tickmarkr 2.6.0 → 2.6.2

package/dist/run/daemon.js

@@ -1,3 +1,5 @@
+import { HOST_PROBE_SAMPLE_MS, HOST_PROBE_SAMPLES, HostDegradedError, hostDegraded, observeHost } from "./host-health.js";
+import { VITEST_CACHE_ENV, worktreeVitestCache } from "../gates/test-manifest.js";
 import { COMMAND_LEASE_TOKEN_ENV, commandLeaseEnvironment, CommandLeases, currentCommandLeaseToken, isRunnerCommand, runWithCommandLease, withCommandLease } from "./lease.js";
 import { execFileSync, spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
@@ -8,9 +10,9 @@ import { tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { stringify } from "yaml";
-import { classifyDeadChannel, NO_TRAILER_SUMMARY, trailerPattern, UNPARSEABLE_TRAILER_SUMMARY, writePrompt } from "../adapters/prompt.js";
+import { BOOTSTRAP_FAILURE_RE, classifyDeadChannel, classifyTransientCapacity, trailerPattern, writePrompt } from "../adapters/prompt.js";
 import { allAdapters, getAdapter, probeAll, readDoctor, rolePools } from "../adapters/registry.js";
-import { SettledTrailerTracker, addUsage, channelKey, matchesInputBox, matchesTrustDialog, QUOTA_RE } from "../adapters/types.js";
+import { SettledTrailerTracker, addUsage, CAPACITY_RE, channelKey, matchesInputBox, matchesTrustDialog, QUOTA_RE } from "../adapters/types.js";
 import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { collateralHits } from "../compile/collateral.js";
 import { ExecutionPolicySchema, DEFAULT_DIFF_CAP, globalConfigDir, loadConfigWithMode, readOverlayFile, repoOverlayPath, } from "../config/config.js";
@@ -20,8 +22,9 @@ import { herdrSealShellPrefix, MAX_BUF, SubprocessDriver } from "../drivers/subp
 import { formatOwnedName } from "../drivers/types.js";
 import { captureBaseline, detectGateCommands, detectVacuousOracles } from "../gates/baseline.js";
 import { runGates } from "../gates/run-gates.js";
+import { isInfraResult } from "../gates/cache.js";
 import { filesGlob } from "../graph/files-glob.js";
-import { addEvidence, attributeBlocked, blockedTasks, getTask, graphDefinitionHash, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus, taskContentDigest, tickmarkrDir } from "../graph/graph.js";
+import { addEvidence, attributeBlocked, batteryPriority, blockedTasks, getTask, graphDefinitionHash, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus, taskContentDigest, tickmarkrDir } from "../graph/graph.js";
 import { GATE_NAMES } from "../graph/schema.js";
 import { distFingerprint } from "../cli/commands/version.js";
 import { augmentRetryBrief, consult, renderRetryGuidance } from "./consult.js";
@@ -29,16 +32,16 @@ import { executionSignal, remainingExecutionMs, withExecutionBudget, withoutExec
 import { repairSelectionDecision } from "./repair-selection.js";
 import { failureDisposition, reserveInfrastructureRetry } from "./recovery.js";
 import { runEnvironment } from "./environment.js";
-import { cleanupRunWorktrees, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, preserveWorktree, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shGit, SUITE_PARENT_ENV, verificationProtocol, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
+import { changeRepresented, cleanupRunWorktrees, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER, preserveWorktree, producerFields, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shGit, SUITE_PARENT_ENV, verificationProtocol, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
 import { classifyRepairDisposition, resolveScopeHints } from "./repair-disposition.js";
-import { applyScopeAmendments, activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, outstandingReviewFindings, pendingApprovalActions, pendingRechecks, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
+import { applyScopeAmendments, activeRetryBan, interruptedAttempt, RESUME_HARVEST_SOURCE, resumeHarvestAuthor, approvalAction, APPROVAL_REFUSED, bindingToken, effectiveEvents, foldDecisions, physicalLine, staleApprovals, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, outstandingReviewFindings, pendingApprovalActions, pendingRechecks, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, standingRulings, structuredFindings, upheldFeedbackByTask } from "./journal.js";
 import { gateReviewerFloor, isDiffCapPark, pickReviewer } from "../gates/review.js";
 import { acquireApprovalSerialization, acquireRunLock, isPidLive, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, reusedTipEvidence, verifyIntegrationTip } from "./merge.js";
 import { climbChannel, marginalCostRank, nextChannel, route } from "../route/router.js";
 import { desiredPanes } from "./reconcile.js";
-import { readTierLiveness, readWatchBoard, supervisionBeatPath } from "./supervision.js";
+import { readTierLiveness, readWatchBoard, supervisionPresencePath } from "./supervision.js";
 import { harvestCpuFlatWindowMs, NUDGEABLE_ADAPTERS, PANE_READ_ROWS, StallProgressTracker, stallSnapshotBannerRows, WorkerTreeCpuAccountant, reapOwnedProcessGroup, readOwnedProcessGroup, } from "./stall.js";
 // The live set is also the ownership claim shared by task cleanup and termination.
 export async function closeLiveSlot(liveSlots, driver, slot) {
@@ -55,6 +58,19 @@ export async function closeLiveSlot(liveSlots, driver, slot) {
 // A transport timeout says nothing about whether a mutation reached the terminal.
 class HeldProbeExhausted extends Error {
 }
+// OBS-1108: an owned slot whose contact stayed latched unreadable past its deadline. Same terminal
+// path as an exhausted transport probe — worktree preserved, one infra park (recheck-able) — with
+// its own disposition, so the park names what was actually lost.
+class ContactUnreadableExhausted extends HeldProbeExhausted {
+}
+// OBS-1108: how long one owned slot's contact may stay latched unreadable before its attempt parks.
+// Default: the attempt's own stall window — the latch holds the stall kill down, so without this
+// only the 4x hard deadline bounded a blind wait (2.5.8: 22k rows; 2.6.1: ~12k rows/h per worker).
+let contactUnreadableDeadlineMs;
+export function setContactUnreadableDeadlineMsForTests(ms) { contactUnreadableDeadlineMs = ms; }
+export function resetContactUnreadableDeadlineMsForTests() { contactUnreadableDeadlineMs = undefined; }
+const CONTACT_BACKOFF_BASE_MS = 1_000; // the pre-latch retry pause, doubled per latched retry
+const CONTACT_BACKOFF_DOUBLINGS = 5; // ponytail: 32 s ceiling; the poll slice caps it lower anyway
 function isTransportTimeout(error) {
     if (!(error instanceof Error))
         return false;
@@ -164,26 +180,53 @@ export function resolveRunMode(repoRoot, opts = {}) {
         : undefined;
     return { cfg: resolved.cfg, mode: resolved.mode, source, ...(conflict ? { conflict } : {}) };
 }
-// Bind approval context before dispatch consumes the release. Restore reconstructs the same
-// binding from journal order; a newer approval, including one without a reason, supersedes it.
-function approvalReviewContext(events, taskId, restore = false) {
-    let pending;
-    let bound;
-    let approved = false;
-    for (const row of events) {
-        if (row.taskId !== taskId)
-            continue;
-        if (row.event === "task-approved") {
-            pending = typeof row.data.reason === "string" ? row.data.reason.trim() || undefined : undefined;
-            approved = true;
-        }
-        else if (row.event === "task-dispatch" || (row.event === "recheck-battery" && approved)) {
-            bound = pending;
-            pending = undefined;
-            approved = false;
-        }
+/** Journal rows are untrusted input: a malformed field reads as not recorded, never as a value. */
+export const fingerprintsOf = (v) => Array.isArray(v) && v.every((x) => typeof x === "string") ? v : undefined;
+export const baselineProvenanceOf = (v) => {
+    const { baseRef, capturedAt } = (typeof v === "object" && v !== null ? v : {});
+    return typeof baseRef === "string" && typeof capturedAt === "string" ? { baseRef, capturedAt } : undefined;
+};
+/** A forgiven battery green: the structured field, or the battery's own "(forgiven)" wording on a legacy row. */
+export const forgivenGateRow = (data) => data.pass === true && (Array.isArray(data.forgivenFingerprints) || /\(forgiven\)/u.test(String(data.details ?? "")));
+/**
+ * OBS-1123: the forgiveness standing at this point in the journal — each task gate's LATEST verdict
+ * where it is a forgiven green, then the latest verification cycle's forgiven tip rows. A legacy row
+ * keeps what it never recorded absent, so the reader says "unknown" instead of borrowing a date.
+ */
+export function forgivenFingerprints(events) {
+    const latest = new Map();
+    for (const e of events) {
+        if (e.event === "gate-result" && e.taskId && typeof e.data.gate === "string")
+            latest.set(`${e.taskId}\0${e.data.gate}`, e);
     }
-    return restore && !approved ? bound : pending;
+    const tasks = [...latest.values()].filter((e) => forgivenGateRow(e.data));
+    const start = events.map((e) => e.event).lastIndexOf("tip-verify-start");
+    const tip = events.slice(start + 1).filter((e) => e.event === "tip-verify" && e.data.pass === true
+        && e.data.forgiven === true && typeof e.data.gate === "string");
+    return [...tasks, ...tip].map((e) => {
+        const fingerprints = fingerprintsOf(e.event === "tip-verify" ? e.data.fingerprints : e.data.forgivenFingerprints);
+        const baseline = baselineProvenanceOf(e.data.baselineProvenance);
+        return { ...(e.taskId ? { taskId: e.taskId } : {}), gate: e.data.gate,
+            ...(fingerprints ? { fingerprints } : {}), ...(baseline ? { baseline } : {}) };
+    });
+}
+/** The capture a forgiveness rests on, or an explicit unknown — never a time read off another clock. */
+export function formatBaselineProvenance(p) {
+    return p ? `baseline ${p.baseRef.slice(0, 12)} captured ${p.capturedAt}`
+        : "baseline provenance unknown (legacy: no capture identity or time recorded)";
+}
+export function formatFingerprints(fingerprints) {
+    return fingerprints === undefined ? "fingerprints not recorded"
+        : fingerprints.length ? fingerprints.join(" | ") : "no fingerprint recognized";
+}
+export function formatForgiven(f) {
+    return `${f.taskId ?? "tip"} ${f.gate}: ${formatFingerprints(f.fingerprints)} — ${formatBaselineProvenance(f.baseline)}`;
+}
+// OBS-1150: the reviewer reads the same standing rulings the worker brief carries, oldest first. A
+// later approval, with or without a reason, adds to them and never supersedes an earlier one.
+function approvalReviewContext(events, taskId) {
+    const rulings = standingRulings(events, taskId);
+    return rulings.length ? rulings.map((ruling) => `- ${ruling}`).join("\n") : undefined;
 }
 // T14: the events that prove an approval was ENACTED — narrowly causal, never merely subsequent.
 // Ordinary, attempt-cap and review-upheld approvals buy a WORKER, so their proof is a dispatch;
@@ -199,7 +242,8 @@ const RECHECK_ENACTMENT = "recheck-battery";
 const GATE_SATISFIED_ENACTMENT = "worktree-recreation";
 // Older daemons enacted rechecks through worker-launch, before recheck-battery existed.
 // Preserve that consumption at every scheduling read without changing continuing permission.
-function pendingDaemonApprovalActions(events) {
+// OBS-1158: exported so plan folds battery priority through the SAME consumption-aware seam.
+export function pendingDaemonApprovalActions(events) {
     const actions = pendingApprovalActions(events);
     const rechecks = pendingRechecks(events);
     for (const [id, action] of actions) {
@@ -221,7 +265,10 @@ function pendingDaemonApprovalActions(events) {
  */
 export function outstandingApprovals(events) {
     const newest = new Map();
-    events.forEach((e, i) => { if (e.event === "task-approved" && e.taskId)
+    // OBS-1178: this reports ANSWERS, not effects — a refused row was answered; an unsound one the daemon
+    // has not yet refused (approved, then failed before any dispatch) is still an unanswered decision.
+    const { refused } = foldDecisions(events);
+    events.forEach((e, i) => { if (e.event === "task-approved" && e.taskId && !refused.has(physicalLine(events, i)))
         newest.set(e.taskId, i); });
     return [...newest]
         .filter(([taskId, i]) => {
@@ -258,7 +305,9 @@ export function formatSummary(s) {
             + (resumable.length ? `; \`tickmarkr resume ${s.runId}\` enacts ${resumable.join(", ")}` : "")
             + (stalled.length ? `; ${stalled.join(", ")} failed before any dispatch — neither resume nor \`--retry-failed\` re-dispatches that` : "")
         : "";
-    return `done: ${s.done.length}, failed: ${s.failed.length}, human: ${s.human.length}, blocked: ${s.blocked.length}, pending: ${s.pending.length}\nintegration branch: ${s.branch}${tip}${outstanding}`;
+    // OBS-1123: a green that carried baseline reds names each one and the capture that recorded it.
+    const forgiven = (s.forgiven ?? []).map((f) => `\nforgiven vs baseline — ${formatForgiven(f)}`).join("");
+    return `done: ${s.done.length}, failed: ${s.failed.length}, human: ${s.human.length}, blocked: ${s.blocked.length}, pending: ${s.pending.length}\nintegration branch: ${s.branch}${tip}${outstanding}${forgiven}`;
 }
 /** The narrator enters the production Run cockpit for this exact run. The
  *  completed static/growing four-hour records precede this default cutover;
@@ -310,6 +359,17 @@ function classifySignalOnlyTest(g) {
         return;
     g.meta = { ...g.meta, classification: "infra", infra: true, retryable: false, kind: "signal-exit" };
 }
+/** OBS-1106: ONE infrastructure predicate for classification, persistence and repair admission. A red
+ * that carries an infra fingerprint or classification without `meta.infra` (a legacy journal row, an
+ * oracle that named only its classification) is still a non-verdict about the work: it is normalized
+ * here BEFORE its journal row and before any park/repair seam reads it, so those seams can key on the
+ * same `isInfraResult` the gate cache keys on and never on one metadata field alone. */
+function classifyInfraResult(g) {
+    classifySignalOnlyTest(g);
+    if (g.pass || g.meta?.infra === true || !isInfraResult(g))
+        return;
+    g.meta = { ...g.meta, classification: "infra", infra: true };
+}
 // v1.85 T3: the gates whose failure IS a deterministic measurement — a machine re-ran a command over a
 // tree and printed the same bytes. Those are the failures the fingerprint cap governs (the ruling names
 // it a "deterministic-gate" cap): a third identical answer to a question already answered twice is the
@@ -338,6 +398,12 @@ function narrowRepairBattery(failing) {
         return isOracleFailure(g) && g.meta?.unparseable !== true;
     return false;
 }
+// OBS-1182: re-seating copies the channel's identity AND its launch effort — the four-field copy
+// this replaced silently reverted a climbed or pinned seat to the CLI's default effort.
+const seatAssignment = (c) => ({
+    adapter: c.adapter, model: c.model, channel: c.channel, tier: c.tier,
+    ...(c.effort ? { effort: c.effort } : {}),
+});
 // v2.0 T2 (OBS-554): the measurement keys run-gates stamps on a GateResult, lifted verbatim onto the
 // gate row. One list, one lift — both onGate sites record through the same helper.
 const GATE_TELEMETRY_KEYS = ["durationMs", "load1Start", "load1End", "load1Max", "load1Mean", "selectedDurationMs", "fullDurationMs", "invocations"];
@@ -426,7 +492,8 @@ const DEFERRED_FINDINGS_HEADING = "## Deferred review findings — a reviewer AC
 // OBS-419: the newest approval starts the current engagement, so it is also the sole authority for
 // that engagement's optional ceiling. Stop at the newest approval even when the field is absent: a
 // later ordinary release restores the module default instead of inheriting an older operator limit.
