tickmarkr 2.5.9 → 2.6.1

package/dist/gates/cache.js

@@ -1,9 +1,9 @@
 import { createHash } from "node:crypto";
 import { execSync } from "node:child_process";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
 import { tmpdir } from "node:os";
-import { describeCapacity, resolvedCapacity, shGit, verificationProtocol } from "../run/git.js";
+import { checkoutIncarnation, describeCapacity, inventoryDependencyLinks, resolvedCapacity, shGit, verificationProtocol } from "../run/git.js";
 import { shq } from "../adapters/types.js";
 export const DEFAULT_VERDICT_CACHE_BOUND = 128;
 let testCacheBound;
@@ -84,6 +84,13 @@ export function environmentFingerprint(env) {
     const capacity = { forkCap: cap.forkCap, cores: cap.cores };
     const selectedSet = env.selectedSet ? [...env.selectedSet].sort() : undefined;
     const verification = env.verification ?? verificationProtocol(process.env, env.worktree ?? process.cwd());
+    // Admitted links still affect resolution. Normalize against the classified root so relocating
+    // an otherwise identical checkout (including its dependency store) preserves the identity.
+    const resolution = env.worktree ? inventoryDependencyLinks(env.worktree).map(({ link, target, classification }) => ({
+        link,
+        classification,
+        target: classification === "outside" ? target : relative(realpathSync(classification === "worktree" ? env.worktree : join(env.worktree, "node_modules")), target),
+    })).sort((a, b) => a.link < b.link ? -1 : a.link > b.link ? 1 : 0) : [];
     // R41: the protocol and the EFFECTIVE lifecycle are IN the hashed payload, so every entry written
     // before this stamp — green or red — keys differently and is never answered; no store surgery is
     // needed. `source` is provenance (kept in parts, printed on the row) and never enters the key: an
@@ -92,6 +99,7 @@ export function environmentFingerprint(env) {
         nodeRuntime,
         lockfile,
         capacity,
+        resolution,
         selectedSet: selectedSet ?? null,
         scope: env.scope ?? "battery",
         verification: { protocol: verification.protocol, lifecycle: verification.lifecycle },
@@ -106,6 +114,9 @@ export async function computeVerificationIdentity(params) {
     const tree = params.tree ?? (await getWorktreeTree(params.worktree));
     if (!tree)
         return undefined;
+    const incarnation = params.gate === "build" ? checkoutIncarnation(params.worktree) : undefined;
+    if (params.gate === "build" && !incarnation)
+        return undefined;
     const baseline = baselineIdentity(params.baseline);
     const env = environmentFingerprint({
         worktree: params.worktree,
@@ -121,6 +132,7 @@ export async function computeVerificationIdentity(params) {
         scope: params.scope ?? "battery",
         worktree: realpathSync(params.worktree),
         tree,
+        ...(incarnation ? { checkoutIncarnation: incarnation } : {}),
         command: params.command,
         baseline,
         environment: env.fingerprint,
@@ -130,8 +142,10 @@ export async function computeVerificationIdentity(params) {
 export function verificationIdentityKey(id) {
     const cmdHash = createHash("sha256").update(id.command).digest("hex").slice(0, 16);
     const gate = id.gate ?? "gate";
-    // Checkout location is diagnostic only. Scope separates each verifier's evidence policy.
-    const workingTree = createHash("sha256").update(id.tree).digest("hex");
+    // Lint/test remain content-addressed. Builds also promise outputs in this physical checkout.
+    // Scope continues to separate each verifier's evidence policy.
+    const workingTree = createHash("sha256").update(id.tree)
+        .update(id.gate === "build" ? `\0checkout:${id.checkoutIncarnation ?? "unbound"}` : "").digest("hex");
     return `${id.scope ?? "battery"}-${gate}-${workingTree}-${cmdHash}-${id.baseline}-${id.environment}`;
 }
 export function formatReusedDetails(originalDetails, id) {
@@ -155,6 +169,9 @@ export function formatReusedRow(cached, id) {
         pass: cached.pass,
         details: cached.pass ? reusedDetails : cached.details,
         capacity: cached.capacity,
+        ...(cached.evidenceReceipt ? { evidenceReceipt: cached.evidenceReceipt } : {}),
+        ...(cached.evidenceReceipts ? { evidenceReceipts: cached.evidenceReceipts } : {}),
+        ...(cached.originRunRoot ? { originRunRoot: cached.originRunRoot } : {}),
         meta: {
             ...cached.meta,
             reused: true,
@@ -168,6 +185,7 @@ export function reusedIdentity(id) {
         gate: id.gate ?? "gate",
         scope: id.scope ?? "battery",
         tree: id.tree,
+        ...(id.checkoutIncarnation ? { checkoutIncarnation: id.checkoutIncarnation } : {}),
         ...(id.worktree ? { worktree: id.worktree } : {}),
         command: id.command,
         baseline: id.baseline,
@@ -306,6 +324,10 @@ export class VerdictStore {
                 ...("exitCode" in verdict ? { exitCode: verdict.exitCode } : {}),
                 ...(verdict.capacity ? { capacity: verdict.capacity } : {}),
                 ...(verdict.meta ? { meta: verdict.meta } : {}),
+                ...(verdict.evidenceReceipt ? { evidenceReceipt: verdict.evidenceReceipt } : {}),
+                ...(verdict.evidenceReceipts ? { evidenceReceipts: verdict.evidenceReceipts } : {}),
+                ...(verdict.originRunRoot ? { originRunRoot: verdict.originRunRoot }
+                    : typeof verdict.meta?.runDir === "string" ? { originRunRoot: resolve(verdict.meta.runDir) } : {}),
             },
             timestamp: Date.now(),
             sequence: ++globalStoreSequence,
@@ -314,17 +336,15 @@ export class VerdictStore {
         const tmpPath = join(this.dir, `verdict-${key}.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`);
         writeFileSync(tmpPath, JSON.stringify(record, null, 2) + "\n");
         try {
-            unlinkSync(finalPath);
-        }
-        catch {
-            // ignore
-        }
-        writeFileSync(finalPath, readFileSync(tmpPath));
-        try {
-            unlinkSync(tmpPath);
+            renameSync(tmpPath, finalPath);
         }
-        catch {
-            // ignore
+        finally {
+            try {
+                unlinkSync(tmpPath);
+            }
+            catch {
+                // Already renamed, or best-effort cleanup after a failed replacement.
+            }
         }
         this.evictOldest(bound);
         return true;

