tickmarkr 2.6.1 → 2.6.3

package/dist/run/daemon.js

@@ -1,5 +1,5 @@
 import { HOST_PROBE_SAMPLE_MS, HOST_PROBE_SAMPLES, HostDegradedError, hostDegraded, observeHost } from "./host-health.js";
-import { VITEST_CACHE_ENV, worktreeVitestCache } from "../gates/test-manifest.js";
+import { runWithInterruptionSink, VITEST_CACHE_ENV, worktreeVitestCache } from "../gates/test-manifest.js";
 import { COMMAND_LEASE_TOKEN_ENV, commandLeaseEnvironment, CommandLeases, currentCommandLeaseToken, isRunnerCommand, runWithCommandLease, withCommandLease } from "./lease.js";
 import { execFileSync, spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
@@ -10,7 +10,7 @@ import { tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { stringify } from "yaml";
-import { classifyDeadChannel, classifyTransientCapacity, NO_TRAILER_SUMMARY, trailerPattern, UNPARSEABLE_TRAILER_SUMMARY, writePrompt } from "../adapters/prompt.js";
+import { BOOTSTRAP_FAILURE_RE, classifyDeadChannel, classifyTransientCapacity, trailerPattern, writePrompt } from "../adapters/prompt.js";
 import { allAdapters, getAdapter, probeAll, readDoctor, rolePools } from "../adapters/registry.js";
 import { SettledTrailerTracker, addUsage, CAPACITY_RE, channelKey, matchesInputBox, matchesTrustDialog, QUOTA_RE } from "../adapters/types.js";
 import { bannerShell, paneDispatchCommand } from "../brand.js";
@@ -21,7 +21,7 @@ import { driverEvidence } from "../drivers/index.js";
 import { herdrSealShellPrefix, MAX_BUF, SubprocessDriver } from "../drivers/subprocess.js";
 import { formatOwnedName } from "../drivers/types.js";
 import { captureBaseline, detectGateCommands, detectVacuousOracles } from "../gates/baseline.js";
-import { runGates } from "../gates/run-gates.js";
+import { reobserveTestFiles, runGates } from "../gates/run-gates.js";
 import { isInfraResult } from "../gates/cache.js";
 import { filesGlob } from "../graph/files-glob.js";
 import { addEvidence, attributeBlocked, batteryPriority, blockedTasks, getTask, graphDefinitionHash, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus, taskContentDigest, tickmarkrDir } from "../graph/graph.js";
@@ -29,19 +29,19 @@ import { GATE_NAMES } from "../graph/schema.js";
 import { distFingerprint } from "../cli/commands/version.js";
 import { augmentRetryBrief, consult, renderRetryGuidance } from "./consult.js";
 import { executionSignal, remainingExecutionMs, withExecutionBudget, withoutExecutionBudget, ExecutionBudgetExceeded } from "./execution-budget.js";
-import { repairSelectionDecision } from "./repair-selection.js";
+import { repairSelectionDecision, repairSelectionEnabled } from "./repair-selection.js";
 import { failureDisposition, reserveInfrastructureRetry } from "./recovery.js";
 import { runEnvironment } from "./environment.js";
-import { cleanupRunWorktrees, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER, preserveWorktree, producerFields, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shGit, SUITE_PARENT_ENV, verificationProtocol, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
+import { changeRepresented, cleanupRunWorktrees, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER, preserveWorktree, producerFields, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shGit, SUITE_PARENT_ENV, verificationProtocol, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
 import { classifyRepairDisposition, resolveScopeHints } from "./repair-disposition.js";
-import { applyScopeAmendments, activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, outstandingReviewFindings, pendingApprovalActions, pendingRechecks, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
-import { gateReviewerFloor, isDiffCapPark, pickReviewer } from "../gates/review.js";
+import { applyScopeAmendments, activeRetryBan, interruptedAttempt, RESUME_HARVEST_SOURCE, resumeHarvestAuthor, approvalAction, APPROVAL_REFUSED, bindingToken, effectiveEvents, foldDecisions, physicalLine, staleApprovals, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, readableExcerpt, receiptOrigin, outstandingReviewFindings, pendingApprovalActions, pendingRechecks, pendingRepairFindings, phaseForGate, priorJudgments, readPriorRunEvidence, recordedTaskFailureKind, reraisedReviewChains, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, standingRulings, structuredFindings, upheldFeedbackByTask } from "./journal.js";
+import { gateReviewerFloor, isDiffCapPark, isGarbageReview, pickReviewer } from "../gates/review.js";
 import { acquireApprovalSerialization, acquireRunLock, isPidLive, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, reusedTipEvidence, verifyIntegrationTip } from "./merge.js";
-import { climbChannel, marginalCostRank, nextChannel, route } from "../route/router.js";
+import { climbChannel, inTaskPool, marginalCostRank, nextChannel, poolExhaustion, route, taskPool } from "../route/router.js";
 import { desiredPanes } from "./reconcile.js";
-import { readTierLiveness, readWatchBoard, supervisionBeatPath } from "./supervision.js";
+import { readTierLiveness, readWatchBoard, supervisionPresencePath } from "./supervision.js";
 import { harvestCpuFlatWindowMs, NUDGEABLE_ADAPTERS, PANE_READ_ROWS, StallProgressTracker, stallSnapshotBannerRows, WorkerTreeCpuAccountant, reapOwnedProcessGroup, readOwnedProcessGroup, } from "./stall.js";
 // The live set is also the ownership claim shared by task cleanup and termination.
 export async function closeLiveSlot(liveSlots, driver, slot) {
@@ -58,6 +58,19 @@ export async function closeLiveSlot(liveSlots, driver, slot) {
 // A transport timeout says nothing about whether a mutation reached the terminal.
 class HeldProbeExhausted extends Error {
 }
+// OBS-1108: an owned slot whose contact stayed latched unreadable past its deadline. Same terminal
+// path as an exhausted transport probe — worktree preserved, one infra park (recheck-able) — with
+// its own disposition, so the park names what was actually lost.
+class ContactUnreadableExhausted extends HeldProbeExhausted {
+}
+// OBS-1108: how long one owned slot's contact may stay latched unreadable before its attempt parks.
+// Default: the attempt's own stall window — the latch holds the stall kill down, so without this
+// only the 4x hard deadline bounded a blind wait (2.5.8: 22k rows; 2.6.1: ~12k rows/h per worker).
+let contactUnreadableDeadlineMs;
+export function setContactUnreadableDeadlineMsForTests(ms) { contactUnreadableDeadlineMs = ms; }
+export function resetContactUnreadableDeadlineMsForTests() { contactUnreadableDeadlineMs = undefined; }
+const CONTACT_BACKOFF_BASE_MS = 1_000; // the pre-latch retry pause, doubled per latched retry
+const CONTACT_BACKOFF_DOUBLINGS = 5; // ponytail: 32 s ceiling; the poll slice caps it lower anyway
 function isTransportTimeout(error) {
     if (!(error instanceof Error))
         return false;
@@ -167,26 +180,53 @@ export function resolveRunMode(repoRoot, opts = {}) {
         : undefined;
     return { cfg: resolved.cfg, mode: resolved.mode, source, ...(conflict ? { conflict } : {}) };
 }
-// Bind approval context before dispatch consumes the release. Restore reconstructs the same
-// binding from journal order; a newer approval, including one without a reason, supersedes it.
-function approvalReviewContext(events, taskId, restore = false) {
-    let pending;
-    let bound;
-    let approved = false;
-    for (const row of events) {
-        if (row.taskId !== taskId)
-            continue;
-        if (row.event === "task-approved") {
-            pending = typeof row.data.reason === "string" ? row.data.reason.trim() || undefined : undefined;
-            approved = true;
-        }
-        else if (row.event === "task-dispatch" || (row.event === "recheck-battery" && approved)) {
-            bound = pending;
-            pending = undefined;
-            approved = false;
-        }
+/** Journal rows are untrusted input: a malformed field reads as not recorded, never as a value. */
+export const fingerprintsOf = (v) => Array.isArray(v) && v.every((x) => typeof x === "string") ? v : undefined;
+export const baselineProvenanceOf = (v) => {
+    const { baseRef, capturedAt } = (typeof v === "object" && v !== null ? v : {});
+    return typeof baseRef === "string" && typeof capturedAt === "string" ? { baseRef, capturedAt } : undefined;
+};
+/** A forgiven battery green: the structured field, or the battery's own "(forgiven)" wording on a legacy row. */
+export const forgivenGateRow = (data) => data.pass === true && (Array.isArray(data.forgivenFingerprints) || /\(forgiven\)/u.test(String(data.details ?? "")));
+/**
+ * OBS-1123: the forgiveness standing at this point in the journal — each task gate's LATEST verdict
+ * where it is a forgiven green, then the latest verification cycle's forgiven tip rows. A legacy row
+ * keeps what it never recorded absent, so the reader says "unknown" instead of borrowing a date.
+ */
+export function forgivenFingerprints(events) {
+    const latest = new Map();
+    for (const e of events) {
+        if (e.event === "gate-result" && e.taskId && typeof e.data.gate === "string")
+            latest.set(`${e.taskId}\0${e.data.gate}`, e);
     }
-    return restore && !approved ? bound : pending;
+    const tasks = [...latest.values()].filter((e) => forgivenGateRow(e.data));
+    const start = events.map((e) => e.event).lastIndexOf("tip-verify-start");
+    const tip = events.slice(start + 1).filter((e) => e.event === "tip-verify" && e.data.pass === true
+        && e.data.forgiven === true && typeof e.data.gate === "string");
+    return [...tasks, ...tip].map((e) => {
+        const fingerprints = fingerprintsOf(e.event === "tip-verify" ? e.data.fingerprints : e.data.forgivenFingerprints);
+        const baseline = baselineProvenanceOf(e.data.baselineProvenance);
+        return { ...(e.taskId ? { taskId: e.taskId } : {}), gate: e.data.gate,
+            ...(fingerprints ? { fingerprints } : {}), ...(baseline ? { baseline } : {}) };
+    });
+}
+/** The capture a forgiveness rests on, or an explicit unknown — never a time read off another clock. */
+export function formatBaselineProvenance(p) {
+    return p ? `baseline ${p.baseRef.slice(0, 12)} captured ${p.capturedAt}`
+        : "baseline provenance unknown (legacy: no capture identity or time recorded)";
+}
+export function formatFingerprints(fingerprints) {
+    return fingerprints === undefined ? "fingerprints not recorded"
+        : fingerprints.length ? fingerprints.join(" | ") : "no fingerprint recognized";
+}
+export function formatForgiven(f) {
+    return `${f.taskId ?? "tip"} ${f.gate}: ${formatFingerprints(f.fingerprints)} — ${formatBaselineProvenance(f.baseline)}`;
+}
+// OBS-1150: the reviewer reads the same standing rulings the worker brief carries, oldest first. A
+// later approval, with or without a reason, adds to them and never supersedes an earlier one.
+function approvalReviewContext(events, taskId) {
+    const rulings = standingRulings(events, taskId);
+    return rulings.length ? rulings.map((ruling) => `- ${ruling}`).join("\n") : undefined;
 }
 // T14: the events that prove an approval was ENACTED — narrowly causal, never merely subsequent.
 // Ordinary, attempt-cap and review-upheld approvals buy a WORKER, so their proof is a dispatch;
@@ -225,7 +265,10 @@ export function pendingDaemonApprovalActions(events) {
  */
 export function outstandingApprovals(events) {
     const newest = new Map();
-    events.forEach((e, i) => { if (e.event === "task-approved" && e.taskId)
+    // OBS-1178: this reports ANSWERS, not effects — a refused row was answered; an unsound one the daemon
+    // has not yet refused (approved, then failed before any dispatch) is still an unanswered decision.
+    const { refused } = foldDecisions(events);
+    events.forEach((e, i) => { if (e.event === "task-approved" && e.taskId && !refused.has(physicalLine(events, i)))
         newest.set(e.taskId, i); });
     return [...newest]
         .filter(([taskId, i]) => {
@@ -262,7 +305,9 @@ export function formatSummary(s) {
             + (resumable.length ? `; \`tickmarkr resume ${s.runId}\` enacts ${resumable.join(", ")}` : "")
             + (stalled.length ? `; ${stalled.join(", ")} failed before any dispatch — neither resume nor \`--retry-failed\` re-dispatches that` : "")
         : "";
-    return `done: ${s.done.length}, failed: ${s.failed.length}, human: ${s.human.length}, blocked: ${s.blocked.length}, pending: ${s.pending.length}\nintegration branch: ${s.branch}${tip}${outstanding}`;
+    // OBS-1123: a green that carried baseline reds names each one and the capture that recorded it.
+    const forgiven = (s.forgiven ?? []).map((f) => `\nforgiven vs baseline — ${formatForgiven(f)}`).join("");
+    return `done: ${s.done.length}, failed: ${s.failed.length}, human: ${s.human.length}, blocked: ${s.blocked.length}, pending: ${s.pending.length}\nintegration branch: ${s.branch}${tip}${outstanding}${forgiven}`;
 }
 /** The narrator enters the production Run cockpit for this exact run. The
  *  completed static/growing four-hour records precede this default cutover;
@@ -325,6 +370,30 @@ function classifyInfraResult(g) {
         return;
     g.meta = { ...g.meta, classification: "infra", infra: true };
 }
+// OBS-1106 residual: a red whose assertion is a timeout or a wall-clock budget, and the runner-level
+// diagnostics (never-started files, a worker RPC timeout) that make such a red infrastructure-SHAPED.
+// Shape alone never parks anything: it only buys one isolated re-observation before a charge. A
+// fresh-fingerprint section masks digits to `#`, so both spellings of a number are read.
