tickmarkr 2.5.9 → 2.6.1

package/dist/run/daemon.js

@@ -1,3 +1,5 @@
+import { HOST_PROBE_SAMPLE_MS, HOST_PROBE_SAMPLES, HostDegradedError, hostDegraded, observeHost } from "./host-health.js";
+import { VITEST_CACHE_ENV, worktreeVitestCache } from "../gates/test-manifest.js";
 import { COMMAND_LEASE_TOKEN_ENV, commandLeaseEnvironment, CommandLeases, currentCommandLeaseToken, isRunnerCommand, runWithCommandLease, withCommandLease } from "./lease.js";
 import { execFileSync, spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
@@ -8,9 +10,9 @@ import { tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { stringify } from "yaml";
-import { classifyDeadChannel, NO_TRAILER_SUMMARY, trailerPattern, UNPARSEABLE_TRAILER_SUMMARY, writePrompt } from "../adapters/prompt.js";
+import { classifyDeadChannel, classifyTransientCapacity, NO_TRAILER_SUMMARY, trailerPattern, UNPARSEABLE_TRAILER_SUMMARY, writePrompt } from "../adapters/prompt.js";
 import { allAdapters, getAdapter, probeAll, readDoctor, rolePools } from "../adapters/registry.js";
-import { SettledTrailerTracker, addUsage, channelKey, matchesInputBox, matchesTrustDialog, QUOTA_RE } from "../adapters/types.js";
+import { SettledTrailerTracker, addUsage, CAPACITY_RE, channelKey, matchesInputBox, matchesTrustDialog, QUOTA_RE } from "../adapters/types.js";
 import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { collateralHits } from "../compile/collateral.js";
 import { ExecutionPolicySchema, DEFAULT_DIFF_CAP, globalConfigDir, loadConfigWithMode, readOverlayFile, repoOverlayPath, } from "../config/config.js";
@@ -20,8 +22,9 @@ import { herdrSealShellPrefix, MAX_BUF, SubprocessDriver } from "../drivers/subp
 import { formatOwnedName } from "../drivers/types.js";
 import { captureBaseline, detectGateCommands, detectVacuousOracles } from "../gates/baseline.js";
 import { runGates } from "../gates/run-gates.js";
+import { isInfraResult } from "../gates/cache.js";
 import { filesGlob } from "../graph/files-glob.js";
-import { addEvidence, attributeBlocked, blockedTasks, getTask, graphDefinitionHash, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus, taskContentDigest, tickmarkrDir } from "../graph/graph.js";
+import { addEvidence, attributeBlocked, batteryPriority, blockedTasks, getTask, graphDefinitionHash, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus, taskContentDigest, tickmarkrDir } from "../graph/graph.js";
 import { GATE_NAMES } from "../graph/schema.js";
 import { distFingerprint } from "../cli/commands/version.js";
 import { augmentRetryBrief, consult, renderRetryGuidance } from "./consult.js";
@@ -29,11 +32,11 @@ import { executionSignal, remainingExecutionMs, withExecutionBudget, withoutExec
 import { repairSelectionDecision } from "./repair-selection.js";
 import { failureDisposition, reserveInfrastructureRetry } from "./recovery.js";
 import { runEnvironment } from "./environment.js";
-import { cleanupRunWorktrees, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, preserveWorktree, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shGit, SUITE_PARENT_ENV, verificationProtocol, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
+import { cleanupRunWorktrees, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER, preserveWorktree, producerFields, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shGit, SUITE_PARENT_ENV, verificationProtocol, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
 import { classifyRepairDisposition, resolveScopeHints } from "./repair-disposition.js";
 import { applyScopeAmendments, activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, outstandingReviewFindings, pendingApprovalActions, pendingRechecks, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
-import { isDiffCapPark, pickReviewer } from "../gates/review.js";
+import { gateReviewerFloor, isDiffCapPark, pickReviewer } from "../gates/review.js";
 import { acquireApprovalSerialization, acquireRunLock, isPidLive, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, reusedTipEvidence, verifyIntegrationTip } from "./merge.js";
 import { climbChannel, marginalCostRank, nextChannel, route } from "../route/router.js";
@@ -199,7 +202,8 @@ const RECHECK_ENACTMENT = "recheck-battery";
 const GATE_SATISFIED_ENACTMENT = "worktree-recreation";
 // Older daemons enacted rechecks through worker-launch, before recheck-battery existed.
 // Preserve that consumption at every scheduling read without changing continuing permission.
-function pendingDaemonApprovalActions(events) {
+// OBS-1158: exported so plan folds battery priority through the SAME consumption-aware seam.
+export function pendingDaemonApprovalActions(events) {
     const actions = pendingApprovalActions(events);
     const rechecks = pendingRechecks(events);
     for (const [id, action] of actions) {
@@ -310,6 +314,17 @@ function classifySignalOnlyTest(g) {
         return;
     g.meta = { ...g.meta, classification: "infra", infra: true, retryable: false, kind: "signal-exit" };
 }
+/** OBS-1106: ONE infrastructure predicate for classification, persistence and repair admission. A red
+ * that carries an infra fingerprint or classification without `meta.infra` (a legacy journal row, an
+ * oracle that named only its classification) is still a non-verdict about the work: it is normalized
+ * here BEFORE its journal row and before any park/repair seam reads it, so those seams can key on the
+ * same `isInfraResult` the gate cache keys on and never on one metadata field alone. */
+function classifyInfraResult(g) {
+    classifySignalOnlyTest(g);
+    if (g.pass || g.meta?.infra === true || !isInfraResult(g))
+        return;
+    g.meta = { ...g.meta, classification: "infra", infra: true };
+}
 // v1.85 T3: the gates whose failure IS a deterministic measurement — a machine re-ran a command over a
 // tree and printed the same bytes. Those are the failures the fingerprint cap governs (the ruling names
 // it a "deterministic-gate" cap): a third identical answer to a question already answered twice is the
@@ -455,6 +470,15 @@ export const setApprovalWindowForTests = (ms) => { approvalWindowMs = ms; };
 export const resetApprovalWindowForTests = () => { approvalWindowMs = DEFAULT_APPROVAL_WINDOW_MS; };
 const PROVIDER_DEATH_REQUEUE_CAP = 2; // v1.46 T1: requeue same assignment twice, then fall through to the normal ladder
 const PROVIDER_DEATH_BACKOFF_MS = 500; // short backoff before provider-death requeue
+// OBS-1161: transient capacity ("Selected model is at capacity") — bounded same-seat requeues with a
+// real wait between them, THEN a same-floor failover; never a demotion. The budget is per task and
+// seat, counted from the journal's own capacity-requeue rows so a resume continues it, never restarts it.
+const CAPACITY_REQUEUE_CAP = 2;
+const CAPACITY_BACKOFF_MS = 60_000;
+let capacityBackoffMs = CAPACITY_BACKOFF_MS;
+/** Test seam — shrink the capacity backoff without minute-long sleeps. */
+export function setCapacityBackoffMsForTests(ms) { capacityBackoffMs = ms; }
+export function resetCapacityBackoffMsForTests() { capacityBackoffMs = CAPACITY_BACKOFF_MS; }
 const NO_TRAILER_DEMOTION_STREAK = 2; // OBS-57: consecutive no-trailer windows demote a channel for the rest of the run
 // OBS-117 (v1.71 T6): a worker pane that never prints a byte by T+60s after dispatch is a dead
 // channel — don't burn the full stall window waiting for a silent launch failure. Checked on the
@@ -734,7 +758,8 @@ function lastVerifyCycle(events) {
  * OBS-1077 close rider: what the engagement's LATEST verification cycle proved — its
  * `tip-verify-start` row and what followed, never a commit comparison. Exactly one kind per close:
  * fresh (every tip command ran AND passed), reused (an eligible cached cycle carried forward),
- * failed, or incomplete (cancelled, cut short, mixed or undelimited). Nothing before the start row
+ * failed, or incomplete (cancelled, cut short or undelimited). Completed mixed cycles retain each
+ * gate's kind beside the whole-cycle reused kind. Nothing before the start row
  * is read, so an unfinished cycle inherits nothing from an earlier green one.
  */
 export function runEndTipProof(events) {
@@ -759,14 +784,25 @@ export function runEndTipProof(events) {
     if ((events[start].data.cached === true) !== cachedRow || (cachedRow && carried !== rows.length))
         return proof("incomplete");
     // D-131: fresh only when EVERY command executed; one per-gate persisted verdict makes the cycle reused.