-function approvedReviewRoundCeiling(events, taskId) {
+function approvedReviewRoundCeiling(journaled, taskId) {
+    const events = effectiveEvents(journaled); // OBS-1178: a refused or unsound approval sets no ceiling
     for (let i = events.length - 1; i >= 0; i--) {
         const event = events[i];
         if (event.event !== "task-approved" || event.taskId !== taskId)
@@ -455,6 +522,23 @@ export const setApprovalWindowForTests = (ms) => { approvalWindowMs = ms; };
 export const resetApprovalWindowForTests = () => { approvalWindowMs = DEFAULT_APPROVAL_WINDOW_MS; };
 const PROVIDER_DEATH_REQUEUE_CAP = 2; // v1.46 T1: requeue same assignment twice, then fall through to the normal ladder
 const PROVIDER_DEATH_BACKOFF_MS = 500; // short backoff before provider-death requeue
+// OBS-1161: transient capacity ("Selected model is at capacity") — bounded same-seat requeues with a
+// real wait between them, THEN a same-floor failover; never a demotion. The budget is per task and
+// seat, counted from the journal's own capacity-requeue rows so a resume continues it, never restarts it.
+const CAPACITY_REQUEUE_CAP = 2;
+const CAPACITY_BACKOFF_MS = 60_000;
+let capacityBackoffMs = CAPACITY_BACKOFF_MS;
+/** Test seam — shrink the capacity backoff without minute-long sleeps. */
+export function setCapacityBackoffMsForTests(ms) { capacityBackoffMs = ms; }
+export function resetCapacityBackoffMsForTests() { capacityBackoffMs = CAPACITY_BACKOFF_MS; }
+// OBS-1169: a CLI bootstrap failure buys ONE same-channel retry after a bounded wait — journal-counted
+// per task and seat like capacity — and then the adapter is escalated away from, never retried forever.
+const BOOTSTRAP_RETRY_CAP = 1;
+const BOOTSTRAP_BACKOFF_MS = 5_000;
+let bootstrapBackoffMs = BOOTSTRAP_BACKOFF_MS;
+/** Test seam — shrink the bootstrap backoff. */
+export function setBootstrapBackoffMsForTests(ms) { bootstrapBackoffMs = ms; }
+export function resetBootstrapBackoffMsForTests() { bootstrapBackoffMs = BOOTSTRAP_BACKOFF_MS; }
 const NO_TRAILER_DEMOTION_STREAK = 2; // OBS-57: consecutive no-trailer windows demote a channel for the rest of the run
 // OBS-117 (v1.71 T6): a worker pane that never prints a byte by T+60s after dispatch is a dead
 // channel — don't burn the full stall window waiting for a silent launch failure. Checked on the
@@ -520,9 +604,16 @@ export function resetWorkerStartupWindowMsForTests() {
 /** One seat, one startup prefix. Once execution or its input box is seen, later panes are ineligible. */
 export class StartupFailureDetector {
     adapter;
+    pattern;
+    wholePrefix;
     closed = false;
-    constructor(adapter) {
+    constructor(adapter, pattern = WORKER_STARTUP_FAILURE_RE, // OBS-1169: or known bootstrap text
+    // OBS-1169: bootstrap evidence must own the WHOLE bounded prefix — a match followed by a tool frame
+    // or an input box anywhere later in the sample is a worker that ran, not a CLI that died starting.
+    wholePrefix = false) {
         this.adapter = adapter;
+        this.pattern = pattern;
+        this.wholePrefix = wholePrefix;
     }
     sample(output, launchedAt) {
         if (this.closed || launchedAt === undefined || Date.now() - launchedAt > workerStartupWindowMs)
@@ -559,6 +650,7 @@ export class StartupFailureDetector {
             }
         }
         let offset = 0;
+        let found;
         for (const [index, row] of rows.entries()) {
             const cleanRow = row.replace(/\u001b\[[0-?]*[ -/]*[@-~]/g, "");
             // Structured tool frames and the terminal's tool headings close the prefix BEFORE their body.
@@ -567,16 +659,20 @@ export class StartupFailureDetector {
                 this.closed = true;
                 return;
             }
-            if (!this.adapter.harnessBannerRows?.includes(cleanRow)) {
-                const match = WORKER_STARTUP_FAILURE_RE.exec(row);
-                if (match)
-                    return {
+            if (!found && !this.adapter.harnessBannerRows?.includes(cleanRow)) {
+                const match = this.pattern.exec(row);
+                if (match) {
+                    found = {
                         matchedBytes: match[0], offset: offset + Buffer.byteLength(row.slice(0, match.index)),
                         row, rowNumber: index + 1,
                     };
+                    if (!this.wholePrefix)
+                        return found;
+                }
             }
             offset += Buffer.byteLength(row) + 1;
         }
+        return found;
     }
 }
 // OBS-901/906: one daemon-owned writer for every execution surface. Drivers expose one retained
@@ -963,7 +1059,7 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
         };
         if (r.pass) {
             // Q121s: a forgiven pass journals its fingerprints — honest about what was carried, never a silent green.
-            journal.append("tip-verify", undefined, { ...evidence, gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.reused ? { cached: true } : {}), ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints } : {}), tip, cmdHash, capacity: measuredCapacity });
+            journal.append("tip-verify", undefined, { ...evidence, gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.reused ? { cached: true } : {}), ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints, ...(r.baselineProvenance ? { baselineProvenance: r.baselineProvenance } : {}) } : {}), tip, cmdHash, capacity: measuredCapacity });
         }
         else {
             journal.append("tip-verify-failed", undefined, {
@@ -1476,18 +1572,51 @@ async function taskWithMaterializedContext(repoRoot, journal, worktree, task, at
     }
     return { ...task, context };
 }
+// OBS-1107: a refused pick is not lost work by that fact alone. A commit whose own change the
+// destination already holds (content-empty, or a patch represented there under another hash) is
+// accounted for and skipped; the carry stops only at a nonempty change the destination lacks.
 async function cherryPickCommits(wt, commits) {
     const carried = [];
+    const accounted = [];
     for (const hash of commits) {
         const r = await shGit(`git cherry-pick --no-gpg-sign ${shq(hash)}`, wt);
-        if (r.code !== 0) {
-            await shGit("git cherry-pick --abort", wt);
+        if (r.code === 0) {
+            carried.push(hash);
+            continue;
+        }
+        await shGit("git cherry-pick --abort", wt);
+        if (!(await changeRepresented(wt, hash)))
             break;
+        accounted.push(hash);
+    }
+    return { carried, accounted };
+}
+const PRESERVED_REF_PREFIX = "refs/tickmarkr/preserved/";
+const preservedRefOf = (data) => [data.ref, data.preservedRef].find((v) => typeof v === "string" && v.startsWith(PRESERVED_REF_PREFIX));
+/** The attempt whose worker last launched into the task's current checkout; "unknown" once a
+ * recreation replaced that tree without a new launch (recheck, gate-only restore) or when no
+ * dispatch assignment is on record. Never the newest dispatch by itself. */
+export function knownProducer(events, taskId) {
+    let dispatched = "unknown";
+    let producer = "unknown";
+    for (const row of events) {
+        if (row.taskId !== taskId)
+            continue;
+        if (row.event === "task-dispatch") {
+            const a = row.data.assignment;
+            dispatched = typeof a?.adapter === "string" && typeof a?.model === "string"
+                ? { channel: `${a.adapter}:${a.model}`, attempt: typeof row.data.attempt === "number" ? row.data.attempt : 0 } : "unknown";
         }
-        carried.push(hash);
+        else if (row.event === "worker-launch")
+            producer = dispatched;
+        else if (row.event === "worktree-recreation")
+            producer = "unknown";
     }
-    return carried;
+    return producer;
 }
+/** Distinct author channels of the subject for task-done/status/board rows: "unknown" replaces every
+ * unresolvable owner (legacy unattributed preservation, dispatch without assignment). */
+const mergedAuthors = (authors) => [...new Set(authors.map((a) => a.startsWith("unknown author") ? "unknown" : a))].sort();
 /** Fold lifetime dispatch/carry evidence, independent of attempt budgets and routing exclusions.
  * Recreation rows name SOURCE hashes, so ownership is joined by stable patch identity. Each
  * attempt owns only what the next carry (or current subject) adds beyond its own incoming set.
@@ -1517,12 +1646,15 @@ async function subjectAuthors(events, taskId, wt, base) {
     let previous;
     let awaitingCarry = false;
     const owners = new Map();
+    // Preserved engine commits carry their producing attempt on the row; a row without one is legacy
+    // and stays explicitly unknown rather than inheriting the seat that later carried the patch.
+    const preservedOwner = new Map();
     const attribute = (ids, attempt) => {
         for (const id of ids) {
             if (attempt?.incoming.has(id))
                 continue;
             const authors = owners.get(id) ?? new Set();
-            authors.add(attempt?.author ?? "unknown author (missing task-dispatch assignment)");
+            authors.add(preservedOwner.get(id) ?? attempt?.author ?? "unknown author (missing task-dispatch assignment)");
             owners.set(id, authors);
         }
     };
@@ -1530,6 +1662,24 @@ async function subjectAuthors(events, taskId, wt, base) {
         for (const row of events) {
             if (row.taskId !== taskId)
                 continue;
+            const preserved = preservedRefOf(row.data);
+            if (preserved) {
+                // Only an engine preserve commit is owned by its row; a ref naming a worker's own commit keeps
+                // that commit's dispatch attribution.
+                const shown = await shGit(`git show -s ${shq(`--format=%H%n%s%n%(trailers:key=${PRESERVE_PRODUCER_TRAILER},valueonly)`)} ${shq(`${preserved}^{commit}`)}`, wt);
+                const [commit, subject, trailer] = shown.stdout.trim().split("\n");
+                if (shown.code === 0 && commit && subject === PRESERVE_COMMIT_SUBJECT) {
+                    // A row that merely mentions the ref (a park naming it) defers to the commit's own trailer;
+                    // only a commit with neither is legacy. A known owner is never downgraded by a later mention.
+                    const owner = typeof row.data.producer === "string" ? row.data.producer
+                        : trailer?.trim().replace(/ attempt \d+$/, "") || "unknown author (legacy unattributed preservation)";
+                    for (const id of await patches([commit])) {
+                        const prior = preservedOwner.get(id);
+                        if (prior === undefined || prior === "unknown" || prior.startsWith("unknown author"))
+                            preservedOwner.set(id, owner);
+                    }
+                }
+            }
             if (row.event === "task-dispatch") {
                 previous = current;
                 const a = row.data.assignment;
@@ -1591,6 +1741,7 @@ export function recordFatalRunEnd(journal, runId, branch, err, graph, phase = "s
     const original = err instanceof Error ? err.message : String(err);
     // A fatal close never finished a cycle: fresh/reused green is withheld, a recorded red still stands.
     let tipProof = { kind: "incomplete" };
+    let forgiven = [];
     try {
         // Only the latest engagement can already own this terminal outcome.
         const events = journal.read();
@@ -1604,6 +1755,8 @@ export function recordFatalRunEnd(journal, runId, branch, err, graph, phase = "s
         }
         const latest = runEndTipProof(events.slice(from));
         tipProof = { ...latest, kind: latest.kind === "failed" ? "failed" : "incomplete" };
+        // OBS-1123: the same fold the normal close records, so a crash never drops what a green carried.
+        forgiven = forgivenFingerprints(events);
     }
     catch (readErr) {
         console.error(`tickmarkr ${runId}: journal read failed while recording the fatal run-end (${readErr instanceof Error ? readErr.message : String(readErr)}) — original error: ${original}`);
@@ -1620,6 +1773,7 @@ export function recordFatalRunEnd(journal, runId, branch, err, graph, phase = "s
         fatal: true,
         error: original,
         tipProof,
+        ...(forgiven.length ? { forgiven } : {}),
     };
     try {
         journal.append("run-end", undefined, record);
@@ -1706,6 +1860,8 @@ export async function runDaemon(repoRoot, opts = {}) {
     let fatalPhase = "setup";
     let deliberateTermination = false;
     const fatalStop = new AbortController();
+    const hostStop = new AbortController();
+    const hostChecks = new Set();
     const inflight = new Map();
     let retireFatalSlots;
     let branch = "";
@@ -1802,21 +1958,50 @@ export async function runDaemon(repoRoot, opts = {}) {
                     if (owner) {
                         const processGroup = readOwnedProcessGroup(owner.groupFile);
                         let survivors;
+                        const strays = [];
+                        let session;
                         try {
                             const shared = processGroup !== undefined && [...workerOwners].some(([other, otherOwner]) => other !== slot && liveSlots.has(other) && readOwnedProcessGroup(otherOwner.groupFile) === processGroup);
                             if (shared)
                                 throw new Error(`worker group ${processGroup} is shared with another live attempt`);
-                            survivors = await reapOwnedProcessGroup(processGroup, slot.cwd);
+                            try {
+                                session = readFileSync(`${owner.groupFile}.session`, "utf8").trim() || undefined;
+                            }
+                            catch { /* pre-launch or older driver */ }
+                            let parent;
+                            try {
+                                const row = /^\s*(\d+)\s+(.+)$/.exec(readFileSync(`${owner.groupFile}.parent`, "utf8").trim());
+                                if (row)
+                                    parent = { pid: Number(row[1]), startedAt: row[2].trim().replace(/\s+/g, " ") };
+                            }
+                            catch { /* a live dispatch root can still prove its parent */ }
+                            const others = [...workerOwners].filter(([other]) => other !== slot && liveSlots.has(other));
+                            survivors = await reapOwnedProcessGroup(processGroup, slot.cwd, {
+                                marker: owner.marker, session, parent, identities: owner.identities, descendants: owner.descendants, strays,
+                                excludedGroups: others.flatMap(([, other]) => {
+                                    const group = readOwnedProcessGroup(other.groupFile);
+                                    return group === undefined ? [] : [group];
+                                }),
+                                excludedWorktrees: others.map(([other]) => other.cwd).filter((cwd) => cwd !== slot.cwd),
+                            });
                         }
                         catch (error) {
                             journal.append("worker-process-reaped", owner.taskId, { slot: slot.name, attempt: owner.attempt,
-                                processGroup: processGroup ?? null, survivors: null, error: String(error) });
+                                processGroup: processGroup ?? null, strays, survivors: null, error: String(error) });
+                            workerOwners.delete(slot); // one reap row per attempt: a later close never re-sweeps
                             throw error;
                         }
-                        reapReports.set(slot, { processGroup: processGroup ?? null, survivors });
+                        reapReports.set(slot, { processGroup: processGroup ?? null, strays, survivors });
                         journal.append("worker-process-reaped", owner.taskId, {
-                            slot: slot.name, attempt: owner.attempt, processGroup: processGroup ?? null, survivors,
+                            slot: slot.name, attempt: owner.attempt, processGroup: processGroup ?? null, strays, survivors,
                         });
+                        // Every outcome retires the claim: one reap row per attempt, whatever the verdict.
+                        workerOwners.delete(slot);
+                        // Pre-launch and in-process drivers have no OS dispatch claim; their close owns retirement.
+                        // Once any dispatch ownership exists, an unreadable sweep must block the next gate.
+                        if (survivors === null && (processGroup !== undefined || session !== undefined || owner.descendants.size > 0)) {
+                            throw new Error(`worker group ${processGroup} cleanup unknown`);
+                        }
                         if (survivors && survivors.length > 0)
                             throw new Error(`worker group ${processGroup} survivors: ${survivors.join(", ")}`);
                     }
@@ -1915,6 +2100,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                             // new attempt while this reaper is still closing the old ones.
                             const termination = new Error(`terminated by ${sig}`);
                             abortRun(termination);
+                            hostStop.abort(termination);
+                            await Promise.allSettled(hostChecks);
                             if (activeTipVerify) {
                                 activeTipVerify.controller.abort(termination);
                                 await activeTipVerify.settled;
@@ -2003,11 +2190,22 @@ export async function runDaemon(repoRoot, opts = {}) {
                 // GATE-08 (v1.12): the humanGate guard consults this run's journaled approvals, not just the compiled
                 // flag. Startup approvals seed the first scheduling pass; live approvals are folded at task
                 // boundaries below so a sibling can release parked work without waiting for run-end + resume.
+                //
+                // OBS-1178: revalidate every open approval before anything can enact it. The decision fold already
+                // gives an unsound one no effect; the approval-refused row records that answer and consumes it, so
+                // every fold and every operator reads the task as still parked — a stale waive never satisfies a newer gate.
+                const refuseStaleApprovals = () => {
+                    for (const [taskId, stale] of staleApprovals(journal.read())) {
+                        // `lines` names the voided rows, so a sound decision beside a stale one survives the refusal.