+const TIMEOUT_SHAPED_RE = /\b(?:Test|Hook) timed out in (?:\d+|#)\s*ms\b|\bexpected (?:\d+|#)(?:\.(?:\d+|#))? to be (?:less than|below)(?: or equal to)? (?:\d+|#)/i;
+const RUNNER_INFRA_DIAGNOSTIC_RE = /\bnever-started (?:[1-9]\d*|#)(?![\d#])|\[vitest-worker\]: Timeout calling\b/;
+const timeoutShaped = (details) => TIMEOUT_SHAPED_RE.test(readableExcerpt(details));
+const ATTRIBUTED_FILE_RE = /^\s*(?:FAIL|×|✗)\s+(?:\|[^|\n]*\|\s+)?(\S+\.(?:test|spec)\.[cm]?[jt]sx?)\b/gm;
+/** The failing files a red attributes to itself: the runner's own list, else its FAIL headlines. */
+const attributedFailingFiles = (g) => [...new Set(Array.isArray(g.meta?.failingFiles) && g.meta.failingFiles.length
+        ? g.meta.failingFiles.filter((f) => typeof f === "string")
+        : [...readableExcerpt(g.details).matchAll(ATTRIBUTED_FILE_RE)].map((m) => m[1].replace(/^\.\//, "")))].sort();
+const metaFiles = (v) => Array.isArray(v) ? v.filter((f) => typeof f === "string") : undefined;
+/** D-607: the files a rerun OBSERVABLY ran — the runner's manifest, the only complete selection
+ * evidence. Never the requested selection, and never the per-file lines a runner printed: a runner that
+ * ignores file arguments and reports only its failures looks isolated while it ran the whole suite.
+ * Undefined without a manifest, and the rerun is then ambiguous. */
+const observedSelection = (g) => {
+    const ran = metaFiles(g.meta?.manifest);
+    return ran?.length ? [...new Set(ran)].sort() : undefined;
+};
+/** D-607: on the manifest path only the reporter's own attribution counts — a `FAIL path` line inside
+ * captured stdout is text, not attribution. Headline lexing is for runners without a reporter. */
+const rerunFailingFiles = (g) => metaFiles(g.meta?.manifest) ? [...new Set(metaFiles(g.meta?.failingFiles) ?? [])].sort() : attributedFailingFiles(g);
 // v1.85 T3: the gates whose failure IS a deterministic measurement — a machine re-ran a command over a
 // tree and printed the same bytes. Those are the failures the fingerprint cap governs (the ruling names
 // it a "deterministic-gate" cap): a third identical answer to a question already answered twice is the
@@ -353,6 +422,12 @@ function narrowRepairBattery(failing) {
         return isOracleFailure(g) && g.meta?.unparseable !== true;
     return false;
 }
+// OBS-1182: re-seating copies the channel's identity AND its launch effort — the four-field copy
+// this replaced silently reverted a climbed or pinned seat to the CLI's default effort.
+const seatAssignment = (c) => ({
+    adapter: c.adapter, model: c.model, channel: c.channel, tier: c.tier,
+    ...(c.effort ? { effort: c.effort } : {}),
+});
 // v2.0 T2 (OBS-554): the measurement keys run-gates stamps on a GateResult, lifted verbatim onto the
 // gate row. One list, one lift — both onGate sites record through the same helper.
 const GATE_TELEMETRY_KEYS = ["durationMs", "load1Start", "load1End", "load1Max", "load1Mean", "selectedDurationMs", "fullDurationMs", "invocations"];
@@ -409,18 +484,36 @@ function repairDiffFilesCut(diff, cap, names) {
 function repairFindingsBrief(results) {
     return results.filter(gateFailed).map((g) => {
         const evidence = g.meta?.failureEvidence;
-        return `${g.gate}: ${g.details}` + (Array.isArray(evidence) && evidence.length
+        return `${g.gate}: ${readableExcerpt(g.details)}` + (Array.isArray(evidence) && evidence.length
             ? `\nAssertion evidence:\n${JSON.stringify(evidence, null, 2)}` : "");
     }).join("\n\n");
 }
-/** The fix-only contract: the findings verbatim, then the diff content of the work already landed. */
-function repairBrief(findings, diff, baseRef) {
+// OBS-1019 add.2: the order a repeated review chain earns in place of the smallest-edit order.
+const REPAIR_CLASS_SENTENCE = "Before editing a chain reraised more than once, enumerate the in-scope consumers,"
+    + " bridges, operations and event sequences as a closed case table; repair every implicated member and verify"
+    + " the accumulated diff against that table.";
+/**
+ * The fix-only contract: the findings verbatim, then the diff content of the work already landed.
+ * OBS-1019 add.2: a first finding stays bounded to the smallest edit. A chain a review has re-raised
+ * more than once was chased edge by edge while every round re-judged the accumulated diff, so it owes
+ * the whole class instead: a closed case table inside the declared bounds, never beyond them.
+ */
+function repairBrief(findings, diff, baseRef, repeated = []) {
     const repair = { findings, diff };
     return [
-        "## Repair attempt — fix ONLY what these findings name",
+        repeated.length ? "## Repair attempt — repair the whole class these findings name" : "## Repair attempt — fix ONLY what these findings name",
         "The commits from your prior attempt are already in this worktree and their diff is reproduced"
-            + " below. Do NOT re-implement that work, do not start over, and do not revert it: make the"
-            + " smallest change that resolves every finding, then commit.",
+            + " below. Do NOT re-implement that work, do not start over, and do not revert it: "
+            + (repeated.length ? "resolve every member of the case table below, then commit." : "make the smallest change that resolves every finding, then commit."),
+        ...(repeated.length ? [
+            "",
+            "### Repeated review chains — repair the class, not the next edge",
+            // Fingerprint and count only: the finding's prose is already quoted once, below or under its heading.
+            ...repeated.map(({ finding, reraises }) => `- \`${finding.fingerprint}\` re-raised ${reraises} times`),
+            REPAIR_CLASS_SENTENCE,
+            "The table stays inside the task's declared write scope (files[]) and never narrows its goal or an"
+                + " acceptance criterion; the reviewer judges the accumulated diff, not the table.",
+        ] : []),
         "",
         "### Failing gate findings (verbatim)",
         repair.findings,
@@ -441,7 +534,8 @@ const DEFERRED_FINDINGS_HEADING = "## Deferred review findings — a reviewer AC
 // OBS-419: the newest approval starts the current engagement, so it is also the sole authority for
 // that engagement's optional ceiling. Stop at the newest approval even when the field is absent: a
 // later ordinary release restores the module default instead of inheriting an older operator limit.
-function approvedReviewRoundCeiling(events, taskId) {
+function approvedReviewRoundCeiling(journaled, taskId) {
+    const events = effectiveEvents(journaled); // OBS-1178: a refused or unsound approval sets no ceiling
     for (let i = events.length - 1; i >= 0; i--) {
         const event = events[i];
         if (event.event !== "task-approved" || event.taskId !== taskId)
@@ -479,6 +573,14 @@ let capacityBackoffMs = CAPACITY_BACKOFF_MS;
 /** Test seam — shrink the capacity backoff without minute-long sleeps. */
 export function setCapacityBackoffMsForTests(ms) { capacityBackoffMs = ms; }
 export function resetCapacityBackoffMsForTests() { capacityBackoffMs = CAPACITY_BACKOFF_MS; }
+// OBS-1169: a CLI bootstrap failure buys ONE same-channel retry after a bounded wait — journal-counted
+// per task and seat like capacity — and then the adapter is escalated away from, never retried forever.
+const BOOTSTRAP_RETRY_CAP = 1;
+const BOOTSTRAP_BACKOFF_MS = 5_000;
+let bootstrapBackoffMs = BOOTSTRAP_BACKOFF_MS;
+/** Test seam — shrink the bootstrap backoff. */
+export function setBootstrapBackoffMsForTests(ms) { bootstrapBackoffMs = ms; }
+export function resetBootstrapBackoffMsForTests() { bootstrapBackoffMs = BOOTSTRAP_BACKOFF_MS; }
 const NO_TRAILER_DEMOTION_STREAK = 2; // OBS-57: consecutive no-trailer windows demote a channel for the rest of the run
 // OBS-117 (v1.71 T6): a worker pane that never prints a byte by T+60s after dispatch is a dead
 // channel — don't burn the full stall window waiting for a silent launch failure. Checked on the
@@ -544,9 +646,16 @@ export function resetWorkerStartupWindowMsForTests() {
 /** One seat, one startup prefix. Once execution or its input box is seen, later panes are ineligible. */
 export class StartupFailureDetector {
     adapter;
+    pattern;
+    wholePrefix;
     closed = false;
-    constructor(adapter) {
+    constructor(adapter, pattern = WORKER_STARTUP_FAILURE_RE, // OBS-1169: or known bootstrap text
+    // OBS-1169: bootstrap evidence must own the WHOLE bounded prefix — a match followed by a tool frame
+    // or an input box anywhere later in the sample is a worker that ran, not a CLI that died starting.
+    wholePrefix = false) {
         this.adapter = adapter;
+        this.pattern = pattern;
+        this.wholePrefix = wholePrefix;
     }
     sample(output, launchedAt) {
         if (this.closed || launchedAt === undefined || Date.now() - launchedAt > workerStartupWindowMs)
@@ -583,6 +692,7 @@ export class StartupFailureDetector {
             }
         }
         let offset = 0;
+        let found;
         for (const [index, row] of rows.entries()) {
             const cleanRow = row.replace(/\u001b\[[0-?]*[ -/]*[@-~]/g, "");
             // Structured tool frames and the terminal's tool headings close the prefix BEFORE their body.
@@ -591,16 +701,20 @@ export class StartupFailureDetector {
                 this.closed = true;
                 return;
             }
-            if (!this.adapter.harnessBannerRows?.includes(cleanRow)) {
-                const match = WORKER_STARTUP_FAILURE_RE.exec(row);
-                if (match)
-                    return {
+            if (!found && !this.adapter.harnessBannerRows?.includes(cleanRow)) {
+                const match = this.pattern.exec(row);
+                if (match) {
+                    found = {
                         matchedBytes: match[0], offset: offset + Buffer.byteLength(row.slice(0, match.index)),
                         row, rowNumber: index + 1,
                     };
+                    if (!this.wholePrefix)
+                        return found;
+                }
             }
             offset += Buffer.byteLength(row) + 1;
         }
+        return found;
     }
 }
 // OBS-901/906: one daemon-owned writer for every execution surface. Drivers expose one retained
@@ -809,7 +923,7 @@ export function formatTipProof(p) {
 }
 // Isolate the battery so cancellation can stop its control flow as well as its shell children.
 // The child uses the same verifier and capacity; only the daemon writes lifecycle verdict rows.
-async function cancellableTipBattery(intWt, commands, runDir, baseline, signal) {
+async function cancellableTipBattery(intWt, commands, runDir, baseline, signal, evidence = {}) {
     signal.throwIfAborted();
     const extension = import.meta.url.endsWith(".ts") ? "ts" : "js";
     const script = `
@@ -858,9 +972,9 @@ async function cancellableTipBattery(intWt, commands, runDir, baseline, signal)
       finally { process.send({ type: 'lease-release', id }); }
     };
     let input = ''; for await (const chunk of process.stdin) input += chunk;
-    const { intWt, commands, runDir, baseline, capacity } = JSON.parse(input);
+    const { intWt, commands, runDir, baseline, capacity, evidence } = JSON.parse(input);
     try {
-      const result = await runWithVerificationBudget(capacity, () => runWithCommandLease(lease, () => verifyIntegrationTip(intWt, commands, runDir, baseline)));
+      const result = await runWithVerificationBudget(capacity, () => runWithCommandLease(lease, () => verifyIntegrationTip(intWt, commands, runDir, baseline, evidence)));
       if (!cancelled) process.stdout.write(JSON.stringify(result.map(row => ({ ...row, capacity: [...commandCapacities].reverse().find(([command]) => command === row.cmd || command.startsWith(row.cmd + " "))?.[1] ?? capacity }))));
     } catch (error) { if (!cancelled) throw error; }
     finally { process.disconnect(); }
@@ -911,7 +1025,7 @@ async function cancellableTipBattery(intWt, commands, runDir, baseline, signal)
     });
     signal.addEventListener("abort", cancel, { once: true });
     child.stdin.on("error", () => { });
-    child.stdin.end(JSON.stringify({ intWt, commands, runDir, baseline, capacity: resolvedCapacity() }));
+    child.stdin.end(JSON.stringify({ intWt, commands, runDir, baseline, capacity: resolvedCapacity(), evidence }));
     try {
         if (signal.aborted)
             cancel();
@@ -972,9 +1086,9 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
         return false;
     }
     let tipFailed = false;
-    for (const r of await (opts.signal
-        ? cancellableTipBattery(intWt, commands, journal.dir, opts.baseline, opts.signal)
-        : verifyIntegrationTip(intWt, commands, journal.dir, opts.baseline))) {
+    for (const r of await runWithInterruptionSink(journalInterruption(journal, undefined), () => opts.signal
+        ? cancellableTipBattery(intWt, commands, journal.dir, opts.baseline, opts.signal, opts.evidence)
+        : verifyIntegrationTip(intWt, commands, journal.dir, opts.baseline, opts.evidence))) {
         const measuredCapacity = r.capacity ?? capacity;
         const evidence = r.reused ? reusedTipEvidence(r) : {
             ...(r.originRunRoot ? { originRunRoot: r.originRunRoot } : {}),
@@ -987,7 +1101,7 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
         };
         if (r.pass) {
             // Q121s: a forgiven pass journals its fingerprints — honest about what was carried, never a silent green.
