tickmarkr 2.6.0 → 2.6.2

package/dist/run/git.d.ts

@@ -4,6 +4,18 @@ import { ROUTING_ENV_SEAMS } from "../route/router.js";
 export { ROUTING_ENV_SEAMS };
 export declare const FORK_CAP_ENV = "VITEST_MAX_FORKS";
 export declare const SUITE_PARENT_ENV = "TICKMARKR_SUITE_PARENT";
+/** OBS-1173 add.2: only ps's clean "no such process" (exit 1, nothing printed) means gone (""). A
+ *  timeout, a signal, a spawn error or any other exit is a FAILED probe (null) that says nothing. */
+export declare function classifyIdentityProbe(error: {
+    code?: number | string | null;
+    killed?: boolean;
+    signal?: string | null;
+} | null, stdout: string): string | null;
+/** `undefined` = the pid is gone; `null` = the probe failed and proves nothing (never gone, never a match). */
+export declare function processIdentity(pid: number): Promise<string | null | undefined>;
+export declare const activeShellIdentities: () => ReadonlyMap<number, string | undefined>;
+/** A process that started after its receipt is a pid reuse, never that receipt's child. */
+export declare function resolveActiveShellIdentities(): Promise<void>;
 export declare const DEFAULT_FORK_CAP = "6";
 /** Verification uses command leases; workers keep their concurrency budget. */
 export declare const runWithVerificationBudget: <T>(capacity: RunCapacity, fn: () => Promise<T>) => Promise<T>;
@@ -174,6 +186,23 @@ export declare function cleanupRunWorktrees(repo: string, branch: string, opts:
     removeTaskIds: string[];
 }): Promise<void>;
 export declare function resolveIntegrationBranch(_repo: string, branch: string): Promise<string>;
+/**
+ * The attempt whose worker last wrote in a checkout, or explicit "unknown" when no worker launch is
+ * on record for the current tree (gate-only recreations, standalone verify, legacy callers). The
+ * label is what the preserve commit trailer and every `worktree-preserved`/refusal row carry, so a
+ * preserved engine commit is never credited to whichever seat is dispatched next.
+ */
+export type PreserveProducer = {
+    channel: string;
+    attempt: number;
+} | "unknown";
+export declare const PRESERVE_PRODUCER_TRAILER = "Tickmarkr-Producer";
+/** Subject of every engine preserve commit; only such commits are owned by their preserve row. */
+export declare const PRESERVE_COMMIT_SUBJECT = "tickmarkr: preserve uncommitted worktree";
+export declare const producerFields: (producer: PreserveProducer | undefined) => {
+    producer: string;
+    producerAttempt?: number;
+};
 /**
  * Preserve the bytes an existing checkout holds before recreation removes it.
  *
@@ -188,7 +217,13 @@ export declare function resolveIntegrationBranch(_repo: string, branch: string):
  * neither a commit nor a ref, keeping meaningful deaths visible rather than minting one ref per
  * ordinary dispatch.
  */
-export declare function preserveWorktree(cwd: string): Promise<string | undefined>;
+export declare function preserveWorktree(cwd: string, producer?: PreserveProducer): Promise<string | undefined>;
+/**
+ * Identity of the physical checkout, including recreation at the same path. Unlike mtime/ctime,
+ * birthtime does not change when builds add outputs. Read from disk on every call so process
+ * restarts preserve reuse. Filesystems without birthtime cannot prove build-output continuity.
+ */
+export declare function checkoutIncarnation(worktree: string): string | undefined;
 export declare function createWorktree(repo: string, branch: string, baseRef: string): Promise<string>;
 export interface DependencyLink {
     /** Package link, relative to node_modules (including @scope/name). */
@@ -242,6 +277,14 @@ export type BaseContainment = {
  * future `git cherry` ever emitted a `-` line for a merge.
  */
 export declare function declaredBaseContainment(cwd: string, declaredRef: string, targetRef?: string): Promise<BaseContainment>;
+/**
+ * OBS-1107: does `dest` already hold everything `commit` changed? Replays the commit's OWN
+ * parent-to-commit change onto `dest` as a three-way merge; a clean merge whose tree IS `dest`'s tree
+ * brings nothing the destination lacks — a content-empty commit, or a patch already represented there
+ * under another hash. Content, never hash identity. Any git failure (a root commit, a git without
+ * `merge-tree --merge-base`) answers false: unproven work stays unaccounted.