-    return carried > 0 ? proof("reused") : proof("fresh");
+    return {
+        ...proof(carried > 0 ? "reused" : "fresh"),
+        gates: gates.map((gate) => ({
+            gate: String(gate),
+            kind: rows.some((r) => r.data.gate === gate && r.data.cached === true) ? "reused" : "fresh",
+        })),
+    };
 }
 /** The close notification's statement of the proof — one clause per kind. */
 export function formatTipProof(p) {
     const at = p.tip ? ` ${p.tip.slice(0, 12)}` : "";
+    const gateReading = p.gates?.map(({ gate, kind }) => `${gate}: ${kind === "fresh" ? "verified fresh" : "cached (reused) — carried, not re-run"}`).join("; ");
+    const suffix = gateReading ? `; ${gateReading}` : "";
+    if (p.kind === "reused" && p.gates?.some(({ kind }) => kind === "fresh")) {
+        return `tip proof: ${p.kind} — commit${at}; ${gateReading}`;
+    }
     switch (p.kind) {
-        case "fresh": return `tip proof: fresh — every tip command ran and passed on${at || " the integration tip"}`;
-        case "reused": return `tip proof: reused — carried from verified commit${at}, commands not re-run`;
+        case "fresh": return `tip proof: fresh — every tip command ran and passed on${at || " the integration tip"}${suffix}`;
+        case "reused": return `tip proof: reused — carried from verified commit${at}, commands not re-run${suffix}`;
         case "failed": return `tip proof: failed —${at ? ` commit${at}` : ""} latest verification cycle is red`;
         case "incomplete": return `tip proof: incomplete —${at ? ` commit${at}` : ""} latest verification cycle did not finish`;
     }
@@ -1476,6 +1512,124 @@ async function cherryPickCommits(wt, commits) {
     }
     return carried;
 }
+const PRESERVED_REF_PREFIX = "refs/tickmarkr/preserved/";
+const preservedRefOf = (data) => [data.ref, data.preservedRef].find((v) => typeof v === "string" && v.startsWith(PRESERVED_REF_PREFIX));
+/** The attempt whose worker last launched into the task's current checkout; "unknown" once a
+ * recreation replaced that tree without a new launch (recheck, gate-only restore) or when no
+ * dispatch assignment is on record. Never the newest dispatch by itself. */
+export function knownProducer(events, taskId) {
+    let dispatched = "unknown";
+    let producer = "unknown";
+    for (const row of events) {
+        if (row.taskId !== taskId)
+            continue;
+        if (row.event === "task-dispatch") {
+            const a = row.data.assignment;
+            dispatched = typeof a?.adapter === "string" && typeof a?.model === "string"
+                ? { channel: `${a.adapter}:${a.model}`, attempt: typeof row.data.attempt === "number" ? row.data.attempt : 0 } : "unknown";
+        }
+        else if (row.event === "worker-launch")
+            producer = dispatched;
+        else if (row.event === "worktree-recreation")
+            producer = "unknown";
+    }
+    return producer;
+}
+/** Distinct author channels of the subject for task-done/status/board rows: "unknown" replaces every
+ * unresolvable owner (legacy unattributed preservation, dispatch without assignment). */
+const mergedAuthors = (authors) => [...new Set(authors.map((a) => a.startsWith("unknown author") ? "unknown" : a))].sort();
+/** Fold lifetime dispatch/carry evidence, independent of attempt budgets and routing exclusions.
+ * Recreation rows name SOURCE hashes, so ownership is joined by stable patch identity. Each
+ * attempt owns only what the next carry (or current subject) adds beyond its own incoming set.
+ * Gate-only recreations do not start an attempt or transfer authorship to the restored seat.
+ */
+async function subjectAuthors(events, taskId, wt, base) {
+    const cache = new Map();
+    const patches = async (commits) => {
+        const ids = new Set();
+        for (const commit of commits) {
+            if (!cache.has(commit)) {
+                const diff = await shGit(`git show --format= --binary ${shq(commit)}`, wt);
+                if (diff.code !== 0)
+                    throw new Error(`cannot read author patch ${commit}`);
+                const id = execFileSync("git", ["patch-id", "--stable"], {
+                    cwd: wt, input: diff.stdout, encoding: "utf8", maxBuffer: 32 * 1024 * 1024,
+                }).trim().split(/\s+/)[0];
+                cache.set(commit, id || undefined); // an empty commit authored no patch
+            }
+            const id = cache.get(commit);
+            if (id)
+                ids.add(id);
+        }
+        return ids;
+    };
+    let current;
+    let previous;
+    let awaitingCarry = false;
+    const owners = new Map();
+    // Preserved engine commits carry their producing attempt on the row; a row without one is legacy
+    // and stays explicitly unknown rather than inheriting the seat that later carried the patch.
+    const preservedOwner = new Map();
+    const attribute = (ids, attempt) => {
+        for (const id of ids) {
+            if (attempt?.incoming.has(id))
+                continue;
+            const authors = owners.get(id) ?? new Set();
+            authors.add(preservedOwner.get(id) ?? attempt?.author ?? "unknown author (missing task-dispatch assignment)");
+            owners.set(id, authors);
+        }
+    };
+    try {
+        for (const row of events) {
+            if (row.taskId !== taskId)
+                continue;
+            const preserved = preservedRefOf(row.data);
+            if (preserved) {
+                // Only an engine preserve commit is owned by its row; a ref naming a worker's own commit keeps
+                // that commit's dispatch attribution.
+                const shown = await shGit(`git show -s ${shq(`--format=%H%n%s%n%(trailers:key=${PRESERVE_PRODUCER_TRAILER},valueonly)`)} ${shq(`${preserved}^{commit}`)}`, wt);
+                const [commit, subject, trailer] = shown.stdout.trim().split("\n");
+                if (shown.code === 0 && commit && subject === PRESERVE_COMMIT_SUBJECT) {
+                    // A row that merely mentions the ref (a park naming it) defers to the commit's own trailer;
+                    // only a commit with neither is legacy. A known owner is never downgraded by a later mention.
+                    const owner = typeof row.data.producer === "string" ? row.data.producer
+                        : trailer?.trim().replace(/ attempt \d+$/, "") || "unknown author (legacy unattributed preservation)";
+                    for (const id of await patches([commit])) {
+                        const prior = preservedOwner.get(id);
+                        if (prior === undefined || prior === "unknown" || prior.startsWith("unknown author"))
+                            preservedOwner.set(id, owner);
+                    }
+                }
+            }
+            if (row.event === "task-dispatch") {
+                previous = current;
+                const a = row.data.assignment;
+                current = { author: typeof a?.adapter === "string" && typeof a?.model === "string"
+                        ? `${a.adapter}:${a.model}` : "unknown author (missing task-dispatch assignment)", incoming: new Set() };
+                awaitingCarry = true;
+            }
+            else if (row.event === "worktree-recreation") {
+                const carried = await patches(Array.isArray(row.data.carried) ? row.data.carried : []);
+                attribute(carried, awaitingCarry ? previous : current);
+                if (awaitingCarry && current)
+                    current.incoming = carried;
+                awaitingCarry = false;
+            }
+            else if (["worker-launch", "worker-result", "gate-result", "task-human"].includes(row.event)) {
+                // The initial checkout has no recreation row. Once work/gates start, a later
+                // recreation is a restore of this attempt, not the input of a new dispatch.
+                awaitingCarry = false;
+            }
+        }
+        const subject = await patches(await commitsAheadOf(base, wt));
+        attribute(subject, current);
+        return [...new Set([...subject].flatMap((id) => [...(owners.get(id) ?? [])]))];
+    }
+    catch (error) {
+        // An unreadable history cannot silently remove an author from the exclusion set.
+        return [`unknown author (${String(error)})`];
+    }
+}
 // T7 (v1.86): a first run-end append that fails AFTER partial bytes landed leaves a torn tail at
 // EOF with no newline; a blind retry would glue the run-end line onto those bytes and readJsonl's
 // torn-line tolerance would drop the retry too — no terminal record despite a successful write.
