tickmarkr 2.5.9 → 2.6.1

package/dist/run/git.d.ts

@@ -4,6 +4,18 @@ import { ROUTING_ENV_SEAMS } from "../route/router.js";
 export { ROUTING_ENV_SEAMS };
 export declare const FORK_CAP_ENV = "VITEST_MAX_FORKS";
 export declare const SUITE_PARENT_ENV = "TICKMARKR_SUITE_PARENT";
+/** OBS-1173 add.2: only ps's clean "no such process" (exit 1, nothing printed) means gone (""). A
+ *  timeout, a signal, a spawn error or any other exit is a FAILED probe (null) that says nothing. */
+export declare function classifyIdentityProbe(error: {
+    code?: number | string | null;
+    killed?: boolean;
+    signal?: string | null;
+} | null, stdout: string): string | null;
+/** `undefined` = the pid is gone; `null` = the probe failed and proves nothing (never gone, never a match). */
+export declare function processIdentity(pid: number): Promise<string | null | undefined>;
+export declare const activeShellIdentities: () => ReadonlyMap<number, string | undefined>;
+/** A process that started after its receipt is a pid reuse, never that receipt's child. */
+export declare function resolveActiveShellIdentities(): Promise<void>;
 export declare const DEFAULT_FORK_CAP = "6";
 /** Verification uses command leases; workers keep their concurrency budget. */
 export declare const runWithVerificationBudget: <T>(capacity: RunCapacity, fn: () => Promise<T>) => Promise<T>;
@@ -174,6 +186,23 @@ export declare function cleanupRunWorktrees(repo: string, branch: string, opts:
     removeTaskIds: string[];
 }): Promise<void>;
 export declare function resolveIntegrationBranch(_repo: string, branch: string): Promise<string>;
+/**
+ * The attempt whose worker last wrote in a checkout, or explicit "unknown" when no worker launch is
+ * on record for the current tree (gate-only recreations, standalone verify, legacy callers). The
+ * label is what the preserve commit trailer and every `worktree-preserved`/refusal row carry, so a
+ * preserved engine commit is never credited to whichever seat is dispatched next.
+ */
+export type PreserveProducer = {
+    channel: string;
+    attempt: number;
+} | "unknown";
+export declare const PRESERVE_PRODUCER_TRAILER = "Tickmarkr-Producer";
+/** Subject of every engine preserve commit; only such commits are owned by their preserve row. */
+export declare const PRESERVE_COMMIT_SUBJECT = "tickmarkr: preserve uncommitted worktree";
+export declare const producerFields: (producer: PreserveProducer | undefined) => {
+    producer: string;
+    producerAttempt?: number;
+};
 /**
  * Preserve the bytes an existing checkout holds before recreation removes it.
  *
@@ -188,8 +217,24 @@ export declare function resolveIntegrationBranch(_repo: string, branch: string):
  * neither a commit nor a ref, keeping meaningful deaths visible rather than minting one ref per
  * ordinary dispatch.
  */
-export declare function preserveWorktree(cwd: string): Promise<string | undefined>;
+export declare function preserveWorktree(cwd: string, producer?: PreserveProducer): Promise<string | undefined>;
+/**
+ * Identity of the physical checkout, including recreation at the same path. Unlike mtime/ctime,
+ * birthtime does not change when builds add outputs. Read from disk on every call so process
+ * restarts preserve reuse. Filesystems without birthtime cannot prove build-output continuity.
+ */
+export declare function checkoutIncarnation(worktree: string): string | undefined;
 export declare function createWorktree(repo: string, branch: string, baseRef: string): Promise<string>;
+export interface DependencyLink {
+    /** Package link, relative to node_modules (including @scope/name). */
+    link: string;
+    target: string;
+    classification: "worktree" | "node_modules" | "outside";
+}
+/** Inventory only package-level links; never descend into installed packages. */
+export declare function inventoryDependencyLinks(worktree: string): DependencyLink[];
+/** Shared pre-command refusal; unreadable inventories cannot establish isolation either. */
+export declare function dependencyLinkRefusal(worktree: string): string | undefined;
 export declare function linkNodeModules(repo: string, dir: string, { force }?: {
     force?: boolean | undefined;
 }): boolean;