+ */
+export declare function changeRepresented(cwd: string, commit: string, dest?: string): Promise<boolean>;
 export declare function removeWorktree(repo: string, dir: string): Promise<void>;
 export declare const REFS_PREFLIGHT_PREFIX = "refs/tickmarkr/preflight";
 export declare const REFS_PROBE_REMEDY = "run from the main repository or a full clone; a sandbox that denies writes under that path cannot host a run";

package/dist/run/git.js

@@ -1,7 +1,7 @@
 import { executionSignal } from "./execution-budget.js";
 import { commandLeaseEnvironment, withCommandLease } from "./lease.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { execFileSync, spawn } from "node:child_process";
+import { execFile, execFileSync, spawn } from "node:child_process";
 import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import { availableParallelism, homedir, tmpdir } from "node:os";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
@@ -16,6 +16,52 @@ export { ROUTING_ENV_SEAMS };
 // as argv (OBS-55) so child test oracles stay intact. The operator's own export wins.
 export const FORK_CAP_ENV = "VITEST_MAX_FORKS";
 export const SUITE_PARENT_ENV = "TICKMARKR_SUITE_PARENT";
+/** A pid is an address, not an identity. Keep this evidence out of ShellReceipt. */
+const linuxIdentity = (pid) => {
+    try {
+        const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+        const start = stat.slice(stat.lastIndexOf(")") + 2).split(/\s+/)[19];
+        return start && /^\d+$/.test(start) ? `${pid}:${start}` : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+/** OBS-1173 add.2: only ps's clean "no such process" (exit 1, nothing printed) means gone (""). A
+ *  timeout, a signal, a spawn error or any other exit is a FAILED probe (null) that says nothing. */
+export function classifyIdentityProbe(error, stdout) {
+    const start = stdout.trim().replace(/\s+/g, " ");
+    if (!error)
+        return start || null;
+    return !error.killed && !error.signal && error.code === 1 && !start ? "" : null;
+}
+/** `undefined` = the pid is gone; `null` = the probe failed and proves nothing (never gone, never a match). */
+export async function processIdentity(pid) {
+    if (process.platform === "linux")
+        return linuxIdentity(pid);
+    // Async and bounded like every other ps probe: a loaded host is slow, not unreadable.
+    const start = await new Promise((done) => execFile("ps", ["-p", String(pid), "-o", "lstart="], {
+        encoding: "utf8", timeout: 15_000, maxBuffer: 4096,
+    }, (error, stdout) => done(classifyIdentityProbe(error, stdout))));
+    if (start === null)
+        return null;
+    return start ? `${pid}:${start}` : undefined;
+}
+// Started receipts own these live pids; terminal receipts retire exactly that invocation. The
+// shell hot path never probes: Linux reads /proc in place, other hosts resolve on demand below.
+const activeShells = new Map();
+export const activeShellIdentities = () => new Map([...activeShells].map(([pid, live]) => [pid, live.identity ?? undefined]));
+/** A process that started after its receipt is a pid reuse, never that receipt's child. */
+export async function resolveActiveShellIdentities() {
+    await Promise.all([...activeShells].filter(([, live]) => live.identity === undefined).map(async ([pid, live]) => {
+        const identity = await processIdentity(pid);
+        if (identity === null)
+            return; // a failed probe resolves nothing; the next resolve retries
+        const started = identity ? Date.parse(identity.slice(identity.indexOf(":") + 1)) : NaN;
+        if (live.identity === undefined)
+            live.identity = identity && started <= live.startedMs + 1_000 ? identity : null;
+    }));
+}
 export const DEFAULT_FORK_CAP = "6";
 /** Worker concurrency is resolved once per run and isolated from other async runs. */
 const forkBudget = new AsyncLocalStorage();
@@ -217,6 +263,8 @@ export function shell(cmd, cwd, timeoutMs, login = false, options = {}) {
     let attribution;
     let confirmedStart = false;
     let terminal = false;
+    let activePid;
+    let activeInvocation;
     const begin = (invocation) => {
         attribution = options.receiptAttribution?.(invocation);
         confirmedStart = false;
@@ -225,10 +273,21 @@ export function shell(cmd, cwd, timeoutMs, login = false, options = {}) {
     const emit = (receipt) => {
         if (terminal)
             return;
-        if (receipt.outcome === "started")
+        if (receipt.outcome === "started") {
             confirmedStart = true;
-        else
+            activePid = receipt.pid;
+            if (activePid !== undefined) {
+                activeInvocation = Symbol("shell invocation");
+                activeShells.set(activePid, { startedMs: Date.now(), invocation: activeInvocation,
+                    ...(process.platform === "linux" ? { identity: linuxIdentity(activePid) ?? null } : {}) });
+            }
+        }
+        else {
             terminal = true;
+            if (activePid !== undefined && activeShells.get(activePid)?.invocation === activeInvocation)
+                activeShells.delete(activePid);
+            activePid = undefined;
+        }
         // Observational callbacks must not change process cleanup, retries or cancellation.