@@ -1623,6 +1777,8 @@ export async function runDaemon(repoRoot, opts = {}) {
     let fatalPhase = "setup";
     let deliberateTermination = false;
     const fatalStop = new AbortController();
+    const hostStop = new AbortController();
+    const hostChecks = new Set();
     const inflight = new Map();
     let retireFatalSlots;
     let branch = "";
@@ -1719,21 +1875,50 @@ export async function runDaemon(repoRoot, opts = {}) {
                     if (owner) {
                         const processGroup = readOwnedProcessGroup(owner.groupFile);
                         let survivors;
+                        const strays = [];
+                        let session;
                         try {
                             const shared = processGroup !== undefined && [...workerOwners].some(([other, otherOwner]) => other !== slot && liveSlots.has(other) && readOwnedProcessGroup(otherOwner.groupFile) === processGroup);
                             if (shared)
                                 throw new Error(`worker group ${processGroup} is shared with another live attempt`);
-                            survivors = await reapOwnedProcessGroup(processGroup, slot.cwd);
+                            try {
+                                session = readFileSync(`${owner.groupFile}.session`, "utf8").trim() || undefined;
+                            }
+                            catch { /* pre-launch or older driver */ }
+                            let parent;
+                            try {
+                                const row = /^\s*(\d+)\s+(.+)$/.exec(readFileSync(`${owner.groupFile}.parent`, "utf8").trim());
+                                if (row)
+                                    parent = { pid: Number(row[1]), startedAt: row[2].trim().replace(/\s+/g, " ") };
+                            }
+                            catch { /* a live dispatch root can still prove its parent */ }
+                            const others = [...workerOwners].filter(([other]) => other !== slot && liveSlots.has(other));
+                            survivors = await reapOwnedProcessGroup(processGroup, slot.cwd, {
+                                marker: owner.marker, session, parent, identities: owner.identities, descendants: owner.descendants, strays,
+                                excludedGroups: others.flatMap(([, other]) => {
+                                    const group = readOwnedProcessGroup(other.groupFile);
+                                    return group === undefined ? [] : [group];
+                                }),
+                                excludedWorktrees: others.map(([other]) => other.cwd).filter((cwd) => cwd !== slot.cwd),
+                            });
                         }
                         catch (error) {
                             journal.append("worker-process-reaped", owner.taskId, { slot: slot.name, attempt: owner.attempt,
-                                processGroup: processGroup ?? null, survivors: null, error: String(error) });
+                                processGroup: processGroup ?? null, strays, survivors: null, error: String(error) });
+                            workerOwners.delete(slot); // one reap row per attempt: a later close never re-sweeps
                             throw error;
                         }
-                        reapReports.set(slot, { processGroup: processGroup ?? null, survivors });
+                        reapReports.set(slot, { processGroup: processGroup ?? null, strays, survivors });
                         journal.append("worker-process-reaped", owner.taskId, {
-                            slot: slot.name, attempt: owner.attempt, processGroup: processGroup ?? null, survivors,
+                            slot: slot.name, attempt: owner.attempt, processGroup: processGroup ?? null, strays, survivors,
                         });
+                        // Every outcome retires the claim: one reap row per attempt, whatever the verdict.
+                        workerOwners.delete(slot);
+                        // Pre-launch and in-process drivers have no OS dispatch claim; their close owns retirement.
+                        // Once any dispatch ownership exists, an unreadable sweep must block the next gate.
+                        if (survivors === null && (processGroup !== undefined || session !== undefined || owner.descendants.size > 0)) {
+                            throw new Error(`worker group ${processGroup} cleanup unknown`);
+                        }
                         if (survivors && survivors.length > 0)
                             throw new Error(`worker group ${processGroup} survivors: ${survivors.join(", ")}`);
                     }
@@ -1832,6 +2017,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                             // new attempt while this reaper is still closing the old ones.
                             const termination = new Error(`terminated by ${sig}`);
                             abortRun(termination);
+                            hostStop.abort(termination);
+                            await Promise.allSettled(hostChecks);
                             if (activeTipVerify) {
                                 activeTipVerify.controller.abort(termination);
                                 await activeTipVerify.settled;
@@ -2024,32 +2211,143 @@ export async function runDaemon(repoRoot, opts = {}) {
                     journal.append("watch-board-reopen-failed", undefined, { pane: loss.pane, attempt, error: reopened.error, ...(boardless ? { boardless: true } : {}) });
                     console.error(`tickmarkr: board not reopened (attempt ${attempt}): ${reopened.error}`);
                 };
-                // Context carries attribution through gates and remote inference; only shell commands acquire.
-                const commandLeases = new CommandLeases();
-                const withCommandContext = (taskId, run, signal = executionSignal()) => runWithCommandLease((_command, execute) => commandLeases.run(async () => {
-                    let lastCount = -1;
+                // Reference rows are the durable source of truth; old journals establish one on first resume.
+                const priorReference = opts.resume ? [...journal.read()].reverse().find(e => ["host-reference", "host-reference-reset"].includes(e.event)
+                    && typeof e.data.medianMs === "number" && Number.isFinite(e.data.medianMs) && e.data.medianMs > 0) : undefined;
+                let hostReferenceMs = priorReference?.data.medianMs;
+                const hostSignal = (signal) => AbortSignal.any([hostStop.signal, fatalStop.signal, signal, executionSignal()].filter((s) => !!s));
+                const trackHost = (promise) => {
+                    hostChecks.add(promise);
+                    void promise.finally(() => hostChecks.delete(promise)).catch(() => { });
+                    return promise;
+                };
+                const recordReference = (observation) => {
+                    if (observation.medianMs === null)
+                        return;
+                    journal.append("host-reference", undefined, { ...observation });
+                    hostReferenceMs = observation.medianMs;
+                };
+                // Health and occupancy share a deadline, but only healthy occupancy gets the bounded fallback.
+                const admitHost = async (taskId, signal, initial, resuming = false, gate, onWait) => {
                     const startedAt = Date.now();
+                    let lastCount = -1;
+                    let observation = initial;
+                    let first = true;
+                    let resetEligible = resuming && hostReferenceMs !== undefined;
                     for (;;) {
-                        signal?.throwIfAborted();
-                        fatalStop.signal.throwIfAborted();
-                        executionSignal()?.throwIfAborted();
+                        signal.throwIfAborted();
                         const count = await liveSuiteCount(repoRoot);
-                        if (count === 0)
-                            break;
-                        if (count !== lastCount)
-                            journal.append("suite-wait", taskId, { count });
+                        signal.throwIfAborted();
+                        const remaining = suiteWaitCeilingMs - (Date.now() - startedAt);
+                        // Reserve a full bounded batch. A partial last batch would manufacture an unreadable
+                        // host at an otherwise healthy occupancy deadline. Retain the latest complete observation.
+                        const probeBudget = HOST_PROBE_SAMPLE_MS * HOST_PROBE_SAMPLES;
+                        if (!observation || (!first && remaining >= probeBudget)) {
+                            observation = await observeHost(signal, remaining > 0 ? Math.min(probeBudget, remaining) : undefined);
+                            journal.append("host-observation", taskId, { ...observation, referenceMs: hostReferenceMs ?? null, resuming });
+                        }
+                        first = false;
+                        if (hostReferenceMs === undefined && observation.medianMs !== null)
+                            recordReference(observation);
+                        const degraded = hostDegraded(observation, hostReferenceMs);
+                        resetEligible &&= count === 0 && observation.medianMs !== null && degraded;
+                        if (!degraded && (count === 0 || resuming))
+                            return count;
+                        onWait?.();
+                        if (degraded)
+                            journal.append("host-degraded", taskId, {
+                                ...observation, referenceMs: hostReferenceMs ?? null, ...(gate ? { gate } : {}), count, waitedMs: Date.now() - startedAt,
+                            });
+                        else if (count !== lastCount)
+                            journal.append("suite-wait", taskId, { count, ...(gate ? { gate } : {}) });
                         lastCount = count;
                         if (Date.now() - startedAt >= suiteWaitCeilingMs) {
+                            if (degraded) {
+                                if (resetEligible) {
+                                    // Append BOTH medians before adoption. An unreadable sample or live suite vetoes reset.