+                        journal.append(APPROVAL_REFUSED, taskId, { reason: `stale or unbound decision refused before enactment — ${stale.reason}`, lines: stale.lines });
+                    }
+                };
+                refuseStaleApprovals();
                 const approvalStartupEvents = journal.read();
-                // Continuing human-gate permission survives enactment; malformed releases grant none.
-                const validApproval = (e) => e.event === "task-approved" && e.taskId
-                    && pendingApprovalActions([e]).get(e.taskId)?.authority !== "inert";
-                const approved = new Set(approvalStartupEvents.filter(validApproval).map((e) => e.taskId));
+                // Continuing human-gate permission survives enactment; malformed, refused or unsound releases grant none.
+                const validApproval = (e) => e.event === "task-approved" && e.taskId !== undefined
+                    && approvalAction(e.taskId, e).authority !== "inert";
+                const approved = new Set(effectiveEvents(approvalStartupEvents).filter(validApproval).map((e) => e.taskId));
                 const startupActions = pendingDaemonApprovalActions(approvalStartupEvents);
                 let approvalSweepCursor = approvalStartupEvents.length;
                 const commands = detectGateCommands(repoRoot, cfg);
@@ -2046,11 +2244,14 @@ export async function runDaemon(repoRoot, opts = {}) {
                     console.error(`tickmarkr: narrator not opened: ${placed.error}`);
                     return undefined;
                 };
-                // WB-1 (OBS-988): the daemon watches its own cockpit. A board is lost when the watch tier's beat
-                // aged past the supervision stale bound, the recorded arm has no presence, or the owner pid is dead.
-                // The beat and presence checks wait for the UI to have armed (armId recorded) — a freshly reopened
-                // board that has not armed yet is not a second loss. Reopens are bounded per run; past the bound
-                // the loss is journaled `boardless` and the narrator is never called again.
+                // WB-1 (OBS-988): the daemon watches its own cockpit. A board is lost when its owner pid is dead, the
+                // recorded arm has no presence, or its beat aged past the supervision stale bound with no owner pid
+                // to consult. OBS-1110: a stale beat under a LIVE MATCHING OWNER — its pid answers and the arm it
+                // claimed is present — is a slow board, not a lost one: journaled once per episode as
+                // `watch-board-slow` and never spending a reopen. The beat and presence checks wait for the UI to
+                // have armed (armId recorded) — a freshly reopened board that has not armed yet is not a second
+                // loss. Reopens are bounded per run; past the bound the loss is journaled `boardless` and the
+                // narrator is never called again.
                 // Leg-2 T7 M2: one `watch-board-lost` row per LOSS. A loss is identified by the pane and pid the
                 // owner record names; a reopen that fails leaves that record in place, so the next poll sees the
                 // same loss, journals only its own reopen attempt, and the bound retires the run boardless from the
@@ -2059,31 +2260,79 @@ export async function runDaemon(repoRoot, opts = {}) {
                 let boardReopens = journal.read().filter((e) => e.event === "watch-board-reopened" || e.event === "watch-board-reopen-failed").length;
                 let boardless = false;
                 let journaledLoss;
-                const boardLoss = () => {
+                let journaledSlow;
+                // Per claim: the next adoption offer, backed off (doubling from the poll cadence to a small cap) but
+                // never exhausted; and whether a reservation is unresolved, so the loop must keep waking to watch it.
+                const MAX_HELD_OFFER_GAP_MS = 4 * APPROVAL_POLL_MS;
+                let heldOffer;
+                let heldRetry = false;
+                const boardHealth = () => {
                     const owner = readWatchBoard(repoRoot, runId);
                     if (!owner)
                         return undefined;
-                    const lost = { pane: owner.pane, ...(owner.pid !== undefined ? { pid: owner.pid } : {}) };
-                    if (owner.armId !== undefined) {
-                        const beat = readTierLiveness(repoRoot, "watch");
-                        if (beat.state === "STALE")
-                            return { ...lost, beatAgeMs: beat.beatAgeMs };
-                        // ponytail: presence path math mirrors supervision.ts's private helper (`<tier>.live.<armId>`)
-                        if (!existsSync(join(dirname(supervisionBeatPath(repoRoot, "watch")), `watch.live.${owner.armId}`)))
-                            return lost;
-                    }
+                    const named = { pane: owner.pane, ...(owner.pid !== undefined ? { pid: owner.pid } : {}) };
+                    const beat = owner.armId !== undefined ? readTierLiveness(repoRoot, "watch") : undefined;
+                    const row = beat?.state === "STALE" ? { ...named, beatAgeMs: beat.beatAgeMs } : named;
                     if (owner.pid !== undefined && !isPidLive(owner.pid))
-                        return lost;
+                        return { lost: row };
+                    if (owner.armId !== undefined && !existsSync(supervisionPresencePath(repoRoot, "watch", owner.armId)))
+                        return { lost: row };
+                    if (beat?.state === "STALE")
+                        return owner.pid !== undefined ? { slow: row } : { lost: row };
                     return undefined;
                 };
+                // OBS-1172: a placement the driver HELD after an indeterminate split receipt has no slot here. While
+                // the reservation stays unresolved the loop keeps polling it — even with every worker slot busy — so
+                // a claim landing mid-task is seen. Once a live observer has claimed, the narrator is offered it
+                // again, backed off per claim (doubling from the poll cadence to MAX_HELD_OFFER_GAP_MS) but never
+                // exhausted: a listing that is unavailable or not yet showing the handle is retried until it proves
+                // the board or the run ends; only success latches (the slot). The driver adopts the proven pane —
+                // tracked from then on like any board — or keeps holding it, and never splits a second board over it.
+                // This spends no reopen: nothing was lost.
+                const adoptHeldBoard = async () => {
+                    heldRetry = false;
+                    const owner = readWatchBoard(repoRoot, runId);
+                    if (watchSlot || owner?.pane !== "" || owner.retired)
+                        return;
+                    heldRetry = true;
+                    if (owner.pid === undefined || !isPidLive(owner.pid))
+                        return; // unclaimed, or claimant dead: keep watching
+                    const id = `${owner.token}:${owner.pid}`;
+                    const now = Date.now();
+                    const offer = heldOffer?.id === id ? heldOffer : { id, gapMs: APPROVAL_POLL_MS, nextAt: now };
+                    if (now < offer.nextAt) {
+                        heldOffer = offer;
+                        return;
+                    }
+                    const adopted = await openBoard();
+                    if (adopted.ok) {
+                        heldOffer = undefined;
+                        heldRetry = false;
+                        journal.append("watch-board-adopted", undefined, { pane: adopted.slot.id });
+                        return;
+                    }
+                    heldOffer = { id, gapMs: Math.min(offer.gapMs * 2, MAX_HELD_OFFER_GAP_MS), nextAt: Date.now() + offer.gapMs };
+                };
                 const watchBoard = async () => {
-                    if (!boardOpened || boardless || !trackedDriver.narrator)
+                    if (boardless || !trackedDriver.narrator)
                         return;
-                    const loss = boardLoss();
-                    if (!loss) {
-                        journaledLoss = undefined;
+                    if (!boardOpened)
+                        return adoptHeldBoard();
+                    const health = boardHealth();
+                    if (health && "slow" in health) {
+                        const identity = `${health.slow.pane}:${health.slow.pid}`;
+                        if (identity !== journaledSlow) {
+                            journaledSlow = identity;
+                            journal.append("watch-board-slow", undefined, health.slow);
+                        }
                         return;
                     }
+                    journaledSlow = undefined;
+                    if (!health) {
+                        journaledLoss = undefined;
+                        return adoptHeldBoard();
+                    }
+                    const loss = health.lost;
                     const identity = `${loss.pane}:${loss.pid ?? ""}`;
                     if (identity !== journaledLoss) {
                         journaledLoss = identity;
@@ -2107,32 +2356,143 @@ export async function runDaemon(repoRoot, opts = {}) {
                     journal.append("watch-board-reopen-failed", undefined, { pane: loss.pane, attempt, error: reopened.error, ...(boardless ? { boardless: true } : {}) });
                     console.error(`tickmarkr: board not reopened (attempt ${attempt}): ${reopened.error}`);
                 };
-                // Context carries attribution through gates and remote inference; only shell commands acquire.
-                const commandLeases = new CommandLeases();
-                const withCommandContext = (taskId, run, signal = executionSignal()) => runWithCommandLease((_command, execute) => commandLeases.run(async () => {
-                    let lastCount = -1;
+                // Reference rows are the durable source of truth; old journals establish one on first resume.
+                const priorReference = opts.resume ? [...journal.read()].reverse().find(e => ["host-reference", "host-reference-reset"].includes(e.event)
+                    && typeof e.data.medianMs === "number" && Number.isFinite(e.data.medianMs) && e.data.medianMs > 0) : undefined;
+                let hostReferenceMs = priorReference?.data.medianMs;
+                const hostSignal = (signal) => AbortSignal.any([hostStop.signal, fatalStop.signal, signal, executionSignal()].filter((s) => !!s));
+                const trackHost = (promise) => {
+                    hostChecks.add(promise);
+                    void promise.finally(() => hostChecks.delete(promise)).catch(() => { });
+                    return promise;
+                };
+                const recordReference = (observation) => {
+                    if (observation.medianMs === null)
+                        return;
+                    journal.append("host-reference", undefined, { ...observation });
+                    hostReferenceMs = observation.medianMs;
+                };
+                // Health and occupancy share a deadline, but only healthy occupancy gets the bounded fallback.
+                const admitHost = async (taskId, signal, initial, resuming = false, gate, onWait) => {
                     const startedAt = Date.now();
+                    let lastCount = -1;
+                    let observation = initial;
+                    let first = true;
+                    let resetEligible = resuming && hostReferenceMs !== undefined;
                     for (;;) {
-                        signal?.throwIfAborted();
-                        fatalStop.signal.throwIfAborted();
-                        executionSignal()?.throwIfAborted();
+                        signal.throwIfAborted();
                         const count = await liveSuiteCount(repoRoot);
-                        if (count === 0)
-                            break;
-                        if (count !== lastCount)
-                            journal.append("suite-wait", taskId, { count });
+                        signal.throwIfAborted();
+                        const remaining = suiteWaitCeilingMs - (Date.now() - startedAt);
+                        // Reserve a full bounded batch. A partial last batch would manufacture an unreadable
+                        // host at an otherwise healthy occupancy deadline. Retain the latest complete observation.
+                        const probeBudget = HOST_PROBE_SAMPLE_MS * HOST_PROBE_SAMPLES;
+                        if (!observation || (!first && remaining >= probeBudget)) {
+                            observation = await observeHost(signal, remaining > 0 ? Math.min(probeBudget, remaining) : undefined);
+                            journal.append("host-observation", taskId, { ...observation, referenceMs: hostReferenceMs ?? null, resuming });
+                        }
+                        first = false;
+                        if (hostReferenceMs === undefined && observation.medianMs !== null)
+                            recordReference(observation);
+                        const degraded = hostDegraded(observation, hostReferenceMs);
+                        resetEligible &&= count === 0 && observation.medianMs !== null && degraded;
+                        if (!degraded && (count === 0 || resuming))
+                            return count;
+                        onWait?.();
+                        if (degraded)
+                            journal.append("host-degraded", taskId, {
+                                ...observation, referenceMs: hostReferenceMs ?? null, ...(gate ? { gate } : {}), count, waitedMs: Date.now() - startedAt,
+                            });
+                        else if (count !== lastCount)
+                            journal.append("suite-wait", taskId, { count, ...(gate ? { gate } : {}) });
                         lastCount = count;
                         if (Date.now() - startedAt >= suiteWaitCeilingMs) {
+                            if (degraded) {
+                                if (resetEligible) {
+                                    // Append BOTH medians before adoption. An unreadable sample or live suite vetoes reset.
+                                    journal.append("host-reference-reset", undefined, {
+                                        referenceMs: hostReferenceMs, medianMs: observation.medianMs, waitedMs: Date.now() - startedAt,
+                                    });
+                                    hostReferenceMs = observation.medianMs;
+                                    return count;
+                                }
+                                throw new HostDegradedError("host latency remained degraded or unreadable through suite-wait deadline");
+                            }
                             journal.append("suite-wait-ceiling", taskId, { count, waitedMs: Date.now() - startedAt });
-                            journal.append("suite-budget", taskId, {
-                                count, occupancyCap: occupancyCapacity.forkCap, conservativeCap: conservativeCapacity.forkCap,
-                            });
-                            return await runWithVerificationBudget(conservativeCapacity, execute);
+                            return count;
                         }
-                        await new Promise((wake) => setTimeout(wake, SUITE_POLL_MS));
+                        await new Promise((resolve, reject) => {
+                            const abort = () => { clearTimeout(timer); reject(signal.reason); };
+                            const timer = setTimeout(() => { signal.removeEventListener("abort", abort); resolve(); }, Math.min(SUITE_POLL_MS, Math.max(0, suiteWaitCeilingMs - (Date.now() - startedAt))));
+                            signal.addEventListener("abort", abort, { once: true });
+                            if (signal.aborted)
+                                abort();
+                        });
                     }
-                    return await execute();
-                }, (count) => journal.append("suite-wait", taskId, { count }), SUITE_POLL_MS, signal), run);
+                };
+                const initializeHost = () => trackHost((async () => {
+                    const signal = hostSignal();
+                    const observation = await observeHost(signal);
+                    journal.append("host-observation", undefined, { ...observation, referenceMs: hostReferenceMs ?? null, resuming: !!opts.resume });
+                    if (hostReferenceMs === undefined)
+                        recordReference(observation);
+                    if (opts.resume || observation.medianMs === null)
+                        await admitHost(undefined, signal, observation, !!opts.resume);
+                })());
+                // Context carries attribution through gates and remote inference; only shell commands acquire.
+                const commandLeases = new CommandLeases();
+                // Only an unambiguous, currently open phase can attribute a command wait. Parallel siblings
+                // deliberately leave gate absent; neither the last phase nor the last red is a safe substitute.
+                const activeGatePhases = new Map();
+                const withCommandContext = (taskId, run, signal = executionSignal()) => {
+                    let hostFailure;
+                    return runWithCommandLease((_command, execute) => {
+                        const active = taskId ? activeGatePhases.get(taskId) : undefined;
+                        const gate = active?.size === 1 ? [...active][0] : undefined;
+                        let waited = false;
+                        return commandLeases.run(async () => {
+                            if (hostFailure)
+                                throw hostFailure;
+                            let count;
+                            try {
+                                count = await trackHost(admitHost(taskId, hostSignal(signal), undefined, false, gate, () => { waited = true; }));
+                            }
+                            catch (error) {
+                                if (error instanceof HostDegradedError)
+                                    hostFailure = error;
+                                throw error;
+                            }
+                            if (waited && taskId) {
+                                if (gate)
+                                    journal.phaseStart(taskId, phaseForGate(gate), { gate, admitted: true });
+                                else
+                                    journal.append("suite-admitted", taskId, {});
+                            }
+                            if (count > 0) {
+                                journal.append("suite-budget", taskId, {
+                                    count, occupancyCap: occupancyCapacity.forkCap, conservativeCap: conservativeCapacity.forkCap,
+                                });
+                                return await runWithVerificationBudget(conservativeCapacity, execute);
+                            }
+                            return await execute();
+                        }, (count) => {
+                            waited = true;
+                            journal.append("suite-wait", taskId, { count, ...(gate ? { gate } : {}) });
+                        }, SUITE_POLL_MS, signal);
+                    }, async () => {
+                        try {
+                            const result = await run();
+                            // Some command oracles turn launch errors into results. Admission failure still parks infra.
+                            if (hostFailure)
+                                throw hostFailure;
+                            return result;
+                        }
+                        finally {
+                            if (taskId)
+                                activeGatePhases.delete(taskId);
+                        }
+                    });
+                };
                 let baseRef;
                 let baseline;
                 let baselinePending = false;
@@ -2220,7 +2580,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // journal.replayStatuses predates typed releases and re-pends even inert rows. Keep that
                     // legacy reader intact; scheduling accepts only the fold's recognised authorities.
                     const statuses = new Map();
-                    for (const e of replayEvents) {
+                    for (const e of effectiveEvents(replayEvents)) { // OBS-1178: a refused or unsound decision released nothing
                         if (!e.taskId)
                             continue;
                         if (e.event === "task-dispatch")
@@ -2264,6 +2624,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                     });
                     runStarted = true;
                     await placeBoard();
+                    // A terminal resume with no commands has no execution to admit.