         try {
             options.onReceipt?.({ ...receipt, confirmedStart, ...(attribution ? { attribution: { ...attribution } } : {}) });
@@ -540,6 +599,14 @@ const resolveTaskBranch = async (repo, branch) => {
     const integration = await resolveIntegrationBranch(repo, branch.slice(0, split));
     return `${integration}${branch.slice(split)}`;
 };
+export const PRESERVE_PRODUCER_TRAILER = "Tickmarkr-Producer";
+/** Subject of every engine preserve commit; only such commits are owned by their preserve row. */
+export const PRESERVE_COMMIT_SUBJECT = "tickmarkr: preserve uncommitted worktree";
+export const producerFields = (producer) => producer && producer !== "unknown" ? { producer: producer.channel, producerAttempt: producer.attempt } : { producer: "unknown" };
+const producerLabel = (producer) => {
+    const f = producerFields(producer);
+    return f.producerAttempt === undefined ? f.producer : `${f.producer} attempt ${f.producerAttempt}`;
+};
 /**
  * Preserve the bytes an existing checkout holds before recreation removes it.
  *
@@ -554,7 +621,7 @@ const resolveTaskBranch = async (repo, branch) => {
  * neither a commit nor a ref, keeping meaningful deaths visible rather than minting one ref per
  * ordinary dispatch.
  */
-export async function preserveWorktree(cwd) {
+export async function preserveWorktree(cwd, producer = "unknown") {
     if (!existsSync(cwd))
         return undefined;
     const scratch = mkdtempSync(join(tmpdir(), "tickmarkr-preserve-index-"));
@@ -571,7 +638,7 @@ export async function preserveWorktree(cwd) {
         // not an authored project commit. Its HEAD parent makes the preserved tree directly inspectable.
         const identity = "GIT_AUTHOR_NAME=tickmarkr GIT_AUTHOR_EMAIL=tickmarkr@localhost "
             + "GIT_COMMITTER_NAME=tickmarkr GIT_COMMITTER_EMAIL=tickmarkr@localhost";
-        const commit = (await shGitOk(`${identity} git commit-tree ${shq(tree)} -p HEAD -m ${shq("tickmarkr: preserve uncommitted worktree")}`, cwd)).trim();
+        const commit = (await shGitOk(`${identity} git commit-tree ${shq(tree)} -p HEAD -m ${shq(PRESERVE_COMMIT_SUBJECT)} -m ${shq(`${PRESERVE_PRODUCER_TRAILER}: ${producerLabel(producer)}`)}`, cwd)).trim();
         const ref = `refs/tickmarkr/preserved/${commit}`;
         await shGitOk(`git update-ref ${shq(ref)} ${shq(commit)}`, cwd);
         return ref;
@@ -580,6 +647,23 @@ export async function preserveWorktree(cwd) {
         rmSync(scratch, { recursive: true, force: true });
     }
 }
+/**
+ * Identity of the physical checkout, including recreation at the same path. Unlike mtime/ctime,
+ * birthtime does not change when builds add outputs. Read from disk on every call so process
+ * restarts preserve reuse. Filesystems without birthtime cannot prove build-output continuity.