package/dist/gates/llm.js

@@ -403,7 +403,10 @@ async function runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs
                 // That seat was killed by its configured timeout, not an early launch reroute.
                 if (now - startedAt >= timeoutMs)
                     break;
-                if (reviewing && !firstLivenessObserved && now - startedAt >= REVIEW_FIRST_LIVENESS_MS) {
+                // OBS-1177: the beat is armed for an INTERACTIVE (pane) driver only. On the subprocess driver
+                // a headless `claude -p` buffers every byte until it exits, so 0 seat bytes at 30 s is not a
+                // dead launch; that seat keeps its full ceiling, which still bounds it (fail-closed by timeout).
+                if (reviewing && via.driver.interactive && !firstLivenessObserved && now - startedAt >= REVIEW_FIRST_LIVENESS_MS) {
                     firstLivenessObserved = true;
                     // RS-2: the beat reads seat-authored bytes ALONE. CPU evidence never holds a preamble-only
                     // capture open to the ceiling; a seat that has not written one byte of its own is re-routed.

package/dist/gates/review.d.ts

@@ -110,7 +110,7 @@ export declare function pickReviewer(author: Assignment, channels: BillingChanne
 prefer?: string[], // v1.53 T2: review.prefer — reorders eligible channels, never changes eligibility
 floor?: Tier, // task/config/prior floor from the caller; the author's own tier is ALWAYS applied here (RF-1)
 history?: string[], // run-scoped picks, oldest to newest; empty preserves the established ranking
-onSeat?: (seat: number, count: number) => void, demoted?: ReadonlySet<string>, excludeVendors?: ReadonlySet<string>): BillingChannel | null;
+onSeat?: (seat: number, count: number) => void, demoted?: ReadonlySet<string>, excludeVendors?: ReadonlySet<string>, authors?: readonly string[]): BillingChannel | null;
 export type ReviewUnparseableCause = VerdictUnparseableCause | "launch-never-started" | "truncated" | "silent" | "closure-mismatch";
 /**
  * This shows the reviewer what the task DECLARED, never what the diff may actually reach. The diff
@@ -120,8 +120,7 @@ export type ReviewUnparseableCause = VerdictUnparseableCause | "launch-never-sta
 export declare function renderDeclaredWriteScope(files: ReadonlyArray<string>): string;
 /**
  * OBS-1033: the vendors of the seats that authored commits inside the accumulated diff. A seat is
- * never handed its own earlier work to approve. A prior author not resolvable in the pool excludes
- * its adapter's vendors instead (fail closed: the seat is known, its vendor is whatever it bills as).
+ * never handed its own earlier work to approve. Unresolved channels are refused by reviewGate.
  */
 export declare function carriedAuthorVendors(channels: BillingChannel[], carriedAuthors?: readonly string[]): Set<string>;
 /**