+                    if (Object.keys(commands).length > 0 || graph.tasks.some(t => ["pending", "running", "gated"].includes(t.status))) {
+                        baselineCapture = initializeHost();
+                        void baselineCapture.catch(() => { baselineFailed = true; });
+                    }
                 }
                 else {
                     baseRef = await gitHead(repoRoot);
@@ -2273,7 +2638,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // Workers can run beside capture, but no gate may observe an absent or partial baseline.
                     // Keep publication and warnings inside the same barrier as the suite's final verdict.
                     baselineCapture = withCommandContext(undefined, async () => {
-                        const captured = await captureBaseline(repoRoot, commands);
+                        // With no commands, capture is already complete: persist it before the probe can wait.
+                        // Otherwise a kill during startup can strand a resumable run without baseline.json.
+                        const emptyCapture = Object.keys(commands).length === 0 ? await captureBaseline(repoRoot, commands) : undefined;
+                        if (emptyCapture)
+                            writeFileSync(join(journal.dir, "baseline.json"), JSON.stringify(emptyCapture, null, 2));
+                        await initializeHost();
+                        // OBS-1123: the capture's identity and publication time ride the measurement every forgiveness reads.
+                        const captured = { ...(emptyCapture ?? await captureBaseline(repoRoot, commands)),
+                            provenance: { baseRef, capturedAt: new Date().toISOString() } };
                         writeFileSync(join(journal.dir, "baseline.json"), JSON.stringify(captured, null, 2));
                         baseline = captured;
                         for (const warning of captured.warnings ?? [])
@@ -2337,16 +2710,29 @@ export async function runDaemon(repoRoot, opts = {}) {
                 // owns listing/parsing/closing. Cosmetic by contract: failures are swallowed and subprocess has no
                 // reconcile (optional chain → no-op), so gates and the oracle suite never feel this. keepPanes
                 // "forever" is the keep-everything debug override — it disables the sweep entirely.
-                const reconcile = async (opts) => {
+                const resuming = !!opts.resume;
+                const reconcile = async (sweep) => {
                     if (keepForever)
                         return;
                     try {
-                        const desired = desiredPanes(journal.read(), runId);
+                        const rows = journal.read();
+                        const desired = desiredPanes(rows, runId);
+                        // OBS-1109: an interrupted attempt's pane is evidence — its nonce-bound trailer decides whether
+                        // the attempt is harvested, declined as foreign, or recovered — so the fold's run-resume clear
+                        // must not reach it before harvestInterruptedAttempt has read it and reaped its processes. Once
+                        // that harvest (or a superseding dispatch) is journaled the fold no longer names it: swept then.
+                        // Only a resumed daemon can hold such an attempt: a fresh run's sweep is the baseline sweep.
+                        if (resuming)
+                            for (const t of graph.tasks) {
+                                const owned = interruptedAttempt(rows, t.id);
+                                if (owned?.launch)
+                                    desired.add(formatOwnedName({ role: "worker", taskId: t.id, attempt: owned.attempt, runId }));
+                            }
                         // The watch pane is never the DRIVER sweep's candidate (panesToClose spares role "watch":
                         // herdr's watches bookkeeping lives in close(), and a raw pane-close in the sweep would
                         // leave narrator() a stale cache) — the driver always sees it as desired; its lifecycle is
                         // decided here from the fold alone.
-                        await driver.reconcile?.(new Set([...desired, watchName]), runId, { ...opts, endedRunIds });
+                        await driver.reconcile?.(new Set([...desired, watchName]), runId, { ...sweep, endedRunIds });
                         // OBS-103: when the fold retires the watch (run-end boundary), close the narrator. The
                         // decision keys on the run identity in the pane name — narrator() adopts a prior daemon
                         // instance's pane under the same owned name, so a stop→resume cycle's leftover narrator
@@ -2436,6 +2822,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                     graph = setStatus(graph, t.id, "human");
                     saveGraph(repoRoot, graph);
                     journal.append("task-human", t.id, { ...details, reason, kind });
+                    // OBS-1178: the notice carries the park token an approval binds to (`approve --park <token>`).
+                    const parked = journal.newestBinding(t.id);
+                    const token = parked && bindingToken(parked);
                     if (assignment) {
                         // OBS-547: `metered` counts CHARGEABLE metered attempts, so an unchargeable dispatch passes 0 and
                         // the count is omitted rather than written as 0 or as `1` beside `attempts: 0` — a row claiming
@@ -2444,7 +2833,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         journal.telemetry({ taskId: t.id, shape: t.shape, adapter: assignment.adapter, model: assignment.model, channel: assignment.channel, attempts, outcome: "human", durationMs: Date.now() - startMs, parkKind: kind, gateFails, consults, tokens, meteredAttempts: tokens && metered ? metered : undefined, retryMode });
                     }
                     await reconcile({ spareLiveLlm: true }); // task-human is a terminal event — sweep, sparing sibling tasks' live LLM panes
-                    await driver.notify(`tickmarkr ${runId}: ${t.id} needs a human — ${reason}`, { tier: "attention" });
+                    await driver.notify(`tickmarkr ${runId}: ${t.id} needs a human — ${reason}${token ? `\npark ${token} — bind the decision with \`--park ${token}\`` : ""}`, { tier: "attention" });
                 };
                 // OBS-547: cross-reference a scope red against the prediction this run already computed. Every hard
                 // offender predicted ⇒ an AUTHORING defect whose repair is pre-written: journal the classification
@@ -2519,8 +2908,16 @@ export async function runDaemon(repoRoot, opts = {}) {
                     }
                     return false;
                 };
+                // OBS-1158: admission reads the same journal snapshot the sweep folded, through the shared seam.
+                let admissionPriority = batteryPriority(startupActions.values());
+                const admissible = () => readyTasks(graph, admissionPriority);
                 const sweepLiveApprovals = () => {
-                    const events = journal.read();
+                    let events = journal.read();
+                    if (events.slice(approvalSweepCursor).some((e) => e.event === "task-approved")) {
+                        refuseStaleApprovals();
+                        events = journal.read();
+                    }
+                    admissionPriority = batteryPriority(pendingDaemonApprovalActions(events).values());
                     const approvals = events.slice(approvalSweepCursor)
                         .filter((e) => e.event === "task-approved" && e.taskId);
                     approvalSweepCursor = events.length;
@@ -2589,10 +2986,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // old path. A preservation failure throws and therefore leaves the old checkout in place. The
                     // row is deliberately written before the later worktree-recreation row so the journal cannot
                     // describe only the commits it carried while omitting uncommitted work the removal destroyed.
+                    const producerNow = () => knownProducer(journal.read(), t.id);
                     const recreateTaskWorktree = async (taskBranch, taskBase, priorWt) => {
-                        const ref = await preserveWorktree(priorWt);
+                        const producer = producerNow();
+                        const ref = await preserveWorktree(priorWt, producer);
                         if (ref)
-                            journal.append("worktree-preserved", t.id, { ref });
+                            journal.append("worktree-preserved", t.id, { ref, ...producerFields(producer) });
                         return driver.worktree(repoRoot, taskBranch, taskBase);
                     };
                     // A dead worker with a clean checkout still needs a durable recovery handle: there may be no
@@ -2625,10 +3024,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // IS the fix; the tried seed and the attempt-loop start close RES-01/RES-02 alongside it.
                     //
                     // v1.24 OBS-18: a task-approved{release:attempt-cap} zeros rs.attempts (fresh budget) and clears
-                    // lastAssignment while keeping tried. Only restore lastAssignment when attempts > 0 — after a
+                    // lastAssignment while keeping tried, so the restore below is skipped — after a
                     // fresh-budget release, prefer nextChannel over the surviving tried-list so burned channels are
                     // not re-tried first (consult bans / prior failovers survive the release).
                     const rs = resume.get(t.id);
+                    let bootstrapExhausted;
                     const contentDigest = taskContentDigest(t);
                     const previousDispatch = journal.read().reverse().find((e) => e.taskId === t.id && e.event === "task-dispatch");
                     const recordedGraphPath = join(journal.dir, "graph.json");
@@ -2646,7 +3046,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                             to: channelKey(assignment),
                             reason: JSON.stringify(previousHints?.pin) !== JSON.stringify(t.routingHints?.pin) ? "pin changed" : "floor changed",
                         });
-                    if (!hintsChanged && rs?.lastAssignment && rs.attempts > 0
+                    // OBS-1161: no `attempts > 0` guard — every release already clears lastAssignment in the replay,
+                    // and a lastAssignment at zero attempts is a first dispatch whose capacity requeue was taken back:
+                    // the seat is still in force, so restore it instead of failing over its own tried[] entry early.
+                    if (!hintsChanged && rs?.lastAssignment
                         && channels.some((c) => channelKey(c) === channelKey(rs.lastAssignment))
                         && !demotedChannels.has(channelKey(rs.lastAssignment))) {
                         assignment = rs.lastAssignment; // restore the consult-chosen assignment (bypasses route()'s static re-pick)
@@ -2657,14 +3060,19 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // EXISTING nextChannel `tried` parameter — zero router changes (D-03).
                         // OBS-1034: a PIN is exempt — route() already returned it, and a review-upheld repair of the diff
                         // the pin produced belongs on the pin, not on the next seat its own tried[] entry would pick.
-                        const next = nextChannel(assignment, t, cfg, channels, rs.tried, profile, demotedChannels);
+                        // OBS-1169: an adapter a bootstrap failover escalated away from stays out, sibling or none.
+                        const escalatedOut = channels.filter((c) => rs.escalatedAdapters?.includes(c.adapter)).map(channelKey);
+                        const next = nextChannel(assignment, t, cfg, channels, [...rs.tried, ...Object.keys(rs.escalated ?? {}), ...escalatedOut], profile, demotedChannels);
                         if (next)
                             assignment = next;
                         // ponytail: nextChannel null (every channel already tried / none available) — keep the static
                         // assignment and proceed. Dispatching on a previously-tried channel beats deadlocking a resumed
                         // run; a park-instead policy can come later if it ever bites.
+                        // OBS-1169: …except onto an escalated adapter — that relaunches the broken bootstrap, so it parks infra below.
+                        else if (rs.escalatedAdapters?.includes(assignment.adapter))
+                            bootstrapExhausted = channelKey(assignment);
                     }
-                    const taskHistory = journal.read().filter((e) => e.taskId === t.id);
+                    const taskHistory = effectiveEvents(journal.read()).filter((e) => e.taskId === t.id); // OBS-1178: only an effective decision opens an engagement
                     // Lifetime identity counts every dispatch, including legacy and unchargeable rows. Releases
                     // reset the budget below, never this counter; observational annotations do not consume it.
                     let nextWorkerDispatchOrdinal = taskHistory.filter((e) => e.event === "task-dispatch").length;
@@ -2673,13 +3081,38 @@ export async function runDaemon(repoRoot, opts = {}) {
                     if (!hintsChanged && priorClimb && taskHistory.indexOf(priorClimb) > taskHistory.map((e) => e.event).lastIndexOf("task-dispatch")) {
                         const target = channels.find((c) => channelKey(c) === priorClimb.data.to && !demotedChannels.has(channelKey(c)));
                         if (target)
-                            assignment = { adapter: target.adapter, model: target.model, channel: target.channel, tier: target.tier };
+                            assignment = seatAssignment(target);
                     }
                     // pre-kill invariant: tried always contains the current assignment. Spread, never alias the
                     // journal-derived array (no hidden mutation of replayed state).
                     const tried = rs?.tried.length ? [...rs.tried] : [channelKey(assignment)];
                     if (!tried.includes(channelKey(assignment)))
                         tried.push(channelKey(assignment));
+                    // OBS-1169 add.1: channels excluded because their whole adapter was escalated away from ride
+                    // `tried` (nextChannel's one exclusion input) but were never launched — keep the true reason so
+                    // the dispatch row never labels an unlaunched sibling "already tried".
+                    const vendorEscalated = new Map();
+                    // …and a resume restores them with their reasons, apart from the channels actually dispatched.
+                    for (const [k, why] of Object.entries(rs?.escalated ?? {})) {
+                        if (tried.includes(k))
+                            continue;
+                        tried.push(k);
+                        vendorEscalated.set(k, why);
+                    }
+                    // OBS-1169 add.2: the ADAPTER exclusion itself, apart from any sibling channel — a single-channel
+                    // adapter has no untried sibling to carry it, yet its exhausted channel must stay out of the
+                    // recycle pool (and a resume's) until the release that clears `tried`.
+                    const escalatedAdapters = new Set(rs?.escalatedAdapters ?? []);
+                    const escalateAdapter = (adapter, reason) => {
+                        escalatedAdapters.add(adapter);
+                        for (const c of channels) {
+                            const k = channelKey(c);
+                            if (c.adapter !== adapter || tried.includes(k))
+                                continue;
+                            tried.push(k);
+                            vendorEscalated.set(k, reason);
+                        }
+                    };
                     // VIS-02 convention: absence = no seeding happened. The observable surface for criterion 2's
                     // exclusion-list-equality oracle. Daemon-side append only — no journal.ts write-path change (Phase 48
                     // stays unblocked); inert to replayStatuses (unknown events ignored, pinned at journal.test.ts:70-80).
@@ -2688,6 +3121,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                             attempts: rs.attempts, tried: [...tried], assignment,
                             workerDispatchOrdinal: previousDispatch?.data.workerDispatchOrdinal ?? null,
                         });
+                    if (bootstrapExhausted === channelKey(assignment)) { // a later tier-climb restore may have moved it off
+                        await park(t, `${bootstrapExhausted} failed at bootstrap and no eligible channel remains after resume`, "infra", assignment, rs?.attempts ?? 0, startMs, 0, 0, undefined, 0, "fresh", { cause: "bootstrap", channel: bootstrapExhausted });
+                        return;
+                    }
                     // Keep one live list: recovery retries must see exclusions added by onGate during the round.
                     const badReviewers = [...replayedReviewerExclusions];
                     const noteReviewEvent = (e) => {
@@ -2742,7 +3179,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // reviewer-exclusion list (badReviewers), never a second parallel counter. OBS-189: scoped to the
                     // current engagement — an operator approval (uphold or accept) resets the round budget, so an upheld
                     // task can dispatch its funded attempt instead of re-parking against the whole journal's history.
-                    const reviewRoundsDrawn = () => reviewRoundsSinceApproval(decisiveReviewRounds(journal.read()), t.id);
+                    const reviewRoundsDrawn = () => reviewRoundsSinceApproval(journal.read(), t.id, decisiveReviewRounds);
                     // OBS-193: journal the in-gate review retry (mirrors judge-retry) and exclude the flaked seat from
                     // later attempts' reviewer picks. One helper, called from both onGate sites (satisfied-gate + main).
                     const noteReviewRetry = (g) => {
@@ -2807,9 +3244,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 dirtyWorktree: true, dirtyPaths: g.meta.paths,
                                 ...(typeof g.meta.culprit === "string" ? { culprit: g.meta.culprit } : {}),
                                 ...(typeof g.meta.preservedRef === "string" ? { preservedRef: g.meta.preservedRef } : {}),
+                                ...(typeof g.meta.producer === "string" ? { producer: g.meta.producer } : {}),
+                                ...(typeof g.meta.producerAttempt === "number" ? { producerAttempt: g.meta.producerAttempt } : {}),
                             } : {}),
                             ...(cfg.executionPolicy && !g.pass ? { disposition: failureDisposition(g) } : {}),
-                            ...Object.fromEntries(["runnerInfraRerun", "hostStarvedRerun", "recoveryBlocked", "failingFiles", "selectionDecision", "failureEvidence"]
+                            ...Object.fromEntries(["runnerInfraRerun", "hostStarvedRerun", "recoveryBlocked", "failingFiles", "selectionDecision", "failureEvidence",
+                                "forgivenFingerprints", "freshFingerprints", "baselineProvenance"]
                                 .filter((key) => g.meta?.[key] !== undefined).map((key) => [key, g.meta[key]])),
                             // OBS-540: preserve terminal-vs-retryable infra exactly. normalizeGateOutcome deliberately
                             // defaults a legacy infra row to retryable, so dropping an explicit false here reverses the
@@ -2910,6 +3350,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                     const parallelPending = new Set();
                     let heldParallel;
                     const notePhaseStart = (e) => {
+                        const active = activeGatePhases.get(t.id) ?? new Set();
+                        active.add(e.gate);
+                        activeGatePhases.set(t.id, active);
                         if (e.parentAt !== undefined)
                             parallelPending.add(e.gate);
                     };
@@ -2929,7 +3372,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // OBS-254: RE-DERIVED from the journal here, at prompt-build time, rather than trusted to survive
                     // in resume state. The journal already holds the upheld review's bytes; no reset of attempt or
                     // channel state can take them away, on any path, including `resume --retry-failed`.