package/dist/run/git.js

@@ -1,10 +1,10 @@
 import { executionSignal } from "./execution-budget.js";
 import { commandLeaseEnvironment, withCommandLease } from "./lease.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { execFileSync, spawn } from "node:child_process";
+import { execFile, execFileSync, spawn } from "node:child_process";
 import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import { availableParallelism, homedir, tmpdir } from "node:os";
-import { join, resolve } from "node:path";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { StringDecoder } from "node:string_decoder";
 import { shq } from "../adapters/types.js";
 import { tickmarkrDir } from "../graph/graph.js";
@@ -16,6 +16,52 @@ export { ROUTING_ENV_SEAMS };
 // as argv (OBS-55) so child test oracles stay intact. The operator's own export wins.
 export const FORK_CAP_ENV = "VITEST_MAX_FORKS";
 export const SUITE_PARENT_ENV = "TICKMARKR_SUITE_PARENT";
+/** A pid is an address, not an identity. Keep this evidence out of ShellReceipt. */
+const linuxIdentity = (pid) => {
+    try {
+        const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+        const start = stat.slice(stat.lastIndexOf(")") + 2).split(/\s+/)[19];
+        return start && /^\d+$/.test(start) ? `${pid}:${start}` : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+/** OBS-1173 add.2: only ps's clean "no such process" (exit 1, nothing printed) means gone (""). A
+ *  timeout, a signal, a spawn error or any other exit is a FAILED probe (null) that says nothing. */
+export function classifyIdentityProbe(error, stdout) {
+    const start = stdout.trim().replace(/\s+/g, " ");
+    if (!error)
+        return start || null;
+    return !error.killed && !error.signal && error.code === 1 && !start ? "" : null;
+}
+/** `undefined` = the pid is gone; `null` = the probe failed and proves nothing (never gone, never a match). */
+export async function processIdentity(pid) {
+    if (process.platform === "linux")
+        return linuxIdentity(pid);
+    // Async and bounded like every other ps probe: a loaded host is slow, not unreadable.
+    const start = await new Promise((done) => execFile("ps", ["-p", String(pid), "-o", "lstart="], {
+        encoding: "utf8", timeout: 15_000, maxBuffer: 4096,
+    }, (error, stdout) => done(classifyIdentityProbe(error, stdout))));
+    if (start === null)
+        return null;
+    return start ? `${pid}:${start}` : undefined;
+}
+// Started receipts own these live pids; terminal receipts retire exactly that invocation. The
+// shell hot path never probes: Linux reads /proc in place, other hosts resolve on demand below.
+const activeShells = new Map();
+export const activeShellIdentities = () => new Map([...activeShells].map(([pid, live]) => [pid, live.identity ?? undefined]));
+/** A process that started after its receipt is a pid reuse, never that receipt's child. */
+export async function resolveActiveShellIdentities() {
+    await Promise.all([...activeShells].filter(([, live]) => live.identity === undefined).map(async ([pid, live]) => {
+        const identity = await processIdentity(pid);
+        if (identity === null)
+            return; // a failed probe resolves nothing; the next resolve retries
+        const started = identity ? Date.parse(identity.slice(identity.indexOf(":") + 1)) : NaN;
+        if (live.identity === undefined)
+            live.identity = identity && started <= live.startedMs + 1_000 ? identity : null;
+    }));
+}
 export const DEFAULT_FORK_CAP = "6";
 /** Worker concurrency is resolved once per run and isolated from other async runs. */