-            journal.append("tip-verify", undefined, { ...evidence, gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.reused ? { cached: true } : {}), ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints } : {}), tip, cmdHash, capacity: measuredCapacity });
+            journal.append("tip-verify", undefined, { ...evidence, gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.reused ? { cached: true } : {}), ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints, ...(r.baselineProvenance ? { baselineProvenance: r.baselineProvenance } : {}) } : {}), tip, cmdHash, capacity: measuredCapacity });
         }
         else {
             journal.append("tip-verify-failed", undefined, {
@@ -1008,6 +1122,12 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
     }
     return tipFailed;
 }
+/** OBS-953: a detected wall-over-monotonic discontinuity journals `host-suspend` (its offset was
+ * subtracted from active test time); an overdue poll whose clocks advanced together journals
+ * `host-poll-overdue` (recorded, never subtracted). */
+const journalInterruption = (journal, taskId) => (interruption) => {
+    journal.append(interruption.kind === "host-suspend" ? "host-suspend" : "host-poll-overdue", taskId, { ...interruption });
+};
 async function commitsAheadOfRef(base, head, cwd) {
     if (head === base)
         return [];
@@ -1500,17 +1620,24 @@ async function taskWithMaterializedContext(repoRoot, journal, worktree, task, at
     }
     return { ...task, context };
 }
+// OBS-1107: a refused pick is not lost work by that fact alone. A commit whose own change the
+// destination already holds (content-empty, or a patch represented there under another hash) is
+// accounted for and skipped; the carry stops only at a nonempty change the destination lacks.
 async function cherryPickCommits(wt, commits) {
     const carried = [];
+    const accounted = [];
     for (const hash of commits) {
         const r = await shGit(`git cherry-pick --no-gpg-sign ${shq(hash)}`, wt);
-        if (r.code !== 0) {
-            await shGit("git cherry-pick --abort", wt);
-            break;
+        if (r.code === 0) {
+            carried.push(hash);
+            continue;
         }
-        carried.push(hash);
+        await shGit("git cherry-pick --abort", wt);
+        if (!(await changeRepresented(wt, hash)))
+            break;
+        accounted.push(hash);
     }
-    return carried;
+    return { carried, accounted };
 }
 const PRESERVED_REF_PREFIX = "refs/tickmarkr/preserved/";
 const preservedRefOf = (data) => [data.ref, data.preservedRef].find((v) => typeof v === "string" && v.startsWith(PRESERVED_REF_PREFIX));
@@ -1662,6 +1789,7 @@ export function recordFatalRunEnd(journal, runId, branch, err, graph, phase = "s
     const original = err instanceof Error ? err.message : String(err);
     // A fatal close never finished a cycle: fresh/reused green is withheld, a recorded red still stands.
     let tipProof = { kind: "incomplete" };
+    let forgiven = [];
     try {
         // Only the latest engagement can already own this terminal outcome.
         const events = journal.read();
@@ -1675,6 +1803,8 @@ export function recordFatalRunEnd(journal, runId, branch, err, graph, phase = "s
         }
         const latest = runEndTipProof(events.slice(from));
         tipProof = { ...latest, kind: latest.kind === "failed" ? "failed" : "incomplete" };
+        // OBS-1123: the same fold the normal close records, so a crash never drops what a green carried.
+        forgiven = forgivenFingerprints(events);
     }
     catch (readErr) {
         console.error(`tickmarkr ${runId}: journal read failed while recording the fatal run-end (${readErr instanceof Error ? readErr.message : String(readErr)}) — original error: ${original}`);
@@ -1691,6 +1821,7 @@ export function recordFatalRunEnd(journal, runId, branch, err, graph, phase = "s
         fatal: true,
         error: original,
         tipProof,
+        ...(forgiven.length ? { forgiven } : {}),
     };
     try {
         journal.append("run-end", undefined, record);
@@ -1821,6 +1952,9 @@ export async function runDaemon(repoRoot, opts = {}) {
         // > repo > global > default. The resolved cfg carries mode-compiled floors; route() never sees the mode.
         const rm = resolveRunMode(repoRoot, { flag: opts.mode, spec: graph.mode, globalDir: opts.globalDir });
         const cfg = rm.cfg;
+        // OBS-1199: the effective repair-selection default is resolved apart from the optional execution
+        // budget, so an absent policy selects on every driver; a resume keeps what the run recorded.
+        let repairSelection = repairSelectionEnabled(cfg);
         if (opts.resume) {
             const start = Journal.open(repoRoot, runId).read().find((e) => e.event === "run-start");
             const snapshot = start?.data.effectivePolicy;
@@ -1832,6 +1966,11 @@ export async function runDaemon(repoRoot, opts = {}) {
             // Historical runs did not opt in; current settings cannot grant them a new allowance.
             cfg.executionPolicy = recorded?.config?.executionPolicy === undefined
                 ? undefined : ExecutionPolicySchema.parse(recorded.config.executionPolicy);
+            const recordedGates = recorded?.config?.gates;
+            if (recordedGates?.repairSelection !== undefined && typeof recordedGates.repairSelection !== "boolean") {
+                throw new Error("cannot restore malformed recorded repair selection");
+            }
+            repairSelection = repairSelectionEnabled({ executionPolicy: cfg.executionPolicy, gates: recordedGates });
         }
         if (cfg.executionPolicy && driver.id !== "subprocess") {
             throw new Error("experimental executionPolicy currently requires the subprocess driver");
@@ -2107,11 +2246,22 @@ export async function runDaemon(repoRoot, opts = {}) {
                 // GATE-08 (v1.12): the humanGate guard consults this run's journaled approvals, not just the compiled
                 // flag. Startup approvals seed the first scheduling pass; live approvals are folded at task
                 // boundaries below so a sibling can release parked work without waiting for run-end + resume.
+                //
+                // OBS-1178: revalidate every open approval before anything can enact it. The decision fold already
+                // gives an unsound one no effect; the approval-refused row records that answer and consumes it, so
+                // every fold and every operator reads the task as still parked — a stale waive never satisfies a newer gate.
+                const refuseStaleApprovals = () => {
+                    for (const [taskId, stale] of staleApprovals(journal.read())) {
+                        // `lines` names the voided rows, so a sound decision beside a stale one survives the refusal.
+                        journal.append(APPROVAL_REFUSED, taskId, { reason: `stale or unbound decision refused before enactment — ${stale.reason}`, lines: stale.lines });
+                    }
+                };
+                refuseStaleApprovals();
                 const approvalStartupEvents = journal.read();
-                // Continuing human-gate permission survives enactment; malformed releases grant none.
-                const validApproval = (e) => e.event === "task-approved" && e.taskId
-                    && pendingApprovalActions([e]).get(e.taskId)?.authority !== "inert";
-                const approved = new Set(approvalStartupEvents.filter(validApproval).map((e) => e.taskId));
+                // Continuing human-gate permission survives enactment; malformed, refused or unsound releases grant none.
+                const validApproval = (e) => e.event === "task-approved" && e.taskId !== undefined
+                    && approvalAction(e.taskId, e).authority !== "inert";
+                const approved = new Set(effectiveEvents(approvalStartupEvents).filter(validApproval).map((e) => e.taskId));
                 const startupActions = pendingDaemonApprovalActions(approvalStartupEvents);
                 let approvalSweepCursor = approvalStartupEvents.length;
                 const commands = detectGateCommands(repoRoot, cfg);
@@ -2150,11 +2300,14 @@ export async function runDaemon(repoRoot, opts = {}) {
                     console.error(`tickmarkr: narrator not opened: ${placed.error}`);
                     return undefined;
                 };
-                // WB-1 (OBS-988): the daemon watches its own cockpit. A board is lost when the watch tier's beat
-                // aged past the supervision stale bound, the recorded arm has no presence, or the owner pid is dead.
-                // The beat and presence checks wait for the UI to have armed (armId recorded) — a freshly reopened
-                // board that has not armed yet is not a second loss. Reopens are bounded per run; past the bound
-                // the loss is journaled `boardless` and the narrator is never called again.
+                // WB-1 (OBS-988): the daemon watches its own cockpit. A board is lost when its owner pid is dead, the
+                // recorded arm has no presence, or its beat aged past the supervision stale bound with no owner pid
+                // to consult. OBS-1110: a stale beat under a LIVE MATCHING OWNER — its pid answers and the arm it
+                // claimed is present — is a slow board, not a lost one: journaled once per episode as
+                // `watch-board-slow` and never spending a reopen. The beat and presence checks wait for the UI to
+                // have armed (armId recorded) — a freshly reopened board that has not armed yet is not a second
+                // loss. Reopens are bounded per run; past the bound the loss is journaled `boardless` and the
+                // narrator is never called again.
                 // Leg-2 T7 M2: one `watch-board-lost` row per LOSS. A loss is identified by the pane and pid the
                 // owner record names; a reopen that fails leaves that record in place, so the next poll sees the
                 // same loss, journals only its own reopen attempt, and the bound retires the run boardless from the
@@ -2163,31 +2316,79 @@ export async function runDaemon(repoRoot, opts = {}) {
                 let boardReopens = journal.read().filter((e) => e.event === "watch-board-reopened" || e.event === "watch-board-reopen-failed").length;
                 let boardless = false;
                 let journaledLoss;
-                const boardLoss = () => {
+                let journaledSlow;
+                // Per claim: the next adoption offer, backed off (doubling from the poll cadence to a small cap) but
+                // never exhausted; and whether a reservation is unresolved, so the loop must keep waking to watch it.
+                const MAX_HELD_OFFER_GAP_MS = 4 * APPROVAL_POLL_MS;
+                let heldOffer;
+                let heldRetry = false;
+                const boardHealth = () => {
                     const owner = readWatchBoard(repoRoot, runId);
                     if (!owner)
                         return undefined;
-                    const lost = { pane: owner.pane, ...(owner.pid !== undefined ? { pid: owner.pid } : {}) };
-                    if (owner.armId !== undefined) {
-                        const beat = readTierLiveness(repoRoot, "watch");
-                        if (beat.state === "STALE")
-                            return { ...lost, beatAgeMs: beat.beatAgeMs };
-                        // ponytail: presence path math mirrors supervision.ts's private helper (`<tier>.live.<armId>`)
-                        if (!existsSync(join(dirname(supervisionBeatPath(repoRoot, "watch")), `watch.live.${owner.armId}`)))
-                            return lost;
-                    }
+                    const named = { pane: owner.pane, ...(owner.pid !== undefined ? { pid: owner.pid } : {}) };
+                    const beat = owner.armId !== undefined ? readTierLiveness(repoRoot, "watch") : undefined;
+                    const row = beat?.state === "STALE" ? { ...named, beatAgeMs: beat.beatAgeMs } : named;
                     if (owner.pid !== undefined && !isPidLive(owner.pid))
-                        return lost;
+                        return { lost: row };
+                    if (owner.armId !== undefined && !existsSync(supervisionPresencePath(repoRoot, "watch", owner.armId)))
+                        return { lost: row };
+                    if (beat?.state === "STALE")
+                        return owner.pid !== undefined ? { slow: row } : { lost: row };
                     return undefined;
                 };
+                // OBS-1172: a placement the driver HELD after an indeterminate split receipt has no slot here. While
+                // the reservation stays unresolved the loop keeps polling it — even with every worker slot busy — so
+                // a claim landing mid-task is seen. Once a live observer has claimed, the narrator is offered it
+                // again, backed off per claim (doubling from the poll cadence to MAX_HELD_OFFER_GAP_MS) but never
+                // exhausted: a listing that is unavailable or not yet showing the handle is retried until it proves
+                // the board or the run ends; only success latches (the slot). The driver adopts the proven pane —
+                // tracked from then on like any board — or keeps holding it, and never splits a second board over it.
+                // This spends no reopen: nothing was lost.
+                const adoptHeldBoard = async () => {
+                    heldRetry = false;
+                    const owner = readWatchBoard(repoRoot, runId);
+                    if (watchSlot || owner?.pane !== "" || owner.retired)
+                        return;
+                    heldRetry = true;
+                    if (owner.pid === undefined || !isPidLive(owner.pid))
+                        return; // unclaimed, or claimant dead: keep watching
+                    const id = `${owner.token}:${owner.pid}`;
+                    const now = Date.now();
+                    const offer = heldOffer?.id === id ? heldOffer : { id, gapMs: APPROVAL_POLL_MS, nextAt: now };
+                    if (now < offer.nextAt) {
+                        heldOffer = offer;
+                        return;
+                    }
+                    const adopted = await openBoard();
+                    if (adopted.ok) {
+                        heldOffer = undefined;
+                        heldRetry = false;
+                        journal.append("watch-board-adopted", undefined, { pane: adopted.slot.id });
+                        return;
+                    }
+                    heldOffer = { id, gapMs: Math.min(offer.gapMs * 2, MAX_HELD_OFFER_GAP_MS), nextAt: Date.now() + offer.gapMs };
+                };
                 const watchBoard = async () => {
-                    if (!boardOpened || boardless || !trackedDriver.narrator)
+                    if (boardless || !trackedDriver.narrator)
                         return;
-                    const loss = boardLoss();
-                    if (!loss) {
-                        journaledLoss = undefined;
+                    if (!boardOpened)
+                        return adoptHeldBoard();
+                    const health = boardHealth();
+                    if (health && "slow" in health) {
+                        const identity = `${health.slow.pane}:${health.slow.pid}`;
+                        if (identity !== journaledSlow) {
+                            journaledSlow = identity;
+                            journal.append("watch-board-slow", undefined, health.slow);
+                        }
                         return;
                     }
+                    journaledSlow = undefined;
+                    if (!health) {
+                        journaledLoss = undefined;
+                        return adoptHeldBoard();
+                    }
+                    const loss = health.lost;
                     const identity = `${loss.pane}:${loss.pid ?? ""}`;
                     if (identity !== journaledLoss) {
                         journaledLoss = identity;
@@ -2221,6 +2422,19 @@ export async function runDaemon(repoRoot, opts = {}) {
                     void promise.finally(() => hostChecks.delete(promise)).catch(() => { });
                     return promise;
                 };
+                // OBS-1190: every admission poll still probes (the probe gates admission), but the journal keeps only
+                // the first observation and each change of state or reference — healthy, degraded, unreadable,
+                // recovered — the way suite-wait already dedupes by count. A steady wait no longer floods the journal.