+                                    journal.append("host-reference-reset", undefined, {
+                                        referenceMs: hostReferenceMs, medianMs: observation.medianMs, waitedMs: Date.now() - startedAt,
+                                    });
+                                    hostReferenceMs = observation.medianMs;
+                                    return count;
+                                }
+                                throw new HostDegradedError("host latency remained degraded or unreadable through suite-wait deadline");
+                            }
                             journal.append("suite-wait-ceiling", taskId, { count, waitedMs: Date.now() - startedAt });
-                            journal.append("suite-budget", taskId, {
-                                count, occupancyCap: occupancyCapacity.forkCap, conservativeCap: conservativeCapacity.forkCap,
-                            });
-                            return await runWithVerificationBudget(conservativeCapacity, execute);
+                            return count;
                         }
-                        await new Promise((wake) => setTimeout(wake, SUITE_POLL_MS));
+                        await new Promise((resolve, reject) => {
+                            const abort = () => { clearTimeout(timer); reject(signal.reason); };
+                            const timer = setTimeout(() => { signal.removeEventListener("abort", abort); resolve(); }, Math.min(SUITE_POLL_MS, Math.max(0, suiteWaitCeilingMs - (Date.now() - startedAt))));
+                            signal.addEventListener("abort", abort, { once: true });
+                            if (signal.aborted)
+                                abort();
+                        });
                     }
-                    return await execute();
-                }, (count) => journal.append("suite-wait", taskId, { count }), SUITE_POLL_MS, signal), run);
+                };
+                const initializeHost = () => trackHost((async () => {
+                    const signal = hostSignal();
+                    const observation = await observeHost(signal);
+                    journal.append("host-observation", undefined, { ...observation, referenceMs: hostReferenceMs ?? null, resuming: !!opts.resume });
+                    if (hostReferenceMs === undefined)
+                        recordReference(observation);
+                    if (opts.resume || observation.medianMs === null)
+                        await admitHost(undefined, signal, observation, !!opts.resume);
+                })());
+                // Context carries attribution through gates and remote inference; only shell commands acquire.
+                const commandLeases = new CommandLeases();
+                // Only an unambiguous, currently open phase can attribute a command wait. Parallel siblings
+                // deliberately leave gate absent; neither the last phase nor the last red is a safe substitute.
+                const activeGatePhases = new Map();
+                const withCommandContext = (taskId, run, signal = executionSignal()) => {
+                    let hostFailure;
+                    return runWithCommandLease((_command, execute) => {
+                        const active = taskId ? activeGatePhases.get(taskId) : undefined;
+                        const gate = active?.size === 1 ? [...active][0] : undefined;
+                        let waited = false;
+                        return commandLeases.run(async () => {
+                            if (hostFailure)
+                                throw hostFailure;
+                            let count;
+                            try {
+                                count = await trackHost(admitHost(taskId, hostSignal(signal), undefined, false, gate, () => { waited = true; }));
+                            }
+                            catch (error) {
+                                if (error instanceof HostDegradedError)
+                                    hostFailure = error;
+                                throw error;
+                            }
+                            if (waited && taskId) {
+                                if (gate)
+                                    journal.phaseStart(taskId, phaseForGate(gate), { gate, admitted: true });
+                                else
+                                    journal.append("suite-admitted", taskId, {});
+                            }
+                            if (count > 0) {
+                                journal.append("suite-budget", taskId, {
+                                    count, occupancyCap: occupancyCapacity.forkCap, conservativeCap: conservativeCapacity.forkCap,
+                                });
+                                return await runWithVerificationBudget(conservativeCapacity, execute);
+                            }
+                            return await execute();
+                        }, (count) => {
+                            waited = true;
+                            journal.append("suite-wait", taskId, { count, ...(gate ? { gate } : {}) });
+                        }, SUITE_POLL_MS, signal);
+                    }, async () => {
+                        try {
+                            const result = await run();
+                            // Some command oracles turn launch errors into results. Admission failure still parks infra.
+                            if (hostFailure)
+                                throw hostFailure;
+                            return result;
+                        }
+                        finally {
+                            if (taskId)
+                                activeGatePhases.delete(taskId);
+                        }
+                    });
+                };
                 let baseRef;
                 let baseline;
                 let baselinePending = false;
@@ -2181,6 +2479,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                     });
                     runStarted = true;
                     await placeBoard();
+                    // A terminal resume with no commands has no execution to admit.
+                    if (Object.keys(commands).length > 0 || graph.tasks.some(t => ["pending", "running", "gated"].includes(t.status))) {
+                        baselineCapture = initializeHost();
+                        void baselineCapture.catch(() => { baselineFailed = true; });
+                    }
                 }
                 else {
                     baseRef = await gitHead(repoRoot);
@@ -2190,7 +2493,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // Workers can run beside capture, but no gate may observe an absent or partial baseline.
                     // Keep publication and warnings inside the same barrier as the suite's final verdict.
                     baselineCapture = withCommandContext(undefined, async () => {
-                        const captured = await captureBaseline(repoRoot, commands);
+                        // With no commands, capture is already complete: persist it before the probe can wait.
+                        // Otherwise a kill during startup can strand a resumable run without baseline.json.
+                        const emptyCapture = Object.keys(commands).length === 0 ? await captureBaseline(repoRoot, commands) : undefined;
+                        if (emptyCapture)
+                            writeFileSync(join(journal.dir, "baseline.json"), JSON.stringify(emptyCapture, null, 2));
+                        await initializeHost();
+                        const captured = emptyCapture ?? await captureBaseline(repoRoot, commands);
                         writeFileSync(join(journal.dir, "baseline.json"), JSON.stringify(captured, null, 2));
                         baseline = captured;
                         for (const warning of captured.warnings ?? [])
@@ -2436,8 +2745,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                     }
                     return false;
                 };
+                // OBS-1158: admission reads the same journal snapshot the sweep folded, through the shared seam.
+                let admissionPriority = batteryPriority(startupActions.values());
+                const admissible = () => readyTasks(graph, admissionPriority);
                 const sweepLiveApprovals = () => {
                     const events = journal.read();
+                    admissionPriority = batteryPriority(pendingDaemonApprovalActions(events).values());
                     const approvals = events.slice(approvalSweepCursor)
                         .filter((e) => e.event === "task-approved" && e.taskId);
                     approvalSweepCursor = events.length;
@@ -2506,10 +2819,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // old path. A preservation failure throws and therefore leaves the old checkout in place. The
                     // row is deliberately written before the later worktree-recreation row so the journal cannot
                     // describe only the commits it carried while omitting uncommitted work the removal destroyed.
+                    const producerNow = () => knownProducer(journal.read(), t.id);
                     const recreateTaskWorktree = async (taskBranch, taskBase, priorWt) => {
-                        const ref = await preserveWorktree(priorWt);
+                        const producer = producerNow();
+                        const ref = await preserveWorktree(priorWt, producer);
                         if (ref)
-                            journal.append("worktree-preserved", t.id, { ref });
+                            journal.append("worktree-preserved", t.id, { ref, ...producerFields(producer) });
                         return driver.worktree(repoRoot, taskBranch, taskBase);
                     };
                     // A dead worker with a clean checkout still needs a durable recovery handle: there may be no
@@ -2542,7 +2857,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // IS the fix; the tried seed and the attempt-loop start close RES-01/RES-02 alongside it.
                     //
                     // v1.24 OBS-18: a task-approved{release:attempt-cap} zeros rs.attempts (fresh budget) and clears
-                    // lastAssignment while keeping tried. Only restore lastAssignment when attempts > 0 — after a
+                    // lastAssignment while keeping tried, so the restore below is skipped — after a
                     // fresh-budget release, prefer nextChannel over the surviving tried-list so burned channels are
                     // not re-tried first (consult bans / prior failovers survive the release).
                     const rs = resume.get(t.id);
@@ -2563,7 +2878,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                             to: channelKey(assignment),
                             reason: JSON.stringify(previousHints?.pin) !== JSON.stringify(t.routingHints?.pin) ? "pin changed" : "floor changed",
                         });
-                    if (!hintsChanged && rs?.lastAssignment && rs.attempts > 0
+                    // OBS-1161: no `attempts > 0` guard — every release already clears lastAssignment in the replay,
+                    // and a lastAssignment at zero attempts is a first dispatch whose capacity requeue was taken back:
+                    // the seat is still in force, so restore it instead of failing over its own tried[] entry early.
+                    if (!hintsChanged && rs?.lastAssignment
                         && channels.some((c) => channelKey(c) === channelKey(rs.lastAssignment))
                         && !demotedChannels.has(channelKey(rs.lastAssignment))) {
                         assignment = rs.lastAssignment; // restore the consult-chosen assignment (bypasses route()'s static re-pick)
@@ -2635,7 +2953,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const round = await runGates(task, ctx);
                         let review = round.results.find((g) => g.gate === "review");
                         while (review?.meta?.noVerdict === true) {
-                            const next = pickReviewer(ctx.author, ctx.channels, badReviewers, cfg.review.prefer ?? [], task.routingHints?.floor, reviewHistory, undefined, demotedReviewers);
+                            // Recovery must honor the gate's floor, including the seats that just failed to
+                            // return a verdict; a below-floor alternative cannot replace the infra result.