 const forkBudget = new AsyncLocalStorage();
@@ -217,6 +263,8 @@ export function shell(cmd, cwd, timeoutMs, login = false, options = {}) {
     let attribution;
     let confirmedStart = false;
     let terminal = false;
+    let activePid;
+    let activeInvocation;
     const begin = (invocation) => {
         attribution = options.receiptAttribution?.(invocation);
         confirmedStart = false;
@@ -225,10 +273,21 @@ export function shell(cmd, cwd, timeoutMs, login = false, options = {}) {
     const emit = (receipt) => {
         if (terminal)
             return;
-        if (receipt.outcome === "started")
+        if (receipt.outcome === "started") {
             confirmedStart = true;
-        else
+            activePid = receipt.pid;
+            if (activePid !== undefined) {
+                activeInvocation = Symbol("shell invocation");
+                activeShells.set(activePid, { startedMs: Date.now(), invocation: activeInvocation,
+                    ...(process.platform === "linux" ? { identity: linuxIdentity(activePid) ?? null } : {}) });
+            }
+        }
+        else {
             terminal = true;
+            if (activePid !== undefined && activeShells.get(activePid)?.invocation === activeInvocation)
+                activeShells.delete(activePid);
+            activePid = undefined;
+        }
         // Observational callbacks must not change process cleanup, retries or cancellation.
         try {
             options.onReceipt?.({ ...receipt, confirmedStart, ...(attribution ? { attribution: { ...attribution } } : {}) });
@@ -540,6 +599,14 @@ const resolveTaskBranch = async (repo, branch) => {
     const integration = await resolveIntegrationBranch(repo, branch.slice(0, split));
     return `${integration}${branch.slice(split)}`;
 };
+export const PRESERVE_PRODUCER_TRAILER = "Tickmarkr-Producer";
+/** Subject of every engine preserve commit; only such commits are owned by their preserve row. */
+export const PRESERVE_COMMIT_SUBJECT = "tickmarkr: preserve uncommitted worktree";
+export const producerFields = (producer) => producer && producer !== "unknown" ? { producer: producer.channel, producerAttempt: producer.attempt } : { producer: "unknown" };
+const producerLabel = (producer) => {
+    const f = producerFields(producer);
+    return f.producerAttempt === undefined ? f.producer : `${f.producer} attempt ${f.producerAttempt}`;
+};
 /**
  * Preserve the bytes an existing checkout holds before recreation removes it.
  *
@@ -554,7 +621,7 @@ const resolveTaskBranch = async (repo, branch) => {
  * neither a commit nor a ref, keeping meaningful deaths visible rather than minting one ref per
  * ordinary dispatch.
  */
-export async function preserveWorktree(cwd) {
+export async function preserveWorktree(cwd, producer = "unknown") {
     if (!existsSync(cwd))
         return undefined;
     const scratch = mkdtempSync(join(tmpdir(), "tickmarkr-preserve-index-"));
@@ -571,7 +638,7 @@ export async function preserveWorktree(cwd) {
         // not an authored project commit. Its HEAD parent makes the preserved tree directly inspectable.
         const identity = "GIT_AUTHOR_NAME=tickmarkr GIT_AUTHOR_EMAIL=tickmarkr@localhost "
             + "GIT_COMMITTER_NAME=tickmarkr GIT_COMMITTER_EMAIL=tickmarkr@localhost";
-        const commit = (await shGitOk(`${identity} git commit-tree ${shq(tree)} -p HEAD -m ${shq("tickmarkr: preserve uncommitted worktree")}`, cwd)).trim();
+        const commit = (await shGitOk(`${identity} git commit-tree ${shq(tree)} -p HEAD -m ${shq(PRESERVE_COMMIT_SUBJECT)} -m ${shq(`${PRESERVE_PRODUCER_TRAILER}: ${producerLabel(producer)}`)}`, cwd)).trim();
