g) => rows.some((r) => r.data.gate === g)))
+        return proof("incomplete");
+    const carried = rows.filter((r) => r.data.cached === true).length;
+    const cachedRow = after.some((e) => e.event === "tip-verify-cached");
+    // A whole-cycle carry must be declared by the start row, stated by the cache row and borne by every verdict row.
+    if ((events[start].data.cached === true) !== cachedRow || (cachedRow && carried !== rows.length))
+        return proof("incomplete");
+    // D-131: fresh only when EVERY command executed; one per-gate persisted verdict makes the cycle reused.
+    return carried > 0 ? proof("reused") : proof("fresh");
+}
+/** The close notification's statement of the proof — one clause per kind. */
+export function formatTipProof(p) {
+    const at = p.tip ? ` ${p.tip.slice(0, 12)}` : "";
+    switch (p.kind) {
+        case "fresh": return `tip proof: fresh — every tip command ran and passed on${at || " the integration tip"}`;
+        case "reused": return `tip proof: reused — carried from verified commit${at}, commands not re-run`;
+        case "failed": return `tip proof: failed —${at ? ` commit${at}` : ""} latest verification cycle is red`;
+        case "incomplete": return `tip proof: incomplete —${at ? ` commit${at}` : ""} latest verification cycle did not finish`;
+    }
+}
 // Isolate the battery so cancellation can stop its control flow as well as its shell children.
 // The child uses the same verifier and capacity; only the daemon writes lifecycle verdict rows.
 async function cancellableTipBattery(intWt, commands, runDir, baseline, signal) {
@@ -848,7 +931,7 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
         // pass — `cached: true` keeps it honest about not having re-run the command.
         for (const gate of gates) {
             const cmd = gate === "test" && commands.tipTest ? commands.tipTest : commands[gate];
-            journal.append("tip-verify", undefined, { gate, cmd, pass: true, exitCode: 0, cached: true, tip, cmdHash, capacity });
+            journal.append("tip-verify", undefined, { ...reusedTipEvidence(last.evidenceByGate.get(gate) ?? {}), gate, cmd, pass: true, exitCode: 0, cached: true, tip, cmdHash, capacity });
         }
         return false;
     }
@@ -857,12 +940,22 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
         ? cancellableTipBattery(intWt, commands, journal.dir, opts.baseline, opts.signal)
         : verifyIntegrationTip(intWt, commands, journal.dir, opts.baseline))) {
         const measuredCapacity = r.capacity ?? capacity;
+        const evidence = r.reused ? reusedTipEvidence(r) : {
+            ...(r.originRunRoot ? { originRunRoot: r.originRunRoot } : {}),
+            ...(r.cause ? { cause: r.cause } : {}),
+            ...(r.evidenceReceipt ? { evidenceReceipt: r.evidenceReceipt } : {}),
+            ...(r.evidenceReceipts ? { evidenceReceipts: r.evidenceReceipts } : {}),
+            ...(r.evidenceAbsence ? { evidenceAbsence: r.evidenceAbsence } : {}),
+            ...Object.fromEntries(["nonce", "stdoutPath", "stderrPath"]
+                .filter(key => r[key] !== undefined).map(key => [key, r[key]])),
+        };
         if (r.pass) {
             // Q121s: a forgiven pass journals its fingerprints — honest about what was carried, never a silent green.
-            journal.append("tip-verify", undefined, { gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints } : {}), tip, cmdHash, capacity: measuredCapacity });
+            journal.append("tip-verify", undefined, { ...evidence, gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.reused ? { cached: true } : {}), ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints } : {}), tip, cmdHash, capacity: measuredCapacity });
         }
         else {
             journal.append("tip-verify-failed", undefined, {
+                ...evidence,
                 gate: r.gate,
                 cmd: r.cmd,
                 exitCode: r.exitCode,
@@ -1411,11 +1504,23 @@ const terminateTornJournalTail = (journalPath) => {
 // a persistently unwritable sink reports a crash naming the journal path and carrying NO terminal
 // record, rather than fabricating an ended run on evidence the harness could not write. (OBS-313:
 // with the sink dead the crash CAUSE is unrecordable — recorded as an observation, not papered over.)
-function recordFatalRunEnd(journal, runId, branch, err) {
+export function recordFatalRunEnd(journal, runId, branch, err, graph, phase = "setup") {
     const original = err instanceof Error ? err.message : String(err);
+    // A fatal close never finished a cycle: fresh/reused green is withheld, a recorded red still stands.
+    let tipProof = { kind: "incomplete" };
     try {
-        if (journal.read().some((e) => e.event === "run-end"))
-            return; // already terminal — nothing to add
+        // Only the latest engagement can already own this terminal outcome.