+                let journaledHost;
+                const journalObservation = (taskId, observation, resuming) => {
+                    const state = observation.medianMs === null ? "unreadable"
+                        : hostReferenceMs !== undefined && hostDegraded(observation, hostReferenceMs) ? "degraded" : "healthy";
+                    const key = `${state}:${hostReferenceMs ?? ""}`;
+                    if (key === journaledHost)
+                        return;
+                    journaledHost = key;
+                    journal.append("host-observation", taskId, { ...observation, referenceMs: hostReferenceMs ?? null, resuming, state });
+                };
                 const recordReference = (observation) => {
                     if (observation.medianMs === null)
                         return;
@@ -2244,7 +2458,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const probeBudget = HOST_PROBE_SAMPLE_MS * HOST_PROBE_SAMPLES;
                         if (!observation || (!first && remaining >= probeBudget)) {
                             observation = await observeHost(signal, remaining > 0 ? Math.min(probeBudget, remaining) : undefined);
-                            journal.append("host-observation", taskId, { ...observation, referenceMs: hostReferenceMs ?? null, resuming });
+                            journalObservation(taskId, observation, resuming);
                         }
                         first = false;
                         if (hostReferenceMs === undefined && observation.medianMs !== null)
@@ -2288,7 +2502,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                 const initializeHost = () => trackHost((async () => {
                     const signal = hostSignal();
                     const observation = await observeHost(signal);
-                    journal.append("host-observation", undefined, { ...observation, referenceMs: hostReferenceMs ?? null, resuming: !!opts.resume });
+                    journalObservation(undefined, observation, !!opts.resume);
                     if (hostReferenceMs === undefined)
                         recordReference(observation);
                     if (opts.resume || observation.medianMs === null)
@@ -2334,7 +2548,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             waited = true;
                             journal.append("suite-wait", taskId, { count, ...(gate ? { gate } : {}) });
                         }, SUITE_POLL_MS, signal);
-                    }, async () => {
+                    }, () => runWithInterruptionSink(journalInterruption(journal, taskId), async () => {
                         try {
                             const result = await run();
                             // Some command oracles turn launch errors into results. Admission failure still parks infra.
@@ -2346,7 +2560,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             if (taskId)
                                 activeGatePhases.delete(taskId);
                         }
-                    });
+                    }));
                 };
                 let baseRef;
                 let baseline;
@@ -2435,7 +2649,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // journal.replayStatuses predates typed releases and re-pends even inert rows. Keep that
                     // legacy reader intact; scheduling accepts only the fold's recognised authorities.
                     const statuses = new Map();
-                    for (const e of replayEvents) {
+                    for (const e of effectiveEvents(replayEvents)) { // OBS-1178: a refused or unsound decision released nothing
                         if (!e.taskId)
                             continue;
                         if (e.event === "task-dispatch")
@@ -2499,7 +2713,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                         if (emptyCapture)
                             writeFileSync(join(journal.dir, "baseline.json"), JSON.stringify(emptyCapture, null, 2));
                         await initializeHost();
-                        const captured = emptyCapture ?? await captureBaseline(repoRoot, commands);
+                        // OBS-1123: the capture's identity and publication time ride the measurement every forgiveness reads.
+                        const captured = { ...(emptyCapture ?? await captureBaseline(repoRoot, commands)),
+                            provenance: { baseRef, capturedAt: new Date().toISOString() } };
                         writeFileSync(join(journal.dir, "baseline.json"), JSON.stringify(captured, null, 2));
                         baseline = captured;
                         for (const warning of captured.warnings ?? [])
@@ -2563,16 +2779,44 @@ export async function runDaemon(repoRoot, opts = {}) {
                 // owns listing/parsing/closing. Cosmetic by contract: failures are swallowed and subprocess has no
                 // reconcile (optional chain → no-op), so gates and the oracle suite never feel this. keepPanes
                 // "forever" is the keep-everything debug override — it disables the sweep entirely.
-                const reconcile = async (opts) => {
+                // OBS-1109: an interrupted attempt's pane is evidence — its nonce-bound trailer decides whether
+                // the attempt is harvested, declined as foreign, or recovered — so the fold's run-resume clear
+                // must not reach it before harvestInterruptedAttempt has read it and reaped its processes. Only a
+                // resumed daemon can hold such an attempt: a fresh run's sweep is the baseline sweep.
+                // OBS-1204: the set is FROZEN here, once, from the rows up to this daemon's own run-resume row: an
+                // attempt launched after it is this daemon's own and reconciles exactly as in a fresh run. Each
+                // frozen spare lapses for good once its harvest, decline or a superseding dispatch is journaled.
+                const resumeInterrupted = new Map();
+                if (opts.resume) {
+                    const rows = journal.read();
+                    let resumedAt = rows.length - 1;
+                    while (resumedAt >= 0 && rows[resumedAt].event !== "run-resume")
+                        resumedAt--;
+                    const prior = rows.slice(0, resumedAt + 1);
+                    for (const t of graph.tasks) {
+                        const owned = interruptedAttempt(prior, t.id);
+                        if (owned?.launch)
+                            resumeInterrupted.set(t.id, { attempt: owned.attempt, nonce: owned.launch.nonce });
+                    }
+                }
+                const reconcile = async (sweep) => {
                     if (keepForever)
                         return;
                     try {
-                        const desired = desiredPanes(journal.read(), runId);
+                        const rows = journal.read();
+                        const desired = desiredPanes(rows, runId);
+                        for (const [taskId, frozen] of resumeInterrupted) {
+                            const owned = interruptedAttempt(rows, taskId);
+                            if (owned?.launch?.nonce !== frozen.nonce)
+                                resumeInterrupted.delete(taskId);
+                            else
+                                desired.add(formatOwnedName({ role: "worker", taskId, attempt: frozen.attempt, runId }));
+                        }
                         // The watch pane is never the DRIVER sweep's candidate (panesToClose spares role "watch":
                         // herdr's watches bookkeeping lives in close(), and a raw pane-close in the sweep would
                         // leave narrator() a stale cache) — the driver always sees it as desired; its lifecycle is
                         // decided here from the fold alone.
-                        await driver.reconcile?.(new Set([...desired, watchName]), runId, { ...opts, endedRunIds });
+                        await driver.reconcile?.(new Set([...desired, watchName]), runId, { ...sweep, endedRunIds });
                         // OBS-103: when the fold retires the watch (run-end boundary), close the narrator. The
                         // decision keys on the run identity in the pane name — narrator() adopts a prior daemon
                         // instance's pane under the same owned name, so a stop→resume cycle's leftover narrator
@@ -2662,6 +2906,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                     graph = setStatus(graph, t.id, "human");
                     saveGraph(repoRoot, graph);
                     journal.append("task-human", t.id, { ...details, reason, kind });
+                    // OBS-1178: the notice carries the park token an approval binds to (`approve --park <token>`).
+                    const parked = journal.newestBinding(t.id);
+                    const token = parked && bindingToken(parked);
                     if (assignment) {
                         // OBS-547: `metered` counts CHARGEABLE metered attempts, so an unchargeable dispatch passes 0 and
                         // the count is omitted rather than written as 0 or as `1` beside `attempts: 0` — a row claiming
@@ -2670,7 +2917,81 @@ export async function runDaemon(repoRoot, opts = {}) {
                         journal.telemetry({ taskId: t.id, shape: t.shape, adapter: assignment.adapter, model: assignment.model, channel: assignment.channel, attempts, outcome: "human", durationMs: Date.now() - startMs, parkKind: kind, gateFails, consults, tokens, meteredAttempts: tokens && metered ? metered : undefined, retryMode });
                     }
                     await reconcile({ spareLiveLlm: true }); // task-human is a terminal event — sweep, sparing sibling tasks' live LLM panes
-                    await driver.notify(`tickmarkr ${runId}: ${t.id} needs a human — ${reason}`, { tier: "attention" });
+                    await driver.notify(`tickmarkr ${runId}: ${t.id} needs a human — ${reason}${token ? `\npark ${token} — bind the decision with \`--park ${token}\`` : ""}`, { tier: "attention" });
+                };
+                // OBS-1106 residual: a retry that landed nothing on a timeout-class red re-observes it ONCE fresh:
+                // neither a journal replay nor the verdict cache may re-state that red. Owed when the prior round's
+                // test red sits on this very subject, is timeout-shaped, and has not yet been observed twice
+                // independently — once it has, the fingerprint cap owns the next move. Read from the journal alone,
+                // so the live gate loop and a resume battery decide alike.
+                const owesTimeoutRefresh = (t, priorRows, commit) => {
+                    const red = priorRows.find((e) => e.event === "gate-result" && e.data.gate === "test" && e.data.pass === false
+                        && e.data.skipped !== true && e.data.commit === commit && typeof e.data.details === "string" && timeoutShaped(e.data.details));
+                    return red !== undefined
+                        && identicalGateFailures(journal.read(), t.id, "test", normalizeGateFailure(String(red.data.details))) < GATE_FINGERPRINT_CAP;
+                };
+                // OBS-1106 residual: before a timeout or wall-budget red accompanied by runner infra diagnostics is
+                // charged, its attributed failing files are re-run ONCE, on the same checkout, under the suite
+                // lease. Only a reproduced assertion is charged. A pass, an infra rerun, a rerun naming none of the
+                // files, or an unattributable red parks with the ORIGINAL red journaled and unresolved: the rerun is
+                // diagnostic, never a verdict, so it can neither green the gate nor permit a merge. Returns true
+                // when it parked.
+                const adjudicateInfraShapedRed = async (t, results, wt, subject, attempt, replayed, parkInfra) => {
+                    const red = results.find((g) => g.gate === "test" && gateFailed(g) && !isInfraResult(g)
+                        && timeoutShaped(g.details) && RUNNER_INFRA_DIAGNOSTIC_RE.test(g.details));
+                    if (!red || commands.test === undefined)
+                        return false;
+                    // The observation this red states: its subject, its fingerprint and, when it carries one, its
+                    // receipt's invocation. A copy (journal replay, cache hit) is never re-run when THAT observation's
+                    // adjudication is on the ledger — its recorded outcome decides, so a crash after the adjudication
+                    // but before its park still parks. A crash before the adjudication leaves none, so the copy is
+                    // adjudicated now. A fresh red always is.
+                    const fingerprint = normalizeGateFailure(red.details);
+                    const observation = receiptOrigin({ evidenceReceipt: red.evidenceReceipt ?? red.meta?.evidenceReceipt,
+                        evidenceReceipts: red.evidenceReceipts ?? red.meta?.evidenceReceipts });
+                    const recorded = replayed || red.meta?.reused === true
+                        ? journal.read().reverse().find((e) => e.taskId === t.id && e.event === "gate-reobserved"
+                            && e.data.commit === subject && e.data.fingerprint === fingerprint
+                            && (observation === undefined || e.data.observation === undefined || e.data.observation === observation))
+                        : undefined;
+                    let files = [];
+                    let outcome = "unattributed";
+                    let selection;
+                    if (recorded) {
+                        files = Array.isArray(recorded.data.files) ? recorded.data.files.filter((f) => typeof f === "string") : [];
+                        outcome = ["reproduced", "passed", "unattributed"].includes(String(recorded.data.outcome)) ? recorded.data.outcome : "ambiguous";
+                    }
+                    else {
+                        for (const file of attributedFailingFiles(red)) {
+                            if (posix.normalize(file) === file && !file.startsWith("../") && !file.startsWith("/") && existsSync(join(wt, file)))
+                                files.push(file);
+                        }
+                        let rerun;
+                        if (files.length) {
+                            rerun = await withCommandContext(t.id, () => reobserveTestFiles(wt, commands.test, baseline, files, journal.dir))
+                                .catch((error) => ({ gate: "test", pass: false, details: `infra: rerun failed: ${error instanceof Error ? error.message : String(error)}`, meta: { infra: true } }));
+                            classifyInfraResult(rerun);
+                            // Reproduced only by failure evidence the rerun ATTRIBUTES to one of exactly these files, from an
+                            // OBSERVED selection that was exactly these files (D-607): a path merely printed in output, a
+                            // positional filter that also collected another file, or a runner that ignored the file
+                            // arguments and reported no manifest of its selection, says nothing about the original red.
+                            const failing = rerunFailingFiles(rerun);
+                            selection = observedSelection(rerun);
+                            const isolated = selection !== undefined && selection.length === files.length
+                                && files.every((file) => selection.includes(file)) && failing.every((file) => files.includes(file));
+                            outcome = rerun.pass ? "passed" : isolated && !isInfraResult(rerun) && failing.length ? "reproduced" : "ambiguous";
+                        }
+                        journal.append("gate-reobserved", t.id, {
+                            gate: "test", attempt, commit: subject, fingerprint, ...(observation ? { observation } : {}), files, outcome,
+                            ...(selection ? { selection } : {}),
+                            ...(rerun ? { pass: rerun.pass, details: rerun.details } : {}),
+                            ...(rerun?.evidenceReceipt ? { evidenceReceipt: rerun.evidenceReceipt } : {}),
+                        });
+                    }
+                    if (outcome === "reproduced")
+                        return false;
+                    await parkInfra(`test: timeout-shaped red with runner infra diagnostics was not reproduced by one isolated rerun of ${files.length ? files.join(", ") : "its attributed files (none attributable)"} (${outcome}); the original red stands unresolved — recheck to re-measure:\n${readableExcerpt(red.details)}`);
+                    return true;
                 };
                 // OBS-547: cross-reference a scope red against the prediction this run already computed. Every hard
                 // offender predicted ⇒ an AUTHORING defect whose repair is pre-written: journal the classification
@@ -2690,7 +3011,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                     const verdict = scopeRed?.meta?.collateral;
                     const worker = journal.read().reverse().find((e) => e.taskId === t.id && e.event === "worker-result");
                     const disposition = classifyRepairDisposition({
-                        results, files: t.files, inventory: changed,
+                        // OBS-1072 add.2: hints are lexed from the readable excerpt, never from terminal control bytes.