         const ref = `refs/tickmarkr/preserved/${commit}`;
         await shGitOk(`git update-ref ${shq(ref)} ${shq(commit)}`, cwd);
         return ref;
@@ -580,6 +647,23 @@ export async function preserveWorktree(cwd) {
         rmSync(scratch, { recursive: true, force: true });
     }
 }
+/**
+ * Identity of the physical checkout, including recreation at the same path. Unlike mtime/ctime,
+ * birthtime does not change when builds add outputs. Read from disk on every call so process
+ * restarts preserve reuse. Filesystems without birthtime cannot prove build-output continuity.
+ */
+export function checkoutIncarnation(worktree) {
+    try {
+        const root = realpathSync(worktree);
+        const stat = statSync(root, { bigint: true });
+        if (!stat.isDirectory() || stat.birthtimeNs <= 0n)
+            return undefined;
+        return `${root}:${stat.dev}:${stat.ino}:${stat.birthtimeNs}`;
+    }
+    catch {
+        return undefined;
+    }
+}
 export async function createWorktree(repo, branch, baseRef) {
     branch = await resolveTaskBranch(repo, branch);
     const dir = join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));
@@ -624,6 +708,54 @@ function excludeNodeModules(dir) {
     }
     catch { /* not a git checkout (bare tmpdir in tests) — never fail provisioning over the exclude */ }
 }
+/** Inventory only package-level links; never descend into installed packages. */
+export function inventoryDependencyLinks(worktree) {
+    const dependencyPath = join(worktree, "node_modules");
+    try {
+        lstatSync(dependencyPath);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+    const root = realpathSync(worktree);
+    const dependencies = realpathSync(dependencyPath);
+    const inside = (parent, target) => {
+        const rel = relative(parent, target);
+        return rel === "" || (!isAbsolute(rel) && rel !== ".." && !rel.startsWith(`..${sep}`));
+    };
+    const links = [];
+    const inspect = (link) => {
+        const path = join(dependencies, link);
+        if (!lstatSync(path).isSymbolicLink())
+            return;
+        const target = realpathSync(path);
+        links.push({ link, target, classification: inside(root, target) ? "worktree"
+                : inside(dependencies, target) ? "node_modules" : "outside" });
+    };
+    for (const entry of readdirSync(dependencies).sort()) {
+        inspect(entry);
+        if (entry.startsWith("@") && statSync(join(dependencies, entry)).isDirectory()) {
+            for (const child of readdirSync(join(dependencies, entry)).sort())
+                inspect(join(entry, child));
+        }
+    }
+    return links;
+}
+/** Shared pre-command refusal; unreadable inventories cannot establish isolation either. */
+export function dependencyLinkRefusal(worktree) {
+    try {
+        const outside = inventoryDependencyLinks(worktree).filter(link => link.classification === "outside");
+        if (!outside.length)
+            return undefined;
+        return "infra: OBS-1118 refusing verification: dependency links resolve outside the worktree and real node_modules:\n"
+            + outside.map(({ link, target }) => `node_modules/${link} -> ${target}`).join("\n");
+    }
+    catch (error) {
+        return `infra: OBS-1118 refusing verification: cannot inventory dependency links in ${worktree}: ${String(error)}`;
+    }
+}
 export function linkNodeModules(repo, dir, { force = false } = {}) {
     const src = join(repo, "node_modules");
     const dest = join(dir, "node_modules");