+        const events = journal.read();
+        let from = events.length;
+        while (from > 0) {
+            const event = events[--from];
+            if (event.event === "run-start" || event.event === "run-resume")
+                break;
+            if (event.event === "run-end")
+                return undefined;
+        }
+        const latest = runEndTipProof(events.slice(from));
+        tipProof = { ...latest, kind: latest.kind === "failed" ? "failed" : "incomplete" };
     }
     catch (readErr) {
         console.error(`tickmarkr ${runId}: journal read failed while recording the fatal run-end (${readErr instanceof Error ? readErr.message : String(readErr)}) — original error: ${original}`);
@@ -1423,18 +1528,19 @@ function recordFatalRunEnd(journal, runId, branch, err) {
     const record = {
         runId,
         branch,
-        done: [],
-        failed: [],
-        human: [],
-        blocked: [],
-        pending: [],
-        phase: "setup",
+        done: graph?.tasks.filter((t) => t.status === "done").map((t) => t.id) ?? [],
+        failed: graph?.tasks.filter((t) => t.status === "failed").map((t) => t.id) ?? [],
+        human: graph?.tasks.filter((t) => t.status === "human").map((t) => t.id) ?? [],
+        blocked: graph ? blockedTasks(graph).map((t) => t.id) : [],
+        pending: graph ? pendingTasks(graph).map((t) => t.id) : [],
+        phase,
         fatal: true,
         error: original,
+        tipProof,
     };
     try {
         journal.append("run-end", undefined, record);
-        return;
+        return tipProof;
     }
     catch {
         // one retry below — the first failure is reported only if the retry also fails
@@ -1443,6 +1549,7 @@ function recordFatalRunEnd(journal, runId, branch, err) {
     try {
         terminateTornJournalTail(journalPath);
         journal.append("run-end", undefined, record);
+        return tipProof;
     }
     catch (retryErr) {
         console.error(`tickmarkr ${runId}: run crashed — no terminal record written; journal sink unwritable at ${journalPath} (${retryErr instanceof Error ? retryErr.message : String(retryErr)}) — original error: ${original}`);
@@ -1512,12 +1619,18 @@ export async function runDaemon(repoRoot, opts = {}) {
     let journal;
     let runStarted = false;
     let taskLoopStarted = false;
+    let graph;
+    let fatalPhase = "setup";
+    let deliberateTermination = false;
+    const fatalStop = new AbortController();
+    const inflight = new Map();
+    let retireFatalSlots;
     let branch = "";
     let releaseApprovalSerialization;
     let baselineCapture = Promise.resolve();
     let baselineFailed = false;
     try {
-        let graph = loadGraph(repoRoot);
+        graph = loadGraph(repoRoot);
         // One bounded snapshot supplies every dispatch. On resume the current journal still participates
         // in the fold so its task-done/ordinary-approval events can retire older evidence, but findings it
         // produced are suppressed: same-run feedback already replays those bytes and must not deliver them
@@ -1629,6 +1742,14 @@ export async function runDaemon(repoRoot, opts = {}) {
                         await reapWorker(slot);
                         await driver.close(slot);
                     } }, s);
+                retireFatalSlots = async () => {
+                    for (const slot of Array.from(liveSlots)) {
+                        try {
+                            await closeSlot(slot);
+                        }
+                        catch { /* preserve the original fatal error */ }
+                    }
+                };
                 const budgetSlots = new Map();
                 const trackedDriver = {
                     id: driver.id,
@@ -1637,19 +1758,24 @@ export async function runDaemon(repoRoot, opts = {}) {
                     ...(driver.describe ? { describe: driver.describe.bind(driver) } : {}),
                     ...(driver.focus ? { focus: driver.focus.bind(driver) } : {}),
                     slot: async (cwd, name, o) => {
+                        fatalStop.signal.throwIfAborted();
                         const signal = executionSignal();
                         signal?.throwIfAborted();
                         const s = await driver.slot(cwd, name, o);
                         liveSlots.add(s);
                         if (signal)
                             budgetSlots.get(signal)?.add(s);
-                        if (signal?.aborted) {
+                        if (signal?.aborted || fatalStop.signal.aborted) {
                             await withoutExecutionBudget(() => closeSlot(s));
-                            signal.throwIfAborted();
+                            fatalStop.signal.throwIfAborted();
+                            signal?.throwIfAborted();
                         }
                         return s;
                     },
-                    run: (s, cmd) => driver.run(s, cmd),
+                    run: (s, cmd) => {
+                        fatalStop.signal.throwIfAborted();
+                        return driver.run(s, cmd);
+                    },
                     waitOutput: (s, p, ms, o) => driver.waitOutput(s, p, ms, o),
                     waitAgentStatus: (s, st, ms) => driver.waitAgentStatus(s, st, ms),
                     status: (s) => driver.status(s),
@@ -1692,6 +1818,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                 const exit = opts.exit ?? ((code) => process.exit(code));
                 onTermination = (sig) => {
                     termSignal = sig;
+                    deliberateTermination = true;
                     void (async () => {
                         if (!reaping) {
                             reaping = true;
@@ -1794,7 +1921,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                 // flag. Startup approvals seed the first scheduling pass; live approvals are folded at task
                 // boundaries below so a sibling can release parked work without waiting for run-end + resume.
                 const approvalStartupEvents = journal.read();
-                const approved = new Set(approvalStartupEvents.filter((e) => e.event === "task-approved" && e.taskId).map((e) => e.taskId));
+                // Continuing human-gate permission survives enactment; malformed releases grant none.
+                const validApproval = (e) => e.event === "task-approved" && e.taskId
+                    && pendingApprovalActions([e]).get(e.taskId)?.authority !== "inert";
+                const approved = new Set(approvalStartupEvents.filter(validApproval).map((e) => e.taskId));
+                const startupActions = pendingDaemonApprovalActions(approvalStartupEvents);
                 let approvalSweepCursor = approvalStartupEvents.length;
                 const commands = detectGateCommands(repoRoot, cfg);
                 const watchName = formatOwnedName({ role: "watch", taskId: "run", attempt: 0, runId });
@@ -1900,6 +2031,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     const startedAt = Date.now();
                     for (;;) {
                         signal?.throwIfAborted();
+                        fatalStop.signal.throwIfAborted();
                         executionSignal()?.throwIfAborted();
                         const count = await liveSuiteCount(repoRoot);
                         if (count === 0)
@@ -1941,11 +2073,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                 // Empty Map on fresh runs — every seed below conditions on resume.get(t.id), never on opts.resume (the
                 // GATE-08 lesson at the humanGate guard: condition on the data, not the code path). Dead-code
                 // equivalence to the router.ts:194 profile⇒undefined pattern: no map entry ⇒ today's literal.
-                let resume = opts.resume ? journal.replayResumeState() : new Map();
-                let satisfiedGates = opts.resume ? journal.replaySatisfiedGates() : new Map();
-                let replayedGateResults = resumeLifecycleOpen
+                const resume = opts.resume ? journal.replayResumeState() : new Map();
+                const satisfiedGates = opts.resume ? journal.replaySatisfiedGates() : new Map();
+                const replayedGateResults = resumeLifecycleOpen
                     ? journal.replayCurrentAttemptGateResults()
                     : new Map();
+                for (const [taskId, action] of startupActions) {
+                    if (action.authority === "worker")
+                        replayedGateResults.delete(taskId);
+                }
                 // T7: the capacity THIS session resolved — read inside the run's fork budget, so it is the number
                 // every shell this run spawns will divide the machine by. Recorded evidence from another session
                 // is only reusable against this.
@@ -1998,7 +2134,29 @@ export async function runDaemon(repoRoot, opts = {}) {
                     }
                     baseline = JSON.parse(readFileSync(join(journal.dir, "baseline.json"), "utf8"));
                     const replayEvents = journal.read();
-                    for (const [id, st] of journal.replayStatuses()) {
+                    // journal.replayStatuses predates typed releases and re-pends even inert rows. Keep that
+                    // legacy reader intact; scheduling accepts only the fold's recognised authorities.
