tickmarkr 2.5.9 → 2.6.0

package/dist/gates/test-manifest.js

@@ -437,16 +437,54 @@ export async function manifestFileCount(cmd, cwd) {
         return null;
     }
 }
+/** Vitest's forks pool awaits the parallel phase, then throws before the single-fork phase
+ * on any rejected worker. Recover only that exact, fully accounted-for boundary. */
+function strandedSingleForkFiles(files, nonce, run) {
+    const r = run.report;
+    if (run.killedFile || run.exitCode !== 1 || !r || r.nonce !== nonce || r.certificate?.exitCode !== 1)
+        return;
+    if (r.requested.length !== files.length || new Set(r.requested).size !== files.length
+        || r.requested.some(f => !files.includes(f)) || r.duplicateCompletions?.length)
+        return;
+    if (Object.keys(r.started).some(f => !files.includes(f))
+        || Object.keys(r.completed).some(f => !files.includes(f) || !Object.hasOwn(r.started, f)))
+        return;
+    const scheduling = r.scheduling;
+    if (!scheduling || Object.keys(scheduling).length !== files.length
+        || files.some(f => !Object.hasOwn(scheduling, f) || scheduling[f]?.pool !== "forks"
+            || typeof scheduling[f]?.singleFork !== "boolean"))
+        return;
+    const diagnostics = r.certificate.diagnostics;
+    if (!Array.isArray(diagnostics) || !diagnostics.length || r.certificate.errors !== diagnostics.length
+        || diagnostics.some(d => {
+            if (typeof d !== "string")
+                return true;
+            const timeout = /^(?:(.+): )?Error: \[vitest-worker\]: Timeout calling "[A-Za-z_$][\w$]*"$/.exec(d);
+            // The optional prefix is the reporter's testPath, not another error or arbitrary prose.
+            return !timeout || (timeout[1] !== undefined && !files.some(f => timeout[1] === f || timeout[1].endsWith(`/${f}`)));
+        }))
+        return;
+    const single = files.filter(f => scheduling[f].singleFork);
+    const parallel = files.filter(f => !scheduling[f].singleFork);
+    if (!single.length || !parallel.length || single.some(f => Object.hasOwn(r.started, f) || Object.hasOwn(r.completed, f)))
+        return;
+    if (parallel.some(f => !Object.hasOwn(r.started, f)
+        || !["passed", "skipped"].includes(r.completed[f]?.status ?? "")
+        || (r.completed[f]?.tests?.failed ?? 0) !== 0))
+        return;
+    return single;
+}
 /** One configured runner execution, and its own collection under the same arguments and environment.
  * The installed runner is trusted (R28 add.1 option B); the nonce catches stale artifacts, not forgery. */
 export async function evaluateManifestedTest(cmd, cwd, opts) {
     const dir = opts.artifactDir ?? mkdtempSync(join(tmpdir(), "tickmarkr-test-report-"));
-    const nonce = randomBytes(16).toString("hex");
-    const reportPath = join(dir, `test-manifest-report-${nonce}.json`);
+    let nonce = randomBytes(16).toString("hex");
+    let reportPath = join(dir, `test-manifest-report-${nonce}.json`);
     const reporterPath = join(dir, `test-reporter-${nonce}.mjs`);
     const evidenceReceipts = [];
     let spawnedCommand = cmd;
     let manifestPath;
+    let recovery;
     const { env, verification } = manifestEnvironment(cwd);
     try {
         const invocation = await discoverTestManifest(cmd, cwd, { dir, nonce, env, overallCeilingMs: opts.overallCeilingMs, evidence: { ...opts.evidence, artifactDir: opts.evidence?.artifactDir ?? dir } });
@@ -463,18 +501,58 @@ export async function evaluateManifestedTest(cmd, cwd, opts) {
         }, null, 2) + "\n");
         writeFileSync(reporterPath, TEST_REPORTER_SOURCE);
         spawnedCommand = `${cmd}${invocation.separator} --reporter=${shq(reporterPath)} --outputFile=${shq(reportPath)}`;
-        const invoked = await runManifestedTest(spawnedCommand, cwd, {
+        let invoked = await runManifestedTest(spawnedCommand, cwd, {
             evidence: { ...opts.evidence, artifactDir: opts.evidence?.artifactDir ?? dir }, manifest: files, nonce, reportPath, env,
             baselineDurations: opts.baselineDurations?.map((d) => ({ ...d, file: toManifestPath(d.file, cwd) })),
             longestFile: opts.longestFile,
             overallCeilingMs: opts.overallCeilingMs ?? DEFAULT_FILE_HANG_BUDGET_MS,
             pollMs: 20,
         });
-        const verdict = verifyManifestReport({ manifest: files, nonce, exitCode: invoked.exitCode,
+        let verdict = verifyManifestReport({ manifest: files, nonce, exitCode: invoked.exitCode,
             report: invoked.report, killedFile: invoked.killedFile, hangBudgetMs: invoked.hangBudgetMs });
+        evidenceReceipts.push(...invoked.evidenceReceipts);
+        const stranded = strandedSingleForkFiles(files, nonce, invoked);
+        if (stranded) {
+            const first = invoked.report;
+            const retryNonce = randomBytes(16).toString("hex");
+            recovery = { firstNonce: nonce, firstReportPath: reportPath, retryNonce, files: stranded };
+            nonce = retryNonce;
+            reportPath = join(dir, `test-manifest-report-${nonce}.json`);
+            // Positional filters are substring matches (and OR with existing filters). Exclude every