+ */
+export function checkoutIncarnation(worktree) {
+    try {
+        const root = realpathSync(worktree);
+        const stat = statSync(root, { bigint: true });
+        if (!stat.isDirectory() || stat.birthtimeNs <= 0n)
+            return undefined;
+        return `${root}:${stat.dev}:${stat.ino}:${stat.birthtimeNs}`;
+    }
+    catch {
+        return undefined;
+    }
+}
 export async function createWorktree(repo, branch, baseRef) {
     branch = await resolveTaskBranch(repo, branch);
     const dir = join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));
@@ -779,6 +863,20 @@ export async function declaredBaseContainment(cwd, declaredRef, targetRef = "HEA
     }
     return missing.length > 0 ? { result: "drifted", missing } : { result: "contained", via: "patch-id" };
 }
+/**
+ * OBS-1107: does `dest` already hold everything `commit` changed? Replays the commit's OWN
+ * parent-to-commit change onto `dest` as a three-way merge; a clean merge whose tree IS `dest`'s tree
+ * brings nothing the destination lacks — a content-empty commit, or a patch already represented there
+ * under another hash. Content, never hash identity. Any git failure (a root commit, a git without
+ * `merge-tree --merge-base`) answers false: unproven work stays unaccounted.
+ */
+export async function changeRepresented(cwd, commit, dest = "HEAD") {
+    const merged = await shGit(`git merge-tree --write-tree --merge-base=${shq(`${commit}^`)} ${shq(dest)} ${shq(commit)}`, cwd);
+    if (merged.code !== 0)
+        return false;
+    const tree = await shGit(`git rev-parse ${shq(`${dest}^{tree}`)}`, cwd);
+    return tree.code === 0 && merged.stdout.split("\n")[0].trim() === tree.stdout.trim();
+}
 export async function removeWorktree(repo, dir) {
     await shGit(`git worktree remove --force ${shq(dir)}`, repo); // best-effort; stale dirs are re-added with -B
     await shGit(`rm -rf ${shq(dir)}`, repo);

package/dist/run/host-health.d.ts

@@ -0,0 +1,20 @@
+import { spawn } from "node:child_process";
+export declare const HOST_PROBE_SAMPLES = 3;
+export declare const HOST_PROBE_SAMPLE_MS = 1000;
+export declare const HOST_LATENCY_FLOOR_MS = 50;
+export declare const HOST_LATENCY_RATIO = 3;
+export declare class HostDegradedError extends Error {
+}
+export declare const setHostProbeSpawnForTests: (fn: typeof spawn) => void;
+export declare const resetHostProbeSpawnForTests: () => void;
+declare const execLatency: (signal: AbortSignal, timeoutMs: number) => Promise<number | null>;
+export declare const setHostLatencySampleForTests: (fn: typeof execLatency) => void;
+export declare const resetHostLatencySampleForTests: () => void;
+export interface HostObservation {
+    samplesMs: Array<number | null>;
+    medianMs: number | null;
+}
+/** Three sequential samples, each bounded by 1s and the remaining observation budget. */
+export declare function observeHost(signal: AbortSignal, budgetMs?: number): Promise<HostObservation>;
+export declare const hostDegraded: (observation: HostObservation, referenceMs: number | undefined) => boolean;
+export {};

package/dist/run/host-health.js

@@ -0,0 +1,64 @@
+import { spawn } from "node:child_process";
+import { performance } from "node:perf_hooks";
+import { FILE_HANG_SLACK } from "../gates/test-manifest.js";
+export const HOST_PROBE_SAMPLES = 3;
+export const HOST_PROBE_SAMPLE_MS = 1_000;
+export const HOST_LATENCY_FLOOR_MS = 50;
+export const HOST_LATENCY_RATIO = FILE_HANG_SLACK;
+export class HostDegradedError extends Error {
+}
+// A probe owns just this child: no shell, descendants, inherited Node options, or host-wide kills.
+let probeSpawn = spawn;
+export const setHostProbeSpawnForTests = (fn) => { probeSpawn = fn; };
+export const resetHostProbeSpawnForTests = () => { probeSpawn = spawn; };
+const execLatency = (signal, timeoutMs) => new Promise((resolve, reject) => {
+    signal.throwIfAborted();
+    const start = performance.now();
+    const env = { ...process.env };
+    delete env.NODE_OPTIONS;
+    let child;
+    try {
+        child = probeSpawn(process.execPath, ["-e", ""], { stdio: "ignore", env });
+    }
+    catch {
+        resolve(null);
+        return;
+    }
+    let unreadable = false;
+    const retire = () => { unreadable = true; child.kill("SIGKILL"); };
+    const timer = setTimeout(retire, timeoutMs);
+    signal.addEventListener("abort", retire, { once: true });
+    child.once("error", () => { unreadable = true; });
+    // Resolve only after close: cancellation and timeout must reap the owned child before returning.