+                    const statuses = new Map();
+                    for (const e of replayEvents) {
+                        if (!e.taskId)
+                            continue;
+                        if (e.event === "task-dispatch")
+                            statuses.set(e.taskId, "pending");
+                        else if (e.event === "task-done")
+                            statuses.set(e.taskId, "done");
+                        else if (e.event === "task-failed")
+                            statuses.set(e.taskId, "failed");
+                        else if (e.event === "task-human")
+                            statuses.set(e.taskId, "human");
+                        else if (validApproval(e))
+                            statuses.set(e.taskId, "pending");
+                    }
+                    for (const [id, action] of startupActions) {
+                        // Legacy gate-only approvals can finish and merge without a dispatch consuming funding.
+                        if (action.authority !== "inert" && statuses.get(id) !== "done")
+                            statuses.set(id, "pending");
+                    }
+                    for (const [id, st] of statuses) {
                         if (opts.retryFailed && st === "failed" && recordedTaskFailureKind(replayEvents, id) === "dispatch") {
                             graph = setStatus(graph, id, "pending");
                             // OBS-254: clear ATTEMPT AND CHANNEL STATE ONLY. Deleting the whole entry also deleted
@@ -2021,6 +2179,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         ...(opts.retryFailed ? { retryFailed: true } : {}),
                         ...(opts.graphChanged ? { graphChanged: true } : {}), // OBS-1073: the release is the engagement's
                     });
+                    runStarted = true;
                     await placeBoard();
                 }
                 else {
@@ -2142,6 +2301,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                 let mergeChain = Promise.resolve();
                 const mergeSerial = (taskBranch, t, gated) => {
                     const next = mergeChain.then(() => {
+                        fatalStop.signal.throwIfAborted();
                         executionSignal()?.throwIfAborted();
                         journal.phaseStart(t.id, "merge");
                         return mergeTask(intWt, taskBranch, `tickmarkr: merge ${t.id} ${t.title}`, gated);
@@ -2173,15 +2333,22 @@ export async function runDaemon(repoRoot, opts = {}) {
                     const tree = await shGit("git ls-files -z", wt);
                     return new Set([...(tree.code === 0 ? tree.stdout.split("\0").filter(Boolean) : []), ...await diffPaths(base, wt)]);
                 };
+                // The base each task was dispatched on: the integration branch moves when a sibling merges, the pin does not.
+                const taskBases = new Map();
                 const park = async (t, reason, kind, assignment, attempts, startMs, gateFails = 0, consults = 0, tokens, metered = 0, retryMode = "fresh", details = {}) => {
                     // OBS-979: a worker refusal can identify the missing authoring scope even when gates
                     // subsequently supply the park's disposition. Keep that actionable path on the park itself.
                     const worker = journal.read().reverse().find((e) => e.taskId === t.id && e.event === "worker-result");
                     if (!details.approveCommand && t.files.length > 0 && worker?.data.ok === false && typeof worker.data.summary === "string") {
                         const allowed = filesGlob(t.files);
-                        const paths = namedPaths(worker.data.summary).filter((path) => !allowed(path) && existsSync(join(repoRoot, path)));
+                        // OBS-1072 residual: the same inventory as the main path — the task tree and its diff from the
+                        // task's PINNED base, never the main checkout and never the moving integration branch.
+                        const wt = worktreePath(repoRoot, `${branch}--${t.id}`);
+                        const inventory = existsSync(wt) ? await treeOrDiffPaths(taskBases.get(t.id) ?? "HEAD", wt) : new Set();
+                        const paths = resolveScopeHints(namedPaths(worker.data.summary).filter((path) => !allowed(path)), inventory)
+                            .resolved.filter((path) => !allowed(path));
                         if (paths.length)
-                            reason += ` — files[] repair hint: ${[...new Set(paths)].join(", ")}`;
+                            reason += ` — files[] repair hint: ${paths.join(", ")}`;
                     }
                     graph = setStatus(graph, t.id, "human");
                     saveGraph(repoRoot, graph);
@@ -2212,42 +2379,34 @@ export async function runDaemon(repoRoot, opts = {}) {
                 const dispositionScopeRed = async (t, results, assignment, attempts, startMs, gateFails, consults, tokens, metered, retryMode, changed = new Set()) => {
                     const scopeRed = results.find((g) => g.gate === "scope" && gateFailed(g));
                     const verdict = scopeRed?.meta?.collateral;
-                    if (!verdict && t.files.length > 0) {
-                        const allowed = filesGlob(t.files);
-                        const worker = journal.read().reverse().find((e) => e.taskId === t.id && e.event === "worker-result");
-                        const requested = worker?.data.ok === false && typeof worker.data.summary === "string"
-                            && /outside|out.of.scope|allowlist|scope expansion|not (?:in|own)|unowned/i.test(worker.data.summary)
-                            ? namedPaths(worker.data.summary).filter((path) => !allowed(path)) : [];
-                        const reds = results.filter(gateFailed);
-                        // A scope verdict already attributes actual out-of-scope EDITS using the collateral map.
-                        // Path-only diagnostics from the other gates name code that needs fixing, not an edit the
-                        // worker made. Do not replace the scope gate's stronger attribution with that inference.
-                        const hints = reds.filter((g) => g.gate !== "scope" || !g.meta?.collateral).flatMap((g) => namedPaths(g.details));
-                        const unresolved = [...new Set([...requested, ...hints].filter((path) => !changed.has(path)))];
-                        if (unresolved.length)
-                            journal.append("scope-hint-unresolved", t.id, { paths: unresolved,
-                                reason: `scope hint resolves to nothing in the task tree: ${unresolved.join(", ")}`, attempt: attempts + 1 });
-                        const refusal = requested.filter((path) => changed.has(path));
-                        const paths = hints.filter((path) => changed.has(path));
-                        if (refusal.length || (paths.length > 0 && paths.every((path) => !allowed(path)))) {
-                            const classification = {
-                                gate: refusal.length ? "worker" : reds[0]?.gate,
-                                paths: [...new Set(refusal.length ? refusal : paths)],
-                                repair: `files[] repair hint: ${[...new Set(refusal.length ? refusal : paths)].join(", ")}`,
-                                attempt: attempts + 1, chargeable: false, source: "diagnostic",
-                            };
-                            const scopeRequest = refusal.length > 0 || reds.some((g) => g.gate === "review");
-                            if (scopeRequest)
-                                journal.append("scope-request", t.id, classification);
-                            else
-                                journal.append("scope-authoring", t.id, classification);
-                            // OBS-547 (Leg-2 T3 material): unchargeable ⇒ metered 0, exactly as the predicted path below —
-                            // passing the physical count would write `meteredAttempts: 1` beside `attempts: 0`.