+            // completed file as well, then require discovery to prove the exact retry set before launch.
+            const excluded = files.filter(f => !stranded.includes(f)).map(f => `--exclude=${shq(f.replace(/[\\*?[\]{}()!+@]/g, "\\$&"))}`).join(" ");
+            const retryCommand = `${cmd}${invocation.separator} ${stranded.map(f => shq(join(cwd, f))).join(" ")} ${excluded}`;
+            const listed = await discoverTestManifest(retryCommand, cwd, { dir, nonce, env,
+                overallCeilingMs: opts.overallCeilingMs, evidence: { ...opts.evidence, artifactDir: opts.evidence?.artifactDir ?? dir } });
+            evidenceReceipts.push(...listed.evidenceReceipts);
+            if (listed.files.length !== stranded.length || listed.files.some(f => !stranded.includes(f)))
+                throw new Error("single fork retry discovery does not match the stranded set");
+            writeFileSync(join(dir, `test-manifest-expected-${nonce}.json`), JSON.stringify({ nonce, files: stranded,
+                firstNonce: recovery.firstNonce, listingCommand: listed.listing, verification }, null, 2) + "\n");
+            spawnedCommand = `${retryCommand}${listed.separator} --reporter=${shq(reporterPath)} --outputFile=${shq(reportPath)}`;
+            invoked = await runManifestedTest(spawnedCommand, cwd, {
+                evidence: { ...opts.evidence, artifactDir: opts.evidence?.artifactDir ?? dir }, manifest: stranded, nonce, reportPath, env,
+                baselineDurations: opts.baselineDurations?.map(d => ({ ...d, file: toManifestPath(d.file, cwd) })),
+                longestFile: opts.longestFile, overallCeilingMs: opts.overallCeilingMs ?? DEFAULT_FILE_HANG_BUDGET_MS, pollMs: 20,
+            });
+            evidenceReceipts.push(...invoked.evidenceReceipts);
+            verdict = verifyManifestReport({ manifest: stranded, nonce, exitCode: invoked.exitCode,
+                report: invoked.report, killedFile: invoked.killedFile, hangBudgetMs: invoked.hangBudgetMs });
+            // An all-skipped retry may contribute lifecycle accounting, but only the combined manifest
+            // can establish executed success. Never rewrite either invocation's persisted certificate.
+            if (verdict.pass || verdict.meta.noExecutedModules) {
+                const retry = invoked.report;
+                if (retry.certificate?.errors !== 0 || !Array.isArray(retry.certificate.diagnostics) || retry.certificate.diagnostics.length)
+                    verdict = { kind: "fail-closed", pass: false, details: "single fork retry has unknown or nonempty runner diagnostics", meta: { classification: "infra", infra: true } };
+                else
+                    verdict = verifyManifestReport({ manifest: files, nonce, exitCode: invoked.exitCode, report: {
+                            ...retry, requested: files, started: { ...first.started, ...retry.started }, completed: { ...first.completed, ...retry.completed },
+                        } });
+            }
+            verdict.details = `single fork retry ${nonce} after worker RPC timeout in ${recovery.firstNonce}: ${verdict.details}`;
+        }
         // Preserve the validator's verdict and classification; runner evidence only explains it.
         const evidenceReceipt = invoked.evidenceReceipt;
-        evidenceReceipts.push(...invoked.evidenceReceipts);
         const evidenceRoot = opts.evidence?.artifactDir ?? dir;
         const stdoutPath = join(evidenceRoot, evidenceReceipt.stdout.path);
         const stderrPath = join(evidenceRoot, evidenceReceipt.stderr.path);
@@ -495,6 +573,7 @@ export async function evaluateManifestedTest(cmd, cwd, opts) {
             details: verdict.details + diagnostics,
             classification: verdict.meta.classification,
             meta: { ...verdict.meta, nonce, manifest: files, manifestPath, listingCommand: invocation.listing, verification,
+                ...(recovery ? { recovery, retryable: false } : {}),
                 spawnedCommand, processExit: invoked.exitCode, pid: invoked.pid, stdoutPath, stderrPath },
             exitCode: invoked.exitCode ?? -1, reportPath };
     }
@@ -503,7 +582,8 @@ export async function evaluateManifestedTest(cmd, cwd, opts) {
         if (evidenceReceipt)
             evidenceReceipts.push(...(error.evidenceReceipts ?? [evidenceReceipt]));
         return { evidenceReceipt, evidenceReceipts, pass: false, kind: "infra", classification: "infra", exitCode: -1, reportPath,
-            details: error instanceof Error ? error.message : String(error),
-            meta: { classification: "infra", infra: true, manifestDiscoveryFailed: true, spawnedCommand, verification, ...(manifestPath ? { manifestPath } : {}) } };
+            details: (recovery ? `single fork retry ${recovery.retryNonce} after ${recovery.firstNonce}: ` : "") + (error instanceof Error ? error.message : String(error)),
+            meta: { classification: "infra", infra: true, manifestDiscoveryFailed: true, spawnedCommand, verification,
+                ...(recovery ? { recovery, retryable: false } : {}), ...(manifestPath ? { manifestPath } : {}) } };
     }
 }