package/dist/run/host-health.d.ts

@@ -0,0 +1,20 @@
+import { spawn } from "node:child_process";
+export declare const HOST_PROBE_SAMPLES = 3;
+export declare const HOST_PROBE_SAMPLE_MS = 1000;
+export declare const HOST_LATENCY_FLOOR_MS = 50;
+export declare const HOST_LATENCY_RATIO = 3;
+export declare class HostDegradedError extends Error {
+}
+export declare const setHostProbeSpawnForTests: (fn: typeof spawn) => void;
+export declare const resetHostProbeSpawnForTests: () => void;
+declare const execLatency: (signal: AbortSignal, timeoutMs: number) => Promise<number | null>;
+export declare const setHostLatencySampleForTests: (fn: typeof execLatency) => void;
+export declare const resetHostLatencySampleForTests: () => void;
+export interface HostObservation {
+    samplesMs: Array<number | null>;
+    medianMs: number | null;
+}
+/** Three sequential samples, each bounded by 1s and the remaining observation budget. */
+export declare function observeHost(signal: AbortSignal, budgetMs?: number): Promise<HostObservation>;
+export declare const hostDegraded: (observation: HostObservation, referenceMs: number | undefined) => boolean;
+export {};

package/dist/run/host-health.js

@@ -0,0 +1,64 @@
+import { spawn } from "node:child_process";
+import { performance } from "node:perf_hooks";
+import { FILE_HANG_SLACK } from "../gates/test-manifest.js";
+export const HOST_PROBE_SAMPLES = 3;
+export const HOST_PROBE_SAMPLE_MS = 1_000;
+export const HOST_LATENCY_FLOOR_MS = 50;
+export const HOST_LATENCY_RATIO = FILE_HANG_SLACK;
+export class HostDegradedError extends Error {
+}
+// A probe owns just this child: no shell, descendants, inherited Node options, or host-wide kills.
+let probeSpawn = spawn;
+export const setHostProbeSpawnForTests = (fn) => { probeSpawn = fn; };
+export const resetHostProbeSpawnForTests = () => { probeSpawn = spawn; };
+const execLatency = (signal, timeoutMs) => new Promise((resolve, reject) => {
+    signal.throwIfAborted();
+    const start = performance.now();
+    const env = { ...process.env };
+    delete env.NODE_OPTIONS;
+    let child;
+    try {
+        child = probeSpawn(process.execPath, ["-e", ""], { stdio: "ignore", env });
+    }
+    catch {
+        resolve(null);
+        return;
+    }
+    let unreadable = false;
+    const retire = () => { unreadable = true; child.kill("SIGKILL"); };
+    const timer = setTimeout(retire, timeoutMs);
+    signal.addEventListener("abort", retire, { once: true });
+    child.once("error", () => { unreadable = true; });
+    // Resolve only after close: cancellation and timeout must reap the owned child before returning.
+    child.once("close", code => {
+        clearTimeout(timer);
+        signal.removeEventListener("abort", retire);
+        if (signal.aborted)
+            reject(signal.reason);
+        else {
+            const elapsed = performance.now() - start;
+            resolve(!unreadable && code === 0 && elapsed <= timeoutMs ? elapsed : null);
+        }
+    });
+    if (signal.aborted)
+        retire();
+});
+let sample = execLatency;
+export const setHostLatencySampleForTests = (fn) => { sample = fn; };
+export const resetHostLatencySampleForTests = () => { sample = execLatency; };
+/** Three sequential samples, each bounded by 1s and the remaining observation budget. */
+export async function observeHost(signal, budgetMs = HOST_PROBE_SAMPLES * HOST_PROBE_SAMPLE_MS) {
+    const deadline = performance.now() + budgetMs;
+    const samplesMs = [];
+    for (let i = 0; i < HOST_PROBE_SAMPLES; i++) {
+        signal.throwIfAborted();
+        const remaining = deadline - performance.now();
+        const value = remaining > 0 ? await sample(signal, Math.min(HOST_PROBE_SAMPLE_MS, remaining)) : null;
+        samplesMs.push(value !== null && Number.isFinite(value) && value > 0 ? value : null);
+    }
+    const medianMs = samplesMs.every((n) => n !== null)
+        ? [...samplesMs].sort((a, b) => a - b)[1] : null;
+    return { samplesMs, medianMs };
+}
+export const hostDegraded = (observation, referenceMs) => observation.medianMs === null || referenceMs === undefined
+    || observation.medianMs >= Math.max(HOST_LATENCY_FLOOR_MS, referenceMs * HOST_LATENCY_RATIO);

package/dist/run/journal.d.ts

@@ -437,7 +437,7 @@ export declare class Journal {
         assignment?: Assignment;
     } | null;
     replayResumeState(): Map<string, ResumeState>;
-    replaySatisfiedGates(): Map<string, GateName>;
+    replaySatisfiedGates(currentSubjects?: ReadonlyMap<string, string>): Map<string, GateName>;
     replayCurrentAttemptGateResults(): Map<string, CurrentAttemptGateReplay>;
     replayExcludedChannels(): Set<string>;
     telemetry(row: TelemetryRow): void;