-                            const approveCommand = `tickmarkr approve ${runId} ${t.id} --files ${[...new Set(refusal.length ? refusal : paths)].map((path) => /^[\w./-]+$/.test(path) ? path : shq(path)).join(",")}`;
-                            await park(t, `${scopeRequest ? "scope request" : "authoring defect"} — files[] repair hint: ${[...new Set(refusal.length ? refusal : paths)].join(", ")}; current files[]: ${t.files.join(", ")}${scopeRequest ? `\n${approveCommand}` : ""}`, scopeRequest ? "scope-request" : "authoring", assignment, attempts, startMs, gateFails, consults, tokens, 0, retryMode, scopeRequest ? { paths: [...new Set(refusal.length ? refusal : paths)], approveCommand, graphDefinitionHash: graphDefinitionHash(graph) } : {});
-                            return true;
-                        }
+                    const worker = journal.read().reverse().find((e) => e.taskId === t.id && e.event === "worker-result");
+                    const disposition = classifyRepairDisposition({
+                        results, files: t.files, inventory: changed,
+                        refusalSummary: worker?.data.ok === false && typeof worker.data.summary === "string" ? worker.data.summary : undefined,
+                    });
+                    for (const diagnostic of disposition.diagnostics) {
+                        journal.append("scope-hint-unresolved", t.id, {
+                            paths: [diagnostic.candidate], reason: diagnostic.reason, diagnostic, attempt: attempts + 1,
+                        });
+                    }
+                    if (disposition.blocker === "infra")
+                        return false;
+                    if (!disposition.blocker && (disposition.kind === "scope-request" || disposition.kind === "authoring")) {
+                        const paths = disposition.paths;
+                        const scopeRequest = disposition.kind === "scope-request";
+                        const classification = {
+                            gate: disposition.source, paths, repair: `files[] repair hint: ${paths.join(", ")}`,
+                            attempt: attempts + 1, chargeable: false, source: "diagnostic",
+                        };
+                        if (scopeRequest)
+                            journal.append("scope-request", t.id, classification);
+                        else
+                            journal.append("scope-authoring", t.id, classification);
+                        const approveCommand = `tickmarkr approve ${runId} ${t.id} --files ${paths.map((path) => /^[\w./-]+$/.test(path) ? path : shq(path)).join(",")}`;
+                        await park(t, `${scopeRequest ? "scope request" : "authoring defect"} — files[] repair hint: ${paths.join(", ")}; current files[]: ${t.files.join(", ")}${scopeRequest ? `\n${approveCommand}` : ""}`, scopeRequest ? "scope-request" : "authoring", assignment, attempts, startMs, gateFails, consults, tokens, 0, retryMode, scopeRequest ? { paths, approveCommand, graphDefinitionHash: graphDefinitionHash(graph) } : {});
+                        return true;
                     }
+                    // A detection site permits the ordinary chargeable policy; it does not itself grant budget.
                     if (!verdict)
                         return false;
                     if (verdict.authoring) {
@@ -2284,17 +2443,33 @@ export async function runDaemon(repoRoot, opts = {}) {
                     approvalSweepCursor = events.length;
                     if (approvals.length === 0)
                         return;
-                    graph = applyScopeAmendments(graph, journal, false, opts.graphChanged === true); // OBS-1073: same release as launch
-                    resume = journal.replayResumeState();
-                    satisfiedGates = journal.replaySatisfiedGates();
-                    replayedGateResults = resumeLifecycleOpen
-                        ? journal.replayCurrentAttemptGateResults()
-                        : new Map();
+                    // Replay every authority from this pass's single snapshot. In particular, helper reads must
+                    // neither rescan the file under load nor observe approvals beyond approvalSweepCursor.
+                    // Keep audit writes on the live journal so narration and persistence retain their owner.
+                    const sweepJournal = Journal.open(repoRoot, runId);
+                    sweepJournal.read = () => events;
+                    sweepJournal.append = journal.append.bind(journal);
+                    graph = applyScopeAmendments(graph, sweepJournal, false, opts.graphChanged === true); // OBS-1073: same release as launch
+                    const actions = pendingDaemonApprovalActions(events);
+                    const nextResume = sweepJournal.replayResumeState();
+                    const nextSatisfied = sweepJournal.replaySatisfiedGates();
                     let changed = false;
-                    for (const e of approvals) {
-                        const taskId = e.taskId;
+                    for (const taskId of new Set(approvals.map((e) => e.taskId))) {
+                        const action = actions.get(taskId);
+                        if (!action || action.authority === "inert")
+                            continue;
                         approved.add(taskId);
-                        if (e.data.release !== GATE_SATISFIED_RELEASE)
+                        const state = nextResume.get(taskId);
+                        if (state)
+                            resume.set(taskId, state);
+                        else
+                            resume.delete(taskId);
+                        const gate = nextSatisfied.get(taskId);
+                        if (gate)
+                            satisfiedGates.set(taskId, gate);
+                        else
+                            satisfiedGates.delete(taskId);
+                        if (action.authority !== "waiver")
                             replayedGateResults.delete(taskId);
                         try {
                             const task = getTask(graph, taskId);
@@ -2311,6 +2486,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                         saveGraph(repoRoot, graph);
                 };
                 const execTask = async (t) => {
+                    const approvalAction = pendingDaemonApprovalActions(journal.read()).get(t.id);
+                    const fundedRerun = approvalAction?.authority === "worker";
                     const startMs = Date.now();
                     let stallSeat;
                     let stallReaps = 0;
@@ -2405,6 +2582,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // run; a park-instead policy can come later if it ever bites.
                     }
                     const taskHistory = journal.read().filter((e) => e.taskId === t.id);
+                    // Lifetime identity counts every dispatch, including legacy and unchargeable rows. Releases
+                    // reset the budget below, never this counter; observational annotations do not consume it.