package/dist/gates/test-reporter.js

@@ -35,6 +35,10 @@ export default class TickmarkrReporter {
   }
   onTestRunStart(specifications) {
     this.report.requested = specifications.map(s => this.file(s));
+    // The files-only CLI listing has no scheduling information. These are the resolved
+    // specifications the pool will consume, including per-file pool overrides.
+    this.report.scheduling = Object.fromEntries(specifications.filter(s => s.project?.config && typeof s.pool === 'string')
+      .map(s => [this.file(s), { pool: s.pool, singleFork: s.project.config.poolOptions?.forks?.singleFork === true }]));
     this.save();
   }
   onTestModuleStart(module) {

package/dist/graph/graph.d.ts

@@ -24,7 +24,7 @@ export declare function onDiskSpecHash(_repoRoot: string, graph: RunGraph): OnDi
 /** A task's definition minus its files[] (and run state): what a scope amendment must NOT move (OBS-1073). */
 export declare function taskDefinitionFingerprint(task: Task): string;
 export declare function graphDefinitionHash(g: RunGraph): string;
-export declare function taskContentDigest(task: Pick<Task, "goal" | "files" | "acceptance">): string;
+export declare function taskContentDigest(task: Pick<Task, "goal" | "files" | "acceptance" | "outOfScope">): string;
 export declare function tickmarkrDir(repoRoot: string): string;
 export declare function loadGraph(repoRoot: string): RunGraph;
 export declare function saveGraph(repoRoot: string, g: RunGraph): void;

package/dist/graph/graph.js

@@ -94,9 +94,14 @@ export function graphDefinitionHash(g) {
 // finding; changing the goal, write surface or acceptance contract does. Keep the full digest here:
 // unlike graphDefinitionHash this value is persisted beside evidence and is the fail-closed join a
 // later run uses, so there is no benefit in making collision diagnosis less explicit.
+// OBS-1126: outOfScope joins the identity only when present — an absent list keeps the historical
+// bytes so every digest persisted before the field existed still joins.
 export function taskContentDigest(task) {
     return createHash("sha256")
-        .update(JSON.stringify({ goal: task.goal, files: task.files, acceptance: task.acceptance }))
+        .update(JSON.stringify({
+        goal: task.goal, files: task.files, acceptance: task.acceptance,
+        ...(task.outOfScope ? { outOfScope: task.outOfScope } : {}),
+    }))
         .digest("hex");
 }
 export function tickmarkrDir(repoRoot) {

package/dist/graph/schema.d.ts

@@ -80,6 +80,7 @@ export declare const TaskSchema: z.ZodObject<{
         kind: z.ZodLiteral<"fixture">;
         paths: z.ZodArray<z.ZodString>;
     }, z.core.$strip>], "kind">>>;
+    outOfScope: z.ZodOptional<z.ZodArray<z.ZodString>>;
     gates: z.ZodDefault<z.ZodArray<z.ZodEnum<{
         build: "build";
         test: "test";
@@ -181,6 +182,7 @@ export declare const RunGraphSchema: z.ZodObject<{
             kind: z.ZodLiteral<"fixture">;
             paths: z.ZodArray<z.ZodString>;
         }, z.core.$strip>], "kind">>>;
+        outOfScope: z.ZodOptional<z.ZodArray<z.ZodString>>;
         gates: z.ZodDefault<z.ZodArray<z.ZodEnum<{
             build: "build";
             test: "test";

package/dist/graph/schema.js

@@ -71,6 +71,8 @@ export const TaskSchema = z.object({
     }))
         .optional(),
     pins: z.array(PinSchema).optional(),
+    // OBS-1126: declared bounds the task must not cross; absent ⇒ no key (sealed graph bytes hold).
+    outOfScope: z.array(z.string().min(1)).optional(),
     gates: z
         .array(z.enum(GATE_NAMES))
         .default(["build", "test", "lint", "evidence", "scope", "acceptance", "review"])

package/dist/route/preference.d.ts

@@ -1,5 +1,5 @@
 import { type AuthHealth } from "../adapters/types.js";
-import type { TickmarkrConfig } from "../config/config.js";
+import { type TickmarkrConfig } from "../config/config.js";
 export interface Disallowed {
     by: "deny" | "allow";
     entry: string;

