tickmarkr 2.5.8 → 2.6.0

package/dist/run/daemon.js

@@ -33,9 +33,9 @@ import { cleanupRunWorktrees, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModu
 import { runInteractiveSeed } from "./interactive-seed.js";
 import { classifyRepairDisposition, resolveScopeHints } from "./repair-disposition.js";
 import { applyScopeAmendments, activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, outstandingReviewFindings, pendingApprovalActions, pendingRechecks, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
-import { isDiffCapPark, pickReviewer } from "../gates/review.js";
+import { gateReviewerFloor, isDiffCapPark, pickReviewer } from "../gates/review.js";
 import { acquireApprovalSerialization, acquireRunLock, isPidLive, releaseRunLock } from "./lock.js";
-import { ensureIntegration, integrationBranch, integrationHead, mergeTask, verifyIntegrationTip } from "./merge.js";
+import { ensureIntegration, integrationBranch, integrationHead, mergeTask, reusedTipEvidence, verifyIntegrationTip } from "./merge.js";
 import { climbChannel, marginalCostRank, nextChannel, route } from "../route/router.js";
 import { desiredPanes } from "./reconcile.js";
 import { readTierLiveness, readWatchBoard, supervisionBeatPath } from "./supervision.js";
@@ -164,6 +164,27 @@ export function resolveRunMode(repoRoot, opts = {}) {
         : undefined;
     return { cfg: resolved.cfg, mode: resolved.mode, source, ...(conflict ? { conflict } : {}) };
 }
+// Bind approval context before dispatch consumes the release. Restore reconstructs the same
+// binding from journal order; a newer approval, including one without a reason, supersedes it.
+function approvalReviewContext(events, taskId, restore = false) {
+    let pending;
+    let bound;
+    let approved = false;
+    for (const row of events) {
+        if (row.taskId !== taskId)
+            continue;
+        if (row.event === "task-approved") {
+            pending = typeof row.data.reason === "string" ? row.data.reason.trim() || undefined : undefined;
+            approved = true;
+        }
+        else if (row.event === "task-dispatch" || (row.event === "recheck-battery" && approved)) {
+            bound = pending;
+            pending = undefined;
+            approved = false;
+        }
+    }
+    return restore && !approved ? bound : pending;
+}
 // T14: the events that prove an approval was ENACTED — narrowly causal, never merely subsequent.
 // Ordinary, attempt-cap and review-upheld approvals buy a WORKER, so their proof is a dispatch;
 // recheck has its own battery enactment below. Generic terminal events are deliberately NOT proof: an approved human-gate
@@ -664,7 +685,7 @@ function lastVerifyCycle(events) {
         if (e.event === "tip-verify-start") {
             const { tip, cmdHash } = e.data;
             cur = typeof tip === "string" && typeof cmdHash === "string"
-                ? { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [e.data.capacity] }
+                ? { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [e.data.capacity], evidenceByGate: new Map() }
                 : undefined;
             afterRunEnd = false;
             continue;
@@ -687,7 +708,7 @@ function lastVerifyCycle(events) {
             continue;
         }
         if (!cur || afterRunEnd || cur.tip !== tip || cur.cmdHash !== cmdHash) {
-            cur = { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [] };
+            cur = { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [], evidenceByGate: new Map() };
         }
         afterRunEnd = false;
         // T7: EVERY verdict row's own capacity, not just the start row's. The start row is a statement of
@@ -699,6 +720,7 @@ function lastVerifyCycle(events) {
             cur.failed = true;
         else {
             cur.gates.add(gate);
+            cur.evidenceByGate.set(gate, e.data);
             // Q121s review M1: a forgiven green depends on the baseline that forgave it. Baselines are not
             // part of the cache key, so a forgiven cycle is NEVER cache-eligible — an unchanged tip whose
             // baseline later vanishes or changes must re-run the full verify, not inherit the green.
@@ -712,7 +734,8 @@ function lastVerifyCycle(events) {
  * OBS-1077 close rider: what the engagement's LATEST verification cycle proved — its
  * `tip-verify-start` row and what followed, never a commit comparison. Exactly one kind per close:
  * fresh (every tip command ran AND passed), reused (an eligible cached cycle carried forward),
- * failed, or incomplete (cancelled, cut short, mixed or undelimited). Nothing before the start row
+ * failed, or incomplete (cancelled, cut short or undelimited). Completed mixed cycles retain each
+ * gate's kind beside the whole-cycle reused kind. Nothing before the start row
  * is read, so an unfinished cycle inherits nothing from an earlier green one.
  */
 export function runEndTipProof(events) {
@@ -737,14 +760,25 @@ export function runEndTipProof(events) {
     if ((events[start].data.cached === true) !== cachedRow || (cachedRow && carried !== rows.length))
         return proof("incomplete");
     // D-131: fresh only when EVERY command executed; one per-gate persisted verdict makes the cycle reused.