+                        results: results.map((g) => ({ ...g, details: readableExcerpt(g.details) })), files: t.files, inventory: changed,
                         refusalSummary: worker?.data.ok === false && typeof worker.data.summary === "string" ? worker.data.summary : undefined,
                     });
                     for (const diagnostic of disposition.diagnostics) {
@@ -2749,7 +3071,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                 let admissionPriority = batteryPriority(startupActions.values());
                 const admissible = () => readyTasks(graph, admissionPriority);
                 const sweepLiveApprovals = () => {
-                    const events = journal.read();
+                    let events = journal.read();
+                    if (events.slice(approvalSweepCursor).some((e) => e.event === "task-approved")) {
+                        refuseStaleApprovals();
+                        events = journal.read();
+                    }
                     admissionPriority = batteryPriority(pendingDaemonApprovalActions(events).values());
                     const approvals = events.slice(approvalSweepCursor)
                         .filter((e) => e.event === "task-approved" && e.taskId);
@@ -2798,7 +3124,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                     if (changed)
                         saveGraph(repoRoot, graph);
                 };
+                // OBS-1168(c): every gate callback is bound to the engagement that asked for it. Once the scheduler
+                // settles that engagement (done, parked or failed), a late sibling's event is dropped, never journaled.
+                const engagements = new Map();
                 const execTask = async (t) => {
+                    const engagement = {};
+                    engagements.set(t.id, engagement);
+                    const liveEngagement = () => engagements.get(t.id) === engagement;
                     const approvalAction = pendingDaemonApprovalActions(journal.read()).get(t.id);
                     const fundedRerun = approvalAction?.authority === "worker";
                     const startMs = Date.now();
@@ -2861,6 +3193,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // fresh-budget release, prefer nextChannel over the surviving tried-list so burned channels are
                     // not re-tried first (consult bans / prior failovers survive the release).
                     const rs = resume.get(t.id);
+                    let bootstrapExhausted;
                     const contentDigest = taskContentDigest(t);
                     const previousDispatch = journal.read().reverse().find((e) => e.taskId === t.id && e.event === "task-dispatch");
                     const recordedGraphPath = join(journal.dir, "graph.json");
@@ -2881,8 +3214,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // OBS-1161: no `attempts > 0` guard — every release already clears lastAssignment in the replay,
                     // and a lastAssignment at zero attempts is a first dispatch whose capacity requeue was taken back:
                     // the seat is still in force, so restore it instead of failing over its own tried[] entry early.
+                    // OBS-1187: a restored seat must still be a member of the task's pool (the operator may have closed it).
                     if (!hintsChanged && rs?.lastAssignment
                         && channels.some((c) => channelKey(c) === channelKey(rs.lastAssignment))
+                        && inTaskPool(t, cfg, channelKey(rs.lastAssignment))
                         && !demotedChannels.has(channelKey(rs.lastAssignment))) {
                         assignment = rs.lastAssignment; // restore the consult-chosen assignment (bypasses route()'s static re-pick)
                     }
@@ -2892,29 +3227,60 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // EXISTING nextChannel `tried` parameter — zero router changes (D-03).
                         // OBS-1034: a PIN is exempt — route() already returned it, and a review-upheld repair of the diff
                         // the pin produced belongs on the pin, not on the next seat its own tried[] entry would pick.
-                        const next = nextChannel(assignment, t, cfg, channels, rs.tried, profile, demotedChannels);
+                        // OBS-1169: an adapter a bootstrap failover escalated away from stays out, sibling or none.
+                        const escalatedOut = channels.filter((c) => rs.escalatedAdapters?.includes(c.adapter)).map(channelKey);
+                        const next = nextChannel(assignment, t, cfg, channels, [...rs.tried, ...Object.keys(rs.escalated ?? {}), ...escalatedOut], profile, demotedChannels);
                         if (next)
                             assignment = next;
                         // ponytail: nextChannel null (every channel already tried / none available) — keep the static
                         // assignment and proceed. Dispatching on a previously-tried channel beats deadlocking a resumed
                         // run; a park-instead policy can come later if it ever bites.
+                        // OBS-1169: …except onto an escalated adapter — that relaunches the broken bootstrap, so it parks infra below.
+                        else if (rs.escalatedAdapters?.includes(assignment.adapter))
+                            bootstrapExhausted = channelKey(assignment);
                     }
-                    const taskHistory = journal.read().filter((e) => e.taskId === t.id);
+                    const taskHistory = effectiveEvents(journal.read()).filter((e) => e.taskId === t.id); // OBS-1178: only an effective decision opens an engagement
                     // Lifetime identity counts every dispatch, including legacy and unchargeable rows. Releases
                     // reset the budget below, never this counter; observational annotations do not consume it.
                     let nextWorkerDispatchOrdinal = taskHistory.filter((e) => e.event === "task-dispatch").length;
                     const lastApproval = taskHistory.map((e) => e.event).lastIndexOf("task-approved");
                     const priorClimb = taskHistory.slice(lastApproval + 1).reverse().find((e) => e.event === "tier-escalated");
                     if (!hintsChanged && priorClimb && taskHistory.indexOf(priorClimb) > taskHistory.map((e) => e.event).lastIndexOf("task-dispatch")) {
-                        const target = channels.find((c) => channelKey(c) === priorClimb.data.to && !demotedChannels.has(channelKey(c)));
+                        const target = channels.find((c) => channelKey(c) === priorClimb.data.to && !demotedChannels.has(channelKey(c))
+                            && inTaskPool(t, cfg, channelKey(c)));
                         if (target)
-                            assignment = { adapter: target.adapter, model: target.model, channel: target.channel, tier: target.tier };
+                            assignment = seatAssignment(target);
                     }
                     // pre-kill invariant: tried always contains the current assignment. Spread, never alias the
                     // journal-derived array (no hidden mutation of replayed state).
                     const tried = rs?.tried.length ? [...rs.tried] : [channelKey(assignment)];
                     if (!tried.includes(channelKey(assignment)))
                         tried.push(channelKey(assignment));
+                    // OBS-1169 add.1: channels excluded because their whole adapter was escalated away from ride
+                    // `tried` (nextChannel's one exclusion input) but were never launched — keep the true reason so
+                    // the dispatch row never labels an unlaunched sibling "already tried".
+                    const vendorEscalated = new Map();
+                    // …and a resume restores them with their reasons, apart from the channels actually dispatched.
+                    for (const [k, why] of Object.entries(rs?.escalated ?? {})) {
+                        if (tried.includes(k))
+                            continue;
+                        tried.push(k);
+                        vendorEscalated.set(k, why);
+                    }
+                    // OBS-1169 add.2: the ADAPTER exclusion itself, apart from any sibling channel — a single-channel
+                    // adapter has no untried sibling to carry it, yet its exhausted channel must stay out of the
+                    // recycle pool (and a resume's) until the release that clears `tried`.
+                    const escalatedAdapters = new Set(rs?.escalatedAdapters ?? []);
+                    const escalateAdapter = (adapter, reason) => {
+                        escalatedAdapters.add(adapter);
+                        for (const c of channels) {
+                            const k = channelKey(c);
+                            if (c.adapter !== adapter || tried.includes(k))
+                                continue;
+                            tried.push(k);
+                            vendorEscalated.set(k, reason);
+                        }
+                    };
                     // VIS-02 convention: absence = no seeding happened. The observable surface for criterion 2's
                     // exclusion-list-equality oracle. Daemon-side append only — no journal.ts write-path change (Phase 48
                     // stays unblocked); inert to replayStatuses (unknown events ignored, pinned at journal.test.ts:70-80).
@@ -2923,6 +3289,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                             attempts: rs.attempts, tried: [...tried], assignment,
                             workerDispatchOrdinal: previousDispatch?.data.workerDispatchOrdinal ?? null,
                         });
+                    if (bootstrapExhausted === channelKey(assignment)) { // a later tier-climb restore may have moved it off
+                        await park(t, `${bootstrapExhausted} failed at bootstrap and no eligible channel remains after resume${poolExhaustion(t, cfg)}`, "infra", assignment, rs?.attempts ?? 0, startMs, 0, 0, undefined, 0, "fresh", { cause: "bootstrap", channel: bootstrapExhausted });
+                        return;
+                    }
                     // Keep one live list: recovery retries must see exclusions added by onGate during the round.
                     const badReviewers = [...replayedReviewerExclusions];
                     const noteReviewEvent = (e) => {
@@ -2931,18 +3301,33 @@ export async function runDaemon(repoRoot, opts = {}) {
                             if (!badReviewers.includes(e.payload.reviewer))
                                 badReviewers.push(e.payload.reviewer);
                         }
+                        // OBS-1196: a seat whose same-subject re-emission delivered a valid verdict was a delivery flake,
+                        // not a bad reviewer — it stays seatable for this task's later rounds.
+                        if (e.name === "review-reemission" && e.payload.delivered === true && typeof e.payload.reviewer === "string") {
+                            const at = badReviewers.indexOf(e.payload.reviewer);
+                            if (at >= 0)
+                                badReviewers.splice(at, 1);
+                        }
                     };
                     // Keep the measured siblings, including a red judge, while replacing only a missing review.
                     // Every dispatched seat is excluded for this task, so the loop is bounded by the eligible pool.
                     const runReviewRecovery = async (task, ctx, allowSelection = true) => {
                         ctx.authorizeInfraRetry = cfg.executionPolicy?.boundedInfrastructure
                             ? (subject, cause) => reserveInfrastructureRetry(journal.read(), task.id, subject, journal.append.bind(journal), cause) : undefined;
-                        if (cfg.executionPolicy?.repairSelection && allowSelection) {
+                        if (repairSelection && allowSelection) {
                             const decision = repairSelectionDecision(journal.read(), task.id, true);
                             ctx.selectTests = decision.selectTests;
                             ctx.requiredRepairTests = decision.requiredFiles;
                             ctx.selectionReason = decision.reason;
                         }
+                        else if (repairSelection) {
+                            // A recheck runs the full suite; its recorded scope keeps a red there attributable.
+                            ctx.selectTests = false;
+                            ctx.selectionReason = "recheck-full-suite";
+                        }
+                        // OBS-1151: every round judges fresh; the journal's earlier judgments (this run and before a
+                        // resume) are only the subjects a reversed ruling is compared against.
+                        ctx.priorJudgments = priorJudgments(journal.read(), task.id);
                         // Resume and ordinary verification share this boundary. Count persisted rounds so a
                         // resumed daemon cannot reuse a previous round's identity within the same attempt.
                         ctx.buildReceiptIdentity = {
@@ -2977,7 +3362,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // reviewer-exclusion list (badReviewers), never a second parallel counter. OBS-189: scoped to the
                     // current engagement — an operator approval (uphold or accept) resets the round budget, so an upheld
                     // task can dispatch its funded attempt instead of re-parking against the whole journal's history.
-                    const reviewRoundsDrawn = () => reviewRoundsSinceApproval(decisiveReviewRounds(journal.read()), t.id);
+                    const reviewRoundsDrawn = () => reviewRoundsSinceApproval(journal.read(), t.id, decisiveReviewRounds);
                     // OBS-193: journal the in-gate review retry (mirrors judge-retry) and exclude the flaked seat from
                     // later attempts' reviewer picks. One helper, called from both onGate sites (satisfied-gate + main).
                     const noteReviewRetry = (g) => {
@@ -3045,8 +3430,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 ...(typeof g.meta.producer === "string" ? { producer: g.meta.producer } : {}),
                                 ...(typeof g.meta.producerAttempt === "number" ? { producerAttempt: g.meta.producerAttempt } : {}),
                             } : {}),
-                            ...(cfg.executionPolicy && !g.pass ? { disposition: failureDisposition(g) } : {}),
-                            ...Object.fromEntries(["runnerInfraRerun", "hostStarvedRerun", "recoveryBlocked", "failingFiles", "selectionDecision", "failureEvidence"]
+                            ...((cfg.executionPolicy || repairSelection) && !g.pass ? { disposition: failureDisposition(g) } : {}),
+                            ...Object.fromEntries(["runnerInfraRerun", "hostStarvedRerun", "recoveryBlocked", "failingFiles", "selectionDecision", "failureEvidence",
+                                "forgivenFingerprints", "freshFingerprints", "baselineProvenance", "judgment", "adjudication", "judgeDisagreement", "interruptions"]
                                 .filter((key) => g.meta?.[key] !== undefined).map((key) => [key, g.meta[key]])),
                             // OBS-540: preserve terminal-vs-retryable infra exactly. normalizeGateOutcome deliberately
                             // defaults a legacy infra row to retryable, so dropping an explicit false here reverses the
@@ -3072,7 +3458,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             } : {}),
                             ...(g.gate === "review" && typeof g.meta?.reviewer === "string" ? {
                                 reviewer: g.meta.reviewer,
-                                ...Object.fromEntries(["cause", "seatAuthoredBytes", "bytes", "rawPath", "briefPath", "timeoutMs", "unparseable", "noVerdict", "resolved", "reraised", "reviewerFloor", "reviewerFloorCause", "reviewerTier"]
+                                ...Object.fromEntries(["cause", "seatAuthoredBytes", "bytes", "rawPath", "briefPath", "timeoutMs", "unparseable", "noVerdict", "resolved", "reraised", "settledAnchors", "reviewerFloor", "reviewerFloorCause", "reviewerTier"]
                                     .filter((key) => g.meta?.[key] !== undefined).map((key) => [key, g.meta[key]])),
                                 ...(typeof g.meta.vendor === "string" ? { vendor: g.meta.vendor } : {}),
                                 ...(typeof g.meta.provider === "string" ? { provider: g.meta.provider } : {}),
@@ -3169,7 +3555,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // OBS-254: RE-DERIVED from the journal here, at prompt-build time, rather than trusted to survive
                     // in resume state. The journal already holds the upheld review's bytes; no reset of attempt or
                     // channel state can take them away, on any path, including `resume --retry-failed`.