+                    let nextWorkerDispatchOrdinal = taskHistory.filter((e) => e.event === "task-dispatch").length;
                     const lastApproval = taskHistory.map((e) => e.event).lastIndexOf("task-approved");
                     const priorClimb = taskHistory.slice(lastApproval + 1).reverse().find((e) => e.event === "tier-escalated");
                     if (!hintsChanged && priorClimb && taskHistory.indexOf(priorClimb) > taskHistory.map((e) => e.event).lastIndexOf("task-dispatch")) {
@@ -2421,7 +2601,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // exclusion-list-equality oracle. Daemon-side append only — no journal.ts write-path change (Phase 48
                     // stays unblocked); inert to replayStatuses (unknown events ignored, pinned at journal.test.ts:70-80).
                     if (rs)
-                        journal.append("resume-restore", t.id, { attempts: rs.attempts, tried: [...tried], assignment });
+                        journal.append("resume-restore", t.id, {
+                            attempts: rs.attempts, tried: [...tried], assignment,
+                            workerDispatchOrdinal: previousDispatch?.data.workerDispatchOrdinal ?? null,
+                        });
                     // Keep one live list: recovery retries must see exclusions added by onGate during the round.
                     const badReviewers = [...replayedReviewerExclusions];
                     const noteReviewEvent = (e) => {
@@ -2540,7 +2723,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 ...(typeof g.meta.preservedRef === "string" ? { preservedRef: g.meta.preservedRef } : {}),
                             } : {}),
                             ...(cfg.executionPolicy && !g.pass ? { disposition: failureDisposition(g) } : {}),
-                            ...Object.fromEntries(["runnerInfraRerun", "hostStarvedRerun", "recoveryBlocked", "failingFiles", "selectionDecision"]
+                            ...Object.fromEntries(["runnerInfraRerun", "hostStarvedRerun", "recoveryBlocked", "failingFiles", "selectionDecision", "failureEvidence"]
                                 .filter((key) => g.meta?.[key] !== undefined).map((key) => [key, g.meta[key]])),
                             // OBS-540: preserve terminal-vs-retryable infra exactly. normalizeGateOutcome deliberately
                             // defaults a legacy infra row to retryable, so dropping an explicit false here reverses the
@@ -2588,6 +2771,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                             // every recalibration this telemetry funds, a gap is honest and a zero is a lie. The
                             // seven-gate closed set is asserted end-to-end in tests/run/gate-telemetry.test.ts.
                             ...gateMeasurement(g.meta),
+                            // Fresh producer evidence is copied verbatim; absent/historical evidence is never minted here.
+                            ...(g.meta?.reused ? {} : {
+                                ...(g.evidenceReceipt ? { evidenceReceipt: g.evidenceReceipt } : {}),
+                                ...(g.evidenceReceipts ? { evidenceReceipts: g.evidenceReceipts } : {}),
+                                ...Object.fromEntries(["nonce", "stdoutPath", "stderrPath", "classification"]
+                                    .filter(key => g.meta?.[key] !== undefined).map(key => [key, g.meta[key]])),
+                            }),
                             // T7: the capacity the gate's own command child ran under, lifted verbatim from the result
                             // the battery produced — read where the shell built that child's environment, never
                             // re-derived from the run's own budget, which would answer a different number than the
@@ -2816,10 +3006,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // An operator approval skips its exact failed gate by authority; observed results skip only the
                     // contiguous green prefix whose recorded commit is still the task branch tip.
                     const satisfiedGate = satisfiedGates.get(t.id);
-                    const replayedGates = replayedGateResults.get(t.id);
-                    const recheck = pendingRechecks(journal.read()).has(t.id);
+                    const replayedGates = fundedRerun ? undefined : replayedGateResults.get(t.id);
+                    const recheck = approvalAction?.authority === "battery";
                     resumeGateReplay: if (satisfiedGate || replayedGates || recheck) {
                         const taskBase = await integrationHead(intWt);
+                        taskBases.set(t.id, taskBase);
                         const taskBranch = `${branch}--${t.id}`;
                         const priorWt = worktreePath(repoRoot, taskBranch);
                         // OBS-1022: the ref `approve --recheck` validated (commits ahead of the base) is the tree the
@@ -2920,6 +3111,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 continue;
                             priorResults.set(e.data.gate, e);
                         }
+                        const declaredGates = GATE_NAMES.filter((gate) => t.gates.includes(gate));
+                        const reused = [];
                         let remainingGates;
                         if (recheck) {
                             remainingGates = GATE_NAMES.filter((gate) => t.gates.includes(gate));
@@ -2973,49 +3166,42 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 });
                             }
                             let reusable = sameWorld && sameProtocol && (exactCurrentCommit || canonicalCurrentCommit || recreatedLegacyCommit);
-                            const reused = [];
-                            const declaredGates = GATE_NAMES.filter((gate) => t.gates.includes(gate));
                             for (const gate of declaredGates) {
                                 if (!reusable || replayedGates.results.get(gate) !== true)
                                     reusable = false;
                                 else
                                     reused.push(gate);
                             }
-                            // OBS-1049: build outputs are not commits. A replayed build verdict says the tree WAS green;
-                            // it says nothing about whether the RECREATED checkout holds what that build produced (dist),
-                            // and the host's npm lifecycle (ignore-scripts) may never rebuild it before the suite runs.
-                            // So a replayed build re-runs its own command here as provisioning, journaled by name; a red
-                            // provisioning is not reused — build (and everything behind it) re-enters the battery as a gate.
-                            // Every resume on this path recreates the checkout (recreateTaskWorktree above), so "reused
-                            // build" is exactly "build replayed onto a recreated tree".
-                            // Journal order is the criterion's order: a GREEN provisioning is recorded AFTER the reuse
-                            // rows it belongs to (gate-reused build, then gate-provisioned build); a RED provisioning is
-                            // recorded alone, and no reuse row follows it.
-                            let provisionedRow;
-                            if (reused.includes("build") && commands.build !== undefined) {
-                                // Provisioning is a verification command like any gate: it waits for the run's baseline and
-                                // takes the command lease (suite admission), never a bare shell beside sibling gates.