-    return carried > 0 ? proof("reused") : proof("fresh");
+    return {
+        ...proof(carried > 0 ? "reused" : "fresh"),
+        gates: gates.map((gate) => ({
+            gate: String(gate),
+            kind: rows.some((r) => r.data.gate === gate && r.data.cached === true) ? "reused" : "fresh",
+        })),
+    };
 }
 /** The close notification's statement of the proof — one clause per kind. */
 export function formatTipProof(p) {
     const at = p.tip ? ` ${p.tip.slice(0, 12)}` : "";
+    const gateReading = p.gates?.map(({ gate, kind }) => `${gate}: ${kind === "fresh" ? "verified fresh" : "cached (reused) — carried, not re-run"}`).join("; ");
+    const suffix = gateReading ? `; ${gateReading}` : "";
+    if (p.kind === "reused" && p.gates?.some(({ kind }) => kind === "fresh")) {
+        return `tip proof: ${p.kind} — commit${at}; ${gateReading}`;
+    }
     switch (p.kind) {
-        case "fresh": return `tip proof: fresh — every tip command ran and passed on${at || " the integration tip"}`;
-        case "reused": return `tip proof: reused — carried from verified commit${at}, commands not re-run`;
+        case "fresh": return `tip proof: fresh — every tip command ran and passed on${at || " the integration tip"}${suffix}`;
+        case "reused": return `tip proof: reused — carried from verified commit${at}, commands not re-run${suffix}`;
         case "failed": return `tip proof: failed —${at ? ` commit${at}` : ""} latest verification cycle is red`;
         case "incomplete": return `tip proof: incomplete —${at ? ` commit${at}` : ""} latest verification cycle did not finish`;
     }
@@ -909,7 +943,7 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
         // pass — `cached: true` keeps it honest about not having re-run the command.
         for (const gate of gates) {
             const cmd = gate === "test" && commands.tipTest ? commands.tipTest : commands[gate];
-            journal.append("tip-verify", undefined, { gate, cmd, pass: true, exitCode: 0, cached: true, tip, cmdHash, capacity });
+            journal.append("tip-verify", undefined, { ...reusedTipEvidence(last.evidenceByGate.get(gate) ?? {}), gate, cmd, pass: true, exitCode: 0, cached: true, tip, cmdHash, capacity });
         }
         return false;
     }
@@ -918,12 +952,22 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
         ? cancellableTipBattery(intWt, commands, journal.dir, opts.baseline, opts.signal)
         : verifyIntegrationTip(intWt, commands, journal.dir, opts.baseline))) {
         const measuredCapacity = r.capacity ?? capacity;
+        const evidence = r.reused ? reusedTipEvidence(r) : {
+            ...(r.originRunRoot ? { originRunRoot: r.originRunRoot } : {}),
+            ...(r.cause ? { cause: r.cause } : {}),
+            ...(r.evidenceReceipt ? { evidenceReceipt: r.evidenceReceipt } : {}),
+            ...(r.evidenceReceipts ? { evidenceReceipts: r.evidenceReceipts } : {}),
+            ...(r.evidenceAbsence ? { evidenceAbsence: r.evidenceAbsence } : {}),
+            ...Object.fromEntries(["nonce", "stdoutPath", "stderrPath"]
+                .filter(key => r[key] !== undefined).map(key => [key, r[key]])),
+        };
         if (r.pass) {
             // Q121s: a forgiven pass journals its fingerprints — honest about what was carried, never a silent green.
-            journal.append("tip-verify", undefined, { gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.reused ? { cached: true } : {}), ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints } : {}), tip, cmdHash, capacity: measuredCapacity });
+            journal.append("tip-verify", undefined, { ...evidence, gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.reused ? { cached: true } : {}), ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints } : {}), tip, cmdHash, capacity: measuredCapacity });
         }
         else {
             journal.append("tip-verify-failed", undefined, {
+                ...evidence,
                 gate: r.gate,
                 cmd: r.cmd,
                 exitCode: r.exitCode,
@@ -1444,6 +1488,77 @@ async function cherryPickCommits(wt, commits) {
     }
     return carried;
 }
+/** Fold lifetime dispatch/carry evidence, independent of attempt budgets and routing exclusions.
+ * Recreation rows name SOURCE hashes, so ownership is joined by stable patch identity. Each
+ * attempt owns only what the next carry (or current subject) adds beyond its own incoming set.
+ * Gate-only recreations do not start an attempt or transfer authorship to the restored seat.