-                    const upheldFeedback = upheldFeedbackByTask(journal.read()).get(t.id) ?? rs?.upheldFeedback;
+                    const upheldFeedback = upheldFeedbackByTask(effectiveEvents(journal.read())).get(t.id) ?? rs?.upheldFeedback; // OBS-1178: a refused uphold funds no brief
                     const carriedEvidence = priorRunEvidence.findings
                         .filter((finding) => finding.taskId === t.id)
                         .map(formatPriorFindingEvidence)
@@ -3184,7 +3570,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         : "");
                     let ladderIdx = 0;
                     const engagementRows = () => {
-                        const rows = journal.read().filter((e) => e.taskId === t.id);
+                        const rows = effectiveEvents(journal.read()).filter((e) => e.taskId === t.id);
                         const approval = rows.map((e) => e.event).lastIndexOf("task-approved");
                         return rows.slice(approval + 1);
                     };
@@ -3206,7 +3592,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                             return;
                         const from = channelKey(assignment);
                         const to = channelKey(next);
-                        const poolBefore = channels.filter((c) => !tried.includes(channelKey(c)) && !demotedChannels.has(channelKey(c))).map(channelKey);
+                        const poolBefore = channels.filter((c) => !tried.includes(channelKey(c)) && !demotedChannels.has(channelKey(c))
+                            && inTaskPool(t, cfg, channelKey(c))).map(channelKey);
                         journal.append("tier-escalated", t.id, {
                             attempt, cause, gate: gate.gate, fingerprint: normalizeGateFailure(gate.details).slice(0, 500),
                             from, to, fromTier: assignment.tier, toTier: next.tier, poolBefore,
@@ -3216,7 +3603,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             if (c.tier === assignment.tier && channelKey(c) !== to)
                                 climbSkips.add(channelKey(c));
                         climbProvenance = `tier-escalated ${from} → ${to} (${cause})`;
-                        assignment = { adapter: next.adapter, model: next.model, channel: next.channel, tier: next.tier };
+                        assignment = seatAssignment(next);
                         tried.push(to);
                         return "climbed";
                     };
@@ -3250,12 +3637,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                         }
                         return next;
                     };
-                    // OBS-1161: capacity requeues spent on a seat for this task since its last operator release —
-                    // journal-derived so the budget survives a resume instead of restarting with the process.
-                    const capacityRequeuesOn = (channel) => {
-                        const rows = journal.read().filter((e) => e.taskId === t.id);
+                    // OBS-1161: capacity requeues (OBS-1169: and bootstrap retries) spent on a seat for this task since
+                    // its last operator release — journal-derived so the budget survives a resume instead of restarting.
+                    const requeuesOn = (event, channel) => {
+                        const rows = effectiveEvents(journal.read()).filter((e) => e.taskId === t.id);
                         const since = rows.map((e) => e.event).lastIndexOf("task-approved");
-                        return rows.slice(since + 1).filter((e) => e.event === "capacity-requeue" && e.data.channel === channel).length;
+                        return rows.slice(since + 1).filter((e) => e.event === event && e.data.channel === channel).length;
                     };
                     // OBS-202 (operator law: "you can spawn as many as you want"): channels are session FACTORIES,
                     // not consumed seats — a tried channel can always host a fresh worker session, and a fresh
@@ -3264,19 +3651,25 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // on artificial scarcity; MAX_ATTEMPTS and the review round cap are the real bounds. Only a
                     // fleet whose every channel is DEMOTED (verified dead: auth/setup/provider outage) has nothing
                     // left to spawn — that case alone still parks.
+                    // OBS-1187: shared with the demotion seam's pooled recycle so neither relaunches an escalated adapter.
+                    const recycleExcluded = () => [channelKey(assignment), ...channels.filter((c) => escalatedAdapters.has(c.adapter)).map(channelKey)];
                     const failoverOrRecycle = (site) => {
                         const next = failover(site);
                         if (next)
                             return next;
-                        const recycled = nextChannel(assignment, t, cfg, channels, [channelKey(assignment)], profile, demotedChannels)
+                        // OBS-1169: a vendor escalated away from stays out of the recycle pool until its release —
+                        // recycling any of its channels, launched or not, would launch the broken bootstrap again.
+                        const recycled = nextChannel(assignment, t, cfg, channels, recycleExcluded(), profile, demotedChannels)
                             ?? (demotedChannels.has(channelKey(assignment)) ? null : assignment);
                         if (recycled)
                             journal.append("channel-recycle", t.id, { site, channel: channelKey(recycled) });
                         return recycled;
                     };
-                    const runConsult = (trigger, transcript, diffOrFeedback, gates) => {
+                    const runConsult = async (trigger, transcript, diffOrFeedback, gates) => {
                         consults++;
-                        return consult({
+                        // OBS-1182: every launched consult seat, failed ones included, rides the verdict into the journal.
+                        const invocations = [];
+                        const v = await consult({
                             taskId: t.id, trigger,
                             journalTail: JSON.stringify(journal.read().slice(-20)),
                             transcript: transcript.slice(-8000),
@@ -3285,7 +3678,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // D-07: consult panes self-clean when the verdict is read (keepLlm) — only "forever" keeps them.
                         // v1.54 T1: channels = this run's doctor-filtered live list — consult.prefer seat liveness
                         // is judged against it, never rebuilt from config (installed-but-unauthed seats would stall).
-                        { keep: keepLlm, onSlot: keepLlm ? (s) => keptSlots.push(s) : undefined, runId, channels: pools.consult });
+                        { keep: keepLlm, onSlot: keepLlm ? (s) => keptSlots.push(s) : undefined, onInvocation: (inv) => invocations.push(inv), runId, channels: pools.consult, health });
+                        // A lone answering seat is already the row's adapter/model/vendor/effort; the list is journaled
+                        // only when a seat failed, so the row never repeats itself and a failed seat never vanishes.
+                        return invocations.some((inv) => inv.outcome === "failed") ? { ...v, invocations } : v;
                     };
                     // returns true → continue attempting, false → task is terminal (parked)
                     // trigger (why the consult ran) is threaded in so the decompose/human park keeps its cause —
@@ -3294,9 +3690,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                         journal.append("consult-verdict", t.id, {
                             action: v.action, notes: v.notes,
                             adapter: v.adapter ?? "unknown", model: v.model ?? "unknown", vendor: v.vendor ?? "unknown",
+                            ...(v.effort ? { effort: v.effort } : {}),
                             ...(v.reason ? { reason: v.reason } : {}),
                             ...(v.guidance ? { guidance: v.guidance } : {}),
                             ...(v.excludeAdapter ? { excludeAdapter: v.excludeAdapter } : {}),
+                            ...(v.invocations?.length ? { invocations: v.invocations } : {}),
                         });
                         await driver.notify(`tickmarkr ${runId}: ${t.id} consult verdict: ${v.action}`, { tier: "attention" });
                         if (v.action === "retry") {
@@ -3316,15 +3714,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                             // nextChannel's existing tried parameter — zero router changes (D-03). Unknown adapter
                             // (zero matches) is a no-op expansion ⇒ ordinary channel-level reroute. Task-scoped:
                             // `tried` lives inside execTask, so a sibling task is unaffected.
-                            if (v.excludeAdapter) {
-                                for (const c of channels) {
-                                    if (c.adapter === v.excludeAdapter) {
-                                        const k = channelKey(c);
-                                        if (!tried.includes(k))
-                                            tried.push(k);
-                                    }
-                                }
-                            }
+                            if (v.excludeAdapter)
+                                escalateAdapter(v.excludeAdapter, `vendor escalated: consult excluded ${v.excludeAdapter}`);
                             const next = failoverOrRecycle("consult-reroute");
                             if (next) {
                                 assignment = next;
@@ -3333,7 +3724,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     tried.push(k);
                                 return true;
                             }
-                            await park(t, "consult said reroute but every channel is demoted (verified dead) — nothing left to spawn", "reroute-exhausted", assignment, attempts, startMs, gateFails, consults, tokens, metered, retryMode);
+                            await park(t, `consult said reroute but every channel is demoted (verified dead) — nothing left to spawn${poolExhaustion(t, cfg)}`, "reroute-exhausted", assignment, attempts, startMs, gateFails, consults, tokens, metered, retryMode);
                             return false;
                         }
                         await park(t, `consult verdict: ${v.action} — ${v.notes}`, trigger, assignment, attempts, startMs, gateFails, consults, tokens, metered, retryMode); // decompose|human
@@ -3345,7 +3736,157 @@ export async function runDaemon(repoRoot, opts = {}) {
                     let satisfiedGate = satisfiedGates.get(t.id);
                     const replayedGates = fundedRerun ? undefined : replayedGateResults.get(t.id);
                     const recheck = approvalAction?.authority === "battery";
-                    resumeGateReplay: if (satisfiedGate || replayedGates || recheck) {
+                    // OBS-1109: finished work is harvested, never redone — on resume too. A daemon that died while its
+                    // worker ran leaves an owned attempt between worker-launch and worker-result: its pane may hold the
+                    // attempt's own nonce-bound trailer, its branch the committed work. Only after the attempt's owned
+                    // processes are reaped is either read as its result — a matching trailer as the worker's claim,
+                    // commits without one as the same no-trailer evidence the live harvest synthesizes — and the gate
+                    // replay below then judges it under the PRODUCING attempt's author, with no new dispatch. An
+                    // unfinished attempt, a pane holding another attempt's trailer, or cleanup that cannot be proven
+                    // is declined onto the ordinary recovery path. A harvest an earlier resume recorded is gated again,
+                    // never recorded twice.
+                    const harvestInterruptedAttempt = async () => {
+                        const found = interruptedAttempt(journal.read(), t.id);
+                        if (!found || (!found.launch && !found.result))
+                            return found?.assignment;
+                        const { attempt } = found;
+                        const wt = worktreePath(repoRoot, `${branch}--${t.id}`);
+                        const recordHarvest = (commits, finished, summary) => journal.append("worker-result-harvested", t.id, {
+                            attempt, commits, summary: finished ? summary : HARVESTED_RESULT_SUMMARY, source: RESUME_HARVEST_SOURCE, trailer: finished,
+                        });
+                        // A declined attempt leaves the fold's spare (interruptedAttempt closes on this row), so its pane
+                        // is swept here, before the ordinary recovery path dispatches beside it — the baseline sweep, late.
+                        const decline = async (reason) => {
+                            journal.append("resume-harvest-declined", t.id, { attempt, reason });
+                            await reconcile({ spareLiveLlm: true });
+                            return undefined;
+                        };
+                        // Owned-process cleanup before any result is read as final: the attempt's own process group and
+                        // dispatch marker, reaped through the same reapWorker a live harvest uses. Uncertain is declined.
+                        const reapOwned = async (key, launch) => {
+                            workerOwners.set(key, { taskId: t.id, attempt, groupFile: `${launch.dispatchScript}.${launch.nonce}.pgid`,
+                                marker: launch.dispatchScript, identities: new Map(), descendants: new Map() });
+                            try {
+                                await reapWorker(key);
+                                return undefined;
+                            }
+                            catch (error) {
+                                return `owned-process cleanup uncertain: ${error instanceof Error ? error.message : String(error)}`;
+                            }
+                        };
+                        if (found.result) {
+                            // A daemon recorded this attempt's result, then died before its harvest row (a live daemon
+                            // before its no-trailer synthesis, or a resume between its two rows): finish that record from
+                            // the result it wrote — the pane is never re-read, the result never rewritten. A resume wrote
+                            // its result only after reaping; a live daemon writes it BEFORE handling a failed reap, so its
+                            // owned processes are reaped again here. A result that neither finished nor left commits has
+                            // nothing to gate: the ordinary recovery path owns it.
+                            if (!found.result.reaped) {
+                                if (!found.launch)
+                                    return decline("owned-process cleanup unproven: the launch recorded no ownership evidence");
+                                const uncertain = await reapOwned(found.launch.slot, found.launch);
+                                if (uncertain)
+                                    return decline(uncertain);
+                            }
+                            const commits = existsSync(wt) ? await commitsAheadOf(await integrationHead(intWt), wt) : [];
+                            if (!found.result.finished && commits.length === 0)
+                                return decline("unfinished");
+                            recordHarvest(commits, found.result.finished, found.result.summary);
+                            return found.assignment;
+                        }
+                        const launch = found.launch;
+                        const { nonce, slot } = launch;
+                        if (!existsSync(wt))
+                            return decline("task worktree missing");
+                        const adapter = adapters.find((a) => a.id === found.assignment.adapter);
+                        if (!adapter)
+                            return decline(`adapter ${found.assignment.adapter} unavailable to read the trailer`);
+                        // The journaled slot is read through THIS daemon's driver, a fresh instance since the last one
+                        // died. A pane the driver cannot read is DECLINED, never classified: an unreadable pane proves
+                        // neither a matching trailer nor the absence of a foreign one, so it is neither harvested nor
+                        // gated as trailerless evidence. A driver whose terminals outlive it (Orca) adopts the owned
+                        // terminal (Orca) or pane (Herdr, OBS-1203): bound only on ownership evidence — the journaled owned
+                        // name AND the task checkout — never a name alone. The journaled slot.id is NEVER trusted across
+                        // daemon instances: a fresh driver numbers its slots from one again, so an interrupted task's old
+                        // id can name whatever terminal THIS instance bound under that id (another task's adoption or allocation).