package/dist/route/preference.js

@@ -1,4 +1,5 @@
 import { channelKey, channelsFromConfig } from "../adapters/types.js";
+import { DENY_SCOPES, denyEntriesAt } from "../config/config.js";
 import { validateGraph } from "../graph/schema.js";
 import { route, RoutingError } from "./router.js";
 const PREFERENCE_ROLES = ["worker", "judge", "review", "consult"];
@@ -121,47 +122,17 @@ export function entryMatchesChannel(entry, c, allowFamilyMatching = false) {
 export function exclusionCollector(c, routingOrCfg, role = "worker") {
     const routing = "routing" in routingOrCfg ? routingOrCfg.routing : routingOrCfg;
     const out = [];
-    const { allow, deny } = routing ?? {};
-    for (const entry of deny?.adapters ?? []) {
-        if (entryMatchesChannel(entry, c, true)) {
-            out.push({
-                scope: "routing.deny.adapters",
-                path: "routing.deny.adapters",
-                configPath: "routing.deny.adapters",
-                entry,
-                by: "deny",
-            });
-        }
-    }
-    for (const entry of deny?.models ?? []) {
-        if (entryMatchesChannel(entry, c, true)) {
-            out.push({
-                scope: "routing.deny.models",
-                path: "routing.deny.models",
-                configPath: "routing.deny.models",
-                entry,
-                by: "deny",
-            });
-        }
-    }
-    if (role === "worker") {
-        for (const entry of deny?.workers?.adapters ?? []) {
-            if (entryMatchesChannel(entry, c, true)) {
-                out.push({
-                    scope: "routing.deny.workers.adapters",
-                    path: "routing.deny.workers.adapters",
-                    configPath: "routing.deny.workers.adapters",
-                    entry,
-                    by: "deny",
-                });
-            }
-        }
-        for (const entry of deny?.workers?.models ?? []) {
+    const { allow } = routing ?? {};
+    for (const scope of DENY_SCOPES) {
+        // Lists under workers apply only to worker seats; flat deny lists cover every role.
+        if (scope.path[2] === "workers" && role !== "worker")
+            continue;
+        for (const entry of denyEntriesAt(routing, scope) ?? []) {
             if (entryMatchesChannel(entry, c, true)) {
                 out.push({
-                    scope: "routing.deny.workers.models",
-                    path: "routing.deny.workers.models",
-                    configPath: "routing.deny.workers.models",
+                    scope: scope.dotted,
+                    path: scope.dotted,
+                    configPath: scope.dotted,
                     entry,
                     by: "deny",
                 });

package/dist/run/daemon.d.ts

@@ -170,6 +170,11 @@ export declare const HARVESTED_RESULT_SUMMARY = "harvested: the worktree carries
 export declare function commandsHash(commands: Record<string, string>): string;
 export interface TipProof {
     kind: "fresh" | "reused" | "failed" | "incomplete";
+    /** Each completed gate keeps its own execution provenance, even in a mixed cycle. */
+    gates?: Array<{
+        gate: string;
+        kind: "fresh" | "reused";
+    }>;
     /** the commit the cycle's start row spoke for */
     tip?: string;
 }
@@ -177,7 +182,8 @@ export interface TipProof {
  * OBS-1077 close rider: what the engagement's LATEST verification cycle proved — its
  * `tip-verify-start` row and what followed, never a commit comparison. Exactly one kind per close:
  * fresh (every tip command ran AND passed), reused (an eligible cached cycle carried forward),
- * failed, or incomplete (cancelled, cut short, mixed or undelimited). Nothing before the start row
+ * failed, or incomplete (cancelled, cut short or undelimited). Completed mixed cycles retain each
+ * gate's kind beside the whole-cycle reused kind. Nothing before the start row
  * is read, so an unfinished cycle inherits nothing from an earlier green one.
  */
 export declare function runEndTipProof(events: readonly JournalEvent[]): TipProof;