+ */
+async function subjectAuthors(events, taskId, wt, base) {
+    const cache = new Map();
+    const patches = async (commits) => {
+        const ids = new Set();
+        for (const commit of commits) {
+            if (!cache.has(commit)) {
+                const diff = await shGit(`git show --format= --binary ${shq(commit)}`, wt);
+                if (diff.code !== 0)
+                    throw new Error(`cannot read author patch ${commit}`);
+                const id = execFileSync("git", ["patch-id", "--stable"], {
+                    cwd: wt, input: diff.stdout, encoding: "utf8", maxBuffer: 32 * 1024 * 1024,
+                }).trim().split(/\s+/)[0];
+                cache.set(commit, id || undefined); // an empty commit authored no patch
+            }
+            const id = cache.get(commit);
+            if (id)
+                ids.add(id);
+        }
+        return ids;
+    };
+    let current;
+    let previous;
+    let awaitingCarry = false;
+    const owners = new Map();
+    const attribute = (ids, attempt) => {
+        for (const id of ids) {
+            if (attempt?.incoming.has(id))
+                continue;
+            const authors = owners.get(id) ?? new Set();
+            authors.add(attempt?.author ?? "unknown author (missing task-dispatch assignment)");
+            owners.set(id, authors);
+        }
+    };
+    try {
+        for (const row of events) {
+            if (row.taskId !== taskId)
+                continue;
+            if (row.event === "task-dispatch") {
+                previous = current;
+                const a = row.data.assignment;
+                current = { author: typeof a?.adapter === "string" && typeof a?.model === "string"
+                        ? `${a.adapter}:${a.model}` : "unknown author (missing task-dispatch assignment)", incoming: new Set() };
+                awaitingCarry = true;
+            }
+            else if (row.event === "worktree-recreation") {
+                const carried = await patches(Array.isArray(row.data.carried) ? row.data.carried : []);
+                attribute(carried, awaitingCarry ? previous : current);
+                if (awaitingCarry && current)
+                    current.incoming = carried;
+                awaitingCarry = false;
+            }
+            else if (["worker-launch", "worker-result", "gate-result", "task-human"].includes(row.event)) {
+                // The initial checkout has no recreation row. Once work/gates start, a later
+                // recreation is a restore of this attempt, not the input of a new dispatch.
+                awaitingCarry = false;
+            }
+        }
+        const subject = await patches(await commitsAheadOf(base, wt));
+        attribute(subject, current);
+        return [...new Set([...subject].flatMap((id) => [...(owners.get(id) ?? [])]))];
+    }
+    catch (error) {
+        // An unreadable history cannot silently remove an author from the exclusion set.
+        return [`unknown author (${String(error)})`];
+    }
+}
 // T7 (v1.86): a first run-end append that fails AFTER partial bytes landed leaves a torn tail at
 // EOF with no newline; a blind retry would glue the run-end line onto those bytes and readJsonl's
 // torn-line tolerance would drop the retry too — no terminal record despite a successful write.
@@ -2550,6 +2665,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // run; a park-instead policy can come later if it ever bites.
                     }
                     const taskHistory = journal.read().filter((e) => e.taskId === t.id);
+                    // Lifetime identity counts every dispatch, including legacy and unchargeable rows. Releases
+                    // reset the budget below, never this counter; observational annotations do not consume it.
+                    let nextWorkerDispatchOrdinal = taskHistory.filter((e) => e.event === "task-dispatch").length;
                     const lastApproval = taskHistory.map((e) => e.event).lastIndexOf("task-approved");
                     const priorClimb = taskHistory.slice(lastApproval + 1).reverse().find((e) => e.event === "tier-escalated");
                     if (!hintsChanged && priorClimb && taskHistory.indexOf(priorClimb) > taskHistory.map((e) => e.event).lastIndexOf("task-dispatch")) {
@@ -2566,7 +2684,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // exclusion-list-equality oracle. Daemon-side append only — no journal.ts write-path change (Phase 48
                     // stays unblocked); inert to replayStatuses (unknown events ignored, pinned at journal.test.ts:70-80).
                     if (rs)
-                        journal.append("resume-restore", t.id, { attempts: rs.attempts, tried: [...tried], assignment });
+                        journal.append("resume-restore", t.id, {
+                            attempts: rs.attempts, tried: [...tried], assignment,
+                            workerDispatchOrdinal: previousDispatch?.data.workerDispatchOrdinal ?? null,
+                        });
                     // Keep one live list: recovery retries must see exclusions added by onGate during the round.
                     const badReviewers = [...replayedReviewerExclusions];
                     const noteReviewEvent = (e) => {
@@ -2597,7 +2718,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const round = await runGates(task, ctx);
                         let review = round.results.find((g) => g.gate === "review");
                         while (review?.meta?.noVerdict === true) {
-                            const next = pickReviewer(ctx.author, ctx.channels, badReviewers, cfg.review.prefer ?? [], task.routingHints?.floor, reviewHistory, undefined, demotedReviewers);
+                            // Recovery must honor the gate's floor, including the seats that just failed to
+                            // return a verdict; a below-floor alternative cannot replace the infra result.