+    child.once("close", code => {
+        clearTimeout(timer);
+        signal.removeEventListener("abort", retire);
+        if (signal.aborted)
+            reject(signal.reason);
+        else {
+            const elapsed = performance.now() - start;
+            resolve(!unreadable && code === 0 && elapsed <= timeoutMs ? elapsed : null);
+        }
+    });
+    if (signal.aborted)
+        retire();
+});
+let sample = execLatency;
+export const setHostLatencySampleForTests = (fn) => { sample = fn; };
+export const resetHostLatencySampleForTests = () => { sample = execLatency; };
+/** Three sequential samples, each bounded by 1s and the remaining observation budget. */
+export async function observeHost(signal, budgetMs = HOST_PROBE_SAMPLES * HOST_PROBE_SAMPLE_MS) {
+    const deadline = performance.now() + budgetMs;
+    const samplesMs = [];
+    for (let i = 0; i < HOST_PROBE_SAMPLES; i++) {
+        signal.throwIfAborted();
+        const remaining = deadline - performance.now();
+        const value = remaining > 0 ? await sample(signal, Math.min(HOST_PROBE_SAMPLE_MS, remaining)) : null;
+        samplesMs.push(value !== null && Number.isFinite(value) && value > 0 ? value : null);
+    }
+    const medianMs = samplesMs.every((n) => n !== null)
+        ? [...samplesMs].sort((a, b) => a - b)[1] : null;
+    return { samplesMs, medianMs };
+}
+export const hostDegraded = (observation, referenceMs) => observation.medianMs === null || referenceMs === undefined
+    || observation.medianMs >= Math.max(HOST_LATENCY_FLOOR_MS, referenceMs * HOST_LATENCY_RATIO);

package/dist/run/journal.d.ts

@@ -18,6 +18,8 @@ export interface ResumeState {
     tried: string[];
     lastAssignment?: Assignment;
     upheldFeedback?: string;
+    escalated?: Record<string, string>;
+    escalatedAdapters?: string[];
 }
 export interface CurrentAttemptGateReplay {
     commit: string;
@@ -29,12 +31,70 @@ export declare const ATTEMPT_CAP_RELEASE: "attempt-cap";
 export declare const GATE_SATISFIED_RELEASE: "gate-satisfied";
 export declare const REVIEW_UPHELD_RELEASE: "review-upheld";
 export declare const RECHECK_RELEASE: "recheck";
+export declare const APPROVAL_REFUSED: "approval-refused";
+/** OBS-1178: the journal row a decision answers — its physical 1-based line plus its timestamp. */
+export interface DecisionBinding {
+    line: number;
+    ts: string;
+}
+/** The token every surface prints and `approve --park` accepts: `<line>@<ts>`. */
+export declare const bindingToken: (binding: DecisionBinding) => string;
+export declare function parseBindingToken(token: string): DecisionBinding | undefined;
+/** The binding a task-approved row recorded under `park` or `failure`, when well formed. */
+export declare function recordedBinding(value: unknown): DecisionBinding | undefined;
+/** The newest failed gate before a park row — the gate a waive of that park would satisfy. */
+export declare function failedGateBeforePark(events: readonly JournalEvent[], taskId: string, parkIndex: number): GateName | undefined;
+/** The physical journal line of `events[i]` (see SOURCE_LINE). */
+export declare const physicalLine: (events: readonly JournalEvent[], i: number) => number;
+/** A row parsed outside this module (a cockpit capture) names its own physical line to the decision fold. */
+export declare const withPhysicalLine: <T extends JournalEvent>(row: T, line: number) => T;
+/** OBS-1178: an approval neither enacted nor refused yet, and — when it may not be enacted — why. */
+export interface OpenDecision {
+    taskId: string;
+    line: number;
+    stale?: string;
+}
+/**
+ * OBS-1178: THE decision fold. Every reader of task-approved rows — the replay folds, the daemon's
+ * startup, sweep and pending-action folds, scope-amendment replay and its audits, status and both
+ * cockpits — reads decisions through it, so no two surfaces can disagree on whether one happened.
+ *
+ * `effective` holds the PHYSICAL lines of the task-approved rows whose effects may apply: a row that
+ * was sound when an enactment row consumed it (bound by line and timestamp to the task's newest park,
+ * a waive also to that park's failed gate, or a recheck to the newest failure with no park after it;
+ * a legacy row carrying no binding only when no park or failure landed between it and that
+ * enactment), plus a row still open that is sound NOW. A refused row is never effective, and neither is an open row that no
+ * longer binds — a newer park or failure landed, or it names none — whatever unrelated rows landed
+ * around it. An enactment row also consumes the task's park and failure: a decision naming either
+ * after the task moved on is stale, while the decisions that enactment already consumed stay effective.