package/dist/run/daemon.js

@@ -33,7 +33,7 @@ import { cleanupRunWorktrees, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModu
 import { runInteractiveSeed } from "./interactive-seed.js";
 import { classifyRepairDisposition, resolveScopeHints } from "./repair-disposition.js";
 import { applyScopeAmendments, activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, outstandingReviewFindings, pendingApprovalActions, pendingRechecks, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
-import { isDiffCapPark, pickReviewer } from "../gates/review.js";
+import { gateReviewerFloor, isDiffCapPark, pickReviewer } from "../gates/review.js";
 import { acquireApprovalSerialization, acquireRunLock, isPidLive, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, reusedTipEvidence, verifyIntegrationTip } from "./merge.js";
 import { climbChannel, marginalCostRank, nextChannel, route } from "../route/router.js";
@@ -734,7 +734,8 @@ function lastVerifyCycle(events) {
  * OBS-1077 close rider: what the engagement's LATEST verification cycle proved — its
  * `tip-verify-start` row and what followed, never a commit comparison. Exactly one kind per close:
  * fresh (every tip command ran AND passed), reused (an eligible cached cycle carried forward),
- * failed, or incomplete (cancelled, cut short, mixed or undelimited). Nothing before the start row
+ * failed, or incomplete (cancelled, cut short or undelimited). Completed mixed cycles retain each
+ * gate's kind beside the whole-cycle reused kind. Nothing before the start row
  * is read, so an unfinished cycle inherits nothing from an earlier green one.
  */
 export function runEndTipProof(events) {
@@ -759,14 +760,25 @@ export function runEndTipProof(events) {
     if ((events[start].data.cached === true) !== cachedRow || (cachedRow && carried !== rows.length))
         return proof("incomplete");
     // D-131: fresh only when EVERY command executed; one per-gate persisted verdict makes the cycle reused.
-    return carried > 0 ? proof("reused") : proof("fresh");
+    return {
+        ...proof(carried > 0 ? "reused" : "fresh"),
+        gates: gates.map((gate) => ({
+            gate: String(gate),
+            kind: rows.some((r) => r.data.gate === gate && r.data.cached === true) ? "reused" : "fresh",
+        })),
+    };
 }
 /** The close notification's statement of the proof — one clause per kind. */
 export function formatTipProof(p) {
     const at = p.tip ? ` ${p.tip.slice(0, 12)}` : "";
+    const gateReading = p.gates?.map(({ gate, kind }) => `${gate}: ${kind === "fresh" ? "verified fresh" : "cached (reused) — carried, not re-run"}`).join("; ");
+    const suffix = gateReading ? `; ${gateReading}` : "";
+    if (p.kind === "reused" && p.gates?.some(({ kind }) => kind === "fresh")) {
+        return `tip proof: ${p.kind} — commit${at}; ${gateReading}`;
+    }
     switch (p.kind) {
-        case "fresh": return `tip proof: fresh — every tip command ran and passed on${at || " the integration tip"}`;
-        case "reused": return `tip proof: reused — carried from verified commit${at}, commands not re-run`;
+        case "fresh": return `tip proof: fresh — every tip command ran and passed on${at || " the integration tip"}${suffix}`;
+        case "reused": return `tip proof: reused — carried from verified commit${at}, commands not re-run${suffix}`;
         case "failed": return `tip proof: failed —${at ? ` commit${at}` : ""} latest verification cycle is red`;
         case "incomplete": return `tip proof: incomplete —${at ? ` commit${at}` : ""} latest verification cycle did not finish`;
     }
@@ -1476,6 +1488,77 @@ async function cherryPickCommits(wt, commits) {
     }
     return carried;
 }
+/** Fold lifetime dispatch/carry evidence, independent of attempt budgets and routing exclusions.
+ * Recreation rows name SOURCE hashes, so ownership is joined by stable patch identity. Each
+ * attempt owns only what the next carry (or current subject) adds beyond its own incoming set.
+ * Gate-only recreations do not start an attempt or transfer authorship to the restored seat.
+ */
+async function subjectAuthors(events, taskId, wt, base) {
+    const cache = new Map();
+    const patches = async (commits) => {
+        const ids = new Set();
+        for (const commit of commits) {
+            if (!cache.has(commit)) {
+                const diff = await shGit(`git show --format= --binary ${shq(commit)}`, wt);
+                if (diff.code !== 0)
+                    throw new Error(`cannot read author patch ${commit}`);
+                const id = execFileSync("git", ["patch-id", "--stable"], {
+                    cwd: wt, input: diff.stdout, encoding: "utf8", maxBuffer: 32 * 1024 * 1024,
+                }).trim().split(/\s+/)[0];
+                cache.set(commit, id || undefined); // an empty commit authored no patch
+            }
+            const id = cache.get(commit);
+            if (id)
+                ids.add(id);
+        }
+        return ids;
+    };
+    let current;
+    let previous;
+    let awaitingCarry = false;
+    const owners = new Map();
+    const attribute = (ids, attempt) => {
+        for (const id of ids) {
+            if (attempt?.incoming.has(id))
+                continue;
+            const authors = owners.get(id) ?? new Set();
+            authors.add(attempt?.author ?? "unknown author (missing task-dispatch assignment)");
+            owners.set(id, authors);
+        }
+    };
+    try {
+        for (const row of events) {
+            if (row.taskId !== taskId)
+                continue;
+            if (row.event === "task-dispatch") {
+                previous = current;
+                const a = row.data.assignment;
+                current = { author: typeof a?.adapter === "string" && typeof a?.model === "string"
+                        ? `${a.adapter}:${a.model}` : "unknown author (missing task-dispatch assignment)", incoming: new Set() };
+                awaitingCarry = true;
+            }
+            else if (row.event === "worktree-recreation") {
+                const carried = await patches(Array.isArray(row.data.carried) ? row.data.carried : []);