+                            const { floor } = gateReviewerFloor(task, ctx.cfg, ctx.author, ctx.channels, [...(ctx.priorReviewers ?? []), ...badReviewers]);
+                            const next = pickReviewer(ctx.author, ctx.channels, badReviewers, cfg.review.prefer ?? [], floor, reviewHistory, undefined, demotedReviewers);
                             if (!next)
                                 break;
                             journal.append("review-infra-retry", t.id, { reviewer: channelKey(next), cause: review.meta.cause });
@@ -2706,6 +2830,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                             ...(Array.isArray(g.meta?.selectedTests) ? { selectedTests: g.meta.selectedTests } : {}),
                             ...(g.meta?.fullSuite === true ? { fullSuite: true } : {}),
                             ...(g.meta?.reapedGroup === true ? { reapedGroup: true } : {}),
+                            ...(g.gate === "review" && g.meta?.noEligibleReviewer === true ? {
+                                noEligibleReviewer: true, authorVendors: g.meta.authorVendors, unresolvedAuthors: g.meta.unresolvedAuthors,
+                            } : {}),
                             ...(g.gate === "review" && typeof g.meta?.reviewer === "string" ? {
                                 reviewer: g.meta.reviewer,
                                 ...Object.fromEntries(["cause", "seatAuthoredBytes", "bytes", "rawPath", "briefPath", "timeoutMs", "unparseable", "noVerdict", "resolved", "reraised", "reviewerFloor", "reviewerFloorCause", "reviewerTier"]
@@ -2733,6 +2860,14 @@ export async function runDaemon(repoRoot, opts = {}) {
                             // every recalibration this telemetry funds, a gap is honest and a zero is a lie. The
                             // seven-gate closed set is asserted end-to-end in tests/run/gate-telemetry.test.ts.
                             ...gateMeasurement(g.meta),
+                            // Carried receipts retain their original invocation and artifact root.
+                            ...(g.evidenceReceipt ? { evidenceReceipt: g.evidenceReceipt } : {}),
+                            ...(g.evidenceReceipts ? { evidenceReceipts: g.evidenceReceipts } : {}),
+                            ...(g.meta?.reused ? {
+                                reused: true,
+                                ...(g.originRunRoot ? { originRunRoot: g.originRunRoot } : {}),
+                            } : Object.fromEntries(["nonce", "stdoutPath", "stderrPath", "classification"]
+                                .filter(key => g.meta?.[key] !== undefined).map(key => [key, g.meta[key]]))),
                             // T7: the capacity the gate's own command child ran under, lifted verbatim from the result
                             // the battery produced — read where the shell built that child's environment, never
                             // re-derived from the run's own budget, which would answer a different number than the
@@ -2960,7 +3095,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // OBS-130/T15: both gate-resume paths consume the persisted task branch with no worker dispatch.
                     // An operator approval skips its exact failed gate by authority; observed results skip only the
                     // contiguous green prefix whose recorded commit is still the task branch tip.
-                    const satisfiedGate = satisfiedGates.get(t.id);
+                    let satisfiedGate = satisfiedGates.get(t.id);
                     const replayedGates = fundedRerun ? undefined : replayedGateResults.get(t.id);
                     const recheck = approvalAction?.authority === "battery";
                     resumeGateReplay: if (satisfiedGate || replayedGates || recheck) {
@@ -2997,6 +3132,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // than against the stale worktree whose task-only history cannot see newly merged dependencies.
                         const currentTaskTip = await gitHead(wt);
                         const currentTaskSubject = await gateCommitSubject(taskBase, currentTaskTip, wt);
+                        // Recheck carries only review authority for the exact subject being gated, never tool greens.
+                        if (recheck) {
+                            satisfiedGate = journal.replaySatisfiedGates(new Map([[t.id, currentTaskSubject]])).get(t.id);
+                        }
                         journal.append("worktree-recreation", t.id, { attempted: commitsToCarry, carried: carriedCommits });
                         // OBS-212: same fail-closed rule as the dispatch path — but this path is worse, because it runs
                         // ONLY the gates after the approved one and then MERGES. T3 took it on run-20260728-110135:
@@ -3066,9 +3205,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 continue;
                             priorResults.set(e.data.gate, e);
                         }
+                        const declaredGates = GATE_NAMES.filter((gate) => t.gates.includes(gate));
+                        const reused = [];
                         let remainingGates;
                         if (recheck) {
-                            remainingGates = GATE_NAMES.filter((gate) => t.gates.includes(gate));
+                            remainingGates = declaredGates.filter((gate) => gate !== satisfiedGate);
                         }
                         else if (satisfiedGate) {
                             remainingGates = t.gates.filter((gate) => {
@@ -3119,48 +3260,40 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 });
                             }
                             let reusable = sameWorld && sameProtocol && (exactCurrentCommit || canonicalCurrentCommit || recreatedLegacyCommit);
-                            const reused = [];
-                            const declaredGates = GATE_NAMES.filter((gate) => t.gates.includes(gate));
                             for (const gate of declaredGates) {
                                 if (!reusable || replayedGates.results.get(gate) !== true)
                                     reusable = false;
                                 else
                                     reused.push(gate);
                             }
-                            // OBS-1049: build outputs are not commits. A replayed build verdict says the tree WAS green;
-                            // it says nothing about whether the RECREATED checkout holds what that build produced (dist),
-                            // and the host's npm lifecycle (ignore-scripts) may never rebuild it before the suite runs.