package/dist/gates/review.js

@@ -8,7 +8,7 @@ import { getAdapter } from "../adapters/registry.js";
 import { shOk } from "../run/git.js";
 import { carryReviewFindings, observedReviewFingerprints, reviewFingerprintMatches, structuredFindings, UNIDENTIFIED } from "../run/journal.js";
 import { redactSecrets } from "../run/redact.js";
-import { marginalCostRank } from "../route/router.js";
+import { rankPreferredChannels, reviewPreferenceTieBreak } from "../route/role-pick.js";
 import { modelProvider } from "../route/preference.js";
 import { resolveStateDir } from "./cache.js";
 import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, parseAnchoredComments, runLlmDetailed, verdictNonceLine } from "./llm.js";
@@ -227,13 +227,6 @@ export function isReviewClosureMismatch(v, priorIds) {
     const priors = priorIds instanceof Set ? priorIds : new Set(priorIds);
     return ids.some((id) => matchClosureId(id, priors) === undefined);
 }
-// v1.53 T2: same entry grammar as routing.map.prefer (router.ts preferIndex — router is out of this
-// module's dependency direction for a private fn, so the 3 lines live here too): `adapter` matches
-// every channel of that adapter, `adapter:model` exactly one; unmatched channels sort after all entries.
-function reviewPreferIndex(c, prefer) {
-    const i = prefer.findIndex((p) => p === c.adapter || p === channelKey(c));
-    return i === -1 ? prefer.length : i;
-}
 /**
  * RF-1 (OBS-922 add.2/3): the tier a reviewer must meet is the maximum of the author's tier, the
  * task-declared floor, a configured `review.floor` tier and, on a second round or a retry, the prior
@@ -283,29 +276,28 @@ floor, // task/config/prior floor from the caller; the author's own tier is ALWA
 history = [], // run-scoped picks, oldest to newest; empty preserves the established ranking
 onSeat, demoted = new Set(), 
 // OBS-1033: vendors that authored a carried commit inside the accumulated diff — excluded for the round.
-excludeVendors = new Set()) {
-    // FLEET-05 success criterion 2: an author not resolvable in the channel list yields NO reviewer.
-    // The old `?? author.adapter` fallback compared an adapter id to vendor names, matched nothing, and
-    // admitted every reviewer — including the author's own channel (fail-OPEN). null lands on reviewGate's
-    // fail-closed branch under review.required.
-    const authorChannel = channels.find((c) => c.adapter === author.adapter && c.model === author.model);
-    if (!authorChannel)
+excludeVendors = new Set(), authors = [channelKey(author)]) {
+    // Resolve every actual author, never guess a vendor from an adapter id.
+    const authorChannels = authors.map((key) => channels.find((c) => channelKey(c) === key));
+    if (authorChannels.some((c) => !c))
         return null;
-    const authorProvider = modelProvider(author.model, authorChannel.vendor);
     // RF-1: every caller inherits the author-tier floor — a reviewer is never seated below its author.
     const effectiveFloor = resolveReviewerFloor(author.tier, floor).floor;
-    const ranked = channels
+    const eligible = channels
         // Three independent axes: different vendor, different resolved provider identity (OBS-946: on initial pick
         // as well as failover, so an aggregator channel stamped "mixed" never seats the author's own provider),
         // and different base-model identity (ADDED TO the vendor rule, never replacing it). The diversity
         // filter runs BEFORE preference ranking, so prefer cannot resurrect an excluded channel.
-        .filter((c) => c.vendor !== authorChannel.vendor
-        && modelProvider(c.model, c.vendor) !== authorProvider
-        && modelId(c.model) !== modelId(author.model)
+        .filter((c) => authorChannels.every((a) => a && c.vendor !== a.vendor
+        && modelProvider(c.model, c.vendor) !== modelProvider(a.model, a.vendor)
+        && modelId(c.model) !== modelId(a.model))
         && !exclude.includes(channelKey(c))
         && !excludeVendors.has(c.vendor)
-        && TIER_RANK[c.tier] >= TIER_RANK[effectiveFloor])
-        .sort((a, b) => reviewPreferIndex(a, prefer) - reviewPreferIndex(b, prefer) || TIER_RANK[b.tier] - TIER_RANK[a.tier] || marginalCostRank(a) - marginalCostRank(b));
+        && TIER_RANK[c.tier] >= TIER_RANK[effectiveFloor]);
+    const ranked = rankPreferredChannels(eligible, prefer, {
+        includeUnpreferred: true,
+        tieBreak: reviewPreferenceTieBreak,
+    });
     const reviewer = [...ranked].sort((a, b) => Number(demoted.has(channelKey(a))) - Number(demoted.has(channelKey(b)))
         || history.lastIndexOf(channelKey(a)) - history.lastIndexOf(channelKey(b))
         || ranked.indexOf(a) - ranked.indexOf(b))[0] ?? null;
@@ -328,15 +320,12 @@ ${files.map((path) => `- ${path}`).join("\n")}`;
 }
 /**
  * OBS-1033: the vendors of the seats that authored commits inside the accumulated diff. A seat is
- * never handed its own earlier work to approve. A prior author not resolvable in the pool excludes
- * its adapter's vendors instead (fail closed: the seat is known, its vendor is whatever it bills as).
+ * never handed its own earlier work to approve. Unresolved channels are refused by reviewGate.
  */
 export function carriedAuthorVendors(channels, carriedAuthors = []) {
     const vendors = new Set();
     for (const key of carriedAuthors) {
-        const adapter = key.split(":")[0];
-        const exact = channels.filter((c) => channelKey(c) === key);
-        for (const c of exact.length ? exact : channels.filter((c) => c.adapter === adapter))
+        for (const c of channels.filter((c) => channelKey(c) === key))
             vendors.add(c.vendor);
     }
     return vendors;
@@ -391,7 +380,7 @@ artifactDir, reviewHistory, demotedReviewers, carriedFindings = [],
 // RF-1: channel keys of THIS task's prior reviewers (earlier rounds, a flaked seat) — task-scoped,
 // never the run-wide rotation history nor excludeReviewers; the seat holds the highest of their tiers.
 priorReviewers = [], 
-// OBS-1033: channel keys of the seats that authored the carried commits (the daemon's tried list).
+// Closed list of actual subject authors; empty preserves legacy callers' single-author contract.
 carriedAuthors = [], operatorContext) {
     // R3 (OBS-186): participation is keyed on PATHS. The compiler's assignment comes from the DECLARED
     // files[]; the operator's floor may RAISE it to full and can never lower it. `complexityThreshold` is
@@ -466,15 +455,15 @@ carriedAuthors = [], operatorContext) {
     // review.floor is read from config — cfg.routing.floors governs workers and never moves review seats.
     const { floor: reviewerFloor, cause: reviewerFloorCause } = gateReviewerFloor(task, cfg, author, channels, priorReviewers);
     const floorMeta = { reviewerFloor, reviewerFloorCause };
+    const authors = carriedAuthors.length ? carriedAuthors : [channelKey(author)];
+    const authorVendors = carriedAuthorVendors(channels, authors);
+    const unresolvedAuthors = authors.filter((key) => !channels.some((c) => channelKey(c) === key));
     let rotationSeat;
-    const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? [], reviewerFloor, reviewHistory, reviewHistory ? (seat) => { rotationSeat = seat; } : undefined, demotedReviewers, carriedAuthorVendors(channels, carriedAuthors));
+    const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? [], reviewerFloor, reviewHistory, reviewHistory ? (seat) => { rotationSeat = seat; } : undefined, demotedReviewers, authorVendors, authors);
     if (!reviewer) {
-        // meta.noEligibleReviewer lets run-gates' review-retry keep the ORIGINAL unparseable result when
-        // the retry finds no second seat — a truthful cause beats a synthetic no-reviewer failure.
-        const reason = `no cross-vendor reviewer available at or above ${reviewerFloor} floor (${reviewerFloorCause}; diversity rule)`;
-        return cfg.review.required || priorMaterials.length > 0
-            ? { gate: "review", pass: false, details: `unreadable — ${reason}; ${priorMaterials.length ? "carried materials require a review verdict" : "set review.required:false to waive"}`, meta: { noEligibleReviewer: true, unreadable: true, ...floorMeta } }
-            : { gate: "review", pass: true, details: `WARNING: ${reason} — review waived by config`, meta: { noEligibleReviewer: true, ...floorMeta } };
+        const reason = `no cross-vendor reviewer available at or above ${reviewerFloor} floor (${reviewerFloorCause}; diversity rule); author vendors: ${[...authorVendors].sort().join(", ") || "unknown"}${unresolvedAuthors.length ? `; unresolved author channels: ${unresolvedAuthors.join(", ")}` : ""}`;
+        return { gate: "review", pass: false, details: `unreadable — ${reason}; operator approve --waive required to proceed`,
+            meta: { noEligibleReviewer: true, unreadable: true, findings: [], authorVendors: [...authorVendors].sort(), unresolvedAuthors, ...floorMeta } };
     }
     reviewHistory?.push(channelKey(reviewer));
     const rotationMeta = rotationSeat === undefined ? {} : { rotationSeat };
@@ -515,6 +504,10 @@ ${priorMaterials.length ? `${renderPriorMaterials(priorMaterials)}
 Context only: this never substitutes for an acceptance criterion or closes a prior material.
 ${operatorContext.trim()}
 