-                    const upheldFeedback = upheldFeedbackByTask(journal.read()).get(t.id) ?? rs?.upheldFeedback;
+                    const upheldFeedback = upheldFeedbackByTask(effectiveEvents(journal.read())).get(t.id) ?? rs?.upheldFeedback; // OBS-1178: a refused uphold funds no brief
                     const carriedEvidence = priorRunEvidence.findings
                         .filter((finding) => finding.taskId === t.id)
                         .map(formatPriorFindingEvidence)
@@ -2944,7 +3387,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         : "");
                     let ladderIdx = 0;
                     const engagementRows = () => {
-                        const rows = journal.read().filter((e) => e.taskId === t.id);
+                        const rows = effectiveEvents(journal.read()).filter((e) => e.taskId === t.id);
                         const approval = rows.map((e) => e.event).lastIndexOf("task-approved");
                         return rows.slice(approval + 1);
                     };
@@ -2976,7 +3419,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             if (c.tier === assignment.tier && channelKey(c) !== to)
                                 climbSkips.add(channelKey(c));
                         climbProvenance = `tier-escalated ${from} → ${to} (${cause})`;
-                        assignment = { adapter: next.adapter, model: next.model, channel: next.channel, tier: next.tier };
+                        assignment = seatAssignment(next);
                         tried.push(to);
                         return "climbed";
                     };
@@ -3010,6 +3453,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                         }
                         return next;
                     };
+                    // OBS-1161: capacity requeues (OBS-1169: and bootstrap retries) spent on a seat for this task since
+                    // its last operator release — journal-derived so the budget survives a resume instead of restarting.
+                    const requeuesOn = (event, channel) => {
+                        const rows = effectiveEvents(journal.read()).filter((e) => e.taskId === t.id);
+                        const since = rows.map((e) => e.event).lastIndexOf("task-approved");
+                        return rows.slice(since + 1).filter((e) => e.event === event && e.data.channel === channel).length;
+                    };
                     // OBS-202 (operator law: "you can spawn as many as you want"): channels are session FACTORIES,
                     // not consumed seats — a tried channel can always host a fresh worker session, and a fresh
                     // session carries none of the failed attempt's baggage. When the untried pool is empty, recycle
@@ -3021,15 +3471,20 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const next = failover(site);
                         if (next)
                             return next;
-                        const recycled = nextChannel(assignment, t, cfg, channels, [channelKey(assignment)], profile, demotedChannels)
+                        // OBS-1169: a vendor escalated away from stays out of the recycle pool until its release —
+                        // recycling any of its channels, launched or not, would launch the broken bootstrap again.
+                        const recycleExcluded = [channelKey(assignment), ...channels.filter((c) => escalatedAdapters.has(c.adapter)).map(channelKey)];
+                        const recycled = nextChannel(assignment, t, cfg, channels, recycleExcluded, profile, demotedChannels)
                             ?? (demotedChannels.has(channelKey(assignment)) ? null : assignment);
                         if (recycled)
                             journal.append("channel-recycle", t.id, { site, channel: channelKey(recycled) });
                         return recycled;
                     };
-                    const runConsult = (trigger, transcript, diffOrFeedback, gates) => {
+                    const runConsult = async (trigger, transcript, diffOrFeedback, gates) => {
                         consults++;
-                        return consult({
+                        // OBS-1182: every launched consult seat, failed ones included, rides the verdict into the journal.
+                        const invocations = [];
+                        const v = await consult({
                             taskId: t.id, trigger,
                             journalTail: JSON.stringify(journal.read().slice(-20)),
                             transcript: transcript.slice(-8000),
@@ -3038,7 +3493,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // D-07: consult panes self-clean when the verdict is read (keepLlm) — only "forever" keeps them.
                         // v1.54 T1: channels = this run's doctor-filtered live list — consult.prefer seat liveness
                         // is judged against it, never rebuilt from config (installed-but-unauthed seats would stall).
-                        { keep: keepLlm, onSlot: keepLlm ? (s) => keptSlots.push(s) : undefined, runId, channels: pools.consult });
+                        { keep: keepLlm, onSlot: keepLlm ? (s) => keptSlots.push(s) : undefined, onInvocation: (inv) => invocations.push(inv), runId, channels: pools.consult });
+                        // A lone answering seat is already the row's adapter/model/vendor/effort; the list is journaled
+                        // only when a seat failed, so the row never repeats itself and a failed seat never vanishes.
+                        return invocations.some((inv) => inv.outcome === "failed") ? { ...v, invocations } : v;
                     };
                     // returns true → continue attempting, false → task is terminal (parked)
                     // trigger (why the consult ran) is threaded in so the decompose/human park keeps its cause —
@@ -3047,9 +3505,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                         journal.append("consult-verdict", t.id, {
                             action: v.action, notes: v.notes,
                             adapter: v.adapter ?? "unknown", model: v.model ?? "unknown", vendor: v.vendor ?? "unknown",
+                            ...(v.effort ? { effort: v.effort } : {}),
                             ...(v.reason ? { reason: v.reason } : {}),
                             ...(v.guidance ? { guidance: v.guidance } : {}),
                             ...(v.excludeAdapter ? { excludeAdapter: v.excludeAdapter } : {}),
+                            ...(v.invocations?.length ? { invocations: v.invocations } : {}),
                         });
                         await driver.notify(`tickmarkr ${runId}: ${t.id} consult verdict: ${v.action}`, { tier: "attention" });
                         if (v.action === "retry") {
@@ -3069,15 +3529,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                             // nextChannel's existing tried parameter — zero router changes (D-03). Unknown adapter
                             // (zero matches) is a no-op expansion ⇒ ordinary channel-level reroute. Task-scoped:
                             // `tried` lives inside execTask, so a sibling task is unaffected.
-                            if (v.excludeAdapter) {
-                                for (const c of channels) {
-                                    if (c.adapter === v.excludeAdapter) {
-                                        const k = channelKey(c);
-                                        if (!tried.includes(k))
-                                            tried.push(k);
-                                    }
-                                }
-                            }
+                            if (v.excludeAdapter)
+                                escalateAdapter(v.excludeAdapter, `vendor escalated: consult excluded ${v.excludeAdapter}`);
                             const next = failoverOrRecycle("consult-reroute");
                             if (next) {
                                 assignment = next;
@@ -3098,7 +3551,117 @@ export async function runDaemon(repoRoot, opts = {}) {
                     let satisfiedGate = satisfiedGates.get(t.id);
                     const replayedGates = fundedRerun ? undefined : replayedGateResults.get(t.id);
                     const recheck = approvalAction?.authority === "battery";
-                    resumeGateReplay: if (satisfiedGate || replayedGates || recheck) {
+                    // OBS-1109: finished work is harvested, never redone — on resume too. A daemon that died while its
+                    // worker ran leaves an owned attempt between worker-launch and worker-result: its pane may hold the
+                    // attempt's own nonce-bound trailer, its branch the committed work. Only after the attempt's owned
+                    // processes are reaped is either read as its result — a matching trailer as the worker's claim,
+                    // commits without one as the same no-trailer evidence the live harvest synthesizes — and the gate
+                    // replay below then judges it under the PRODUCING attempt's author, with no new dispatch. An
+                    // unfinished attempt, a pane holding another attempt's trailer, or cleanup that cannot be proven
+                    // is declined onto the ordinary recovery path. A harvest an earlier resume recorded is gated again,
+                    // never recorded twice.
+                    const harvestInterruptedAttempt = async () => {
+                        const found = interruptedAttempt(journal.read(), t.id);
+                        if (!found || (!found.launch && !found.result))
+                            return found?.assignment;
+                        const { attempt } = found;
+                        const wt = worktreePath(repoRoot, `${branch}--${t.id}`);
+                        const recordHarvest = (commits, finished, summary) => journal.append("worker-result-harvested", t.id, {
+                            attempt, commits, summary: finished ? summary : HARVESTED_RESULT_SUMMARY, source: RESUME_HARVEST_SOURCE, trailer: finished,
+                        });
+                        // A declined attempt leaves the fold's spare (interruptedAttempt closes on this row), so its pane
+                        // is swept here, before the ordinary recovery path dispatches beside it — the baseline sweep, late.
+                        const decline = async (reason) => {
+                            journal.append("resume-harvest-declined", t.id, { attempt, reason });
+                            await reconcile({ spareLiveLlm: true });
+                            return undefined;
+                        };
+                        // Owned-process cleanup before any result is read as final: the attempt's own process group and
+                        // dispatch marker, reaped through the same reapWorker a live harvest uses. Uncertain is declined.
+                        const reapOwned = async (key, launch) => {
+                            workerOwners.set(key, { taskId: t.id, attempt, groupFile: `${launch.dispatchScript}.${launch.nonce}.pgid`,
+                                marker: launch.dispatchScript, identities: new Map(), descendants: new Map() });
+                            try {
+                                await reapWorker(key);
+                                return undefined;
+                            }
+                            catch (error) {
+                                return `owned-process cleanup uncertain: ${error instanceof Error ? error.message : String(error)}`;
+                            }
+                        };
+                        if (found.result) {
+                            // A daemon recorded this attempt's result, then died before its harvest row (a live daemon
+                            // before its no-trailer synthesis, or a resume between its two rows): finish that record from
+                            // the result it wrote — the pane is never re-read, the result never rewritten. A resume wrote
+                            // its result only after reaping; a live daemon writes it BEFORE handling a failed reap, so its
+                            // owned processes are reaped again here. A result that neither finished nor left commits has
+                            // nothing to gate: the ordinary recovery path owns it.
+                            if (!found.result.reaped) {
+                                if (!found.launch)
+                                    return decline("owned-process cleanup unproven: the launch recorded no ownership evidence");
+                                const uncertain = await reapOwned(found.launch.slot, found.launch);
+                                if (uncertain)
+                                    return decline(uncertain);
+                            }
+                            const commits = existsSync(wt) ? await commitsAheadOf(await integrationHead(intWt), wt) : [];
+                            if (!found.result.finished && commits.length === 0)
+                                return decline("unfinished");
+                            recordHarvest(commits, found.result.finished, found.result.summary);
+                            return found.assignment;
+                        }
+                        const launch = found.launch;
+                        const { nonce, slot } = launch;
+                        if (!existsSync(wt))
+                            return decline("task worktree missing");
+                        const adapter = adapters.find((a) => a.id === found.assignment.adapter);
+                        if (!adapter)
+                            return decline(`adapter ${found.assignment.adapter} unavailable to read the trailer`);
+                        // The journaled slot is read through THIS daemon's driver, a fresh instance since the last one
+                        // died. A pane the driver cannot read is DECLINED, never classified: an unreadable pane proves
+                        // neither a matching trailer nor the absence of a foreign one, so it is neither harvested nor
+                        // gated as trailerless evidence. A driver whose terminals outlive it (Orca) adopts the owned
+                        // terminal: bound only on ownership evidence — the journaled owned title AND the task checkout —
+                        // never a title alone. The journaled slot.id is NEVER trusted across daemon instances: a fresh
+                        // driver numbers its slots from one again, so an interrupted task's old id can name whatever
+                        // terminal THIS instance bound under that id (another task's adoption or allocation).
+                        // A driver with no read-only adoption is declined BEFORE anything is bound: slot() allocates —
+                        // herdr's reclaims the same-named pane (closing the evidence unread) and holds a dispatch lease
+                        // only run() releases — so it is never an adoption fallback; that driver keeps ordinary recovery.
+                        const adopt = driver.adopt;
+                        if (!adopt)
+                            return decline("no read-only adoption on this driver");
+                        let ownedSlot;
+                        let pane;
+                        try {
+                            ownedSlot = await adopt.call(driver, slot);
+                            pane = await driver.read(ownedSlot, PANE_READ_ROWS);
+                        }
+                        catch (error) {
+                            return decline(`pane unreadable: ${error instanceof Error ? error.message : String(error)}`);
+                        }
+                        const parsed = adapter.parse(pane, nonce);
+                        const finished = parsed.cause === undefined;
+                        const foreign = !finished && [...pane.matchAll(/TICKMARKR_RESULT_([0-9a-z]+)/g)]
+                            .some(([, other]) => other !== nonce && adapter.parse(pane, other).cause === undefined);
+                        if (foreign)
+                            return decline("foreign-nonce");
+                        const taskBase = await integrationHead(intWt);
+                        if (!finished && (await commitsAheadOf(taskBase, wt)).length === 0)
+                            return decline("unfinished");
+                        const uncertain = await reapOwned(ownedSlot, launch);
+                        if (uncertain)
+                            return decline(uncertain);
+                        const commits = await commitsAheadOf(taskBase, wt); // re-measured: the reaped writer is gone now
+                        // The source tag makes a death between these two rows recoverable: the next resume finishes the record.
+                        journal.append("worker-result", t.id, {
+                            ok: parsed.ok, summary: parsed.summary, deviations: parsed.deviations, finished, exitCode: null, attempt,
+                            source: RESUME_HARVEST_SOURCE, ...(parsed.cause ? { cause: parsed.cause } : {}),
+                        });
+                        recordHarvest(commits, finished, parsed.summary);
+                        return found.assignment;
+                    };
+                    const harvestAuthor = rs && !satisfiedGate && !replayedGates && !recheck ? await harvestInterruptedAttempt() : undefined;
+                    resumeGateReplay: if (satisfiedGate || replayedGates || recheck || harvestAuthor) {
                         const taskBase = await integrationHead(intWt);
                         taskBases.set(t.id, taskBase);
                         const taskBranch = `${branch}--${t.id}`;
@@ -3107,7 +3670,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // battery gates — read from the pending approval row, never re-selected here, so the tree
                         // approve counted and the tree the daemon gates are one and the same, checkout present or not.
                         const preservedRef = recheck
-                            ? [...journal.read()].reverse().find((e) => e.taskId === t.id && e.event === "task-approved" && e.data.release === RECHECK_RELEASE)?.data.recheckedRef
+                            ? effectiveEvents(journal.read()).reverse().find((e) => e.taskId === t.id && e.event === "task-approved" && e.data.release === RECHECK_RELEASE)?.data.recheckedRef
                             : undefined;
                         if (!existsSync(priorWt) && !preservedRef) {
                             if (satisfiedGate || recheck)
@@ -3119,14 +3682,16 @@ export async function runDaemon(repoRoot, opts = {}) {
                         }
                         const resumeReason = recheck
                             ? "operator recheck"
-                            : satisfiedGate
-                                ? `approved gate ${satisfiedGate}`
-                                : `recorded gates on ${replayedGates.commit.slice(0, 10)}`;
+                            : harvestAuthor
+                                ? "harvested interrupted attempt"
+                                : satisfiedGate
+                                    ? `approved gate ${satisfiedGate}`
+                                    : `recorded gates on ${replayedGates.commit.slice(0, 10)}`;
                         const priorTaskTip = preservedRef ? (await shGit(`git rev-parse ${shq(preservedRef)}`, repoRoot)).stdout.trim() : await gitHead(priorWt);
                         const priorTaskSubject = await gateCommitSubject(taskBase, priorTaskTip, preservedRef ? repoRoot : priorWt);
                         const commitsToCarry = preservedRef ? await commitsAheadOfRef(taskBase, priorTaskTip, repoRoot) : await commitsAheadOf(taskBase, priorWt);
                         const wt = await recreateTaskWorktree(taskBranch, taskBase, priorWt);
-                        const carriedCommits = await cherryPickCommits(wt, commitsToCarry);
+                        const { carried: carriedCommits, accounted: accountedCommits } = await cherryPickCommits(wt, commitsToCarry);
                         // Reuse is about the tree the gates will actually inspect. The integration tip may have moved
                         // while the daemon was down, so compare after recreating the task on today's taskBase rather
                         // than against the stale worktree whose task-only history cannot see newly merged dependencies.