-                            // So a replayed build re-runs its own command here as provisioning, journaled by name; a red
-                            // provisioning is not reused — build (and everything behind it) re-enters the battery as a gate.
-                            // Every resume on this path recreates the checkout (recreateTaskWorktree above), so "reused
-                            // build" is exactly "build replayed onto a recreated tree".
-                            // Journal order is the criterion's order: a GREEN provisioning is recorded AFTER the reuse
-                            // rows it belongs to (gate-reused build, then gate-provisioned build); a RED provisioning is
-                            // recorded alone, and no reuse row follows it.
-                            let provisionedRow;
-                            if (reused.includes("build") && commands.build !== undefined) {
-                                // Provisioning is a verification command like any gate: it waits for the run's baseline and
-                                // takes the command lease (suite admission), never a bare shell beside sibling gates.
-                                await waitForBaseline(t.id);
-                                const startedAt = Date.now();
-                                const provisioned = await withCommandContext(t.id, () => sh(commands.build, wt));
-                                provisionedRow = {
-                                    gate: "build", commit: replayedGates.commit, exitCode: provisioned.code, durationMs: Date.now() - startedAt,
-                                };
-                                if (provisioned.code !== 0) {
-                                    reused.splice(reused.indexOf("build"));
-                                    journal.append("gate-provisioned", t.id, provisionedRow);
-                                    provisionedRow = undefined;
-                                }
-                            }
-                            for (const gate of reused) {
-                                journal.append("gate-reused", t.id, { gate, commit: replayedGates.commit });
-                            }
-                            if (provisionedRow !== undefined)
-                                journal.append("gate-provisioned", t.id, provisionedRow);
                             remainingGates = declaredGates.slice(reused.length);
                         }
+                        // OBS-1094/1049: every replay recreates the checkout, but build outputs are not commits.
+                        // Provision whenever build will not run as a gate, including an operator waiver restore.
+                        // Defer reuse rows until provisioning succeeds: green keeps reuse-then-provision order;
+                        // red records only provisioning and puts build and every declared successor back in gates,
+                        // unless build itself was waived: provisioning must not undo the operator's release.
+                        let provisionedRow;
+                        if (!remainingGates.includes("build") && commands.build !== undefined) {
+                            await waitForBaseline(t.id);
+                            const startedAt = Date.now();
+                            const provisioned = await withCommandContext(t.id, () => sh(commands.build, wt));
+                            provisionedRow = {
+                                gate: "build", commit: !satisfiedGate && !recheck ? replayedGates.commit : currentTaskSubject,
+                                exitCode: provisioned.code, durationMs: Date.now() - startedAt,
+                            };
+                            if (provisioned.code !== 0 && satisfiedGate !== "build") {
+                                reused.length = 0;
+                                remainingGates = ["build", ...declaredGates.filter((gate) => gate !== "build")];
+                            }
+                        }
+                        for (const gate of reused) {
+                            journal.append("gate-reused", t.id, { gate, commit: replayedGates.commit });
+                        }
+                        if (provisionedRow !== undefined)
+                            journal.append("gate-provisioned", t.id, provisionedRow);
                         const resumedTask = { ...t, gates: remainingGates };
+                        const operatorContext = approvalReviewContext(journal.read(), t.id, true);
                         gateLoop: while (true) {
                             fatalStop.signal.throwIfAborted();
                             executionSignal()?.throwIfAborted();
@@ -3173,11 +3306,20 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // deterministic-fingerprint occurrence/review round for budget accounting.