+` : ""}${task.outOfScope?.length ? `## Out of scope
+The task declares these items out of scope. A finding inside these declared bounds is not material and must not block approval.
+${task.outOfScope.map((item) => `- ${item}`).join("\n")}
+
 ` : ""}## Diff
 \`\`\`diff
 ${diff}

package/dist/gates/run-gates.d.ts

@@ -7,6 +7,7 @@ import { type GateVia } from "./llm.js";
 import { type PriorReviewer } from "./review.js";
 import type { GateResult } from "./types.js";
 import { type VerificationRetryCause } from "../run/recovery.js";
+import { type PreserveProducer } from "../run/git.js";
 import { type StructuredFinding } from "../run/journal.js";
 import { type VerificationScope } from "./cache.js";
 export type LoadProvider = () => number;
@@ -71,6 +72,9 @@ export interface GateContext {
     /** Explicit worker funding requires fresh red measurements, never a gate waiver. */
     cachedRedBypass?: "operator-rerun";
     carriedAuthors?: readonly string[];
+    /** The attempt whose worker last wrote the gated checkout; a dirty-tree refusal stamps it on the
+     * preserve commit and its row. Absent (standalone verify, gate-only restores) preserves as "unknown". */
+    producer?: PreserveProducer;
     reviewHistory?: string[];
     priorReviewers?: PriorReviewer[];
     artifactDir?: string;