package/dist/run/journal.js

@@ -1673,6 +1673,15 @@ export class Journal {
                     lastDispatch.delete(e.taskId);
                 }
             }
+            else if (e.event === "capacity-requeue") {
+                // OBS-1161: a capacity requeue is free — the daemon re-dispatches the SAME attempt on the SAME
+                // seat — so the dispatch it closes must not count, or a resume bills every busy-seat wait
+                // against MAX_ATTEMPTS. Only the attempt rewinds: the seat stays tried and in force (busy, not
+                // burned). Idempotent by the same rule as the scope rewind: only the OUTSTANDING dispatch.
+                const st = m.get(e.taskId);
+                if (st && lastDispatch.delete(e.taskId))
+                    st.attempts = Math.max(0, st.attempts - 1);
+            }
             else if (e.event === "consult-verdict" && e.data.action === "reroute") {
                 // A reroute bans the in-force channel; retry/decompose/human verdicts ban nothing (D-03).
                 pendingReroute.add(e.taskId);
@@ -1734,26 +1743,62 @@ export class Journal {
         }
         return m;
     }
-    // OBS-130/OBS-571: gate satisfaction is authority, not an inferred daemon state. Only an explicit
-    // task-approved event with the typed release marker and a known gate enters this fold. Authority is
-    // scoped to that approval: any later approval supersedes it, and the worktree-recreation row written
-    // before the approved gate suffix runs consumes it at enactment. A daemon-made gate-satisfied event,
-    // a prior pass/fail result, malformed data, or another task's approval is inert.
-    replaySatisfiedGates() {
+    // OBS-130/OBS-571: only an explicit approval grants gate authority; recreation consumes
+    // its immediate enactment. OBS-1133: retain a review waiver's subject separately so a later
+    // recheck may carry it. Tool waivers never survive recheck. The daemon supplies the recreated
+    // subject before using a carried waiver; absent that, replay can only compare journaled subjects.
+    replaySatisfiedGates(currentSubjects) {
         const satisfied = new Map();
+        const reviewSubjects = new Map();
+        const subjects = new Map();
+        const reviewWaivers = new Map();
         for (const e of this.read()) {
             if (!e.taskId)
                 continue;
+            if (e.event === "task-dispatch") {
+                reviewSubjects.delete(e.taskId);
+                subjects.delete(e.taskId);
+                reviewWaivers.delete(e.taskId);
+                satisfied.delete(e.taskId);
+            }
+            if (e.event === "gate-result") {
+                const commit = typeof e.data.commit === "string" && e.data.commit ? e.data.commit : undefined;
+                if (commit)
+                    subjects.set(e.taskId, commit);
+                else
+                    subjects.delete(e.taskId);
+                if (reviewWaivers.has(e.taskId) && reviewWaivers.get(e.taskId) !== commit) {
+                    reviewWaivers.delete(e.taskId);
+                }
+                if (e.data.gate === "review") {
+                    if (commit && e.data.pass === false)
+                        reviewSubjects.set(e.taskId, commit);
+                    else
+                        reviewSubjects.delete(e.taskId);
+                }
+            }
             if (e.event === "worktree-recreation") {
                 satisfied.delete(e.taskId);
                 continue;
             }
             if (e.event === "task-approved") {
                 satisfied.delete(e.taskId);
+                if (e.data.release === RECHECK_RELEASE) {
+                    const waivedSubject = reviewWaivers.get(e.taskId);
+                    const subject = currentSubjects?.get(e.taskId) ?? subjects.get(e.taskId);
+                    if (waivedSubject && waivedSubject === subject)
+                        satisfied.set(e.taskId, "review");
+                    continue;
+                }
+                reviewWaivers.delete(e.taskId);
                 if (e.data.release === GATE_SATISFIED_RELEASE
                     && typeof e.data.gate === "string"
                     && GATE_NAMES.includes(e.data.gate)) {
                     satisfied.set(e.taskId, e.data.gate);
+                    const subject = reviewSubjects.get(e.taskId);
+                    if (e.data.gate === "review" && subject && subject === subjects.get(e.taskId)) {
+                        reviewWaivers.set(e.taskId, subject);
+                    }
                 }
             }
         }

package/dist/run/merge.d.ts

@@ -5,7 +5,7 @@ export interface TipVerifyResult {
     evidenceReceipt?: GateEvidenceReceipt;
     evidenceReceipts?: GateEvidenceReceipt[];
     evidenceAbsence?: "provenance-refused" | "not-started" | "historical-cache";
-    /** Absolute directory against which the original receipt artifact paths resolve. */
+    /** Directory the evidence setup returned; receipt artifact paths resolve against it. */
     originRunRoot?: string;
     nonce?: string;
     stdoutPath?: string;