                                 ...(!satisfiedGate && !recheck ? { replayMeasurement: true } : {}),
                             };
+                            if (recheck && satisfiedGate === "review" && gateSubject.commit !== currentTaskSubject) {
+                                satisfiedGate = undefined;
+                                resumedTask.gates = declaredGates;
+                            }
+                            if (recheck && satisfiedGate === "review" && !resumedTask.gates.includes("review")) {
+                                journal.append("gate-waiver-carried", t.id, { gate: "review", commit: gateSubject.commit, carried: true, release: RECHECK_RELEASE });
+                            }
                             await trackedDriver.project?.(t.id, "in-review");
                             await waitForBaseline(t.id);
                             journal.phaseStart(t.id, "gates");
-                            const { results } = await withCommandContext(t.id, () => runReviewRecovery(resumedTask, {
+                            const { results } = await withCommandContext(t.id, async () => runReviewRecovery(resumedTask, {
+                                carriedAuthors: await subjectAuthors(journal.read(), t.id, wt, taskBase),
                                 carriedFindings: outstandingReviewFindings(journal.read(), t.id),
+                                operatorContext,
                                 worktree: wt, baseRef: taskBase, result: priorResult, author: gateAuthor,
                                 commands, baseline, channels: pools.review, judgeChannels: pools.judge, adapters, cfg, artifactDir: journal.dir,
                                 collateral: collateral.get(t.id) ?? [],
@@ -3194,7 +3336,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 excludeReviewers: badReviewers,
                                 reviewHistory, demotedReviewers, priorReviewers: taskReviewers(t.id),
                                 // Leg-2 (OBS-1052): the run-scoped two-strike tally — without it retirement is inert and a
-                                // flaking seat is re-asked on every task. (carriedAuthors is held back: see SURGEON-LEG2-REPORT.)
+                                // flaking seat is re-asked on every task.
                                 reviewNoVerdicts,
                                 recheck, // OBS-1055: a recheck discards cached reds — the battery re-measures what the operator questioned
                                 onGate: async (e) => {
@@ -3231,6 +3373,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                             graph = addEvidence(graph, t.id, { commits: approvedCommits, gateResults: results });
                             saveGraph(repoRoot, graph);
                             if (!results.every(gateSatisfied)) {
+                                const unavailableReview = results.find((g) => gateFailed(g) && g.meta?.noEligibleReviewer === true);
+                                if (unavailableReview) {
+                                    await park(t, gateFailApprovalReason(t.id, unavailableReview.details, true), "gate-fail", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
+                                    return;
+                                }
                                 const infra = results.find((g) => g.meta?.infra === true);
                                 if (infra) {
                                     await park(t, `${infra.gate}: ${infra.details}`, "infra", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
@@ -3259,7 +3406,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // Observed green gates are only measurements. If the resumed suffix is red, preserve that
                                 // result in the journal and return to the ordinary attempt/consult ladder, which rebuilds
                                 // feedback from those rows. Only an operator-authorized gate release parks on a new red.
-                                if (!satisfiedGate) {
+                                if (!satisfiedGate || recheck) {
                                     // OBS-1055: a recheck red funds a repair of the pin's own work. A pinned task's repair sits
                                     // on the pin (OBS-1034's exemption keeps the tried list from excluding it); a pin the fleet
                                     // cannot seat parks naming the pin — never the ladder.
@@ -3425,6 +3572,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // fresh re-dispatches. Read from the JOURNAL, before this dispatch's own event lands: a run that
                         // stopped between funding the repair and sending it resumes still carrying the findings.
                         const journaledSoFar = journal.read(); // read BEFORE this dispatch's own event lands
+                        const operatorContext = approvalReviewContext(journaledSoFar, t.id);
                         let repairFindings = pendingRepairFindings(journaledSoFar, t.id);
                         // OBS-254, one layer below the upheld brief: the ordinary gate-fail brief was loop-local, so any
                         // path that rebuilt this task's state (a resume, `--retry-failed`, a fresh daemon) dispatched a
@@ -3515,9 +3663,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // ledger cannot tell a carried dispatch from an amnesiac one — the exact question a run that
                         // spends two frontier attempts re-deriving a known defect has to be able to answer afterwards.
                         fatalStop.signal.throwIfAborted();
+                        const workerDispatchOrdinal = nextWorkerDispatchOrdinal++;
                         journal.append("task-dispatch", t.id, {
                             ...(scopeApproval?.data.release === "scope-request" ? { files: t.files, graphDefinitionHash: graphDefinitionHash(graph) } : {}),
-                            assignment, attempt, provenance: dispatchProvenance([
+                            assignment, attempt, workerDispatchOrdinal, provenance: dispatchProvenance([
                                 channelKey(assignment) === channelKey(r.assignment) ? r.provenance
                                     : t.routingHints?.pin ? `pin ${t.routingHints.pin.via}:${t.routingHints.pin.model} not re-tried` : "ladder assignment",
                                 `dispatch ${channelKey(assignment)}`, climbProvenance,
@@ -3624,7 +3773,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             // anything the live brief holds beyond the journaled findings (a consult's guidance) is kept:
                             // a repair adds the diff and the fix-only contract, it never subtracts what was already known.