+                attribute(carried, awaitingCarry ? previous : current);
+                if (awaitingCarry && current)
+                    current.incoming = carried;
+                awaitingCarry = false;
+            }
+            else if (["worker-launch", "worker-result", "gate-result", "task-human"].includes(row.event)) {
+                // The initial checkout has no recreation row. Once work/gates start, a later
+                // recreation is a restore of this attempt, not the input of a new dispatch.
+                awaitingCarry = false;
+            }
+        }
+        const subject = await patches(await commitsAheadOf(base, wt));
+        attribute(subject, current);
+        return [...new Set([...subject].flatMap((id) => [...(owners.get(id) ?? [])]))];
+    }
+    catch (error) {
+        // An unreadable history cannot silently remove an author from the exclusion set.
+        return [`unknown author (${String(error)})`];
+    }
+}
 // T7 (v1.86): a first run-end append that fails AFTER partial bytes landed leaves a torn tail at
 // EOF with no newline; a blind retry would glue the run-end line onto those bytes and readJsonl's
 // torn-line tolerance would drop the retry too — no terminal record despite a successful write.
@@ -2635,7 +2718,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const round = await runGates(task, ctx);
                         let review = round.results.find((g) => g.gate === "review");
                         while (review?.meta?.noVerdict === true) {
-                            const next = pickReviewer(ctx.author, ctx.channels, badReviewers, cfg.review.prefer ?? [], task.routingHints?.floor, reviewHistory, undefined, demotedReviewers);
+                            // Recovery must honor the gate's floor, including the seats that just failed to
+                            // return a verdict; a below-floor alternative cannot replace the infra result.
+                            const { floor } = gateReviewerFloor(task, ctx.cfg, ctx.author, ctx.channels, [...(ctx.priorReviewers ?? []), ...badReviewers]);
+                            const next = pickReviewer(ctx.author, ctx.channels, badReviewers, cfg.review.prefer ?? [], floor, reviewHistory, undefined, demotedReviewers);
                             if (!next)
                                 break;
                             journal.append("review-infra-retry", t.id, { reviewer: channelKey(next), cause: review.meta.cause });
@@ -2744,6 +2830,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                             ...(Array.isArray(g.meta?.selectedTests) ? { selectedTests: g.meta.selectedTests } : {}),
                             ...(g.meta?.fullSuite === true ? { fullSuite: true } : {}),
                             ...(g.meta?.reapedGroup === true ? { reapedGroup: true } : {}),
+                            ...(g.gate === "review" && g.meta?.noEligibleReviewer === true ? {
+                                noEligibleReviewer: true, authorVendors: g.meta.authorVendors, unresolvedAuthors: g.meta.unresolvedAuthors,
+                            } : {}),
                             ...(g.gate === "review" && typeof g.meta?.reviewer === "string" ? {
                                 reviewer: g.meta.reviewer,
                                 ...Object.fromEntries(["cause", "seatAuthoredBytes", "bytes", "rawPath", "briefPath", "timeoutMs", "unparseable", "noVerdict", "resolved", "reraised", "reviewerFloor", "reviewerFloorCause", "reviewerTier"]
@@ -2771,13 +2860,14 @@ export async function runDaemon(repoRoot, opts = {}) {
                             // every recalibration this telemetry funds, a gap is honest and a zero is a lie. The
                             // seven-gate closed set is asserted end-to-end in tests/run/gate-telemetry.test.ts.
                             ...gateMeasurement(g.meta),
-                            // Fresh producer evidence is copied verbatim; absent/historical evidence is never minted here.
-                            ...(g.meta?.reused ? {} : {
-                                ...(g.evidenceReceipt ? { evidenceReceipt: g.evidenceReceipt } : {}),
-                                ...(g.evidenceReceipts ? { evidenceReceipts: g.evidenceReceipts } : {}),
-                                ...Object.fromEntries(["nonce", "stdoutPath", "stderrPath", "classification"]
-                                    .filter(key => g.meta?.[key] !== undefined).map(key => [key, g.meta[key]])),
-                            }),
+                            // Carried receipts retain their original invocation and artifact root.
+                            ...(g.evidenceReceipt ? { evidenceReceipt: g.evidenceReceipt } : {}),
+                            ...(g.evidenceReceipts ? { evidenceReceipts: g.evidenceReceipts } : {}),
+                            ...(g.meta?.reused ? {
+                                reused: true,
+                                ...(g.originRunRoot ? { originRunRoot: g.originRunRoot } : {}),
+                            } : Object.fromEntries(["nonce", "stdoutPath", "stderrPath", "classification"]
+                                .filter(key => g.meta?.[key] !== undefined).map(key => [key, g.meta[key]]))),
                             // T7: the capacity the gate's own command child ran under, lifted verbatim from the result
                             // the battery produced — read where the shell built that child's environment, never
                             // re-derived from the run's own budget, which would answer a different number than the
@@ -3005,7 +3095,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // OBS-130/T15: both gate-resume paths consume the persisted task branch with no worker dispatch.
                     // An operator approval skips its exact failed gate by authority; observed results skip only the
                     // contiguous green prefix whose recorded commit is still the task branch tip.
-                    const satisfiedGate = satisfiedGates.get(t.id);
+                    let satisfiedGate = satisfiedGates.get(t.id);
                     const replayedGates = fundedRerun ? undefined : replayedGateResults.get(t.id);