package/dist/run/merge.js

@@ -1,11 +1,11 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { join } from "node:path";
 import { shq } from "../adapters/types.js";
 import { beginGateEvidence, ceilingKillResult, classifyFreshRunnerOutput, classifyRunnerOutput, fileCountDeficit, waitForCalmWindow, effectiveCeilingMs, fingerprint, freshFailures, } from "../gates/baseline.js";
 import { evaluateManifestedTest, isVitestTestCommand } from "../gates/test-manifest.js";
 import { computeVerificationIdentity, formatReusedDetails, getVerdictStore, getWorktreeTree, resolveStateDir, isInfraResult, } from "../gates/cache.js";
 import { tickmarkrDir } from "../graph/graph.js";
-import { describeCapacity, gitHead, linkNodeModules, resolveIntegrationBranch, resolvedCapacity, sameCapacity, sh, shGit, shGitOk, WORKTREES_DIR } from "./git.js";
+import { dependencyLinkRefusal, describeCapacity, gitHead, linkNodeModules, resolveIntegrationBranch, resolvedCapacity, sameCapacity, sh, shGit, shGitOk, WORKTREES_DIR } from "./git.js";
 import { executionSignal } from "./execution-budget.js";
 // Diagnostic convenience logs are observational, just like receipt persistence.
 function writeTipLog(path, text) {
@@ -128,6 +128,16 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
     if (!commands.test && commands.tipTest) {
         gatesToRun.push(["test", commands.tipTest]);
     }
+    const dependencyRefusal = dependencyLinkRefusal(intWt);
+    if (dependencyRefusal) {
+        for (const [gate, cmd] of gatesToRun.length ? gatesToRun : [["build", ""]]) {
+            const artifact = join(runDir, `tip-verify-${gate}.log`);
+            writeTipLog(artifact, dependencyRefusal + "\n");
+            results.push({ gate, cmd, pass: false, exitCode: 1, fingerprints: [],
+                cause: "infra", details: dependencyRefusal, evidenceAbsence: "not-started", artifact });
+        }
+        return results;
+    }
     if (journalFound && hasRunEvidenceOrMalformed && runStartCommands === undefined) {
         for (const [gate, cmd] of gatesToRun) {
             const artifact = join(runDir, `tip-verify-${gate}.log`);
@@ -151,6 +161,8 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
     // Publish only after the entire verification completes. The daemon kills a cancelled
     // verifier process, so completed early gates must remain in memory until then.
     const pending = new Map();
+    // D-267 (1): each fresh receipt's origin is the root its own beginGateEvidence returned.
+    const evidenceRoots = new Map();
     for (const [gate, cmd] of gatesToRun) {
         if (runStartCommands !== undefined) {
             const expectedCmd = gate === "test"
@@ -226,13 +238,20 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
         // a detected vitest test command never reaches the stdout-count/file-count path below (this
         // gate's own manifest is always the FULL suite; verify has no selected screen to hold). A
         // scripted test command that is not the detected runner falls through unchanged.
+        const evidenceSetup = { artifactDir: runDir, runId: runDir, ...evidenceOptions };
         if (gate === "test" && isVitestTestCommand(cmd, intWt)) {
+            // D-267 (1): stamp the root the evidence setup returned, then give that exact root to every
+            // manifested invocation. Do not reconstruct it from the caller's options: the receipt's
+            // artifact paths are relative to the root returned by beginGateEvidence.
+            const evidence = beginGateEvidence(intWt, gate, cmd, evidenceSetup);
+            const manifestedEvidence = { ...evidenceSetup, artifactDir: evidence.root };
+            evidenceRoots.set(gate, evidence.root);
             const outcome = await evaluateManifestedTest(cmd, intWt, {
                 baselineDurations: entry?.fileDurations,
                 longestFile: entry?.longestFile,
                 overallCeilingMs: effectiveCeilingMs(entry),
                 artifactDir: runDir,
-                evidence: { artifactDir: runDir, runId: runDir, ...evidenceOptions },
+                evidence: manifestedEvidence,
             });
             const artifact = join(runDir, `tip-verify-${gate}.log`);
             if (!outcome.pass)
@@ -264,7 +283,8 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
         const ceilingMs = effectiveCeilingMs(entry);
         const evidenceReceipts = [];
         const execute = async () => {
-            const evidence = beginGateEvidence(intWt, gate, cmd, { artifactDir: runDir, runId: runDir, ...evidenceOptions });
+            const evidence = beginGateEvidence(intWt, gate, cmd, evidenceSetup);
+            evidenceRoots.set(gate, evidence.root);
             try {
                 const result = await sh(cmd, intWt, ceilingMs, { env: evidenceOptions.env, onReceipt: receipt => evidence.observe(receipt) });
                 evidenceReceipts.push(...evidence.history, evidence.finish(result.stdout, result.stderr));
@@ -372,8 +392,12 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
     // spawns in the daemon child, and a command that changed the tree invalidates reuse.
     const completedTree = pending.size ? await getWorktreeTree(intWt) : undefined;
     for (const result of results) {
-        if (!result.reused && result.evidenceReceipt)
-            result.originRunRoot = resolve(evidenceOptions.artifactDir ?? runDir);
+        if (!result.reused && result.evidenceReceipt) {
+            const evidenceRoot = evidenceRoots.get(result.gate);
+            if (evidenceRoot === undefined)
+                throw new Error(`tip verify receipt for ${result.gate} has no evidence root from its evidence setup`);
+            result.originRunRoot = evidenceRoot;
+        }
         const id = pending.get(result.gate);
         if (id && id.tree === completedTree && !isInfraResult(result)) {
             store.set(id, { ...result, meta: {