package/dist/gates/run-gates.js

@@ -17,7 +17,7 @@ import { scopeGate } from "./scope.js";
 import { evaluateManifestedTest, isVitestTestCommand } from "./test-manifest.js";
 import { executionSignal } from "../run/execution-budget.js";
 import { failureDisposition } from "../run/recovery.js";
-import { preserveWorktree, shGit, resolvedCapacity, verificationProtocol } from "../run/git.js";
+import { dependencyLinkRefusal, preserveWorktree, producerFields, shGit, resolvedCapacity, verificationProtocol } from "../run/git.js";
 import { withJudgeInvocationEvidence } from "../run/journal.js";
 import { computeVerificationIdentity, verificationIdentityKey, formatReusedRow, getVerdictStore, isInfraResult, resolveStateDir, reusedIdentity, } from "./cache.js";
 const productionLoadProvider = () => loadavg()[0] ?? 0;
@@ -223,6 +223,7 @@ async function runVitestManifestGate(worktree, cmd, baseline, selected, artifact
         overallCeilingMs: effectiveCeilingMs(entry),
         artifactDir,
         evidence: retry.evidence,
+        retryBaseCommand: retry.retryBaseCommand, // OBS-1166: the un-narrowed command for a selected screen's stranded retry
     });
     const reportPath = outcome.reportPath;
     const evidence = { evidenceReceipt: outcome.evidenceReceipt, evidenceReceipts: outcome.evidenceReceipts };
@@ -304,6 +305,16 @@ export async function runGates(task, ctx) {
     };
     let selectionDecision;
     let commits = [];
+    // Check before cache identity, npm policy probes, or any gate command.
+    const dependencyRefusal = dependencyLinkRefusal(ctx.worktree);
+    if (dependencyRefusal) {
+        const gate = GATE_NAMES.find(g => task.gates.includes(g)) ?? "build";
+        const result = { gate, pass: false, details: dependencyRefusal,
+            meta: { infra: true, classification: "infra", retryable: false, kind: "workspace-dependency" } };
+        await noBuild("refused", dependencyRefusal);
+        await ctx.onGate?.({ phase: "end", gate, result });
+        return { results: [result], commits: [] };
+    }
     const stateDir = ctx.stateDir ?? resolveStateDir(ctx.worktree, ctx.artifactDir);
     const verdictStore = getVerdictStore(stateDir);
     // R41: the verification protocol and the EFFECTIVE npm lifecycle policy measured for THIS
@@ -472,7 +483,7 @@ export async function runGates(task, ctx) {
         let preservedRef;
         let preservationError;
         try {
-            preservedRef = await preserveWorktree(ctx.worktree);
+            preservedRef = await preserveWorktree(ctx.worktree, ctx.producer);
         }
         catch (error) {
             // Never masks the refusal, but never pretends a snapshot exists either — surfaced below.
@@ -527,6 +538,7 @@ export async function runGates(task, ctx) {
             dirtyWorktree: true,
             ref: preservedRef,
             preservedRef,
+            ...producerFields(ctx.producer),
             paths: dirtyPaths,
             files: dirtyPaths,
             path: primaryFile,
@@ -573,7 +585,7 @@ export async function runGates(task, ctx) {
         let preservedRef;
         let preservationError;
         try {
-            preservedRef = await preserveWorktree(ctx.worktree);
+            preservedRef = await preserveWorktree(ctx.worktree, ctx.producer);
         }
         catch (error) {
             preservationError = error instanceof Error ? error.message : String(error);
@@ -604,6 +616,7 @@ export async function runGates(task, ctx) {
                 dirtyAtRoundEnd: true,
                 ref: preservedRef,
                 preservedRef,
+                ...producerFields(ctx.producer),
                 paths: dirtyPaths,
                 files: dirtyPaths,
                 path: primaryFile,
@@ -667,7 +680,7 @@ export async function runGates(task, ctx) {
                     // other scripted test command keeps today's exit-code contract byte-identically.
                     const useManifest = g === "test" && commands.test !== undefined && isVitestTestCommand(commands.test, ctx.worktree);
                     r = useManifest
-                        ? await measure(g, () => runVitestManifestGate(ctx.worktree, commands.test, ctx.baseline, selected, ctx.artifactDir, { ...retryOptions(identity), evidence }))
+                        ? await measure(g, () => runVitestManifestGate(ctx.worktree, commands.test, ctx.baseline, selected, ctx.artifactDir, { ...retryOptions(identity), evidence, ...(selected ? { retryBaseCommand: ctx.commands.test } : {}) }))
                         : (await measure(g, () => compareToBaseline(ctx.worktree, commands, ctx.baseline, [g], { ...retryOptions(identity), evidence, ...(g === "build" ? { onReceipt: buildReceipt, taskBuildAttribution: beginBuild } : {}), ...(g === "test" && selected ? { selected } : {}) })))[0];
                 }
                 finally {