+                            const { floor } = gateReviewerFloor(task, ctx.cfg, ctx.author, ctx.channels, [...(ctx.priorReviewers ?? []), ...badReviewers]);
+                            const next = pickReviewer(ctx.author, ctx.channels, badReviewers, cfg.review.prefer ?? [], floor, reviewHistory, undefined, demotedReviewers);
                             if (!next)
                                 break;
                             journal.append("review-infra-retry", t.id, { reviewer: channelKey(next), cause: review.meta.cause });
@@ -2721,6 +3042,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 dirtyWorktree: true, dirtyPaths: g.meta.paths,
                                 ...(typeof g.meta.culprit === "string" ? { culprit: g.meta.culprit } : {}),
                                 ...(typeof g.meta.preservedRef === "string" ? { preservedRef: g.meta.preservedRef } : {}),
+                                ...(typeof g.meta.producer === "string" ? { producer: g.meta.producer } : {}),
+                                ...(typeof g.meta.producerAttempt === "number" ? { producerAttempt: g.meta.producerAttempt } : {}),
                             } : {}),
                             ...(cfg.executionPolicy && !g.pass ? { disposition: failureDisposition(g) } : {}),
                             ...Object.fromEntries(["runnerInfraRerun", "hostStarvedRerun", "recoveryBlocked", "failingFiles", "selectionDecision", "failureEvidence"]
@@ -2744,6 +3067,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                             ...(Array.isArray(g.meta?.selectedTests) ? { selectedTests: g.meta.selectedTests } : {}),
                             ...(g.meta?.fullSuite === true ? { fullSuite: true } : {}),
                             ...(g.meta?.reapedGroup === true ? { reapedGroup: true } : {}),
+                            ...(g.gate === "review" && g.meta?.noEligibleReviewer === true ? {
+                                noEligibleReviewer: true, authorVendors: g.meta.authorVendors, unresolvedAuthors: g.meta.unresolvedAuthors,
+                            } : {}),
                             ...(g.gate === "review" && typeof g.meta?.reviewer === "string" ? {
                                 reviewer: g.meta.reviewer,
                                 ...Object.fromEntries(["cause", "seatAuthoredBytes", "bytes", "rawPath", "briefPath", "timeoutMs", "unparseable", "noVerdict", "resolved", "reraised", "reviewerFloor", "reviewerFloorCause", "reviewerTier"]
@@ -2771,13 +3097,14 @@ export async function runDaemon(repoRoot, opts = {}) {
                             // every recalibration this telemetry funds, a gap is honest and a zero is a lie. The
                             // seven-gate closed set is asserted end-to-end in tests/run/gate-telemetry.test.ts.
                             ...gateMeasurement(g.meta),
-                            // Fresh producer evidence is copied verbatim; absent/historical evidence is never minted here.
-                            ...(g.meta?.reused ? {} : {
-                                ...(g.evidenceReceipt ? { evidenceReceipt: g.evidenceReceipt } : {}),
-                                ...(g.evidenceReceipts ? { evidenceReceipts: g.evidenceReceipts } : {}),
-                                ...Object.fromEntries(["nonce", "stdoutPath", "stderrPath", "classification"]
-                                    .filter(key => g.meta?.[key] !== undefined).map(key => [key, g.meta[key]])),
-                            }),
+                            // Carried receipts retain their original invocation and artifact root.
+                            ...(g.evidenceReceipt ? { evidenceReceipt: g.evidenceReceipt } : {}),
+                            ...(g.evidenceReceipts ? { evidenceReceipts: g.evidenceReceipts } : {}),
+                            ...(g.meta?.reused ? {
+                                reused: true,
+                                ...(g.originRunRoot ? { originRunRoot: g.originRunRoot } : {}),
+                            } : Object.fromEntries(["nonce", "stdoutPath", "stderrPath", "classification"]
+                                .filter(key => g.meta?.[key] !== undefined).map(key => [key, g.meta[key]]))),
                             // T7: the capacity the gate's own command child ran under, lifted verbatim from the result
                             // the battery produced — read where the shell built that child's environment, never
                             // re-derived from the run's own budget, which would answer a different number than the
@@ -2820,6 +3147,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                     const parallelPending = new Set();
                     let heldParallel;
                     const notePhaseStart = (e) => {
+                        const active = activeGatePhases.get(t.id) ?? new Set();
+                        active.add(e.gate);
+                        activeGatePhases.set(t.id, active);
                         if (e.parentAt !== undefined)
                             parallelPending.add(e.gate);
                     };
@@ -2920,6 +3250,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                         }
                         return next;
                     };
+                    // OBS-1161: capacity requeues spent on a seat for this task since its last operator release —
+                    // journal-derived so the budget survives a resume instead of restarting with the process.
+                    const capacityRequeuesOn = (channel) => {
+                        const rows = journal.read().filter((e) => e.taskId === t.id);
+                        const since = rows.map((e) => e.event).lastIndexOf("task-approved");
+                        return rows.slice(since + 1).filter((e) => e.event === "capacity-requeue" && e.data.channel === channel).length;
+                    };
                     // OBS-202 (operator law: "you can spawn as many as you want"): channels are session FACTORIES,
                     // not consumed seats — a tried channel can always host a fresh worker session, and a fresh
                     // session carries none of the failed attempt's baggage. When the untried pool is empty, recycle
@@ -3005,7 +3342,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // OBS-130/T15: both gate-resume paths consume the persisted task branch with no worker dispatch.
                     // An operator approval skips its exact failed gate by authority; observed results skip only the
                     // contiguous green prefix whose recorded commit is still the task branch tip.
-                    const satisfiedGate = satisfiedGates.get(t.id);
+                    let satisfiedGate = satisfiedGates.get(t.id);
                     const replayedGates = fundedRerun ? undefined : replayedGateResults.get(t.id);
                     const recheck = approvalAction?.authority === "battery";
                     resumeGateReplay: if (satisfiedGate || replayedGates || recheck) {
@@ -3042,6 +3379,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // than against the stale worktree whose task-only history cannot see newly merged dependencies.
                         const currentTaskTip = await gitHead(wt);
                         const currentTaskSubject = await gateCommitSubject(taskBase, currentTaskTip, wt);
+                        // Recheck carries only review authority for the exact subject being gated, never tool greens.
+                        if (recheck) {
+                            satisfiedGate = journal.replaySatisfiedGates(new Map([[t.id, currentTaskSubject]])).get(t.id);
+                        }
                         journal.append("worktree-recreation", t.id, { attempted: commitsToCarry, carried: carriedCommits });
                         // OBS-212: same fail-closed rule as the dispatch path — but this path is worse, because it runs
                         // ONLY the gates after the approved one and then MERGES. T3 took it on run-20260728-110135:
@@ -3115,7 +3456,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const reused = [];
                         let remainingGates;
                         if (recheck) {
-                            remainingGates = GATE_NAMES.filter((gate) => t.gates.includes(gate));
+                            remainingGates = declaredGates.filter((gate) => gate !== satisfiedGate);
                         }
                         else if (satisfiedGate) {
                             remainingGates = t.gates.filter((gate) => {
@@ -3212,10 +3553,19 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // deterministic-fingerprint occurrence/review round for budget accounting.
                                 ...(!satisfiedGate && !recheck ? { replayMeasurement: true } : {}),
                             };
+                            if (recheck && satisfiedGate === "review" && gateSubject.commit !== currentTaskSubject) {
+                                satisfiedGate = undefined;
+                                resumedTask.gates = declaredGates;
+                            }
+                            if (recheck && satisfiedGate === "review" && !resumedTask.gates.includes("review")) {
+                                journal.append("gate-waiver-carried", t.id, { gate: "review", commit: gateSubject.commit, carried: true, release: RECHECK_RELEASE });
+                            }
                             await trackedDriver.project?.(t.id, "in-review");
                             await waitForBaseline(t.id);
                             journal.phaseStart(t.id, "gates");
-                            const { results } = await withCommandContext(t.id, () => runReviewRecovery(resumedTask, {
+                            const { results } = await withCommandContext(t.id, async () => runReviewRecovery(resumedTask, {
+                                carriedAuthors: await subjectAuthors(journal.read(), t.id, wt, taskBase),
+                                producer: producerNow(),
                                 carriedFindings: outstandingReviewFindings(journal.read(), t.id),
                                 operatorContext,
                                 worktree: wt, baseRef: taskBase, result: priorResult, author: gateAuthor,
@@ -3234,7 +3584,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 excludeReviewers: badReviewers,
                                 reviewHistory, demotedReviewers, priorReviewers: taskReviewers(t.id),
                                 // Leg-2 (OBS-1052): the run-scoped two-strike tally — without it retirement is inert and a
-                                // flaking seat is re-asked on every task. (carriedAuthors is held back: see SURGEON-LEG2-REPORT.)