-                                await waitForBaseline(t.id);
-                                const startedAt = Date.now();
-                                const provisioned = await withCommandContext(t.id, () => sh(commands.build, wt));
-                                provisionedRow = {
-                                    gate: "build", commit: replayedGates.commit, exitCode: provisioned.code, durationMs: Date.now() - startedAt,
-                                };
-                                if (provisioned.code !== 0) {
-                                    reused.splice(reused.indexOf("build"));
-                                    journal.append("gate-provisioned", t.id, provisionedRow);
-                                    provisionedRow = undefined;
-                                }
-                            }
-                            for (const gate of reused) {
-                                journal.append("gate-reused", t.id, { gate, commit: replayedGates.commit });
-                            }
-                            if (provisionedRow !== undefined)
-                                journal.append("gate-provisioned", t.id, provisionedRow);
                             remainingGates = declaredGates.slice(reused.length);
                         }
+                        // OBS-1094/1049: every replay recreates the checkout, but build outputs are not commits.
+                        // Provision whenever build will not run as a gate, including an operator waiver restore.
+                        // Defer reuse rows until provisioning succeeds: green keeps reuse-then-provision order;
+                        // red records only provisioning and puts build and every declared successor back in gates,
+                        // unless build itself was waived: provisioning must not undo the operator's release.
+                        let provisionedRow;
+                        if (!remainingGates.includes("build") && commands.build !== undefined) {
+                            await waitForBaseline(t.id);
+                            const startedAt = Date.now();
+                            const provisioned = await withCommandContext(t.id, () => sh(commands.build, wt));
+                            provisionedRow = {
+                                gate: "build", commit: !satisfiedGate && !recheck ? replayedGates.commit : currentTaskSubject,
+                                exitCode: provisioned.code, durationMs: Date.now() - startedAt,
+                            };
+                            if (provisioned.code !== 0 && satisfiedGate !== "build") {
+                                reused.length = 0;
+                                remainingGates = ["build", ...declaredGates.filter((gate) => gate !== "build")];
+                            }
+                        }
+                        for (const gate of reused) {
+                            journal.append("gate-reused", t.id, { gate, commit: replayedGates.commit });
+                        }
+                        if (provisionedRow !== undefined)
+                            journal.append("gate-provisioned", t.id, provisionedRow);
                         const resumedTask = { ...t, gates: remainingGates };
+                        const operatorContext = approvalReviewContext(journal.read(), t.id, true);
                         gateLoop: while (true) {
+                            fatalStop.signal.throwIfAborted();
                             executionSignal()?.throwIfAborted();
                             const gated = await gitHead(wt);
                             gateSubject = {
@@ -3031,6 +3217,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             journal.phaseStart(t.id, "gates");
                             const { results } = await withCommandContext(t.id, () => runReviewRecovery(resumedTask, {
                                 carriedFindings: outstandingReviewFindings(journal.read(), t.id),
+                                operatorContext,
                                 worktree: wt, baseRef: taskBase, result: priorResult, author: gateAuthor,
                                 commands, baseline, channels: pools.review, judgeChannels: pools.judge, adapters, cfg, artifactDir: journal.dir,
                                 collateral: collateral.get(t.id) ?? [],
@@ -3073,7 +3260,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 },
                             }, false));
                             results.forEach(classifySignalOnlyTest);
-                            if (pendingRechecks(journal.read()).has(t.id)) {
+                            if (pendingDaemonApprovalActions(journal.read()).get(t.id)?.authority === "battery") {
                                 journal.append("recheck-battery", t.id, {
                                     commit: gateSubject.commit,
                                     gates: resumedTask.gates,
@@ -3125,6 +3312,26 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         }
                                         assignment = { adapter: seat.adapter, model: seat.model, channel: seat.channel, tier: seat.tier };
                                     }
+                                    // Carry completeness was verified before this replay battery. Apply the ordinary
+                                    // repair bounds here too; a restored red must fund the same findings-bearing dispatch.
+                                    // Funding is durable intent only: repairReachSinceApproval charges it after launch
+                                    // reaches a funded gate, and a restart before launch must not duplicate that intent.
+                                    const failing = results.filter(gateFailed);
+                                    const battery = failing.some((g) => g.gate !== "review") ? failing.filter((g) => g.gate !== "review") : failing;
+                                    const landed = await commitsAheadOf(taskBase, wt);
+                                    const events = journal.read();
+                                    const drawn = repairsSinceApproval(events, t.id);
+                                    const repeated = failing.some((g) => isDeterministicFailure(g)
+                                        && identicalGateFailures(events, t.id, g.gate, normalizeGateFailure(g.details)) >= GATE_FINGERPRINT_CAP);
+                                    if (narrowRepairBattery(battery) && landed.length > 0 && drawn < MAX_REPAIRS
+                                        && (rs?.attempts ?? 0) < MAX_ATTEMPTS && !repeated
+                                        && pendingRepairFindings(events, t.id) === undefined) {
+                                        journal.append("repair-attempt", t.id, {
+                                            repair: repairReachSinceApproval(events, t.id).length + 1, charge: drawn + 1, of: MAX_REPAIRS,
+                                            gates: failing.map((g) => g.gate), commits: landed.length,
+                                            findings: withCarriedEvidence(repairFindingsBrief(results)),
+                                        });
+                                    }
                                     break gateLoop;
                                 }
                                 await park(t, gateFailApprovalReason(t.id, "post-approval gate failed", results.some((g) => g.gate === "review" && gateFailed(g))), "gate-fail", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
@@ -3170,6 +3377,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // the same worktree. The next loop iteration retires it before reading/recreating the tree.
                     let supersededWorkerSlot;
                     attempts: for (let attempt = rs?.attempts ?? 0;; attempt++) {
+                        // Funding belongs to the next attempt. Later automatic repairs retain ordinary red reuse.
+                        const explicitlyFundedAttempt = fundedRerun && attempt === (rs?.attempts ?? 0);
+                        fatalStop.signal.throwIfAborted();
                         executionSignal()?.throwIfAborted();
                         if (attempt !== providerDeathAttempt) {
                             providerDeathRequeues = 0;
@@ -3255,6 +3465,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // fresh re-dispatches. Read from the JOURNAL, before this dispatch's own event lands: a run that
                         // stopped between funding the repair and sending it resumes still carrying the findings.
                         const journaledSoFar = journal.read(); // read BEFORE this dispatch's own event lands
+                        const operatorContext = approvalReviewContext(journaledSoFar, t.id);
                         let repairFindings = pendingRepairFindings(journaledSoFar, t.id);
                         // OBS-254, one layer below the upheld brief: the ordinary gate-fail brief was loop-local, so any
                         // path that rebuilt this task's state (a resume, `--retry-failed`, a fresh daemon) dispatched a
@@ -3344,9 +3555,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // T6: a dispatch that carries an outstanding finding says so, and names it. Without this the
                         // ledger cannot tell a carried dispatch from an amnesiac one — the exact question a run that
                         // spends two frontier attempts re-deriving a known defect has to be able to answer afterwards.