@@ -3136,13 +3701,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                         if (recheck) {
                             satisfiedGate = journal.replaySatisfiedGates(new Map([[t.id, currentTaskSubject]])).get(t.id);
                         }
-                        journal.append("worktree-recreation", t.id, { attempted: commitsToCarry, carried: carriedCommits });
+                        journal.append("worktree-recreation", t.id, {
+                            attempted: commitsToCarry, carried: carriedCommits, ...(accountedCommits.length > 0 ? { accounted: accountedCommits } : {}),
+                        });
                         // OBS-212: same fail-closed rule as the dispatch path — but this path is worse, because it runs
                         // ONLY the gates after the approved one and then MERGES. T3 took it on run-20260728-110135:
                         // approved past review at 11:22, recreated at 12:50, and phase-start{gates} / phase-start{merge}
                         // landed in the same second with zero gate-result events. Work missing here is merged unverified.
                         {
-                            const present = new Set(carriedCommits);
+                            const present = new Set([...carriedCommits, ...accountedCommits]);
                             for (const h of commitsToCarry) {
                                 if (!present.has(h) && (await shGit(`git merge-base --is-ancestor ${shq(h)} HEAD`, wt)).code === 0) {
                                     present.add(h);
@@ -3182,7 +3749,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const parkedAuthor = recheck
                             ? [...journal.read()].reverse().find((e) => e.event === "task-dispatch" && e.taskId === t.id)?.data.assignment
                             : undefined;
-                        const gateAuthor = parkedAuthor ?? rs?.lastAssignment ?? assignment;
+                        // OBS-1109: a harvested attempt's author is read from the journal, not from this resume's path —
+                        // a later resume that replays the harvest's recorded gates still gates it under its producer.
+                        const gateAuthor = parkedAuthor ?? resumeHarvestAuthor(journal.read(), t.id) ?? rs?.lastAssignment ?? assignment;
                         const satisfiedIndex = satisfiedGate ? GATE_NAMES.indexOf(satisfiedGate) : -1;
                         // The serial pipeline could have at most one blocking result, so "everything after the
                         // approved gate" was enough. v1.85 can record both verdict siblings red in one round, and a
@@ -3211,6 +3780,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                         if (recheck) {
                             remainingGates = declaredGates.filter((gate) => gate !== satisfiedGate);
                         }
+                        else if (harvestAuthor) {
+                            remainingGates = declaredGates; // the harvested attempt was never gated: every declared gate runs
+                        }
                         else if (satisfiedGate) {
                             remainingGates = t.gates.filter((gate) => {
                                 if (gate === satisfiedGate)
@@ -3279,7 +3851,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             const startedAt = Date.now();
                             const provisioned = await withCommandContext(t.id, () => sh(commands.build, wt));
                             provisionedRow = {
-                                gate: "build", commit: !satisfiedGate && !recheck ? replayedGates.commit : currentTaskSubject,
+                                gate: "build", commit: !satisfiedGate && !recheck && replayedGates ? replayedGates.commit : currentTaskSubject,
                                 exitCode: provisioned.code, durationMs: Date.now() - startedAt,
                             };
                             if (provisioned.code !== 0 && satisfiedGate !== "build") {
@@ -3293,7 +3865,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         if (provisionedRow !== undefined)
                             journal.append("gate-provisioned", t.id, provisionedRow);
                         const resumedTask = { ...t, gates: remainingGates };
-                        const operatorContext = approvalReviewContext(journal.read(), t.id, true);
+                        const operatorContext = approvalReviewContext(journal.read(), t.id);
                         gateLoop: while (true) {
                             fatalStop.signal.throwIfAborted();
                             executionSignal()?.throwIfAborted();
@@ -3304,7 +3876,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // This suffix is re-measured to decide whether resume may advance, but the interrupted
                                 // attempt already paid for its red result. The next worker-backed round remains the next
                                 // deterministic-fingerprint occurrence/review round for budget accounting.
-                                ...(!satisfiedGate && !recheck ? { replayMeasurement: true } : {}),
+                                ...(!satisfiedGate && !recheck && !harvestAuthor ? { replayMeasurement: true } : {}),
                             };
                             if (recheck && satisfiedGate === "review" && gateSubject.commit !== currentTaskSubject) {
                                 satisfiedGate = undefined;
@@ -3318,6 +3890,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             journal.phaseStart(t.id, "gates");
                             const { results } = await withCommandContext(t.id, async () => runReviewRecovery(resumedTask, {
                                 carriedAuthors: await subjectAuthors(journal.read(), t.id, wt, taskBase),
+                                producer: producerNow(),
                                 carriedFindings: outstandingReviewFindings(journal.read(), t.id),
                                 operatorContext,
                                 worktree: wt, baseRef: taskBase, result: priorResult, author: gateAuthor,
@@ -3350,7 +3923,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         return;
                                     }
                                     const g = e.result;
-                                    classifySignalOnlyTest(g);
+                                    activeGatePhases.get(t.id)?.delete(e.gate);
+                                    classifyInfraResult(g);
                                     inParallelOrder(g.gate, () => {
                                         journalGateResult(g);
                                         noteReviewRetry(g);
@@ -3361,7 +3935,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     });
                                 },
                             }, false));
-                            results.forEach(classifySignalOnlyTest);
+                            results.forEach(classifyInfraResult);
                             if (pendingDaemonApprovalActions(journal.read()).get(t.id)?.authority === "battery") {
                                 journal.append("recheck-battery", t.id, {
                                     commit: gateSubject.commit,
@@ -3378,7 +3952,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     await park(t, gateFailApprovalReason(t.id, unavailableReview.details, true), "gate-fail", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
                                     return;
                                 }
-                                const infra = results.find((g) => g.meta?.infra === true);
+                                // OBS-1106: same predicate as classification — an infra replay is parked, never repaired.
+                                const infra = results.find((g) => gateFailed(g) && isInfraResult(g));
                                 if (infra) {
                                     await park(t, `${infra.gate}: ${infra.details}`, "infra", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
                                     return;
@@ -3417,7 +3992,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             await park(t, `recheck red: pinned ${pin.via}:${pin.model} is unavailable to host the repair — refusing the ladder`, "gate-fail", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
                                             return;
                                         }
-                                        assignment = { adapter: seat.adapter, model: seat.model, channel: seat.channel, tier: seat.tier };
+                                        assignment = seatAssignment(seat);
                                     }
                                     // Carry completeness was verified before this replay battery. Apply the ordinary
                                     // repair bounds here too; a restored red must fund the same findings-bearing dispatch.
@@ -3461,6 +4036,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             saveGraph(repoRoot, graph);
                             journal.append("task-done", t.id, {
                                 attempts: rs?.attempts ?? 0, assignment: gateAuthor, taskContentDigest: contentDigest,
+                                authors: mergedAuthors(await subjectAuthors(journal.read(), t.id, wt, taskBase)),
                             });
                             journal.append("merge", t.id, { branch: taskBranch, commit: await integrationHead(intWt) });
                             await trackedDriver.project?.(t.id, "completed");
@@ -3635,7 +4211,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 feedback = feedback ? `${feedback}\n\n${consultBrief}` : consultBrief;
                             }
                         }
-                        const scopeApproval = [...journaledSoFar].reverse().find((e) => e.taskId === t.id && (e.event === "task-approved" || e.event === "task-dispatch"));
+                        const scopeApproval = effectiveEvents(journaledSoFar).reverse().find((e) => e.taskId === t.id && (e.event === "task-approved" || e.event === "task-dispatch"));
                         retryMode = scopeApproval?.data.release === "scope-request" ? "fresh" : repairFindings
                             ? "repair"
                             : priorSession
@@ -3664,6 +4240,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // spends two frontier attempts re-deriving a known defect has to be able to answer afterwards.
                         fatalStop.signal.throwIfAborted();
                         const workerDispatchOrdinal = nextWorkerDispatchOrdinal++;
+                        vendorEscalated.delete(channelKey(assignment)); // dispatched now: from here on it IS tried
                         journal.append("task-dispatch", t.id, {
                             ...(scopeApproval?.data.release === "scope-request" ? { files: t.files, graphDefinitionHash: graphDefinitionHash(graph) } : {}),
                             assignment, attempt, workerDispatchOrdinal, provenance: dispatchProvenance([
@@ -3676,7 +4253,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 .filter((key) => key !== channelKey(assignment)).sort(),
                             exclusionReasons: Object.fromEntries([...new Set([...demotedChannels, ...tried, ...climbSkips])]
                                 .filter((key) => key !== channelKey(assignment))
-                                .map((key) => [key, demotedChannels.has(key) ? "demoted" : tried.includes(key) ? "already tried" : "tier climb skipped"])),
+                                .map((key) => [key, demotedChannels.has(key) ? "demoted"
+                                    : vendorEscalated.get(key) ?? (tried.includes(key) ? "already tried" : "tier climb skipped")])),
                             ...(outstandingFindings.length > 0 ? { carriedFindings: outstandingFindings } : {}),
                             ...(carriedConsultGuidance ? { carriedConsultGuidance } : {}),
                         });
@@ -3696,12 +4274,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // OBS-58: quota-failover and every retry recreate the task worktree from the integration tip —
                         // cherry-pick prior attempts' landed commits forward so a failover dispatch cannot silently
                         // orphan work a consult already verified as landed.
-                        let carriedCommits = [];
-                        if (commitsToCarry.length > 0) {
-                            carriedCommits = await cherryPickCommits(wt, commitsToCarry);
+                        const { carried: carriedCommits, accounted: accountedCommits } = commitsToCarry.length > 0
+                            ? await cherryPickCommits(wt, commitsToCarry) : { carried: [], accounted: [] };
+                        if (recreating) {
+                            journal.append("worktree-recreation", t.id, {
+                                attempted: commitsToCarry, carried: carriedCommits, ...(accountedCommits.length > 0 ? { accounted: accountedCommits } : {}),
+                            });
                         }
-                        if (recreating)
-                            journal.append("worktree-recreation", t.id, { attempted: commitsToCarry, carried: carriedCommits });
                         // T2 review (material): harvest eligibility is "does this WORKTREE carry unverified work",
                         // measured against taskBase — the same base the fast-kill's delta probe and the gates
                         // themselves use. It was measured against this attempt's post-carry HEAD, which excluded
@@ -3712,7 +4291,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // quota, dead-channel and provider-death all classify the PRE-HARVEST outcome below and fire
                         // BEFORE the synthesis, so carried-only work reaches gates without bypassing any failover.
                         const priorNamed = [...new Set([...commitsToCarry, ...carriedCommits])];
-                        const presentCommits = new Set(carriedCommits);
+                        const presentCommits = new Set([...carriedCommits, ...accountedCommits]);
                         for (const h of commitsToCarry) {
                             if (!presentCommits.has(h) && (await shGit(`git merge-base --is-ancestor ${shq(h)} HEAD`, wt)).code === 0) {
                                 presentCommits.add(h);
@@ -3828,9 +4407,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 sessionId, attempt, workerDispatchOrdinal, baselineBytes: resumeBaseline?.bytes ?? null,
                             });
                         const icmd = retryMode === "resume"
-                            ? adapter.resumeCommand(sessionId, promptFile, assignment.model)
+                            ? adapter.resumeCommand(sessionId, promptFile, assignment.model, assignment.effort)
                             : cfg.visibility.worker === "interactive" && driver.interactive
-                                ? adapter.interactiveCommand(promptFile, assignment.model)
+                                ? adapter.interactiveCommand(promptFile, assignment.model, assignment.effort)
                                 : null;
                         // v1.69 T6: adapters that declare interactiveSeed launch the real TUI and inject the prompt as a
                         // user turn; they do NOT need the argv-seeding surface that interactiveCommand represents.
@@ -3852,13 +4431,16 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // Approval can reset the attempt counter while the old pane remains retained.
                         // Its ownership claim must survive a new engagement reusing the script path.
                         const groupFile = `${dispatchScript}.${nonce}.pgid`;
-                        workerOwners.set(slot, { taskId: t.id, attempt, groupFile });
+                        workerOwners.set(slot, { taskId: t.id, attempt, groupFile, marker: dispatchScript, identities: new Map(), descendants: new Map() });
                         writeFileSync(dispatchScript, [
                             // Shell startup can swallow the driver's leading cd; the payload owns its checkout too.
                             `cd ${shq(wt)} || exit 1`,
+                            `export ${VITEST_CACHE_ENV}=${shq(worktreeVitestCache(wt))}`,
                             // A driver may launch inside the daemon's group. That group is never worker-owned.
                             `worker_pgid=$(ps -o pgid= -p $$ 2>/dev/null); daemon_pgid=$(ps -o pgid= -p ${process.pid} 2>/dev/null)`,
                             `if [ -n "$worker_pgid" ] && [ -n "$daemon_pgid" ] && [ "$worker_pgid" != "$daemon_pgid" ]; then printf '%s\\n' "$worker_pgid" > ${shq(groupFile)}; fi`,
+                            `ps -o sess= -p $$ > ${shq(`${groupFile}.session`)} 2>/dev/null`,
+                            `ps -o pid=,lstart= -p $PPID > ${shq(`${groupFile}.parent`)} 2>/dev/null`,
                             "export BASH_SILENCE_DEPRECATION_WARNING=1",
                             bannerShell(),
                             `printf '%s\\n' 'TICKMARKR_DISPATCH_${nonce}'`,
@@ -3888,6 +4470,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                             journal.append("worker-launch", t.id, {
                                 attempt,
                                 retryMode,
+                                // OBS-1109: the attempt's own ownership evidence, so a resumed daemon can harvest it.
+                                nonce, dispatchScript,
                                 ...(retryMode === "resume" ? { sessionId, workerDispatchOrdinal } : {}),
                                 driver: trackedDriver.id,
                                 slot: { ...slot },
@@ -3928,7 +4512,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             }
                             if (hasSeed || cpuAccountant !== undefined)
                                 return;
-                            cpuAccountant = new WorkerTreeCpuAccountant(dispatchScript, wt, () => readOwnedProcessGroup(groupFile));
+                            cpuAccountant = new WorkerTreeCpuAccountant(dispatchScript, wt, () => readOwnedProcessGroup(groupFile), workerOwners.get(slot).descendants);
                             await cpuAccountant.start();
                         };
                         const readCpuLeg = () => {
@@ -4024,15 +4608,49 @@ export async function runDaemon(repoRoot, opts = {}) {
                         let deadChannelKilled = false;
                         let hardTimedOut = false;
                         let quotaBannerKilled = false;
+                        let capacityBannerKilled = false; // OBS-1161: same banner filter and gates, transient outcome
                         let driverProbeFailed = false;
                         let heldLegs = [];
+                        // OBS-1108: contact uncertainty is LATCHED per owned slot and dispatch (this attempt's slot): one
+                        // row when contact is lost and one when it returns, never one per retry. Retries back off while
+                        // latched, and a latch held past its deadline throws into the transport-uncertain park, which
+                        // preserves the worktree for a recheck. A read that recovers inside the deadline charges nothing.