+                                // flaking seat is re-asked on every task.
                                 reviewNoVerdicts,
                                 recheck, // OBS-1055: a recheck discards cached reds — the battery re-measures what the operator questioned
                                 onGate: async (e) => {
@@ -3248,7 +3598,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         return;
                                     }
                                     const g = e.result;
-                                    classifySignalOnlyTest(g);
+                                    activeGatePhases.get(t.id)?.delete(e.gate);
+                                    classifyInfraResult(g);
                                     inParallelOrder(g.gate, () => {
                                         journalGateResult(g);
                                         noteReviewRetry(g);
@@ -3259,7 +3610,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     });
                                 },
                             }, false));
-                            results.forEach(classifySignalOnlyTest);
+                            results.forEach(classifyInfraResult);
                             if (pendingDaemonApprovalActions(journal.read()).get(t.id)?.authority === "battery") {
                                 journal.append("recheck-battery", t.id, {
                                     commit: gateSubject.commit,
@@ -3271,7 +3622,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                             graph = addEvidence(graph, t.id, { commits: approvedCommits, gateResults: results });
                             saveGraph(repoRoot, graph);
                             if (!results.every(gateSatisfied)) {
-                                const infra = results.find((g) => g.meta?.infra === true);
+                                const unavailableReview = results.find((g) => gateFailed(g) && g.meta?.noEligibleReviewer === true);
+                                if (unavailableReview) {
+                                    await park(t, gateFailApprovalReason(t.id, unavailableReview.details, true), "gate-fail", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
+                                    return;
+                                }
+                                // OBS-1106: same predicate as classification — an infra replay is parked, never repaired.
+                                const infra = results.find((g) => gateFailed(g) && isInfraResult(g));
                                 if (infra) {
                                     await park(t, `${infra.gate}: ${infra.details}`, "infra", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
                                     return;
@@ -3299,7 +3656,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // Observed green gates are only measurements. If the resumed suffix is red, preserve that
                                 // result in the journal and return to the ordinary attempt/consult ladder, which rebuilds
                                 // feedback from those rows. Only an operator-authorized gate release parks on a new red.
-                                if (!satisfiedGate) {
+                                if (!satisfiedGate || recheck) {
                                     // OBS-1055: a recheck red funds a repair of the pin's own work. A pinned task's repair sits
                                     // on the pin (OBS-1034's exemption keeps the tried list from excluding it); a pin the fleet
                                     // cannot seat parks naming the pin — never the ladder.
@@ -3354,6 +3711,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             saveGraph(repoRoot, graph);
                             journal.append("task-done", t.id, {
                                 attempts: rs?.attempts ?? 0, assignment: gateAuthor, taskContentDigest: contentDigest,
+                                authors: mergedAuthors(await subjectAuthors(journal.read(), t.id, wt, taskBase)),
                             });
                             journal.append("merge", t.id, { branch: taskBranch, commit: await integrationHead(intWt) });
                             await trackedDriver.project?.(t.id, "completed");
@@ -3706,6 +4064,20 @@ export async function runDaemon(repoRoot, opts = {}) {
                         Object.defineProperty(workerSlotOpts, "agent", { value: assignment.adapter });
                         const slot = await trackedDriver.slot(wt, `${t.id}-worker-${assignment.adapter}-a${attempt}-${runTag}`, workerSlotOpts);
                         const sessionId = retryMode === "resume" ? priorSession.id : slot.name;
+                        const readResumeTranscript = () => {
+                            try {
+                                const sample = adapter.readSessionTranscript?.({ cwd: wt, id: sessionId });
+                                return sample && Number.isSafeInteger(sample.bytes) && sample.bytes >= 0 ? sample : null;
+                            }
+                            catch {
+                                return null;
+                            }
+                        };
+                        const resumeBaseline = retryMode === "resume" ? readResumeTranscript() : null;
+                        if (retryMode === "resume")
+                            journal.append("worker-resume-requested", t.id, {
+                                sessionId, attempt, workerDispatchOrdinal, baselineBytes: resumeBaseline?.bytes ?? null,
+                            });
                         const icmd = retryMode === "resume"
                             ? adapter.resumeCommand(sessionId, promptFile, assignment.model)
                             : cfg.visibility.worker === "interactive" && driver.interactive
@@ -3731,11 +4103,16 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // Approval can reset the attempt counter while the old pane remains retained.
                         // Its ownership claim must survive a new engagement reusing the script path.
                         const groupFile = `${dispatchScript}.${nonce}.pgid`;
-                        workerOwners.set(slot, { taskId: t.id, attempt, groupFile });
+                        workerOwners.set(slot, { taskId: t.id, attempt, groupFile, marker: dispatchScript, identities: new Map(), descendants: new Map() });
                         writeFileSync(dispatchScript, [
+                            // Shell startup can swallow the driver's leading cd; the payload owns its checkout too.
+                            `cd ${shq(wt)} || exit 1`,
+                            `export ${VITEST_CACHE_ENV}=${shq(worktreeVitestCache(wt))}`,
                             // A driver may launch inside the daemon's group. That group is never worker-owned.
                             `worker_pgid=$(ps -o pgid= -p $$ 2>/dev/null); daemon_pgid=$(ps -o pgid= -p ${process.pid} 2>/dev/null)`,
                             `if [ -n "$worker_pgid" ] && [ -n "$daemon_pgid" ] && [ "$worker_pgid" != "$daemon_pgid" ]; then printf '%s\\n' "$worker_pgid" > ${shq(groupFile)}; fi`,
+                            `ps -o sess= -p $$ > ${shq(`${groupFile}.session`)} 2>/dev/null`,
+                            `ps -o pid=,lstart= -p $PPID > ${shq(`${groupFile}.parent`)} 2>/dev/null`,
                             "export BASH_SILENCE_DEPRECATION_WARNING=1",
                             bannerShell(),
                             `printf '%s\\n' 'TICKMARKR_DISPATCH_${nonce}'`,
@@ -3765,6 +4142,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             journal.append("worker-launch", t.id, {
                                 attempt,
                                 retryMode,
+                                ...(retryMode === "resume" ? { sessionId, workerDispatchOrdinal } : {}),
                                 driver: trackedDriver.id,
                                 slot: { ...slot },
                                 workspace: driver.id === "herdr" ? process.env.HERDR_WORKSPACE_ID : undefined,
@@ -3804,7 +4182,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             }
                             if (hasSeed || cpuAccountant !== undefined)
                                 return;
-                            cpuAccountant = new WorkerTreeCpuAccountant(dispatchScript, wt, () => readOwnedProcessGroup(groupFile));
+                            cpuAccountant = new WorkerTreeCpuAccountant(dispatchScript, wt, () => readOwnedProcessGroup(groupFile), workerOwners.get(slot).descendants);
                             await cpuAccountant.start();
                         };
                         const readCpuLeg = () => {
@@ -3900,6 +4278,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         let deadChannelKilled = false;
                         let hardTimedOut = false;
                         let quotaBannerKilled = false;
+                        let capacityBannerKilled = false; // OBS-1161: same banner filter and gates, transient outcome
                         let driverProbeFailed = false;
                         let heldLegs = [];
                         const noteDriverUnreadable = (error) => {
@@ -4228,19 +4607,32 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         // filtered by identity, never by novelty — a banner already on screen at launch
                                         // classifies exactly like one printed mid-attempt (T1 review: a novelty baseline
                                         // exculpated the launch-throttle case forever).
-                                        const bannerMatch = QUOTA_RE.exec(stallSnapshotBannerRows(paneText));
+                                        // OBS-1161: a transient-capacity banner rides the SAME filter, streak and silence gates,
+                                        // and concludes the attempt the same way — only its post-loop outcome differs (bounded
+                                        // requeue on this seat, then same-floor failover, never demotion). Quota wins a tie.