                     const recheck = approvalAction?.authority === "battery";
                     resumeGateReplay: if (satisfiedGate || replayedGates || recheck) {
@@ -3042,6 +3132,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // than against the stale worktree whose task-only history cannot see newly merged dependencies.
                         const currentTaskTip = await gitHead(wt);
                         const currentTaskSubject = await gateCommitSubject(taskBase, currentTaskTip, wt);
+                        // Recheck carries only review authority for the exact subject being gated, never tool greens.
+                        if (recheck) {
+                            satisfiedGate = journal.replaySatisfiedGates(new Map([[t.id, currentTaskSubject]])).get(t.id);
+                        }
                         journal.append("worktree-recreation", t.id, { attempted: commitsToCarry, carried: carriedCommits });
                         // OBS-212: same fail-closed rule as the dispatch path — but this path is worse, because it runs
                         // ONLY the gates after the approved one and then MERGES. T3 took it on run-20260728-110135:
@@ -3115,7 +3209,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const reused = [];
                         let remainingGates;
                         if (recheck) {
-                            remainingGates = GATE_NAMES.filter((gate) => t.gates.includes(gate));
+                            remainingGates = declaredGates.filter((gate) => gate !== satisfiedGate);
                         }
                         else if (satisfiedGate) {
                             remainingGates = t.gates.filter((gate) => {
@@ -3212,10 +3306,18 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // deterministic-fingerprint occurrence/review round for budget accounting.
                                 ...(!satisfiedGate && !recheck ? { replayMeasurement: true } : {}),
                             };
+                            if (recheck && satisfiedGate === "review" && gateSubject.commit !== currentTaskSubject) {
+                                satisfiedGate = undefined;
+                                resumedTask.gates = declaredGates;
+                            }
+                            if (recheck && satisfiedGate === "review" && !resumedTask.gates.includes("review")) {
+                                journal.append("gate-waiver-carried", t.id, { gate: "review", commit: gateSubject.commit, carried: true, release: RECHECK_RELEASE });
+                            }
                             await trackedDriver.project?.(t.id, "in-review");
                             await waitForBaseline(t.id);
                             journal.phaseStart(t.id, "gates");
-                            const { results } = await withCommandContext(t.id, () => runReviewRecovery(resumedTask, {
+                            const { results } = await withCommandContext(t.id, async () => runReviewRecovery(resumedTask, {
+                                carriedAuthors: await subjectAuthors(journal.read(), t.id, wt, taskBase),
                                 carriedFindings: outstandingReviewFindings(journal.read(), t.id),
                                 operatorContext,
                                 worktree: wt, baseRef: taskBase, result: priorResult, author: gateAuthor,
@@ -3234,7 +3336,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 excludeReviewers: badReviewers,
                                 reviewHistory, demotedReviewers, priorReviewers: taskReviewers(t.id),
                                 // Leg-2 (OBS-1052): the run-scoped two-strike tally — without it retirement is inert and a
-                                // flaking seat is re-asked on every task. (carriedAuthors is held back: see SURGEON-LEG2-REPORT.)
+                                // flaking seat is re-asked on every task.
                                 reviewNoVerdicts,
                                 recheck, // OBS-1055: a recheck discards cached reds — the battery re-measures what the operator questioned
                                 onGate: async (e) => {
@@ -3271,6 +3373,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                             graph = addEvidence(graph, t.id, { commits: approvedCommits, gateResults: results });
                             saveGraph(repoRoot, graph);
                             if (!results.every(gateSatisfied)) {
+                                const unavailableReview = results.find((g) => gateFailed(g) && g.meta?.noEligibleReviewer === true);
+                                if (unavailableReview) {
+                                    await park(t, gateFailApprovalReason(t.id, unavailableReview.details, true), "gate-fail", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
+                                    return;
+                                }
                                 const infra = results.find((g) => g.meta?.infra === true);
                                 if (infra) {
                                     await park(t, `${infra.gate}: ${infra.details}`, "infra", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
@@ -3299,7 +3406,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // Observed green gates are only measurements. If the resumed suffix is red, preserve that
                                 // result in the journal and return to the ordinary attempt/consult ladder, which rebuilds
                                 // feedback from those rows. Only an operator-authorized gate release parks on a new red.
-                                if (!satisfiedGate) {
+                                if (!satisfiedGate || recheck) {
                                     // OBS-1055: a recheck red funds a repair of the pin's own work. A pinned task's repair sits
                                     // on the pin (OBS-1034's exemption keeps the tried list from excluding it); a pin the fleet
                                     // cannot seat parks naming the pin — never the ladder.
@@ -3706,6 +3813,20 @@ export async function runDaemon(repoRoot, opts = {}) {