+                        // A driver with no read-only adoption is declined BEFORE anything is bound: slot() allocates —
+                        // herdr's reclaims the same-named pane (closing the evidence unread) and holds a dispatch lease
+                        // only run() releases — so it is never an adoption fallback; that driver keeps ordinary recovery.
+                        if (!driver.adopt)
+                            return decline("no read-only adoption on this driver");
+                        let ownedSlot;
+                        let pane;
+                        try {
+                            ownedSlot = await driver.adopt(slot);
+                            pane = await driver.read(ownedSlot, PANE_READ_ROWS);
+                        }
+                        catch (error) {
+                            return decline(`pane unreadable: ${error instanceof Error ? error.message : String(error)}`);
+                        }
+                        const parsed = adapter.parse(pane, nonce);
+                        const finished = parsed.cause === undefined;
+                        const foreign = !finished && [...pane.matchAll(/TICKMARKR_RESULT_([0-9a-z]+)/g)]
+                            .some(([, other]) => other !== nonce && adapter.parse(pane, other).cause === undefined);
+                        if (foreign)
+                            return decline("foreign-nonce");
+                        const taskBase = await integrationHead(intWt);
+                        if (!finished && (await commitsAheadOf(taskBase, wt)).length === 0)
+                            return decline("unfinished");
+                        const uncertain = await reapOwned(ownedSlot, launch);
+                        if (uncertain)
+                            return decline(uncertain);
+                        const commits = await commitsAheadOf(taskBase, wt); // re-measured: the reaped writer is gone now
+                        // The source tag makes a death between these two rows recoverable: the next resume finishes the record.
+                        journal.append("worker-result", t.id, {
+                            ok: parsed.ok, summary: parsed.summary, deviations: parsed.deviations, finished, exitCode: null, attempt,
+                            source: RESUME_HARVEST_SOURCE, ...(parsed.cause ? { cause: parsed.cause } : {}),
+                        });
+                        recordHarvest(commits, finished, parsed.summary);
+                        return found.assignment;
+                    };
+                    const harvestAuthor = rs && !satisfiedGate && !replayedGates && !recheck ? await harvestInterruptedAttempt() : undefined;
+                    // OBS-1202: a recheck bound to a stall park that recorded a reapFailure re-verifies the parked
+                    // attempt's owned census through the same reapWorker a live harvest uses, BEFORE any gate reads
+                    // its tree. Only a complete, empty census releases the harvested commits to the battery; an
+                    // unreadable (null) or surviving census keeps the task parked on the same kind — a stall carrying
+                    // the fresh reapFailure, bound by its own new token — and no worker is funded either way. Plain
+                    // approve on that park keeps its dispatch semantics.
+                    if (recheck) {
+                        const approvalRow = effectiveEvents(journal.read()).reverse()
+                            .find((e) => e.taskId === t.id && e.event === "task-approved" && e.data.release === RECHECK_RELEASE);
+                        if (typeof approvalRow?.data.reapFailure === "string") {
+                            const launch = [...journal.read()].reverse().find((e) => e.taskId === t.id && e.event === "worker-launch");
+                            const owned = launch?.data.slot;
+                            let uncertain;
+                            if (typeof launch?.data.nonce !== "string" || typeof launch.data.dispatchScript !== "string"
+                                || typeof owned?.name !== "string" || typeof owned.cwd !== "string") {
+                                uncertain = "the parked attempt recorded no launch ownership evidence";
+                            }
+                            else {
+                                const key = { ...owned };
+                                workerOwners.set(key, { taskId: t.id, attempt: Number(launch.data.attempt ?? 0),
+                                    groupFile: `${launch.data.dispatchScript}.${launch.data.nonce}.pgid`, marker: launch.data.dispatchScript,
+                                    identities: new Map(), descendants: new Map() });
+                                try {
+                                    await reapWorker(key);
+                                    // reapWorker returns normally for a null census when no ownership file was readable (a
+                                    // missing .pgid/.session with no descendants); recovery needs a RECORDED empty census.
+                                    const census = reapReports.get(key)?.survivors;
+                                    if (!Array.isArray(census) || census.length > 0) {
+                                        uncertain = `worker group ${reapReports.get(key)?.processGroup ?? "unknown"} census unrecorded`;
+                                    }
+                                }
+                                catch (error) {
+                                    uncertain = error instanceof Error ? error.message : String(error);
+                                }
+                            }
+                            if (uncertain !== undefined) {
+                                await park(t, `worker could not be reaped before recheck: ${uncertain}`, "stall", null, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode, { reapFailure: uncertain });
+                                return;
+                            }
+                        }
+                    }
+                    resumeGateReplay: if (satisfiedGate || replayedGates || recheck || harvestAuthor) {
                         const taskBase = await integrationHead(intWt);
                         taskBases.set(t.id, taskBase);
                         const taskBranch = `${branch}--${t.id}`;
@@ -3354,7 +3895,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // battery gates — read from the pending approval row, never re-selected here, so the tree
                         // approve counted and the tree the daemon gates are one and the same, checkout present or not.
                         const preservedRef = recheck
-                            ? [...journal.read()].reverse().find((e) => e.taskId === t.id && e.event === "task-approved" && e.data.release === RECHECK_RELEASE)?.data.recheckedRef
+                            ? effectiveEvents(journal.read()).reverse().find((e) => e.taskId === t.id && e.event === "task-approved" && e.data.release === RECHECK_RELEASE)?.data.recheckedRef
                             : undefined;
                         if (!existsSync(priorWt) && !preservedRef) {
                             if (satisfiedGate || recheck)
@@ -3366,14 +3907,16 @@ export async function runDaemon(repoRoot, opts = {}) {
                         }
                         const resumeReason = recheck
                             ? "operator recheck"
-                            : satisfiedGate
-                                ? `approved gate ${satisfiedGate}`
-                                : `recorded gates on ${replayedGates.commit.slice(0, 10)}`;
+                            : harvestAuthor
+                                ? "harvested interrupted attempt"
+                                : satisfiedGate
+                                    ? `approved gate ${satisfiedGate}`
+                                    : `recorded gates on ${replayedGates.commit.slice(0, 10)}`;
                         const priorTaskTip = preservedRef ? (await shGit(`git rev-parse ${shq(preservedRef)}`, repoRoot)).stdout.trim() : await gitHead(priorWt);
                         const priorTaskSubject = await gateCommitSubject(taskBase, priorTaskTip, preservedRef ? repoRoot : priorWt);
                         const commitsToCarry = preservedRef ? await commitsAheadOfRef(taskBase, priorTaskTip, repoRoot) : await commitsAheadOf(taskBase, priorWt);
                         const wt = await recreateTaskWorktree(taskBranch, taskBase, priorWt);
-                        const carriedCommits = await cherryPickCommits(wt, commitsToCarry);
+                        const { carried: carriedCommits, accounted: accountedCommits } = await cherryPickCommits(wt, commitsToCarry);
                         // Reuse is about the tree the gates will actually inspect. The integration tip may have moved
                         // while the daemon was down, so compare after recreating the task on today's taskBase rather
                         // than against the stale worktree whose task-only history cannot see newly merged dependencies.
@@ -3383,13 +3926,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                         if (recheck) {
                             satisfiedGate = journal.replaySatisfiedGates(new Map([[t.id, currentTaskSubject]])).get(t.id);
                         }
-                        journal.append("worktree-recreation", t.id, { attempted: commitsToCarry, carried: carriedCommits });
+                        journal.append("worktree-recreation", t.id, {
+                            attempted: commitsToCarry, carried: carriedCommits, ...(accountedCommits.length > 0 ? { accounted: accountedCommits } : {}),
+                        });
                         // OBS-212: same fail-closed rule as the dispatch path — but this path is worse, because it runs
                         // ONLY the gates after the approved one and then MERGES. T3 took it on run-20260728-110135:
                         // approved past review at 11:22, recreated at 12:50, and phase-start{gates} / phase-start{merge}
                         // landed in the same second with zero gate-result events. Work missing here is merged unverified.
                         {
-                            const present = new Set(carriedCommits);
+                            const present = new Set([...carriedCommits, ...accountedCommits]);
                             for (const h of commitsToCarry) {
                                 if (!present.has(h) && (await shGit(`git merge-base --is-ancestor ${shq(h)} HEAD`, wt)).code === 0) {
                                     present.add(h);
@@ -3429,7 +3974,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const parkedAuthor = recheck
                             ? [...journal.read()].reverse().find((e) => e.event === "task-dispatch" && e.taskId === t.id)?.data.assignment
                             : undefined;
-                        const gateAuthor = parkedAuthor ?? rs?.lastAssignment ?? assignment;
+                        // OBS-1109: a harvested attempt's author is read from the journal, not from this resume's path —
+                        // a later resume that replays the harvest's recorded gates still gates it under its producer.
+                        const gateAuthor = parkedAuthor ?? resumeHarvestAuthor(journal.read(), t.id) ?? rs?.lastAssignment ?? assignment;
                         const satisfiedIndex = satisfiedGate ? GATE_NAMES.indexOf(satisfiedGate) : -1;
                         // The serial pipeline could have at most one blocking result, so "everything after the
                         // approved gate" was enough. v1.85 can record both verdict siblings red in one round, and a
@@ -3458,6 +4005,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                         if (recheck) {
                             remainingGates = declaredGates.filter((gate) => gate !== satisfiedGate);
                         }
+                        else if (harvestAuthor) {
+                            remainingGates = declaredGates; // the harvested attempt was never gated: every declared gate runs
+                        }
                         else if (satisfiedGate) {
                             remainingGates = t.gates.filter((gate) => {
                                 if (gate === satisfiedGate)
@@ -3526,7 +4076,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             const startedAt = Date.now();
                             const provisioned = await withCommandContext(t.id, () => sh(commands.build, wt));
                             provisionedRow = {
-                                gate: "build", commit: !satisfiedGate && !recheck ? replayedGates.commit : currentTaskSubject,
+                                gate: "build", commit: !satisfiedGate && !recheck && replayedGates ? replayedGates.commit : currentTaskSubject,
                                 exitCode: provisioned.code, durationMs: Date.now() - startedAt,
                             };
                             if (provisioned.code !== 0 && satisfiedGate !== "build") {
@@ -3540,7 +4090,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         if (provisionedRow !== undefined)
                             journal.append("gate-provisioned", t.id, provisionedRow);
                         const resumedTask = { ...t, gates: remainingGates };
-                        const operatorContext = approvalReviewContext(journal.read(), t.id, true);
+                        const operatorContext = approvalReviewContext(journal.read(), t.id);
                         gateLoop: while (true) {
                             fatalStop.signal.throwIfAborted();
                             executionSignal()?.throwIfAborted();
@@ -3551,7 +4101,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // This suffix is re-measured to decide whether resume may advance, but the interrupted
                                 // attempt already paid for its red result. The next worker-backed round remains the next
                                 // deterministic-fingerprint occurrence/review round for budget accounting.
-                                ...(!satisfiedGate && !recheck ? { replayMeasurement: true } : {}),
+                                ...(!satisfiedGate && !recheck && !harvestAuthor ? { replayMeasurement: true } : {}),
                             };
                             if (recheck && satisfiedGate === "review" && gateSubject.commit !== currentTaskSubject) {
                                 satisfiedGate = undefined;
@@ -3562,14 +4112,27 @@ export async function runDaemon(repoRoot, opts = {}) {
                             }
                             await trackedDriver.project?.(t.id, "in-review");
                             await waitForBaseline(t.id);
+                            // OBS-1106 residual: the live loop's timeout refresh, decided again from the journal, so a crash
+                            // cannot launder the copy it forbids. A harvested retry that landed nothing owes it exactly as
+                            // the live loop would have; a crash inside a forced battery before its test row still owes it.
+                            const lastRound = (() => {
+                                const own = journal.read().filter((e) => e.taskId === t.id);
+                                return own.slice(own.map((e) => e.event === "phase-start" && e.data.phase === "gates").lastIndexOf(true) + 1);
+                            })();
+                            const freshTimeout = !recheck && !satisfiedGate && ((harvestAuthor !== undefined && owesTimeoutRefresh(t, lastRound, gateSubject.commit))
+                                || (lastRound.some((e) => e.event === "gate-fresh-forced" && e.data.commit === gateSubject.commit)
+                                    && !lastRound.some((e) => e.event === "gate-result" && e.data.gate === "test")));
                             journal.phaseStart(t.id, "gates");
+                            if (freshTimeout) {
+                                journal.append("gate-fresh-forced", t.id, { gate: "test", attempt: gateSubject.attempt, commit: gateSubject.commit, reason: "no-commit-timeout-red", resumed: true });
+                            }
                             const { results } = await withCommandContext(t.id, async () => runReviewRecovery(resumedTask, {
                                 carriedAuthors: await subjectAuthors(journal.read(), t.id, wt, taskBase),
                                 producer: producerNow(),
                                 carriedFindings: outstandingReviewFindings(journal.read(), t.id),
                                 operatorContext,
                                 worktree: wt, baseRef: taskBase, result: priorResult, author: gateAuthor,
-                                commands, baseline, channels: pools.review, judgeChannels: pools.judge, adapters, cfg, artifactDir: journal.dir,
+                                commands, baseline, channels: pools.review, judgeChannels: pools.judge, health, adapters, cfg, artifactDir: journal.dir,
                                 collateral: collateral.get(t.id) ?? [],
                                 // a recheck re-verifies a human's release: it never selects tests down, it runs the suite.