+                                        const bannerRows = stallSnapshotBannerRows(paneText);
+                                        const quotaBanner = QUOTA_RE.exec(bannerRows);
+                                        const bannerMatch = quotaBanner ?? CAPACITY_RE.exec(bannerRows);
                                         if (bannerMatch)
                                             quotaStreak++;
                                         else
                                             quotaStreak = 0;
-                                        if (bannerMatch && !stallProgress.rowSignalSaturated && !nudgeFailed
+                                        if (bannerMatch && !quotaBanner && !stallProgress.rowSignalSaturated && !nudgeFailed
+                                            && !(driver.nudge && NUDGEABLE_ADAPTERS.has(adapter.id) && (!nudged || nudgeDeadline !== undefined))
+                                            && readCpuLeg().state === "flat"
+                                            && quotaStreak >= 2 && sliceNow - lastProgressAt >= quotaBannerSilentMs) {
+                                            capacityBannerKilled = true;
+                                            journal.append("capacity-banner", t.id, { slot: slot.name, attempt, silentMs: sliceNow - lastProgressAt, matched: bannerMatch[0], excerpt: bannerMatch.input, regex: CAPACITY_RE.source });
+                                            break;
+                                        }
+                                        if (quotaBanner && !stallProgress.rowSignalSaturated && !nudgeFailed
                                             && !(driver.nudge && NUDGEABLE_ADAPTERS.has(adapter.id) && (!nudged || nudgeDeadline !== undefined))
                                             && readCpuLeg().state === "flat"
                                             && quotaStreak >= 2 && sliceNow - lastProgressAt >= quotaBannerSilentMs) {
                                             // no `output =` here: the post-loop no-trailer tail re-reads the pane anyway, so an
                                             // assignment would only split the classification read from the verdict read.
                                             quotaBannerKilled = true;
-                                            journal.append("quota-banner", t.id, { slot: slot.name, attempt, silentMs: sliceNow - lastProgressAt, matched: bannerMatch[0], excerpt: bannerMatch.input, regex: QUOTA_RE.source });
+                                            journal.append("quota-banner", t.id, { slot: slot.name, attempt, silentMs: sliceNow - lastProgressAt, matched: quotaBanner[0], excerpt: quotaBanner.input, regex: QUOTA_RE.source });
                                             break;
                                         }
                                         // T1 (OBS-262): the `paged` latch is deleted — status is sampled EVERY slice (and
@@ -4396,7 +4788,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             const ref = preservation.ref;
                                             const reason = `worker is unambiguously dead: pane absent, process tree empty, and worktree unchanged; preserved at ${ref}`;
                                             deadWorkerPark = { ref, reason };
-                                            journal.append("worktree-preserved", t.id, { ref });
+                                            journal.append("worktree-preserved", t.id, { ref, ...producerFields(producerNow()) });
                                             noteWorkerLiveness("worker-dead-held", {
                                                 slot: slot.name, attempt, reason: "unambiguous-worker-death", ref,
                                             });
@@ -4768,9 +5160,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                             try {
                                 await closeSlot(slot);
                                 if (!workerFinished) {
-                                    const ref = await preserveWorktree(wt);
+                                    const producer = producerNow();
+                                    const ref = await preserveWorktree(wt, producer);
                                     if (ref) {
-                                        journal.append("worktree-preserved", t.id, { ref });
+                                        journal.append("worktree-preserved", t.id, { ref, ...producerFields(producer) });
                                         reapedWorktreeRef = ref;
                                     }
                                     journal.append("worker-reaped-before-harvest", t.id, {
@@ -4786,12 +5179,24 @@ export async function runDaemon(repoRoot, opts = {}) {
                             }
                         }
                         else if (keepOpen && (workerFinished || processExited || driver.id !== "subprocess")) {
+                            await reapWorker(slot);
                             keptSlots.push(slot);
                             supersededWorkerSlot = slot;
                         }
                         else {
                             await closeSlot(slot);
                         }
+                        if (retryMode === "resume") {
+                            const transcript = readResumeTranscript();
+                            const identity = resumeBaseline === null || transcript === null
+                                ? "unknown" : transcript.bytes > resumeBaseline.bytes ? "confirmed" : "unconfirmed";
+                            journal.append("worker-resume-identity", t.id, {
+                                sessionId, attempt, workerDispatchOrdinal, identity,
+                                baselineBytes: resumeBaseline?.bytes ?? null, observedBytes: transcript?.bytes ?? null,
+                                // This is evidence of file growth, not an independent runtime identity handshake.
+                                assumption: "external runtime appends to the requested session's own transcript",
+                            });
+                        }
                         // SPEND-01: usage from the harness's own cwd-keyed structured store, read POST-HOC from disk —
                         // `wt` is this task's private worktree, so the path is unique; the read is sliced to records
                         // stamped at/after this attempt's dispatch instant. Never the harvested pane text, never the
@@ -4829,9 +5234,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                             stallReaps = stallSeat === seat ? stallReaps + 1 : 1;
                             stallSeat = seat;
                             if (stallReaps >= 2) {
-                                const ref = await preserveWorktree(wt);
+                                const producer = producerNow();
+                                const ref = await preserveWorktree(wt, producer);
                                 if (ref)
-                                    journal.append("worktree-preserved", t.id, { ref });
+                                    journal.append("worktree-preserved", t.id, { ref, ...producerFields(producer) });
                                 await park(t, `two consecutive stall reaps without a gate on seat ${seat}`, "stall", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode, { seat, stallReaps });
                                 return;
                             }
@@ -4876,6 +5282,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const quotaMatch = (interactive ? !workerFinished : exitCode !== 0)
                             ? QUOTA_RE.exec(stallSnapshotBannerRows(output))
                             : null;
+                        // OBS-1161: transient capacity reads the SAME tail under the same guards — a live idle banner
+                        // and a no-trailer capacity exit classify identically — through the parse-boundary rule that a
+                        // parsed verdict (either way) is work, so a trailer QUOTING the phrase never lands here.
+                        const capacityMatch = !quotaMatch && (interactive ? !workerFinished : exitCode !== 0)
+                            ? classifyTransientCapacity({ ...preHarvestResult, raw: stallSnapshotBannerRows(output) })
+                            : null;
                         // Q-1: a graph pin is an operator instruction — a quota match ALONE never overrides it; only a
                         // channel-attributed error (auth/setup/outage/timeout, the typed dead-channel classes) may.
                         const pin = t.routingHints?.pin;
@@ -4886,7 +5298,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // demote the pin two tails in and the demotion re-dispatch would move the task off it.
                         if (preHarvestResult.ok && workerFinished)
                             noTrailerStreak.set(channelKey(assignment), 0);
-                        else if (!workerFinished && cause !== "provider-death" && !pinRefusesQuota) {
+                        else if (!workerFinished && cause !== "provider-death" && !pinRefusesQuota && !capacityMatch) {
                             const ck = channelKey(assignment);
                             const streak = (noTrailerStreak.get(ck) ?? 0) + 1;
                             noTrailerStreak.set(ck, streak);
@@ -4904,6 +5316,48 @@ export async function runDaemon(repoRoot, opts = {}) {
                             attempt--;
                             continue;
                         }
+                        // OBS-1161: transient capacity → bounded same-seat requeue with backoff (no attempt burn, no
+                        // consult), then a same-floor failover exactly like quota — but the seat is NEVER demoted or
+                        // excluded: it is busy, not dead, and a later task may find it free. The budget is read from
+                        // the journal, never a loop-local counter, so a resume continues the count it left off at.
+                        if (capacityMatch) {
+                            const from = channelKey(assignment);
+                            const requeues = capacityRequeuesOn(from);
+                            const source = capacityBannerKilled ? "banner" : "exit";
+                            if (requeues < CAPACITY_REQUEUE_CAP) {
+                                journal.append("capacity-requeue", t.id, {
+                                    attempt, requeue: requeues + 1, of: CAPACITY_REQUEUE_CAP, channel: from, assignment,
+                                    matched: capacityMatch[0], source, backoffMs: capacityBackoffMs,
+                                });
+                                await new Promise((r) => setTimeout(r, capacityBackoffMs));
+                                attempt--;
+                                continue;
+                            }
+                            const next = failover("capacity-failover");
+                            journal.append("capacity-failover", t.id, {
+                                from, to: next ? channelKey(next) : null, matched: capacityMatch[0], source, requeues, cause: "capacity",
+                            });
+                            if (next) {
+                                await driver.notify(`tickmarkr ${runId}: ${t.id} capacity failover`, { tier: "attention" });
+                                if (!keepForever) {
+                                    const idx = keptSlots.indexOf(slot);
+                                    if (idx >= 0) {
+                                        keptSlots.splice(idx, 1);
+                                        try {
+                                            await closeSlot(slot);
+                                        }
+                                        catch { /* cosmetic — reconcile is the backstop */ }
+                                    }
+                                    if (supersededWorkerSlot === slot)
+                                        supersededWorkerSlot = undefined;
+                                }
+                                assignment = next;
+                                tried.push(channelKey(next));
+                                continue;
+                            }
+                            await park(t, `capacity exhausted on ${from} after ${requeues} requeues and no eligible channel at floor`, "quota", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode, { cause: "capacity", channel: from, requeues });
+                            return;
+                        }
                         // quota exhaustion → failover within floor; does NOT consume the ladder (spec §4)
                         // print: guarded on exit code — exit-0 output that merely MENTIONS "rate limit" must not failover
                         // interactive: a worker-CLAIMED trailer beats quota mentions; without one, quota text fails over
@@ -5067,7 +5521,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 return;
                             }
                             const g = e.result;
-                            classifySignalOnlyTest(g);
+                            activeGatePhases.get(t.id)?.delete(e.gate);
+                            classifyInfraResult(g);
                             inParallelOrder(g.gate, () => {
                                 // GATE-09 (ROADMAP SC-4): journal every judge retry as an attributable event — which gate flaked,
                                 // which channel flaked, which channel retried — so `tickmarkr journal`/report can distinguish "judge
@@ -5123,6 +5578,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     meta: Object.fromEntries(Object.entries(data).filter(([key]) => !GATE_TELEMETRY_KEYS.includes(key) && key !== "capacity")),
                                 }));
                                 commits = await commitsAheadOf(taskBase, wt);
+                                // OBS-1106: a replayed legacy infra row lacking `infra` is re-classified before it is
+                                // re-journaled and before the infra park below reads it.