+ * `open` lists every unenacted, unrefused row with why it may not be enacted, and `refused` the lines
+ * an approval-refused row answered.
+ */
+export declare function foldDecisions(events: readonly JournalEvent[]): {
+    effective: Set<number>;
+    open: OpenDecision[];
+    refused: Set<number>;
+};
+/** The physical lines of the task-approved rows whose effects may apply (see foldDecisions). */
+export declare const effectiveDecisions: (events: readonly JournalEvent[]) => Set<number>;
+/**
+ * The journal as every decision reader must see it: task-approved rows that are not effective removed,
+ * every other row (and its physical line) kept. Order-only folds iterate this instead of skipping rows
+ * on their own.
+ */
+export declare function effectiveEvents(events: readonly JournalEvent[]): JournalEvent[];
+/** Per task, the open decisions that may not be enacted now — what the daemon refuses before enactment. */
+export interface StaleApprovals {
+    reason: string;
+    lines: number[];
+}
+export declare function staleApprovals(events: readonly JournalEvent[]): Map<string, StaleApprovals>;
 export interface PreservedRef {
     ref: string;
     diffCommand: string;
 }
 export declare function preservedRefsByTask(events: JournalEvent[]): Map<string, PreservedRef[]>;
-export declare function reviewRoundsSinceApproval(events: JournalEvent[], taskId: string): number;
+export declare function reviewRoundsSinceApproval(events: JournalEvent[], taskId: string, rounds?: (decided: JournalEvent[]) => JournalEvent[]): number;
 export declare function upheldFeedbackByTask(events: JournalEvent[]): Map<string, string>;
 export interface StructuredFinding {
     class: string;
@@ -177,6 +237,7 @@ export type PendingApprovalAction = {
  * enacts it.
  */
 export declare function pendingApprovalActions(events: JournalEvent[]): Map<string, PendingApprovalAction>;
+export declare function approvalAction(taskId: string, e: JournalEvent): PendingApprovalAction;
 /**
  * Why the last attempt failed, one row per journaled cause, in the daemon's own `source: details`
  * shape. The daemon builds that brief in a loop-local variable, which dies with the process: a resumed
@@ -192,10 +253,20 @@ export declare function pendingApprovalActions(events: JournalEvent[]): Map<stri
  * failures OR the delivery failure that preceded it. Of the approvals, only a WAIVE clears (the operator
  * retired the findings by fiat — the uphold case re-derives its own brief separately). OBS-1074: a
  * plain approve, a scope grant or a recheck re-funds an attempt that must still see why the last one
- * parked, plus the operator's stated reason — v2.5.7's T11 looped four times on one hygiene oracle
- * because every approval erased exactly the finding the fresh attempt was funded to fix.
+ * parked — v2.5.7's T11 looped four times on one hygiene oracle because every approval erased exactly
+ * the finding the fresh attempt was funded to fix. The operator's stated reasons ride after those rows
+ * as `standingRulings` (OBS-1150): no launch and no waive resets them.
  */
 export declare function journaledFailureBrief(events: JournalEvent[], taskId: string): string[];
+/**
+ * OBS-1150: an operator's approval reason is a ruling on the TASK, not on the attempt it released.
+ * The failure rows above are spent at the next worker-launch and the review context once bound only
+ * the newest reason, so ruling A vanished at the first launch after it and a later ruling B replaced
+ * it. Every effective reason therefore stands, oldest first, for the whole run; a repeat is carried
+ * once. A gate-satisfied release accepts a gate's verdict rather than ruling on the work, so its
+ * reason adds no standing ruling — and, being no ruling, it retires none either.