package/dist/gates/test-manifest.d.ts

@@ -1,5 +1,7 @@
 import { type GateEvidenceOptions, type BaselineFileDuration } from "./baseline.js";
 import type { GateEvidenceReceipt } from "../run/protocol.js";
+export declare const VITEST_CACHE_ENV = "TICKMARKR_VITEST_CACHE_DIR";
+export declare function worktreeVitestCache(cwd: string, inherited?: string): string;
 export declare function isVitestTestCommand(cmd: string, cwd: string): boolean;
 /** One identity for every path this module compares: repo-relative, forward-slash. `vitest list
  * --json` and `TestModule.moduleId` both hand back an absolute filesystem path already resolved
@@ -37,6 +39,11 @@ export interface TestReport {
     requested: string[];
     started: Record<string, number>;
     completed: Record<string, TestReportCompletion>;
+    /** Resolved scheduling observed at run start; absent/partial means unknown, never inferred. */
+    scheduling?: Record<string, {
+        pool: string;
+        singleFork: boolean;
+    }>;
     /** Files the reporter observed complete MORE than once — `completed`'s object keys cannot show
      * this themselves (a second write silently overwrites the first), so the reporter records the
      * evidence separately before it is lost. */
@@ -139,6 +146,13 @@ export declare function discoverTestManifest(cmd: string, cwd: string, opts: {
  * runner cannot list (a null compares nothing — it never manufactures a deficit). The suite is not
  * run here; the capture already ran it once. */
 export declare function manifestFileCount(cmd: string, cwd: string): Promise<number | null>;
+/** The stranded single-fork retry: positional filters are substring matches that OR with any filter
+ * the command already carries, and under a `projects` config the CLI `--exclude` never subtracts such a
+ * selection (OBS-1166: a selected screen's retry rediscovered the whole selection and refused). So the
+ * retry is built from the UN-narrowed base command, its own `--` rule, the stranded files as the only
+ * positional filters, and an `--exclude` of every completed file; the caller then requires discovery
+ * to prove the exact retry set before launch. */
+export declare function singleForkRetryCommand(base: string, cwd: string, stranded: readonly string[], completed: readonly string[]): string;
 /** One configured runner execution, and its own collection under the same arguments and environment.
  * The installed runner is trusted (R28 add.1 option B); the nonce catches stale artifacts, not forgery. */
 export declare function evaluateManifestedTest(cmd: string, cwd: string, opts: {
@@ -147,4 +161,7 @@ export declare function evaluateManifestedTest(cmd: string, cwd: string, opts: {
     overallCeilingMs?: number;
     artifactDir?: string;
     evidence?: GateEvidenceOptions;
+    /** OBS-1166: the configured command BEFORE a selected screen narrowed it, so a stranded retry's
+     * only positional filters are the stranded files. Absent (a full suite), `cmd` is that command. */
+    retryBaseCommand?: string;
 }): Promise<ManifestGateOutcome>;