+                        let contactLost;
+                        const contactDeadlineMs = contactUnreadableDeadlineMs ?? taskTimeoutMinutes * 60_000;
                         const noteDriverUnreadable = (error) => {
                             if (error instanceof HeldProbeExhausted)
                                 throw error;
                             driverProbeFailed = true;
                             heldLegs = ["quota:driver-unreadable", "stall:driver-unreadable"];
-                            journal.append("contact-unreadable", t.id, { slot: slot.name, attempt, source: "driver", concludes: false,
-                                error: error instanceof Error ? error.message : String(error) });
+                            const message = error instanceof Error ? error.message : String(error);
+                            if (contactLost) {
+                                contactLost.retries++;
+                                const unreadableMs = Date.now() - contactLost.since;
+                                if (unreadableMs >= contactDeadlineMs) {
+                                    throw new ContactUnreadableExhausted(`contact with ${slot.name} unreadable for ${unreadableMs}ms, past its ${contactDeadlineMs}ms deadline, after ${contactLost.retries} retries: ${message}`);
+                                }
+                                return;
+                            }
+                            contactLost = { since: Date.now(), retries: 0 };
+                            journal.append("contact-unreadable", t.id, { slot: slot.name, attempt, source: "driver", state: "unreadable",
+                                concludes: false, deadlineMs: contactDeadlineMs, error: message });
+                        };
+                        const noteContactReadable = () => {
+                            if (!contactLost)
+                                return;
+                            journal.append("contact-recovered", t.id, { slot: slot.name, attempt, source: "driver", state: "readable",
+                                unreadableMs: Date.now() - contactLost.since, retries: contactLost.retries });
+                            contactLost = undefined;
+                        };
+                        // The pause after a slice whose contact probe failed. Unlatched: the unspent slice, at most 1 s.
+                        // Latched: a next-contact-at schedule of its own — doubling per retry, bounded by the contact and
+                        // hard deadlines and NEVER by the poll slice, which clamps to 100 ms once the stall clock expires
+                        // and would otherwise collapse the backoff into ~10 orca calls a second for the rest of the window.
+                        const contactPauseMs = (sliceStart, slice, hardDeadline) => {
+                            const now = Date.now();
+                            if (!contactLost)
+                                return Math.max(0, Math.min(slice - (now - sliceStart), CONTACT_BACKOFF_BASE_MS));
+                            return Math.max(1, Math.min(CONTACT_BACKOFF_BASE_MS * 2 ** Math.min(contactLost.retries, CONTACT_BACKOFF_DOUBLINGS), contactLost.since + contactDeadlineMs - now, hardDeadline - now));
                         };
                         // T2 review: print mode's "the exit marker appeared". Kept apart from `finished` (the
                         // trailer) but still needed by the keepPanes decision below, whose contract is about a
@@ -4042,7 +4660,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                         let startupFailure = false;
                         let startupEvidence;
                         const startupDetector = new StartupFailureDetector(adapter);
+                        // OBS-1169: bootstrap text is evidence only inside the same startup prefix — every sample below
+                        // feeds it, so a tool frame, an input box or a saturated read seen at ANY poll closes it for good.
+                        const bootstrapDetector = new StartupFailureDetector(adapter, BOOTSTRAP_FAILURE_RE, true);
                         const startupFailureInWindow = (text, launchedAt) => {
+                            bootstrapDetector.sample(text, launchedAt);
                             startupEvidence ??= startupDetector.sample(text, launchedAt);
                             return startupEvidence !== undefined;
                         };
@@ -4052,8 +4674,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                             ? new SettledTrailerTracker(adapter.busyFrameMarkers) : undefined;
                         const sampleTrailer = (frame) => {
                             const parsed = adapter.parse(frame, nonce);
-                            const trailer = new RegExp(trailerPattern(nonce)).test(frame)
-                                && parsed.summary !== NO_TRAILER_SUMMARY && parsed.summary !== UNPARSEABLE_TRAILER_SUMMARY;
+                            // OBS-1175: the parser's cause, never the summary — a parsed trailer may carry a sentinel string.
+                            const trailer = new RegExp(trailerPattern(nonce)).test(frame) && parsed.cause === undefined;
                             return trailerFrames ? trailerFrames.sample(frame, trailer) : trailer;
                         };
                         let seedResult;
@@ -4108,6 +4730,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                             await park(t, "escalation ladder exhausted", "ladder-exhausted", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
                             return false;
                         };
+                        // OBS-1169: the tree this worker receives — commits past it are this attempt's own work; the
+                        // carried ones beneath it are not, and must not make a bootstrap death look like work.
+                        const launchHead = await gitHead(wt);
                         try {
                             if (interactive) {
                                 // v1.2 interactive: the TUI doesn't exit on completion — the trailer is the finish line.
@@ -4155,7 +4780,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         return;
                                     }
                                     await noteLaunched();
-                                    output = await workerTransport.read(slot, PANE_READ_ROWS);
+                                    // OBS-1108: the first owned-slot read joins the contact latch — an unreadable launch read is
+                                    // retried by the wait loop below under the same deadline, never a task failure on its own.
+                                    output = await workerTransport.read(slot, PANE_READ_ROWS).catch((error) => { noteDriverUnreadable(error); return ""; });
                                 }
                                 // The returning paths report the same fact on the result; both callbacks land on the one
                                 // latch, and the second is a no-op. A seed that answered is never re-answered by the loop.
@@ -4242,7 +4869,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                                 await sampleContext(); // final poll-seam sample before leaving the wait
                                                 break;
                                             }
-                                            if (adapter.parse(output, nonce).summary === UNPARSEABLE_TRAILER_SUMMARY)
+                                            if (adapter.parse(output, nonce).cause === "malformed-verdict")
                                                 break;
                                             if (trailerFrames && new RegExp(trailerPattern(nonce)).test(output)) {
                                                 // A matching busy frame is still a live turn. Preserve the rolling progress budget.
@@ -4269,9 +4896,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                                 });
                                             }
                                             await armCpuLeg(true);
-                                            const spent = Date.now() - sliceStart;
-                                            if (spent < slice)
-                                                await new Promise((r) => setTimeout(r, Math.min(slice - spent, 1_000)));
+                                            await new Promise((r) => setTimeout(r, contactPauseMs(sliceStart, slice, hardDeadline)));
                                             continue;
                                         }
                                         // waitOutput is only a wake hint; a driver may miss a trailer already painted.
@@ -4284,14 +4909,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             await sampleContext();
                                             break;
                                         }
-                                        if (adapter.parse(paneText, nonce).summary === UNPARSEABLE_TRAILER_SUMMARY) {
+                                        if (adapter.parse(paneText, nonce).cause === "malformed-verdict") {
                                             output = paneText;
                                             break;
                                         }
                                         if (driverProbeFailed) {
-                                            const spent = Date.now() - sliceStart;
-                                            if (spent < slice)
-                                                await new Promise((resolve) => setTimeout(resolve, Math.min(slice - spent, 1_000)));
+                                            await new Promise((resolve) => setTimeout(resolve, contactPauseMs(sliceStart, slice, hardDeadline)));
                                             continue;
                                         }
                                         if (paneText.length > 0)
@@ -4352,19 +4975,32 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         // filtered by identity, never by novelty — a banner already on screen at launch
                                         // classifies exactly like one printed mid-attempt (T1 review: a novelty baseline
                                         // exculpated the launch-throttle case forever).
-                                        const bannerMatch = QUOTA_RE.exec(stallSnapshotBannerRows(paneText));
+                                        // OBS-1161: a transient-capacity banner rides the SAME filter, streak and silence gates,
+                                        // and concludes the attempt the same way — only its post-loop outcome differs (bounded
+                                        // requeue on this seat, then same-floor failover, never demotion). Quota wins a tie.
+                                        const bannerRows = stallSnapshotBannerRows(paneText);
+                                        const quotaBanner = QUOTA_RE.exec(bannerRows);
+                                        const bannerMatch = quotaBanner ?? CAPACITY_RE.exec(bannerRows);
                                         if (bannerMatch)
                                             quotaStreak++;
                                         else
                                             quotaStreak = 0;
-                                        if (bannerMatch && !stallProgress.rowSignalSaturated && !nudgeFailed
+                                        if (bannerMatch && !quotaBanner && !stallProgress.rowSignalSaturated && !nudgeFailed
+                                            && !(driver.nudge && NUDGEABLE_ADAPTERS.has(adapter.id) && (!nudged || nudgeDeadline !== undefined))
+                                            && readCpuLeg().state === "flat"
+                                            && quotaStreak >= 2 && sliceNow - lastProgressAt >= quotaBannerSilentMs) {
+                                            capacityBannerKilled = true;
+                                            journal.append("capacity-banner", t.id, { slot: slot.name, attempt, silentMs: sliceNow - lastProgressAt, matched: bannerMatch[0], excerpt: bannerMatch.input, regex: CAPACITY_RE.source });
+                                            break;
+                                        }
+                                        if (quotaBanner && !stallProgress.rowSignalSaturated && !nudgeFailed
                                             && !(driver.nudge && NUDGEABLE_ADAPTERS.has(adapter.id) && (!nudged || nudgeDeadline !== undefined))
                                             && readCpuLeg().state === "flat"
                                             && quotaStreak >= 2 && sliceNow - lastProgressAt >= quotaBannerSilentMs) {
                                             // no `output =` here: the post-loop no-trailer tail re-reads the pane anyway, so an
                                             // assignment would only split the classification read from the verdict read.
                                             quotaBannerKilled = true;
-                                            journal.append("quota-banner", t.id, { slot: slot.name, attempt, silentMs: sliceNow - lastProgressAt, matched: bannerMatch[0], excerpt: bannerMatch.input, regex: QUOTA_RE.source });
+                                            journal.append("quota-banner", t.id, { slot: slot.name, attempt, silentMs: sliceNow - lastProgressAt, matched: quotaBanner[0], excerpt: quotaBanner.input, regex: QUOTA_RE.source });
                                             break;
                                         }
                                         // T1 (OBS-262): the `paged` latch is deleted — status is sampled EVERY slice (and
@@ -4386,11 +5022,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                                                 });
                                             }
                                             await armCpuLeg(true);
-                                            const spent = Date.now() - sliceStart;
-                                            if (spent < slice)
-                                                await new Promise((r) => setTimeout(r, Math.min(slice - spent, 1_000)));
+                                            await new Promise((r) => setTimeout(r, contactPauseMs(sliceStart, slice, hardDeadline)));
                                             continue;
                                         }
+                                        // OBS-1108: every contact probe of this slice answered (a failed wait or read continues
+                                        // above), so only here — never after one probe while another stays latched — has contact returned.
+                                        noteContactReadable();
                                         if (st !== lastStatus) {
                                             lastStatus = st;
                                             journal.append("worker-status", t.id, { slot: slot.name, status: st, attempt });
@@ -4520,7 +5157,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             const ref = preservation.ref;
                                             const reason = `worker is unambiguously dead: pane absent, process tree empty, and worktree unchanged; preserved at ${ref}`;
                                             deadWorkerPark = { ref, reason };
-                                            journal.append("worktree-preserved", t.id, { ref });
+                                            journal.append("worktree-preserved", t.id, { ref, ...producerFields(producerNow()) });
                                             noteWorkerLiveness("worker-dead-held", {
                                                 slot: slot.name, attempt, reason: "unambiguous-worker-death", ref,
                                             });
@@ -4709,7 +5346,16 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         if (spent < slice)
                                             await new Promise((r) => setTimeout(r, Math.min(slice - spent, 1_000)));
                                     }
-                                    if (!finished && exitCode === null && adapter.parse(output, nonce).summary !== UNPARSEABLE_TRAILER_SUMMARY) {
+                                    // A wait that concludes on a clean slice's read (trailer, exit, startup failure) has contact back too.
+                                    if (!driverProbeFailed)
+                                        noteContactReadable();
+                                    if (!finished && exitCode === null && adapter.parse(output, nonce).cause !== "malformed-verdict") {
+                                        // OBS-1108: the hard deadline ended an attempt whose contact was still latched (its last
+                                        // probe failed). That is contact loss, not a stall: keep the one infra park and the preserved
+                                        // worktree instead of the hard-timeout classification and its repair charge.
+                                        if (contactLost && driverProbeFailed && Date.now() >= hardDeadline) {
+                                            throw new ContactUnreadableExhausted(`contact with ${slot.name} unreadable for ${Date.now() - contactLost.since}ms, still latched at the attempt's hard deadline after ${contactLost.retries} retries`);
+                                        }
                                         // timed out (or only ever saw false positives): harvest whatever the pane holds now
                                         hardTimedOut = Date.now() >= hardDeadline;
                                         timedOut ||= hardTimedOut;
@@ -4745,7 +5391,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         const maxSettleRetries = 2;
                                         let settleTries = 0;
                                         settleParsed = adapter.parse(output, nonce);
-                                        while (settleParsed.summary === UNPARSEABLE_TRAILER_SUMMARY && settleTries < maxSettleRetries) {
+                                        while (settleParsed.cause === "malformed-verdict" && settleTries < maxSettleRetries) {
                                             const remaining = settleDeadline - Date.now();
                                             if (remaining <= 0)
                                                 break;
@@ -4755,8 +5401,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             settleParsed = adapter.parse(output, nonce);
                                             settleTries++;
                                         }
-                                        if (settleParsed.summary !== UNPARSEABLE_TRAILER_SUMMARY) {
-                                            finished = settleParsed.summary !== NO_TRAILER_SUMMARY && (!trailerFrames || trailerFrames.settled);
+                                        if (settleParsed.cause !== "malformed-verdict") {
+                                            finished = settleParsed.cause === undefined && (!trailerFrames || trailerFrames.settled);
                                         }
                                     }
                                 }
@@ -4849,6 +5495,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                         finally {
                             await cpuAccountant?.stop();
                         }
+                        // OBS-1169: the final pane read decides, at exit, whether the prefix is still the CLI's own startup.
+                        const bootstrapEvidence = processExited ? bootstrapDetector.sample(output, workerLaunchedAt) : undefined;
                         // SPEND-01 interactive metering race: the harvest loop breaks on the trailer, but the worker
                         // shell may still be running post-trailer bookkeeping (session-store flush, fake usage stamp,
                         // exit wrapper). Print mode already waits for TICKMARKR_EXIT, which follows that tail; drain
@@ -4892,9 +5540,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                             try {
                                 await closeSlot(slot);
                                 if (!workerFinished) {
-                                    const ref = await preserveWorktree(wt);
+                                    const producer = producerNow();
+                                    const ref = await preserveWorktree(wt, producer);
                                     if (ref) {
-                                        journal.append("worktree-preserved", t.id, { ref });
+                                        journal.append("worktree-preserved", t.id, { ref, ...producerFields(producer) });
                                         reapedWorktreeRef = ref;
                                     }
                                     journal.append("worker-reaped-before-harvest", t.id, {
@@ -4910,6 +5559,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             }
                         }
                         else if (keepOpen && (workerFinished || processExited || driver.id !== "subprocess")) {
+                            await reapWorker(slot);
                             keptSlots.push(slot);
                             supersededWorkerSlot = slot;
                         }
@@ -4964,9 +5614,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                             stallReaps = stallSeat === seat ? stallReaps + 1 : 1;
                             stallSeat = seat;
                             if (stallReaps >= 2) {
-                                const ref = await preserveWorktree(wt);
+                                const producer = producerNow();
+                                const ref = await preserveWorktree(wt, producer);
                                 if (ref)
-                                    journal.append("worktree-preserved", t.id, { ref });
+                                    journal.append("worktree-preserved", t.id, { ref, ...producerFields(producer) });
                                 await park(t, `two consecutive stall reaps without a gate on seat ${seat}`, "stall", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode, { seat, stallReaps });
                                 return;
                             }
@@ -4975,6 +5626,58 @@ export async function runDaemon(repoRoot, opts = {}) {
                             stallReaps = 0;
                             stallSeat = undefined;
                         }
+                        // OBS-1169: a CLI that died in its own bootstrap never read the brief. Startup-owned evidence
+                        // (known bootstrap text in the startup prefix StartupFailureDetector owns: inside the window, before
+                        // any tool frame or input box, in an unsaturated read), and only when it exited nonzero with no
+                        // parsed trailer and no commit of its own: the carried commits
+                        // beneath launchHead are an earlier attempt's, and harvesting them would replay that attempt's
+                        // red as a second fingerprint occurrence. One same-channel retry after a bounded backoff charges
+                        // no attempt, repair or fingerprint; after that the whole adapter shares the broken bootstrap,
+                        // so its channels are escalated away from and the existing failover moves on or parks infra.