+ */
+export declare function standingRulings(events: JournalEvent[], taskId: string): string[];
 /** Never infer a cross-path alias from a symbol, sentence, or hash. */
 export declare function reviewFingerprintMatches(candidate: unknown, fingerprint: string): boolean;
 export declare function observedReviewFingerprints(finding: StructuredFinding): string[];
@@ -256,6 +327,32 @@ export type WorkerResultCause = (typeof WORKER_RESULT_CAUSES)[number];
 export declare function isQualityFailureParkKind(kind: ParkKind): boolean;
 export declare function classifyTaskFailure(taskEvents: JournalEvent[]): ParkKind;
 export declare function recordedTaskFailureKind(events: JournalEvent[], taskId: string): ParkKind | undefined;
+export declare const RESUME_HARVEST_SOURCE: "resume";
+export interface InterruptedAttempt {
+    attempt: number;
+    /** The producing dispatch's own assignment — the author the harvested work is gated under. */
+    assignment: Assignment;
+    /** Owned evidence still to read: nothing of this attempt's harvest is recorded yet. */
+    launch?: {
+        nonce: string;
+        dispatchScript: string;
+        slot: {
+            id: string;
+            name: string;
+            cwd: string;
+        };
+    };
+    /** A worker-result with no harvest row after it: finish that record. `reaped` only when a resume wrote
+     *  it — a resume records the result after its owned-process cleanup; a live daemon records it BEFORE
+     *  handling a failed reap, so its result alone never proves cleanup and `launch` must be reaped again. */
+    result?: {
+        finished: boolean;
+        summary: string;
+        reaped: boolean;
+    };
+}
+export declare function resumeHarvestAuthor(events: JournalEvent[], taskId: string): Assignment | undefined;
+export declare function interruptedAttempt(events: JournalEvent[], taskId: string): InterruptedAttempt | undefined;
 export declare function runHasEnded(events: JournalEvent[]): boolean;
 /** OBS-53: classify worker-result failures so retries and routing see the true signal, not one lumped bucket. */
 export declare function classifyWorkerResultCause(opts: {
@@ -392,6 +489,8 @@ export type EngagementCompare = {
 export declare function engagementComparable(events: JournalEvent[], loadedHash: string): EngagementCompare;
 export declare function newRunId(now?: Date): string;
 export declare function parseRunId(runId: string): string;
+/** The journal reader rule over bytes in hand: skip blanks, drop a torn line, keep each row's physical line. */
+export declare function parseJournalText(raw: string): JournalEvent[];
 export declare function readAllTelemetry(repoRoot: string, lastK: number, opts?: {
     after?: string;
 }): (TelemetryRow & {
@@ -402,6 +501,23 @@ export declare const PRIOR_JOURNAL_RUN_WINDOW = 50;
 export declare function readPriorRunEvidence(repoRoot: string, tasks: readonly Pick<Task, "id" | "goal" | "files" | "acceptance">[], opts?: {
     suppressRunId?: string;
 }): PriorRunEvidence;
+export declare const REVIEW_NO_VERDICT_RUN_WINDOW = 10;
+export declare const REVIEW_NO_VERDICT_ADVISORY_AT = 2;
+export interface ReviewNoVerdictHistory {
+    /** completed runs measured, oldest first */
+    runs: string[];
+    /** window journals with a row that did not parse — their events are unknown, never zero */
+    unreadable: string[];
+    /** reviewer channel → review-no-verdict events; every channel seen reviewing is present, 0 included */
+    counts: Map<string, number>;
+}
+export declare function readReviewNoVerdictHistory(repoRoot: string, window?: number): ReviewNoVerdictHistory;
+/** One row per measured channel (plus one naming unreadable journals); doctor prints all, Fleet the warn rows. */
+export declare function reviewNoVerdictRows(history: ReviewNoVerdictHistory): {
+    channel: string;
+    verdict: "pass" | "warn";
+    value: string;
+}[];
 export declare function readProfileCursor(repoRoot: string): string | undefined;
 export declare function profileDiscountsPath(repoRoot: string): string;
 export declare function readProfileDiscounts(repoRoot: string): ProfileDiscount[];
@@ -424,6 +540,13 @@ export declare class Journal {
     append(event: string, taskId?: string, data?: Record<string, unknown>): void;
     phaseStart(taskId: string, phase: TaskPhase, data?: Record<string, unknown>): void;
     read(): JournalEvent[];
+    /** Parsed rows paired with their physical 1-based journal lines (OBS-1178 bindings name lines). */
+    readSourced(): {
+        events: JournalEvent[];
+        lines: number[];
+    };
+    /** OBS-1178: the binding of a task's newest park (or `task-failed`) row — what a decision on it names. */
+    newestBinding(taskId: string, event?: "task-human" | "task-failed"): DecisionBinding | undefined;
     readTracked(): TrackedJournalRow[];
     replayStatuses(): Map<string, TaskStatus>;
     /**