package/dist/gates/test-manifest.js

@@ -1,11 +1,20 @@
 import { createHash, randomBytes } from "node:crypto";
-import { existsSync, mkdtempSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { existsSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { isAbsolute, join, relative, sep } from "node:path";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { TEST_REPORTER_SOURCE } from "./test-reporter.js";
 import { shq } from "../adapters/types.js";
 import { beginGateEvidence, redactGateOutput } from "./baseline.js";
 import { FORK_CAP_ENV, ROUTING_ENV_SEAMS, SUITE_PARENT_ENV, shell, resolvedCapacity, verificationProtocol } from "../run/git.js";
+// Outside the shared dependency symlink and ignored by the shipped repository.
+export const VITEST_CACHE_ENV = "TICKMARKR_VITEST_CACHE_DIR";
+export function worktreeVitestCache(cwd, inherited) {
+    const local = resolve(cwd, ".vitest-cache");
+    const candidate = inherited ? resolve(cwd, inherited) : local;
+    const within = relative(local, candidate);
+    return within === "" || (!isAbsolute(within) && within !== ".." && !within.startsWith(`..${sep}`))
+        ? candidate : local;
+}
 /**
  * VL-1 (OBS-985 lineage): a test gate's completion must be the runner's OWN report, never a stdout
  * count. `fileCountDeficit` (baseline.ts) reads a summary LINE — a selected screen's smaller count
@@ -387,6 +396,7 @@ export function runManifestedTest(cmd, cwd, opts) {
  * verdict measured with `pretest` hooks is never compared to one without. */
 function manifestEnvironment(cwd) {
     const env = { ...process.env, PATH: `${join(cwd, "node_modules/.bin")}:${process.env.PATH ?? ""}`,
+        [VITEST_CACHE_ENV]: worktreeVitestCache(cwd),
         [FORK_CAP_ENV]: String(resolvedCapacity().forkCap), [SUITE_PARENT_ENV]: String(process.pid) };
     const verification = verificationProtocol(env, cwd);
     for (const key of ROUTING_ENV_SEAMS)
@@ -436,17 +446,68 @@ export async function manifestFileCount(cmd, cwd) {
     catch {
         return null;
     }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    } // OBS-1155: the listing directory is the capture's alone, listed or not
+}
+/** Vitest's forks pool awaits the parallel phase, then throws before the single-fork phase
+ * on any rejected worker. Recover only that exact, fully accounted-for boundary. */
+function strandedSingleForkFiles(files, nonce, run) {
+    const r = run.report;
+    if (run.killedFile || run.exitCode !== 1 || !r || r.nonce !== nonce || r.certificate?.exitCode !== 1)
+        return;
+    if (r.requested.length !== files.length || new Set(r.requested).size !== files.length
+        || r.requested.some(f => !files.includes(f)) || r.duplicateCompletions?.length)
+        return;
+    if (Object.keys(r.started).some(f => !files.includes(f))
+        || Object.keys(r.completed).some(f => !files.includes(f) || !Object.hasOwn(r.started, f)))
+        return;
+    const scheduling = r.scheduling;
+    if (!scheduling || Object.keys(scheduling).length !== files.length
+        || files.some(f => !Object.hasOwn(scheduling, f) || scheduling[f]?.pool !== "forks"
+            || typeof scheduling[f]?.singleFork !== "boolean"))
+        return;
+    const diagnostics = r.certificate.diagnostics;
+    if (!Array.isArray(diagnostics) || !diagnostics.length || r.certificate.errors !== diagnostics.length
+        || diagnostics.some(d => {
+            if (typeof d !== "string")
+                return true;
+            const timeout = /^(?:(.+): )?Error: \[vitest-worker\]: Timeout calling "[A-Za-z_$][\w$]*"$/.exec(d);
+            // The optional prefix is the reporter's testPath, not another error or arbitrary prose.
+            return !timeout || (timeout[1] !== undefined && !files.some(f => timeout[1] === f || timeout[1].endsWith(`/${f}`)));
+        }))
+        return;
+    const single = files.filter(f => scheduling[f].singleFork);
+    const parallel = files.filter(f => !scheduling[f].singleFork);
+    if (!single.length || !parallel.length || single.some(f => Object.hasOwn(r.started, f) || Object.hasOwn(r.completed, f)))
+        return;
+    if (parallel.some(f => !Object.hasOwn(r.started, f)
+        || !["passed", "skipped"].includes(r.completed[f]?.status ?? "")
+        || (r.completed[f]?.tests?.failed ?? 0) !== 0))
+        return;
+    return single;
+}
+/** The stranded single-fork retry: positional filters are substring matches that OR with any filter
+ * the command already carries, and under a `projects` config the CLI `--exclude` never subtracts such a
+ * selection (OBS-1166: a selected screen's retry rediscovered the whole selection and refused). So the
+ * retry is built from the UN-narrowed base command, its own `--` rule, the stranded files as the only
+ * positional filters, and an `--exclude` of every completed file; the caller then requires discovery
+ * to prove the exact retry set before launch. */
+export function singleForkRetryCommand(base, cwd, stranded, completed) {
+    const excluded = completed.map(f => `--exclude=${shq(f.replace(/[\\*?[\]{}()!+@]/g, "\\$&"))}`).join(" ");
+    return `${base}${runnerInvocation(base, cwd).separator} ${stranded.map(f => shq(join(cwd, f))).join(" ")} ${excluded}`;
 }
 /** One configured runner execution, and its own collection under the same arguments and environment.
  * The installed runner is trusted (R28 add.1 option B); the nonce catches stale artifacts, not forgery. */
 export async function evaluateManifestedTest(cmd, cwd, opts) {
     const dir = opts.artifactDir ?? mkdtempSync(join(tmpdir(), "tickmarkr-test-report-"));
-    const nonce = randomBytes(16).toString("hex");
-    const reportPath = join(dir, `test-manifest-report-${nonce}.json`);
+    let nonce = randomBytes(16).toString("hex");
+    let reportPath = join(dir, `test-manifest-report-${nonce}.json`);
     const reporterPath = join(dir, `test-reporter-${nonce}.mjs`);
     const evidenceReceipts = [];
     let spawnedCommand = cmd;
     let manifestPath;
+    let recovery;
     const { env, verification } = manifestEnvironment(cwd);
     try {
         const invocation = await discoverTestManifest(cmd, cwd, { dir, nonce, env, overallCeilingMs: opts.overallCeilingMs, evidence: { ...opts.evidence, artifactDir: opts.evidence?.artifactDir ?? dir } });
@@ -463,18 +524,55 @@ export async function evaluateManifestedTest(cmd, cwd, opts) {
         }, null, 2) + "\n");
         writeFileSync(reporterPath, TEST_REPORTER_SOURCE);
         spawnedCommand = `${cmd}${invocation.separator} --reporter=${shq(reporterPath)} --outputFile=${shq(reportPath)}`;
-        const invoked = await runManifestedTest(spawnedCommand, cwd, {
+        let invoked = await runManifestedTest(spawnedCommand, cwd, {