+                        fatalStop.signal.throwIfAborted();
+                        const workerDispatchOrdinal = nextWorkerDispatchOrdinal++;
                         journal.append("task-dispatch", t.id, {
                             ...(scopeApproval?.data.release === "scope-request" ? { files: t.files, graphDefinitionHash: graphDefinitionHash(graph) } : {}),
-                            assignment, attempt, provenance: dispatchProvenance([
+                            assignment, attempt, workerDispatchOrdinal, provenance: dispatchProvenance([
                                 channelKey(assignment) === channelKey(r.assignment) ? r.provenance
                                     : t.routingHints?.pin ? `pin ${t.routingHints.pin.via}:${t.routingHints.pin.model} not re-tried` : "ladder assignment",
                                 `dispatch ${channelKey(assignment)}`, climbProvenance,
@@ -3362,6 +3575,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         });
                         journal.phaseStart(t.id, "worker", { attempt, assignment });
                         const taskBase = await integrationHead(intWt); // deps are merged → visible to this task
+                        taskBases.set(t.id, taskBase);
                         const taskBranch = `${branch}--${t.id}`; // "--": a ref can't nest under the existing integration branch (locked decision 10)
                         const priorWt = worktreePath(repoRoot, taskBranch);
                         const recreating = existsSync(priorWt);
@@ -3452,7 +3666,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             // anything the live brief holds beyond the journaled findings (a consult's guidance) is kept:
                             // a repair adds the diff and the fix-only contract, it never subtracts what was already known.
                             feedback = feedback && !brief.includes(feedback) ? `${brief}\n\n${feedback}` : brief;
-                            journal.append("repair-dispatch", t.id, { diffBytes: Buffer.byteLength(diff, "utf8"), capped, ...(capped ? { droppedFiles } : {}) });
+                            journal.append("repair-dispatch", t.id, { workerDispatchOrdinal, diffBytes: Buffer.byteLength(diff, "utf8"), capped, ...(capped ? { droppedFiles } : {}) });
                         }
                         if (feedback || priorNamed.length > 0) {
                             feedback = augmentRetryBrief(feedback, { attempted: commitsToCarry, carried: carriedCommits, present: presentCommits });
@@ -3869,6 +4083,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     while (Date.now() < hardDeadline) {
                                         if (termSignal)
                                             throw new Error(`terminated by ${termSignal}`);
+                                        fatalStop.signal.throwIfAborted();
                                         executionSignal()?.throwIfAborted();
                                         driverProbeFailed = false;
                                         const sliceStart = Date.now();
@@ -4452,6 +4667,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // there is the trailer regex; the exit marker only sets exitCode), and the cause taxonomy
                                 // already names this shape "clean-exit-no-trailer" — unreachable in print mode until now.
                                 while (!startupFailure && Date.now() - lastProgressAt < stallWindowMs) {
+                                    fatalStop.signal.throwIfAborted();
                                     executionSignal()?.throwIfAborted();
                                     const remaining = stallWindowMs - (Date.now() - lastProgressAt);
                                     let slice = Math.min(BLOCKED_POLL_MS, Math.max(100, Math.min(stallWindowMs / 2, remaining)));
@@ -4881,6 +5097,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         let results = [];
                         let commits = [];
                         gateLoop: while (true) {
+                            fatalStop.signal.throwIfAborted();
                             executionSignal()?.throwIfAborted();
                             const gated = await gitHead(wt);
                             gateSubject = { commit: await gateCommitSubject(taskBase, gated, wt), attempt };
@@ -4895,7 +5112,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     && e.data.attempt === attempt - 1)
                                 : [];
                             journal.phaseStart(t.id, "gates");
-                            const replay = previousRows.length > 0
+                            const replay = !explicitlyFundedAttempt && previousRows.length > 0
                                 && previousRows.every((e) => e.data.commit === gateSubject.commit)
                                 && previousRows.some((e) => e.data.pass === false && e.data.skipped !== true);
                             if (replay) {
@@ -4918,10 +5135,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                             else {
                                 ({ results, commits } = await withCommandContext(t.id, () => runReviewRecovery(t, {
                                     carriedFindings: outstandingFindings,
+                                    operatorContext,
                                     worktree: wt, baseRef: taskBase, result, author: assignment,
                                     commands, baseline, channels: pools.review, judgeChannels: pools.judge, adapters, cfg, artifactDir: journal.dir,
                                     collateral: collateral.get(t.id) ?? [],
                                     selectTests: !testGateFailed,
+                                    cachedRedBypass: explicitlyFundedAttempt ? "operator-rerun" : undefined,
                                     via: cfg.visibility.llm === "pane"
                                         ? {
                                             driver: trackedDriver,
@@ -4960,6 +5179,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // gate-fail brief is, so prior-RUN evidence (retired by its own rule, not by this reviewer)
                                 // survives and only this run's settled findings go.
                                 feedback = withCarriedEvidence("");
+                                fatalStop.signal.throwIfAborted();
                                 executionSignal()?.throwIfAborted();
                                 const m = await mergeSerial(taskBranch, t, gated);
                                 if (m.tipMoved) {
@@ -5029,7 +5249,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // v1.53 T3: prefer the CLI's own session id captured from this attempt's output (kimi's resume
                         // trailer) over the harness slot name; absent hook or no capture keeps today's slot-name id.
                         retrySession = { channel: channelKey(assignment), id: adapter.sessionIdFrom?.(output) ?? sessionId, contextTokens };
-                        feedback = withCarriedEvidence(results.filter(gateFailed).map((g) => `${g.gate}: ${g.details}`).join("\n\n"));
+                        feedback = withCarriedEvidence(repairFindingsBrief(results));
                         // OBS-189/G3 (park-economics patch): a request-changes review is a findings brief, not a worker
                         // defect — the fix attempt stays on the same channel with the findings as feedback and consumes
                         // no escalation-ladder rung. Bounded by the engagement round cap at the top of this loop.