                             feedback = feedback && !brief.includes(feedback) ? `${brief}\n\n${feedback}` : brief;
-                            journal.append("repair-dispatch", t.id, { diffBytes: Buffer.byteLength(diff, "utf8"), capped, ...(capped ? { droppedFiles } : {}) });
+                            journal.append("repair-dispatch", t.id, { workerDispatchOrdinal, diffBytes: Buffer.byteLength(diff, "utf8"), capped, ...(capped ? { droppedFiles } : {}) });
                         }
                         if (feedback || priorNamed.length > 0) {
                             feedback = augmentRetryBrief(feedback, { attempted: commitsToCarry, carried: carriedCommits, present: presentCommits });
@@ -3664,6 +3813,20 @@ export async function runDaemon(repoRoot, opts = {}) {
                         Object.defineProperty(workerSlotOpts, "agent", { value: assignment.adapter });
                         const slot = await trackedDriver.slot(wt, `${t.id}-worker-${assignment.adapter}-a${attempt}-${runTag}`, workerSlotOpts);
                         const sessionId = retryMode === "resume" ? priorSession.id : slot.name;
+                        const readResumeTranscript = () => {
+                            try {
+                                const sample = adapter.readSessionTranscript?.({ cwd: wt, id: sessionId });
+                                return sample && Number.isSafeInteger(sample.bytes) && sample.bytes >= 0 ? sample : null;
+                            }
+                            catch {
+                                return null;
+                            }
+                        };
+                        const resumeBaseline = retryMode === "resume" ? readResumeTranscript() : null;
+                        if (retryMode === "resume")
+                            journal.append("worker-resume-requested", t.id, {
+                                sessionId, attempt, workerDispatchOrdinal, baselineBytes: resumeBaseline?.bytes ?? null,
+                            });
                         const icmd = retryMode === "resume"
                             ? adapter.resumeCommand(sessionId, promptFile, assignment.model)
                             : cfg.visibility.worker === "interactive" && driver.interactive
@@ -3691,6 +3854,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const groupFile = `${dispatchScript}.${nonce}.pgid`;
                         workerOwners.set(slot, { taskId: t.id, attempt, groupFile });
                         writeFileSync(dispatchScript, [
+                            // Shell startup can swallow the driver's leading cd; the payload owns its checkout too.
+                            `cd ${shq(wt)} || exit 1`,
                             // A driver may launch inside the daemon's group. That group is never worker-owned.
                             `worker_pgid=$(ps -o pgid= -p $$ 2>/dev/null); daemon_pgid=$(ps -o pgid= -p ${process.pid} 2>/dev/null)`,
                             `if [ -n "$worker_pgid" ] && [ -n "$daemon_pgid" ] && [ "$worker_pgid" != "$daemon_pgid" ]; then printf '%s\\n' "$worker_pgid" > ${shq(groupFile)}; fi`,
@@ -3723,6 +3888,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             journal.append("worker-launch", t.id, {
                                 attempt,
                                 retryMode,
+                                ...(retryMode === "resume" ? { sessionId, workerDispatchOrdinal } : {}),
                                 driver: trackedDriver.id,
                                 slot: { ...slot },
                                 workspace: driver.id === "herdr" ? process.env.HERDR_WORKSPACE_ID : undefined,
@@ -4750,6 +4916,17 @@ export async function runDaemon(repoRoot, opts = {}) {
                         else {
                             await closeSlot(slot);
                         }
+                        if (retryMode === "resume") {
+                            const transcript = readResumeTranscript();
+                            const identity = resumeBaseline === null || transcript === null
+                                ? "unknown" : transcript.bytes > resumeBaseline.bytes ? "confirmed" : "unconfirmed";
+                            journal.append("worker-resume-identity", t.id, {
+                                sessionId, attempt, workerDispatchOrdinal, identity,
+                                baselineBytes: resumeBaseline?.bytes ?? null, observedBytes: transcript?.bytes ?? null,
+                                // This is evidence of file growth, not an independent runtime identity handshake.
+                                assumption: "external runtime appends to the requested session's own transcript",
+                            });
+                        }
                         // SPEND-01: usage from the harness's own cwd-keyed structured store, read POST-HOC from disk —
                         // `wt` is this task's private worktree, so the path is unique; the read is sliced to records
                         // stamped at/after this attempt's dispatch instant. Never the harvested pane text, never the
@@ -5091,8 +5268,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 }
                             }
                             else {
-                                ({ results, commits } = await withCommandContext(t.id, () => runReviewRecovery(t, {
+                                ({ results, commits } = await withCommandContext(t.id, async () => runReviewRecovery(t, {
+                                    carriedAuthors: await subjectAuthors(journal.read(), t.id, wt, taskBase),
                                     carriedFindings: outstandingFindings,
+                                    operatorContext,
                                     worktree: wt, baseRef: taskBase, result, author: assignment,
                                     commands, baseline, channels: pools.review, judgeChannels: pools.judge, adapters, cfg, artifactDir: journal.dir,
                                     collateral: collateral.get(t.id) ?? [],
@@ -5185,6 +5364,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // already journaled by onGate, before gateFails and before any ladder selection can fund an
                         // identical retry in the same environment. Parsed judge refusals never carry infra and keep
                         // flowing through the chargeable quality path below.