                         Object.defineProperty(workerSlotOpts, "agent", { value: assignment.adapter });
                         const slot = await trackedDriver.slot(wt, `${t.id}-worker-${assignment.adapter}-a${attempt}-${runTag}`, workerSlotOpts);
                         const sessionId = retryMode === "resume" ? priorSession.id : slot.name;
+                        const readResumeTranscript = () => {
+                            try {
+                                const sample = adapter.readSessionTranscript?.({ cwd: wt, id: sessionId });
+                                return sample && Number.isSafeInteger(sample.bytes) && sample.bytes >= 0 ? sample : null;
+                            }
+                            catch {
+                                return null;
+                            }
+                        };
+                        const resumeBaseline = retryMode === "resume" ? readResumeTranscript() : null;
+                        if (retryMode === "resume")
+                            journal.append("worker-resume-requested", t.id, {
+                                sessionId, attempt, workerDispatchOrdinal, baselineBytes: resumeBaseline?.bytes ?? null,
+                            });
                         const icmd = retryMode === "resume"
                             ? adapter.resumeCommand(sessionId, promptFile, assignment.model)
                             : cfg.visibility.worker === "interactive" && driver.interactive
@@ -3733,6 +3854,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const groupFile = `${dispatchScript}.${nonce}.pgid`;
                         workerOwners.set(slot, { taskId: t.id, attempt, groupFile });
                         writeFileSync(dispatchScript, [
+                            // Shell startup can swallow the driver's leading cd; the payload owns its checkout too.
+                            `cd ${shq(wt)} || exit 1`,
                             // A driver may launch inside the daemon's group. That group is never worker-owned.
                             `worker_pgid=$(ps -o pgid= -p $$ 2>/dev/null); daemon_pgid=$(ps -o pgid= -p ${process.pid} 2>/dev/null)`,
                             `if [ -n "$worker_pgid" ] && [ -n "$daemon_pgid" ] && [ "$worker_pgid" != "$daemon_pgid" ]; then printf '%s\\n' "$worker_pgid" > ${shq(groupFile)}; fi`,
@@ -3765,6 +3888,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             journal.append("worker-launch", t.id, {
                                 attempt,
                                 retryMode,
+                                ...(retryMode === "resume" ? { sessionId, workerDispatchOrdinal } : {}),
                                 driver: trackedDriver.id,
                                 slot: { ...slot },
                                 workspace: driver.id === "herdr" ? process.env.HERDR_WORKSPACE_ID : undefined,
@@ -4792,6 +4916,17 @@ export async function runDaemon(repoRoot, opts = {}) {
                         else {
                             await closeSlot(slot);
                         }
+                        if (retryMode === "resume") {
+                            const transcript = readResumeTranscript();
+                            const identity = resumeBaseline === null || transcript === null
+                                ? "unknown" : transcript.bytes > resumeBaseline.bytes ? "confirmed" : "unconfirmed";
+                            journal.append("worker-resume-identity", t.id, {
+                                sessionId, attempt, workerDispatchOrdinal, identity,
+                                baselineBytes: resumeBaseline?.bytes ?? null, observedBytes: transcript?.bytes ?? null,
+                                // This is evidence of file growth, not an independent runtime identity handshake.
+                                assumption: "external runtime appends to the requested session's own transcript",
+                            });
+                        }
                         // SPEND-01: usage from the harness's own cwd-keyed structured store, read POST-HOC from disk —
                         // `wt` is this task's private worktree, so the path is unique; the read is sliced to records
                         // stamped at/after this attempt's dispatch instant. Never the harvested pane text, never the
@@ -5133,7 +5268,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 }
                             }
                             else {
-                                ({ results, commits } = await withCommandContext(t.id, () => runReviewRecovery(t, {
+                                ({ results, commits } = await withCommandContext(t.id, async () => runReviewRecovery(t, {
+                                    carriedAuthors: await subjectAuthors(journal.read(), t.id, wt, taskBase),
                                     carriedFindings: outstandingFindings,
                                     operatorContext,
                                     worktree: wt, baseRef: taskBase, result, author: assignment,
@@ -5228,6 +5364,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // already journaled by onGate, before gateFails and before any ladder selection can fund an
                         // identical retry in the same environment. Parsed judge refusals never carry infra and keep
                         // flowing through the chargeable quality path below.
+                        const unavailableReview = results.find((g) => gateFailed(g) && g.meta?.noEligibleReviewer === true);
+                        if (unavailableReview) {
+                            await park(t, gateFailApprovalReason(t.id, unavailableReview.details, true), "gate-fail", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
+                            return;
+                        }
                         const infraFailure = results.find((g) => gateFailed(g) && g.meta?.infra === true);
                         if (infraFailure) {
                             await park(t, `${infraFailure.gate}: ${infraFailure.details}${infraFailure.meta?.recoveryBlocked ? ` — ${infraFailure.meta.recoveryBlocked}` : ""}`, "infra", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);