             evidence: { ...opts.evidence, artifactDir: opts.evidence?.artifactDir ?? dir }, manifest: files, nonce, reportPath, env,
             baselineDurations: opts.baselineDurations?.map((d) => ({ ...d, file: toManifestPath(d.file, cwd) })),
             longestFile: opts.longestFile,
             overallCeilingMs: opts.overallCeilingMs ?? DEFAULT_FILE_HANG_BUDGET_MS,
             pollMs: 20,
         });
-        const verdict = verifyManifestReport({ manifest: files, nonce, exitCode: invoked.exitCode,
+        let verdict = verifyManifestReport({ manifest: files, nonce, exitCode: invoked.exitCode,
             report: invoked.report, killedFile: invoked.killedFile, hangBudgetMs: invoked.hangBudgetMs });
+        evidenceReceipts.push(...invoked.evidenceReceipts);
+        const stranded = strandedSingleForkFiles(files, nonce, invoked);
+        if (stranded) {
+            const first = invoked.report;
+            const retryNonce = randomBytes(16).toString("hex");
+            recovery = { firstNonce: nonce, firstReportPath: reportPath, retryNonce, files: stranded };
+            nonce = retryNonce;
+            reportPath = join(dir, `test-manifest-report-${nonce}.json`);
+            const retryCommand = singleForkRetryCommand(opts.retryBaseCommand ?? cmd, cwd, stranded, files.filter(f => !stranded.includes(f)));
+            const listed = await discoverTestManifest(retryCommand, cwd, { dir, nonce, env,
+                overallCeilingMs: opts.overallCeilingMs, evidence: { ...opts.evidence, artifactDir: opts.evidence?.artifactDir ?? dir } });
+            evidenceReceipts.push(...listed.evidenceReceipts);
+            if (listed.files.length !== stranded.length || listed.files.some(f => !stranded.includes(f)))
+                throw new Error("single fork retry discovery does not match the stranded set");
+            writeFileSync(join(dir, `test-manifest-expected-${nonce}.json`), JSON.stringify({ nonce, files: stranded,
+                firstNonce: recovery.firstNonce, listingCommand: listed.listing, verification }, null, 2) + "\n");
+            spawnedCommand = `${retryCommand}${listed.separator} --reporter=${shq(reporterPath)} --outputFile=${shq(reportPath)}`;
+            invoked = await runManifestedTest(spawnedCommand, cwd, {
+                evidence: { ...opts.evidence, artifactDir: opts.evidence?.artifactDir ?? dir }, manifest: stranded, nonce, reportPath, env,
+                baselineDurations: opts.baselineDurations?.map(d => ({ ...d, file: toManifestPath(d.file, cwd) })),
+                longestFile: opts.longestFile, overallCeilingMs: opts.overallCeilingMs ?? DEFAULT_FILE_HANG_BUDGET_MS, pollMs: 20,
+            });
+            evidenceReceipts.push(...invoked.evidenceReceipts);
+            verdict = verifyManifestReport({ manifest: stranded, nonce, exitCode: invoked.exitCode,
+                report: invoked.report, killedFile: invoked.killedFile, hangBudgetMs: invoked.hangBudgetMs });
+            // An all-skipped retry may contribute lifecycle accounting, but only the combined manifest
+            // can establish executed success. Never rewrite either invocation's persisted certificate.
+            if (verdict.pass || verdict.meta.noExecutedModules) {
+                const retry = invoked.report;
+                if (retry.certificate?.errors !== 0 || !Array.isArray(retry.certificate.diagnostics) || retry.certificate.diagnostics.length)
+                    verdict = { kind: "fail-closed", pass: false, details: "single fork retry has unknown or nonempty runner diagnostics", meta: { classification: "infra", infra: true } };
+                else
+                    verdict = verifyManifestReport({ manifest: files, nonce, exitCode: invoked.exitCode, report: {
+                            ...retry, requested: files, started: { ...first.started, ...retry.started }, completed: { ...first.completed, ...retry.completed },
+                        } });
+            }
+            verdict.details = `single fork retry ${nonce} after worker RPC timeout in ${recovery.firstNonce}: ${verdict.details}`;
+        }
         // Preserve the validator's verdict and classification; runner evidence only explains it.
         const evidenceReceipt = invoked.evidenceReceipt;
-        evidenceReceipts.push(...invoked.evidenceReceipts);
         const evidenceRoot = opts.evidence?.artifactDir ?? dir;
         const stdoutPath = join(evidenceRoot, evidenceReceipt.stdout.path);
         const stderrPath = join(evidenceRoot, evidenceReceipt.stderr.path);
@@ -495,6 +593,7 @@ export async function evaluateManifestedTest(cmd, cwd, opts) {
             details: verdict.details + diagnostics,
             classification: verdict.meta.classification,
             meta: { ...verdict.meta, nonce, manifest: files, manifestPath, listingCommand: invocation.listing, verification,
+                ...(recovery ? { recovery, retryable: false } : {}),
                 spawnedCommand, processExit: invoked.exitCode, pid: invoked.pid, stdoutPath, stderrPath },
             exitCode: invoked.exitCode ?? -1, reportPath };
     }
@@ -503,7 +602,8 @@ export async function evaluateManifestedTest(cmd, cwd, opts) {
         if (evidenceReceipt)
             evidenceReceipts.push(...(error.evidenceReceipts ?? [evidenceReceipt]));
         return { evidenceReceipt, evidenceReceipts, pass: false, kind: "infra", classification: "infra", exitCode: -1, reportPath,
-            details: error instanceof Error ? error.message : String(error),
-            meta: { classification: "infra", infra: true, manifestDiscoveryFailed: true, spawnedCommand, verification, ...(manifestPath ? { manifestPath } : {}) } };
+            details: (recovery ? `single fork retry ${recovery.retryNonce} after ${recovery.firstNonce}: ` : "") + (error instanceof Error ? error.message : String(error)),
+            meta: { classification: "infra", infra: true, manifestDiscoveryFailed: true, spawnedCommand, verification,
+                ...(recovery ? { recovery, retryable: false } : {}), ...(manifestPath ? { manifestPath } : {}) } };
     }
 }

package/dist/gates/test-reporter.js

@@ -35,6 +35,10 @@ export default class TickmarkrReporter {
   }
   onTestRunStart(specifications) {
     this.report.requested = specifications.map(s => this.file(s));
+    // The files-only CLI listing has no scheduling information. These are the resolved
+    // specifications the pool will consume, including per-file pool overrides.
+    this.report.scheduling = Object.fromEntries(specifications.filter(s => s.project?.config && typeof s.pool === 'string')
+      .map(s => [this.file(s), { pool: s.pool, singleFork: s.project.config.poolOptions?.forks?.singleFork === true }]));
     this.save();
   }
   onTestModuleStart(module) {