+                        const unavailableReview = results.find((g) => gateFailed(g) && g.meta?.noEligibleReviewer === true);
+                        if (unavailableReview) {
+                            await park(t, gateFailApprovalReason(t.id, unavailableReview.details, true), "gate-fail", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
+                            return;
+                        }
                         const infraFailure = results.find((g) => gateFailed(g) && g.meta?.infra === true);
                         if (infraFailure) {
                             await park(t, `${infraFailure.gate}: ${infraFailure.details}${infraFailure.meta?.recoveryBlocked ? ` — ${infraFailure.meta.recoveryBlocked}` : ""}`, "infra", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);

package/dist/run/git.d.ts

@@ -190,6 +190,16 @@ export declare function resolveIntegrationBranch(_repo: string, branch: string):
  */
 export declare function preserveWorktree(cwd: string): Promise<string | undefined>;
 export declare function createWorktree(repo: string, branch: string, baseRef: string): Promise<string>;
+export interface DependencyLink {
+    /** Package link, relative to node_modules (including @scope/name). */
+    link: string;
+    target: string;
+    classification: "worktree" | "node_modules" | "outside";
+}
+/** Inventory only package-level links; never descend into installed packages. */
+export declare function inventoryDependencyLinks(worktree: string): DependencyLink[];
+/** Shared pre-command refusal; unreadable inventories cannot establish isolation either. */
+export declare function dependencyLinkRefusal(worktree: string): string | undefined;
 export declare function linkNodeModules(repo: string, dir: string, { force }?: {
     force?: boolean | undefined;
 }): boolean;

package/dist/run/git.js

@@ -4,7 +4,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { execFileSync, spawn } from "node:child_process";
 import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import { availableParallelism, homedir, tmpdir } from "node:os";
-import { join, resolve } from "node:path";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { StringDecoder } from "node:string_decoder";
 import { shq } from "../adapters/types.js";
 import { tickmarkrDir } from "../graph/graph.js";
@@ -624,6 +624,54 @@ function excludeNodeModules(dir) {
     }
     catch { /* not a git checkout (bare tmpdir in tests) — never fail provisioning over the exclude */ }
 }
+/** Inventory only package-level links; never descend into installed packages. */
+export function inventoryDependencyLinks(worktree) {
+    const dependencyPath = join(worktree, "node_modules");
+    try {
+        lstatSync(dependencyPath);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+    const root = realpathSync(worktree);
+    const dependencies = realpathSync(dependencyPath);
+    const inside = (parent, target) => {
+        const rel = relative(parent, target);
+        return rel === "" || (!isAbsolute(rel) && rel !== ".." && !rel.startsWith(`..${sep}`));
+    };
+    const links = [];
+    const inspect = (link) => {
+        const path = join(dependencies, link);
+        if (!lstatSync(path).isSymbolicLink())
+            return;
+        const target = realpathSync(path);
+        links.push({ link, target, classification: inside(root, target) ? "worktree"
+                : inside(dependencies, target) ? "node_modules" : "outside" });
+    };
+    for (const entry of readdirSync(dependencies).sort()) {
+        inspect(entry);
+        if (entry.startsWith("@") && statSync(join(dependencies, entry)).isDirectory()) {
+            for (const child of readdirSync(join(dependencies, entry)).sort())
+                inspect(join(entry, child));
+        }
+    }
+    return links;
+}
+/** Shared pre-command refusal; unreadable inventories cannot establish isolation either. */
+export function dependencyLinkRefusal(worktree) {
+    try {
+        const outside = inventoryDependencyLinks(worktree).filter(link => link.classification === "outside");
+        if (!outside.length)
+            return undefined;
+        return "infra: OBS-1118 refusing verification: dependency links resolve outside the worktree and real node_modules:\n"
+            + outside.map(({ link, target }) => `node_modules/${link} -> ${target}`).join("\n");
+    }
+    catch (error) {
+        return `infra: OBS-1118 refusing verification: cannot inventory dependency links in ${worktree}: ${String(error)}`;
+    }
+}
 export function linkNodeModules(repo, dir, { force = false } = {}) {
     const src = join(repo, "node_modules");
     const dest = join(dir, "node_modules");