@@ -5057,7 +5277,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const repairable = narrowRepairBattery(repairBattery) && lostCommits.length === 0 && landed.length > 0;
                         const repairHistory = repairReachSinceApproval(journal.read(), t.id);
                         const repairsDrawn = repairsSinceApproval(journal.read(), t.id);
-                        const repair = repairable && repairsDrawn < MAX_REPAIRS;
+                        const repair = repairable && repairsDrawn < MAX_REPAIRS && attempt + 1 < MAX_ATTEMPTS;
                         // v1.85 T3: the fingerprint cap. Two normalized-identical failures of one DETERMINISTIC gate on
                         // one task (volatile tokens — worktree prefixes, line refs, durations, run ids — are not
                         // information) mean the round about to be bought is a re-measurement: ~663m across 5 runs went to
@@ -5217,7 +5437,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     });
                 };
                 taskLoopStarted = true;
-                const inflight = new Map();
+                fatalPhase = "scheduler";
                 // A settled worker can release a dependency or an approval in the same poll tick.
                 // Audit the current graph at every empty-flight boundary, never a prior ready snapshot.
                 // WB-1 rider: `end-condition-held` names a CLOSE the daemon refused, so only a close attempt journals
@@ -5236,6 +5456,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     return true;
                 };
                 closeLoop: while (true) {
+                    fatalPhase = "scheduler";
                     let approvalDeadline;
                     while (true) {
                         // v1.54 T2: a signal that landed while nothing was racing `aborted` (empty inflight window)
@@ -5262,6 +5483,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         cleanupErrors.push({ slot: slot.name, attempt: owner.attempt, error: String(error) });
                                     }
                                 }
+                                if (fatalStop.signal.aborted)
+                                    return;
                                 const cleanupEvidence = cleanupErrors.length ? { cleanupErrors } : {};
                                 if (err instanceof HeldProbeExhausted) {
                                     const wt = worktreePath(repoRoot, `${branch}--${t.id}`);
@@ -5364,7 +5587,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                         blocked: blockedTasks(graph).map((t) => t.id),
                         pending: pendingTasks(graph).map((t) => t.id),
                     };
+                    fatalPhase = "baseline";
                     await baselineCapture; // also drain capture when every worker parks or fails before its gates
+                    fatalPhase = "tip-verify";
                     // OBS-34: post-merge integration-tip verify — strict exit codes, no baseline forgiveness.
                     const lastMergedTask = [...journal.read()].reverse().find((e) => e.event === "merge" && e.taskId)?.taskId;
                     if (summary.done.length > 0 && Object.keys(commands).length > 0) {
@@ -5407,9 +5632,14 @@ export async function runDaemon(repoRoot, opts = {}) {
                             clearTimeout(poll);
                         }
                         summary.tipVerify = tipFailed ? "failed" : "passed";
+                        summary.tipProof = runEndTipProof(journal.read());
                         if (tipFailed && lastMergedTask)
                             summary.lastMergedTask = lastMergedTask;
                     }
+                    else {
+                        // Exactly one proof per close: no cycle ran for THIS close, and an earlier one is not inherited.
+                        summary.tipProof = { kind: "incomplete" };
+                    }
                     // T14: read the journal, not the startup `approved` set — an approval appended DURING this run is
                     // exactly the one the set cannot see, and it is the one the record has to name.
                     //
@@ -5417,6 +5647,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // graph.lock release in the outer finally: an approval that wins first is included below, while an
                     // approval that loses cannot append until the live owner is gone and reports recorded-no-owner.
                     // Thus no accepted approval can land after this sample while still being attributed to this run.
+                    fatalPhase = "scheduler";
                     const approvalSerialization = await acquireApprovalSerialization(repoRoot, runId);
                     releaseApprovalSerialization = approvalSerialization.release;
                     // Close the last poll-to-run-end race while holding the same serializer as approve.
@@ -5448,7 +5679,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     const tipFail = summary.tipVerify === "failed"
                         ? ` — TIP VERIFY FAILED on ${summary.lastMergedTask ? `last merge ${summary.lastMergedTask}` : "integration tip"}`
                         : "";
-                    await driver.notify(`tickmarkr ${runId}: ${summary.done.length} done, ${summary.failed.length} failed, ${summary.human.length} awaiting human, ${summary.blocked.length} blocked, ${summary.pending.length} pending${attribution ? ` (${attribution})` : ""}${tipFail} — integration branch ${branch} (merge to main is yours)`, { tier: summary.tipVerify === "failed" ? "attention" : "routine" });
+                    await driver.notify(`tickmarkr ${runId}: ${summary.done.length} done, ${summary.failed.length} failed, ${summary.human.length} awaiting human, ${summary.blocked.length} blocked, ${summary.pending.length} pending${attribution ? ` (${attribution})` : ""}${tipFail} — ${formatTipProof(summary.tipProof)} — integration branch ${branch} (merge to main is yours)`, { tier: summary.tipVerify === "failed" ? "attention" : "routine" });
                     return summary;
                 }
             });
@@ -5458,8 +5689,22 @@ export async function runDaemon(repoRoot, opts = {}) {
         // T7 (v1.86): guarded — a journal read/append failure while recording the fatal run-end is
         // reported alongside err, never instead of it; recordFatalRunEnd never throws, so the original
         // error (message, stack, cause) always reaches the caller verbatim.
-        if (runStarted && (!taskLoopStarted || baselineFailed))
-            recordFatalRunEnd(journal, runId, branch, err);
+        // Freeze failure-time buckets, stop new dispatch, and drain all journal writers before closing.
+        if (!deliberateTermination) {
+            const failedGraph = graph;
+            const phase = taskLoopStarted ? (baselineFailed ? "baseline" : fatalPhase) : "setup";
+            fatalStop.abort(err);
+            await retireFatalSlots?.();
+            await Promise.allSettled(inflight.values());
+            await baselineCapture.catch(() => { });
+            if (runStarted && !deliberateTermination) {
+                const tipProof = recordFatalRunEnd(journal, runId, branch, err, taskLoopStarted || opts.resume ? failedGraph : undefined, phase);
+                // The fatal close states its proof too; a dead notifier never replaces the original error.
+                if (tipProof) {
+                    await driver.notify(`tickmarkr ${runId}: run crashed — ${formatTipProof(tipProof)} — integration branch ${branch}`, { tier: "attention" }).catch(() => { });
+                }
+            }
+        }
         throw err;
     }
     finally {