+                                results.forEach(classifyInfraResult);
                                 for (const g of results) {
                                     journal.append("gate-replayed", t.id, {
                                         attempt, priorAttempt: attempt - 1, gate: g.gate, commit: gateSubject.commit,
@@ -5133,7 +5591,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 }
                             }
                             else {
-                                ({ results, commits } = await withCommandContext(t.id, () => runReviewRecovery(t, {
+                                ({ results, commits } = await withCommandContext(t.id, async () => runReviewRecovery(t, {
+                                    carriedAuthors: await subjectAuthors(journal.read(), t.id, wt, taskBase),
+                                    producer: producerNow(),
                                     carriedFindings: outstandingFindings,
                                     operatorContext,
                                     worktree: wt, baseRef: taskBase, result, author: assignment,
@@ -5163,7 +5623,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     onGate,
                                 })));
                             }
-                            results.forEach(classifySignalOnlyTest);
+                            results.forEach(classifyInfraResult);
                             graph = addEvidence(graph, t.id, { commits, gateResults: results, artifacts: [promptFile] });
                             saveGraph(repoRoot, graph);
                             if (results.some((g) => g.gate === "test" && !g.pass
@@ -5200,6 +5660,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 saveGraph(repoRoot, graph);
                                 journal.append("task-done", t.id, {
                                     attempts: attempt + 1, assignment, taskContentDigest: contentDigest,
+                                    authors: mergedAuthors(await subjectAuthors(journal.read(), t.id, wt, taskBase)),
                                 });
                                 journal.append("merge", t.id, { branch: taskBranch, commit: await integrationHead(intWt) });
                                 await trackedDriver.project?.(t.id, "completed");
@@ -5228,7 +5689,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // already journaled by onGate, before gateFails and before any ladder selection can fund an
                         // identical retry in the same environment. Parsed judge refusals never carry infra and keep
                         // flowing through the chargeable quality path below.
-                        const infraFailure = results.find((g) => gateFailed(g) && g.meta?.infra === true);
+                        const unavailableReview = results.find((g) => gateFailed(g) && g.meta?.noEligibleReviewer === true);
+                        if (unavailableReview) {
+                            await park(t, gateFailApprovalReason(t.id, unavailableReview.details, true), "gate-fail", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
+                            return;
+                        }
+                        const infraFailure = results.find((g) => gateFailed(g) && isInfraResult(g));
                         if (infraFailure) {
                             await park(t, `${infraFailure.gate}: ${infraFailure.details}${infraFailure.meta?.recoveryBlocked ? ` — ${infraFailure.meta.recoveryBlocked}` : ""}`, "infra", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
                             return;
@@ -5445,7 +5911,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                 const holdEndCondition = (closing = true) => {
                     sweepLiveApprovals();
                     const freeSlots = Math.max(0, concurrency - inflight.size);
-                    const dispatchable = readyTasks(graph).filter((t) => !inflight.has(t.id));
+                    const dispatchable = admissible().filter((t) => !inflight.has(t.id));
                     if (freeSlots === 0 || dispatchable.length === 0)
                         return false;
                     if (closing) {
@@ -5465,7 +5931,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             throw new Error(`terminated by ${termSignal}`);
                         await watchBoard();
                         sweepLiveApprovals();
-                        const ready = readyTasks(graph)
+                        const ready = admissible()
                             .filter((t) => !inflight.has(t.id))
                             .slice(0, Math.max(0, concurrency - inflight.size));
                         for (const t of ready) {
@@ -5486,9 +5952,14 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 if (fatalStop.signal.aborted)
                                     return;
                                 const cleanupEvidence = cleanupErrors.length ? { cleanupErrors } : {};
+                                if (err instanceof HostDegradedError) {
+                                    await park(t, err.message, "infra", null, 0, Date.now(), 0, 0, undefined, 0, "fresh", { disposition: "host-degraded", ...cleanupEvidence });
+                                    return;
+                                }
                                 if (err instanceof HeldProbeExhausted) {
                                     const wt = worktreePath(repoRoot, `${branch}--${t.id}`);
-                                    let ref = await withoutExecutionBudget(() => preserveWorktree(wt));
+                                    const producer = knownProducer(journal.read(), t.id);
+                                    let ref = await withoutExecutionBudget(() => preserveWorktree(wt, producer));
                                     if (!ref) {
                                         const head = await gitHead(wt);
                                         ref = `refs/tickmarkr/preserved/${head}`;
@@ -5496,15 +5967,16 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         if (saved.code !== 0)
                                             throw new Error(`could not preserve ${head}: ${saved.stderr}`);
                                     }
-                                    journal.append("worktree-preserved", t.id, { ref });
+                                    journal.append("worktree-preserved", t.id, { ref, ...producerFields(producer) });
                                     await park(t, err.message, "infra", null, 0, Date.now(), 0, 0, undefined, 0, "fresh", { disposition: "transport-uncertain", ref, ...cleanupEvidence });
                                     return;
                                 }
                                 if (err instanceof ExecutionBudgetExceeded) {
                                     const wt = worktreePath(repoRoot, `${branch}--${t.id}`);
-                                    const ref = await preserveWorktree(wt);
+                                    const producer = knownProducer(journal.read(), t.id);
+                                    const ref = await preserveWorktree(wt, producer);
                                     if (ref)
-                                        journal.append("worktree-preserved", t.id, { ref });
+                                        journal.append("worktree-preserved", t.id, { ref, ...producerFields(producer) });
                                     const dispatch = journal.read().reverse().find((e) => e.taskId === t.id && e.event === "task-dispatch");
                                     await park(t, err.message, "infra", null, 0, Date.now(), 0, 0, undefined, 0, "fresh", { disposition: "execution-budget-exhausted", limitMs: cfg.executionPolicy.taskExecutionLimitMs,
                                         ...cleanupEvidence,
@@ -5538,7 +6010,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     journal.append("approval-window-start", undefined, { windowMs, parked: [...parked] });
                                     // The narrator may itself append a decision at this boundary.
                                     sweepLiveApprovals();
-                                    if (readyTasks(graph).length) {
+                                    if (admissible().length) {
                                         approvalDeadline = undefined;
                                         continue;
                                     }
@@ -5588,7 +6060,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                         pending: pendingTasks(graph).map((t) => t.id),
                     };
                     fatalPhase = "baseline";
-                    await baselineCapture; // also drain capture when every worker parks or fails before its gates
+                    await baselineCapture.catch(error => {
+                        // A host park is resumable only after baseline publication. Before that, retain the
+                        // fatal baseline failure: resume requires baseline.json and cannot recover this capture.
+                        if (!(error instanceof HostDegradedError) || !existsSync(join(journal.dir, "baseline.json")))
+                            throw error;
+                    });
                     fatalPhase = "tip-verify";
                     // OBS-34: post-merge integration-tip verify — strict exit codes, no baseline forgiveness.
                     const lastMergedTask = [...journal.read()].reverse().find((e) => e.event === "merge" && e.taskId)?.taskId;
@@ -5598,7 +6075,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const checkApprovals = () => {
                             try {
                                 sweepLiveApprovals();
-                                if (readyTasks(graph).length)
+                                if (admissible().length)
                                     controller.abort(cancellation);
                                 if (termSignal)
                                     controller.abort(new Error(`terminated by ${termSignal}`));