+                        const bootstrap = !workerFinished && exitCode !== null && exitCode !== 0 && bootstrapEvidence
+                            && (await commitsAheadOf(launchHead, wt)).length === 0 ? bootstrapEvidence.matchedBytes : undefined;
+                        if (bootstrap) {
+                            const from = channelKey(assignment);
+                            const retries = requeuesOn("bootstrap-retry", from);
+                            if (retries < BOOTSTRAP_RETRY_CAP) {
+                                journal.append("bootstrap-retry", t.id, {
+                                    attempt, retry: retries + 1, of: BOOTSTRAP_RETRY_CAP, channel: from, assignment,
+                                    matched: bootstrap, exitCode, backoffMs: bootstrapBackoffMs,
+                                });
+                                await new Promise((r) => setTimeout(r, bootstrapBackoffMs));
+                                attempt--;
+                                continue;
+                            }
+                            const reason = `vendor escalated: ${assignment.adapter} bootstrap failed on ${from}`;
+                            escalateAdapter(assignment.adapter, reason);
+                            const next = failover("bootstrap-failover");
+                            // `toAssignment` and `reason` let a resume replay this routing disposition, not only its refund.
+                            journal.append("bootstrap-failover", t.id, {
+                                from, to: next ? channelKey(next) : null, ...(next ? { toAssignment: next } : {}), matched: bootstrap, retries,
+                                escalated: [...vendorEscalated].filter(([, why]) => why === reason).map(([k]) => k), reason,
+                            });
+                            if (next) {
+                                await driver.notify(`tickmarkr ${runId}: ${t.id} bootstrap failover`, { tier: "attention" });
+                                if (!keepForever) {
+                                    const idx = keptSlots.indexOf(slot);
+                                    if (idx >= 0) {
+                                        keptSlots.splice(idx, 1);
+                                        try {
+                                            await closeSlot(slot);
+                                        }
+                                        catch { /* cosmetic — reconcile is the backstop */ }
+                                    }
+                                    if (supersededWorkerSlot === slot)
+                                        supersededWorkerSlot = undefined;
+                                }
+                                assignment = next;
+                                tried.push(channelKey(next));
+                                attempt--; // the dead bootstrap bought no worker turn
+                                continue;
+                            }
+                            await park(t, `${from} failed at bootstrap after ${retries} same-channel retry and no eligible channel remains`, "infra", assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode, { cause: "bootstrap", channel: from, retries });
+                            return;
+                        }
                         const preHarvestResult = result;
                         // T2 (OBS-264): recognize committed no-trailer work BEFORE any no-trailer streak, provider,
                         // quota or dead-channel routing. Gates never trusted the trailer, so this successful synthesis
@@ -5011,6 +5714,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const quotaMatch = (interactive ? !workerFinished : exitCode !== 0)
                             ? QUOTA_RE.exec(stallSnapshotBannerRows(output))
                             : null;
+                        // OBS-1161: transient capacity reads the SAME tail under the same guards — a live idle banner
+                        // and a no-trailer capacity exit classify identically — through the parse-boundary rule that a
+                        // parsed verdict (either way) is work, so a trailer QUOTING the phrase never lands here.
+                        const capacityMatch = !quotaMatch && (interactive ? !workerFinished : exitCode !== 0)
+                            ? classifyTransientCapacity({ ...preHarvestResult, raw: stallSnapshotBannerRows(output) })
+                            : null;
                         // Q-1: a graph pin is an operator instruction — a quota match ALONE never overrides it; only a
                         // channel-attributed error (auth/setup/outage/timeout, the typed dead-channel classes) may.
                         const pin = t.routingHints?.pin;
@@ -5021,7 +5730,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // demote the pin two tails in and the demotion re-dispatch would move the task off it.
                         if (preHarvestResult.ok && workerFinished)
                             noTrailerStreak.set(channelKey(assignment), 0);
-                        else if (!workerFinished && cause !== "provider-death" && !pinRefusesQuota) {
+                        else if (!workerFinished && cause !== "provider-death" && !pinRefusesQuota && !capacityMatch) {
                             const ck = channelKey(assignment);
                             const streak = (noTrailerStreak.get(ck) ?? 0) + 1;
                             noTrailerStreak.set(ck, streak);
@@ -5039,6 +5748,48 @@ export async function runDaemon(repoRoot, opts = {}) {
                             attempt--;
                             continue;
                         }
+                        // OBS-1161: transient capacity → bounded same-seat requeue with backoff (no attempt burn, no
+                        // consult), then a same-floor failover exactly like quota — but the seat is NEVER demoted or
+                        // excluded: it is busy, not dead, and a later task may find it free. The budget is read from
+                        // the journal, never a loop-local counter, so a resume continues the count it left off at.
+                        if (capacityMatch) {
+                            const from = channelKey(assignment);
+                            const requeues = requeuesOn("capacity-requeue", from);
+                            const source = capacityBannerKilled ? "banner" : "exit";
+                            if (requeues < CAPACITY_REQUEUE_CAP) {
+                                journal.append("capacity-requeue", t.id, {
+                                    attempt, requeue: requeues + 1, of: CAPACITY_REQUEUE_CAP, channel: from, assignment,
+                                    matched: capacityMatch[0], source, backoffMs: capacityBackoffMs,
+                                });
+                                await new Promise((r) => setTimeout(r, capacityBackoffMs));
+                                attempt--;
+                                continue;
+                            }
+                            const next = failover("capacity-failover");
+                            journal.append("capacity-failover", t.id, {
+                                from, to: next ? channelKey(next) : null, matched: capacityMatch[0], source, requeues, cause: "capacity",
+                            });
+                            if (next) {
+                                await driver.notify(`tickmarkr ${runId}: ${t.id} capacity failover`, { tier: "attention" });
+                                if (!keepForever) {
+                                    const idx = keptSlots.indexOf(slot);
+                                    if (idx >= 0) {
+                                        keptSlots.splice(idx, 1);
+                                        try {
+                                            await closeSlot(slot);
+                                        }
+                                        catch { /* cosmetic — reconcile is the backstop */ }
+                                    }
+                                    if (supersededWorkerSlot === slot)
+                                        supersededWorkerSlot = undefined;
+                                }
+                                assignment = next;
+                                tried.push(channelKey(next));
+                                continue;
+                            }
+                            await park(t, `capacity exhausted on ${from} after ${requeues} requeues and no eligible channel at floor`, "quota", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode, { cause: "capacity", channel: from, requeues });
+                            return;
+                        }
                         // quota exhaustion → failover within floor; does NOT consume the ladder (spec §4)
                         // print: guarded on exit code — exit-0 output that merely MENTIONS "rate limit" must not failover
                         // interactive: a worker-CLAIMED trailer beats quota mentions; without one, quota text fails over
@@ -5202,7 +5953,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 return;
                             }
                             const g = e.result;
-                            classifySignalOnlyTest(g);
+                            activeGatePhases.get(t.id)?.delete(e.gate);
+                            classifyInfraResult(g);
                             inParallelOrder(g.gate, () => {
                                 // GATE-09 (ROADMAP SC-4): journal every judge retry as an attributable event — which gate flaked,
                                 // which channel flaked, which channel retried — so `tickmarkr journal`/report can distinguish "judge
@@ -5258,6 +6010,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     meta: Object.fromEntries(Object.entries(data).filter(([key]) => !GATE_TELEMETRY_KEYS.includes(key) && key !== "capacity")),
                                 }));
                                 commits = await commitsAheadOf(taskBase, wt);
+                                // OBS-1106: a replayed legacy infra row lacking `infra` is re-classified before it is
+                                // re-journaled and before the infra park below reads it.
+                                results.forEach(classifyInfraResult);
                                 for (const g of results) {
                                     journal.append("gate-replayed", t.id, {
                                         attempt, priorAttempt: attempt - 1, gate: g.gate, commit: gateSubject.commit,
@@ -5270,6 +6025,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             else {
                                 ({ results, commits } = await withCommandContext(t.id, async () => runReviewRecovery(t, {
                                     carriedAuthors: await subjectAuthors(journal.read(), t.id, wt, taskBase),
+                                    producer: producerNow(),
                                     carriedFindings: outstandingFindings,
                                     operatorContext,
                                     worktree: wt, baseRef: taskBase, result, author: assignment,
@@ -5299,7 +6055,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     onGate,
                                 })));
                             }
-                            results.forEach(classifySignalOnlyTest);
+                            results.forEach(classifyInfraResult);
                             graph = addEvidence(graph, t.id, { commits, gateResults: results, artifacts: [promptFile] });
                             saveGraph(repoRoot, graph);
                             if (results.some((g) => g.gate === "test" && !g.pass
@@ -5336,6 +6092,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 saveGraph(repoRoot, graph);
                                 journal.append("task-done", t.id, {
                                     attempts: attempt + 1, assignment, taskContentDigest: contentDigest,
+                                    authors: mergedAuthors(await subjectAuthors(journal.read(), t.id, wt, taskBase)),
                                 });
                                 journal.append("merge", t.id, { branch: taskBranch, commit: await integrationHead(intWt) });
                                 await trackedDriver.project?.(t.id, "completed");
@@ -5369,7 +6126,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             await park(t, gateFailApprovalReason(t.id, unavailableReview.details, true), "gate-fail", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
                             return;
                         }
-                        const infraFailure = results.find((g) => gateFailed(g) && g.meta?.infra === true);
+                        const infraFailure = results.find((g) => gateFailed(g) && isInfraResult(g));
                         if (infraFailure) {
                             await park(t, `${infraFailure.gate}: ${infraFailure.details}${infraFailure.meta?.recoveryBlocked ? ` — ${infraFailure.meta.recoveryBlocked}` : ""}`, "infra", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
                             return;
@@ -5474,6 +6231,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                             journal.append("consult-verdict", t.id, {
                                 action: v.action, notes: v.notes,
                                 adapter: v.adapter ?? "unknown", model: v.model ?? "unknown", vendor: v.vendor ?? "unknown",
+                                ...(v.effort ? { effort: v.effort } : {}),
+                                ...(v.invocations?.length ? { invocations: v.invocations } : {}),
                                 capAdvisory: true,
                             });
                         }
@@ -5586,7 +6345,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                 const holdEndCondition = (closing = true) => {
                     sweepLiveApprovals();
                     const freeSlots = Math.max(0, concurrency - inflight.size);
-                    const dispatchable = readyTasks(graph).filter((t) => !inflight.has(t.id));
+                    const dispatchable = admissible().filter((t) => !inflight.has(t.id));
                     if (freeSlots === 0 || dispatchable.length === 0)
                         return false;
                     if (closing) {
@@ -5606,7 +6365,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             throw new Error(`terminated by ${termSignal}`);
                         await watchBoard();
                         sweepLiveApprovals();
-                        const ready = readyTasks(graph)
+                        const ready = admissible()
                             .filter((t) => !inflight.has(t.id))
                             .slice(0, Math.max(0, concurrency - inflight.size));
                         for (const t of ready) {
@@ -5627,9 +6386,14 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 if (fatalStop.signal.aborted)
                                     return;
                                 const cleanupEvidence = cleanupErrors.length ? { cleanupErrors } : {};
+                                if (err instanceof HostDegradedError) {
+                                    await park(t, err.message, "infra", null, 0, Date.now(), 0, 0, undefined, 0, "fresh", { disposition: "host-degraded", ...cleanupEvidence });
+                                    return;
+                                }
                                 if (err instanceof HeldProbeExhausted) {
                                     const wt = worktreePath(repoRoot, `${branch}--${t.id}`);
-                                    let ref = await withoutExecutionBudget(() => preserveWorktree(wt));
+                                    const producer = knownProducer(journal.read(), t.id);
+                                    let ref = await withoutExecutionBudget(() => preserveWorktree(wt, producer));
                                     if (!ref) {
                                         const head = await gitHead(wt);
                                         ref = `refs/tickmarkr/preserved/${head}`;
@@ -5637,15 +6401,16 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         if (saved.code !== 0)
                                             throw new Error(`could not preserve ${head}: ${saved.stderr}`);
                                     }
-                                    journal.append("worktree-preserved", t.id, { ref });
-                                    await park(t, err.message, "infra", null, 0, Date.now(), 0, 0, undefined, 0, "fresh", { disposition: "transport-uncertain", ref, ...cleanupEvidence });
+                                    journal.append("worktree-preserved", t.id, { ref, ...producerFields(producer) });
+                                    await park(t, err.message, "infra", null, 0, Date.now(), 0, 0, undefined, 0, "fresh", { disposition: err instanceof ContactUnreadableExhausted ? "contact-unreadable" : "transport-uncertain", ref, ...cleanupEvidence });
                                     return;
                                 }
                                 if (err instanceof ExecutionBudgetExceeded) {
                                     const wt = worktreePath(repoRoot, `${branch}--${t.id}`);
-                                    const ref = await preserveWorktree(wt);
+                                    const producer = knownProducer(journal.read(), t.id);
+                                    const ref = await preserveWorktree(wt, producer);
                                     if (ref)
-                                        journal.append("worktree-preserved", t.id, { ref });
+                                        journal.append("worktree-preserved", t.id, { ref, ...producerFields(producer) });
                                     const dispatch = journal.read().reverse().find((e) => e.taskId === t.id && e.event === "task-dispatch");
                                     await park(t, err.message, "infra", null, 0, Date.now(), 0, 0, undefined, 0, "fresh", { disposition: "execution-budget-exhausted", limitMs: cfg.executionPolicy.taskExecutionLimitMs,
                                         ...cleanupEvidence,
@@ -5679,7 +6444,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     journal.append("approval-window-start", undefined, { windowMs, parked: [...parked] });
                                     // The narrator may itself append a decision at this boundary.
                                     sweepLiveApprovals();
-                                    if (readyTasks(graph).length) {
+                                    if (admissible().length) {
                                         approvalDeadline = undefined;
                                         continue;
                                     }
@@ -5700,8 +6465,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const waiters = [...inflight.values(), aborted];
                         // A free slot is itself a scheduling boundary: poll the append-only approval stream instead of
                         // sleeping until an unrelated long-running task settles.
-                        // An open board is polled on the same cadence, so a dead cockpit is noticed mid-task.
-                        if (inflight.size < concurrency || boardOpened) {
+                        // An open board is polled on the same cadence, so a dead cockpit is noticed mid-task; so is a
+                        // held reservation still awaiting its claim or its adoption.
+                        if (inflight.size < concurrency || boardOpened || heldRetry) {
                             waiters.push(new Promise((wake) => setTimeout(wake, APPROVAL_POLL_MS)));
                         }
                         await Promise.race(waiters); // aborted rejects on termination — unwinds the run
@@ -5729,7 +6495,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                         pending: pendingTasks(graph).map((t) => t.id),
                     };
                     fatalPhase = "baseline";
-                    await baselineCapture; // also drain capture when every worker parks or fails before its gates
+                    await baselineCapture.catch(error => {
+                        // A host park is resumable only after baseline publication. Before that, retain the
+                        // fatal baseline failure: resume requires baseline.json and cannot recover this capture.
+                        if (!(error instanceof HostDegradedError) || !existsSync(join(journal.dir, "baseline.json")))
+                            throw error;
+                    });
                     fatalPhase = "tip-verify";
                     // OBS-34: post-merge integration-tip verify — strict exit codes, no baseline forgiveness.
                     const lastMergedTask = [...journal.read()].reverse().find((e) => e.event === "merge" && e.taskId)?.taskId;
@@ -5739,7 +6510,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const checkApprovals = () => {
                             try {
                                 sweepLiveApprovals();
-                                if (readyTasks(graph).length)
+                                if (admissible().length)
                                     controller.abort(cancellation);
                                 if (termSignal)
                                     controller.abort(new Error(`terminated by ${termSignal}`));
@@ -5803,6 +6574,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                     summary.approvalDisposition = outstanding.length === 0 ? "complete" : "outstanding";
                     if (outstanding.length > 0)
                         summary.outstandingApprovals = outstanding;
+                    const forgiven = forgivenFingerprints(journal.read());
+                    if (forgiven.length > 0)
+                        summary.forgiven = forgiven;
                     journal.append("run-end", undefined, { ...summary });
                     await reconcile(); // run-end boundary: nothing in flight — full sweep (empty desired set)
                     // OBS-28: lingering worktrees starve CLI probes; keepPanes:forever is the debug override.