package/dist/run/operator-state.d.ts

@@ -11,11 +11,18 @@ export interface OperatorRecord extends EvidenceIdentity {
     event: JournalEvent;
 }
 export type OperatorTaskState = "unknown" | "pending" | "running" | "completed" | "merged" | "failed" | "human" | "blocked";
-export type OperatorGateState = "unknown" | "not-run" | "disabled" | "running" | "passed" | "failed";
+export type OperatorGateState = "unknown" | "not-run" | "disabled" | "queued" | "running" | "passed" | "failed";
 export interface OperatorGate {
     state: OperatorGateState;
     evidence?: EvidenceIdentity;
 }
+export interface GateActivity {
+    state: "queued" | "running";
+    gate?: string;
+    reason?: "suite-wait" | "host-degraded";
+    count?: number;
+    evidence: EvidenceIdentity;
+}
 export interface OperatorTask {
     id: string;
     title?: string;
@@ -30,10 +37,14 @@ export interface OperatorTask {
     evidence?: EvidenceIdentity;
     mergeEvidence?: EvidenceIdentity;
     gates: Record<string, OperatorGate>;
+    gateActivity?: GateActivity;
     /** BD-1: the board's per-task counters — latest dispatch channel, review verdicts drawn, human parks. */
     channel?: string;
     reviewRounds: number;
     parks: number;
+    /** Distinct producing channels of the merged subject from task-done; "unknown" names unattributed preserved work.
+     * Kept apart from `channel`: the last-dispatched seat may have authored nothing. */
+    authors?: readonly string[];
 }
 export interface OperatorSnapshot {
     sequence: number;
@@ -47,6 +58,10 @@ export interface OperatorSnapshot {
     label: string;
     green: boolean;
     currentTip: "passed" | "not required" | "pending" | "failed" | "unknown";
+    graphAvailability?: {
+        status: "readable" | "absent" | "unreadable";
+        error?: string;
+    };
     comparable: boolean;
     comparison: "matching graph" | "not comparable";
     merged: number;
@@ -60,6 +75,12 @@ export interface OperatorSnapshot {
     latestRunEnd?: EvidenceIdentity;
     approvedResumeRequired: boolean;
 }
+/** Author channels recorded on a task-done row. A row written before authors were recorded carries none and
+ * projects nothing (never the dispatch); unattributed preserved work arrives as an explicit "unknown" entry. */
+export declare const doneAuthors: (data: Record<string, unknown>) => string[] | undefined;
+/** The note a status row or board row shows beside the last-dispatched channel when the merged
+ * authors are not exactly that channel (a carry-only seat, a mixed subject, or legacy unknown). */
+export declare const authorsNote: (authors: readonly string[] | undefined, channel: string | undefined) => string | undefined;
 /** Incremental pure lifecycle fold. Retains facts per task/gate, never verdict bodies or event history. */
 export declare class OperatorStateFold {
     private tasks;
@@ -78,11 +99,12 @@ export declare class OperatorStateFold {
     private total;
     apply(record: OperatorRecord): void;
     private task;
-    snapshot({ graph, sequence, observedAt, readable }?: {
+    snapshot({ graph, sequence, observedAt, readable, graphAvailability }?: {
         graph?: RunGraph;
         sequence?: number;
         observedAt?: number;
         readable?: boolean;
+        graphAvailability?: OperatorSnapshot["graphAvailability"];
     }): OperatorSnapshot;
     private comparableTo;
 }