                                 via: cfg.visibility.llm === "pane"
@@ -3587,7 +4150,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // flaking seat is re-asked on every task.
                                 reviewNoVerdicts,
                                 recheck, // OBS-1055: a recheck discards cached reds — the battery re-measures what the operator questioned
+                                cachedRedBypass: freshTimeout ? "timeout-fresh" : undefined,
                                 onGate: async (e) => {
+                                    if (!liveEngagement())
+                                        return;
                                     if (e.phase === "start") {
                                         notePhaseStart(e);
                                         journal.phaseStart(t.id, phaseForGate(e.gate), { gate: e.gate, index: e.index, total: e.total, ...(e.parentAt === undefined ? {} : { parallel: true }) });
@@ -3603,10 +4169,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     inParallelOrder(g.gate, () => {
                                         journalGateResult(g);
                                         noteReviewRetry(g);
-                                        if (g.gate === "review" && !g.pass && /unparseable/.test(g.details)
-                                            && typeof g.meta?.reviewer === "string") {
+                                        if (isGarbageReview(g))
                                             badReviewers.push(g.meta.reviewer);
-                                        }
                                     });
                                 },
                             }, false));
@@ -3649,6 +4213,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // erase an EARLIER chargeable attempt and attribute the park to the assignment the rewind
                                 // restored. Ask the journal which state this is, and take the classified dispatch's own
                                 // assignment back with it.
+                                if (await adjudicateInfraShapedRed(t, results, wt, gateSubject.commit, rs?.attempts ?? 0, false, (reason) => park(t, reason, "infra", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode)))
+                                    return;
                                 const classified = journal.classifiedDispatch(t.id);
                                 if (await dispositionScopeRed(t, results, classified?.assignment ?? gateAuthor, classified ? (rs?.attempts ?? 0) : Math.max(0, (rs?.attempts ?? 0) - 1), startMs, gateFails, consults, tokens, metered, retryMode, await treeOrDiffPaths(taskBase, wt)))
                                     return;
@@ -3667,7 +4233,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             await park(t, `recheck red: pinned ${pin.via}:${pin.model} is unavailable to host the repair — refusing the ladder`, "gate-fail", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
                                             return;
                                         }
-                                        assignment = { adapter: seat.adapter, model: seat.model, channel: seat.channel, tier: seat.tier };
+                                        assignment = seatAssignment(seat);
                                     }
                                     // Carry completeness was verified before this replay battery. Apply the ordinary
                                     // repair bounds here too; a restored red must fund the same findings-bearing dispatch.
@@ -3778,13 +4344,21 @@ export async function runDaemon(repoRoot, opts = {}) {
                         }
                         // OBS-57: a demoted channel must not be re-dispatched on consult retry or provider requeue.
                         if (demotedChannels.has(channelKey(assignment))) {
-                            const next = nextChannel(assignment, t, cfg, channels, tried, profile, demotedChannels);
+                            // OBS-1187: a pooled task recycles a live pool member (OBS-202) before it may park naming the pool;
+                            // it never keeps a demoted seat and never leaves the pool.
+                            const pooled = taskPool(t, cfg) !== undefined;
+                            const next = nextChannel(assignment, t, cfg, channels, tried, profile, demotedChannels)
+                                ?? (pooled ? nextChannel(assignment, t, cfg, channels, recycleExcluded(), profile, demotedChannels) : null);
                             if (next) {
                                 assignment = next;
                                 const k = channelKey(next);
                                 if (!tried.includes(k))
                                     tried.push(k);
                             }
+                            else if (pooled) {
+                                await park(t, `${channelKey(assignment)} is demoted (verified dead) and no live pool member remains${poolExhaustion(t, cfg)}`, "reroute-exhausted", assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode);
+                                return;
+                            }
                         }
                         // v1.29: consume the prior gate-failed session once. Same channel + known under-threshold context
                         // + adapter capability resumes; every other path is today's fresh dispatch.
@@ -3809,7 +4383,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 gate: banned, from: channelKey(assignment), to: next ? channelKey(next) : null,
                             });
                             if (!next) {
-                                await park(t, gateFailApprovalReason(t.id, `identical ${banned} failure twice this engagement — an identical retry is banned and no untried channel is left`), "gate-fail", assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode);
+                                await park(t, gateFailApprovalReason(t.id, `identical ${banned} failure twice this engagement — an identical retry is banned and no untried channel is left${poolExhaustion(t, cfg)}`), "gate-fail", assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode);
                                 return;
                             }
                             assignment = next;
@@ -3886,7 +4460,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 feedback = feedback ? `${feedback}\n\n${consultBrief}` : consultBrief;
                             }
                         }
-                        const scopeApproval = [...journaledSoFar].reverse().find((e) => e.taskId === t.id && (e.event === "task-approved" || e.event === "task-dispatch"));
+                        const scopeApproval = effectiveEvents(journaledSoFar).reverse().find((e) => e.taskId === t.id && (e.event === "task-approved" || e.event === "task-dispatch"));
                         retryMode = scopeApproval?.data.release === "scope-request" ? "fresh" : repairFindings
                             ? "repair"
                             : priorSession
@@ -3915,6 +4489,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // spends two frontier attempts re-deriving a known defect has to be able to answer afterwards.
                         fatalStop.signal.throwIfAborted();
                         const workerDispatchOrdinal = nextWorkerDispatchOrdinal++;
+                        vendorEscalated.delete(channelKey(assignment)); // dispatched now: from here on it IS tried
                         journal.append("task-dispatch", t.id, {
                             ...(scopeApproval?.data.release === "scope-request" ? { files: t.files, graphDefinitionHash: graphDefinitionHash(graph) } : {}),
                             assignment, attempt, workerDispatchOrdinal, provenance: dispatchProvenance([
@@ -3927,7 +4502,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 .filter((key) => key !== channelKey(assignment)).sort(),
                             exclusionReasons: Object.fromEntries([...new Set([...demotedChannels, ...tried, ...climbSkips])]
                                 .filter((key) => key !== channelKey(assignment))
-                                .map((key) => [key, demotedChannels.has(key) ? "demoted" : tried.includes(key) ? "already tried" : "tier climb skipped"])),
+                                .map((key) => [key, demotedChannels.has(key) ? "demoted"
+                                    : vendorEscalated.get(key) ?? (tried.includes(key) ? "already tried" : "tier climb skipped")])),
                             ...(outstandingFindings.length > 0 ? { carriedFindings: outstandingFindings } : {}),
                             ...(carriedConsultGuidance ? { carriedConsultGuidance } : {}),
                         });
@@ -3947,12 +4523,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // OBS-58: quota-failover and every retry recreate the task worktree from the integration tip —
                         // cherry-pick prior attempts' landed commits forward so a failover dispatch cannot silently
                         // orphan work a consult already verified as landed.
-                        let carriedCommits = [];
-                        if (commitsToCarry.length > 0) {
-                            carriedCommits = await cherryPickCommits(wt, commitsToCarry);
+                        const { carried: carriedCommits, accounted: accountedCommits } = commitsToCarry.length > 0
+                            ? await cherryPickCommits(wt, commitsToCarry) : { carried: [], accounted: [] };
+                        if (recreating) {
+                            journal.append("worktree-recreation", t.id, {
+                                attempted: commitsToCarry, carried: carriedCommits, ...(accountedCommits.length > 0 ? { accounted: accountedCommits } : {}),
+                            });
                         }
-                        if (recreating)
-                            journal.append("worktree-recreation", t.id, { attempted: commitsToCarry, carried: carriedCommits });
                         // T2 review (material): harvest eligibility is "does this WORKTREE carry unverified work",
                         // measured against taskBase — the same base the fast-kill's delta probe and the gates
                         // themselves use. It was measured against this attempt's post-carry HEAD, which excluded
@@ -3963,7 +4540,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // quota, dead-channel and provider-death all classify the PRE-HARVEST outcome below and fire
                         // BEFORE the synthesis, so carried-only work reaches gates without bypassing any failover.
                         const priorNamed = [...new Set([...commitsToCarry, ...carriedCommits])];
-                        const presentCommits = new Set(carriedCommits);
+                        const presentCommits = new Set([...carriedCommits, ...accountedCommits]);
                         for (const h of commitsToCarry) {
                             if (!presentCommits.has(h) && (await shGit(`git merge-base --is-ancestor ${shq(h)} HEAD`, wt)).code === 0) {
                                 presentCommits.add(h);
@@ -4020,10 +4597,18 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 ? `${new TextDecoder().decode(rawBytes.subarray(0, cap))}\n… diff truncated at gates.diffCap (${cap} bytes)`
                                     + `\nPARTIAL DIFF: the diff above is incomplete; files cut by the cap: ${droppedFiles.join(", ") || "(unknown)"}`
                                 : raw.stdout;
-                            const brief = repairBrief(repairFindings, diff, taskBase);
+                            const repeated = reraisedReviewChains(journaledSoFar, t.id).filter((chain) => chain.reraises > 1);
+                            const brief = repairBrief(repairFindings, diff, taskBase, repeated);
                             // anything the live brief holds beyond the journaled findings (a consult's guidance) is kept:
                             // a repair adds the diff and the fix-only contract, it never subtracts what was already known.
-                            feedback = feedback && !brief.includes(feedback) ? `${brief}\n\n${feedback}` : brief;
+                            // OBS-1195: a resumed upheld repair re-derives the same review bytes on both carries; when the
+                            // repair already quotes them verbatim they are said once, and the operator's uphold line stays.
+                            // Both carries had their deferrals cut above, so the quote is compared after the same cut.
+                            const upheldQuote = upheldFeedback ? withoutDeferrals(`review: ${upheldFeedback}`) : undefined;
+                            const rest = upheldQuote && brief.includes(upheldQuote)
+                                ? feedback.replace(upheldQuote, "").replace(/\n{3,}/g, "\n\n").trim()
+                                : feedback;
+                            feedback = rest && !brief.includes(rest) ? `${brief}\n\n${rest}` : brief;
                             journal.append("repair-dispatch", t.id, { workerDispatchOrdinal, diffBytes: Buffer.byteLength(diff, "utf8"), capped, ...(capped ? { droppedFiles } : {}) });
                         }
                         if (feedback || priorNamed.length > 0) {
@@ -4079,9 +4664,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 sessionId, attempt, workerDispatchOrdinal, baselineBytes: resumeBaseline?.bytes ?? null,
                             });
                         const icmd = retryMode === "resume"
-                            ? adapter.resumeCommand(sessionId, promptFile, assignment.model)
+                            ? adapter.resumeCommand(sessionId, promptFile, assignment.model, assignment.effort)
                             : cfg.visibility.worker === "interactive" && driver.interactive
-                                ? adapter.interactiveCommand(promptFile, assignment.model)
+                                ? adapter.interactiveCommand(promptFile, assignment.model, assignment.effort)
                                 : null;
                         // v1.69 T6: adapters that declare interactiveSeed launch the real TUI and inject the prompt as a
                         // user turn; they do NOT need the argv-seeding surface that interactiveCommand represents.
@@ -4142,6 +4727,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                             journal.append("worker-launch", t.id, {
                                 attempt,
                                 retryMode,
+                                // OBS-1109: the attempt's own ownership evidence, so a resumed daemon can harvest it.
+                                nonce, dispatchScript,
                                 ...(retryMode === "resume" ? { sessionId, workerDispatchOrdinal } : {}),
                                 driver: trackedDriver.id,
                                 slot: { ...slot },
@@ -4281,13 +4868,46 @@ export async function runDaemon(repoRoot, opts = {}) {
                         let capacityBannerKilled = false; // OBS-1161: same banner filter and gates, transient outcome
                         let driverProbeFailed = false;
                         let heldLegs = [];
+                        // OBS-1108: contact uncertainty is LATCHED per owned slot and dispatch (this attempt's slot): one
+                        // row when contact is lost and one when it returns, never one per retry. Retries back off while
+                        // latched, and a latch held past its deadline throws into the transport-uncertain park, which
+                        // preserves the worktree for a recheck. A read that recovers inside the deadline charges nothing.
+                        let contactLost;
+                        const contactDeadlineMs = contactUnreadableDeadlineMs ?? taskTimeoutMinutes * 60_000;
                         const noteDriverUnreadable = (error) => {
                             if (error instanceof HeldProbeExhausted)
                                 throw error;
                             driverProbeFailed = true;
                             heldLegs = ["quota:driver-unreadable", "stall:driver-unreadable"];
-                            journal.append("contact-unreadable", t.id, { slot: slot.name, attempt, source: "driver", concludes: false,
-                                error: error instanceof Error ? error.message : String(error) });
+                            const message = error instanceof Error ? error.message : String(error);
+                            if (contactLost) {
+                                contactLost.retries++;
+                                const unreadableMs = Date.now() - contactLost.since;
+                                if (unreadableMs >= contactDeadlineMs) {
+                                    throw new ContactUnreadableExhausted(`contact with ${slot.name} unreadable for ${unreadableMs}ms, past its ${contactDeadlineMs}ms deadline, after ${contactLost.retries} retries: ${message}`);
+                                }
+                                return;
+                            }
+                            contactLost = { since: Date.now(), retries: 0 };
+                            journal.append("contact-unreadable", t.id, { slot: slot.name, attempt, source: "driver", state: "unreadable",
+                                concludes: false, deadlineMs: contactDeadlineMs, error: message });
+                        };
+                        const noteContactReadable = () => {
+                            if (!contactLost)
+                                return;
+                            journal.append("contact-recovered", t.id, { slot: slot.name, attempt, source: "driver", state: "readable",
+                                unreadableMs: Date.now() - contactLost.since, retries: contactLost.retries });
+                            contactLost = undefined;
+                        };
+                        // The pause after a slice whose contact probe failed. Unlatched: the unspent slice, at most 1 s.
+                        // Latched: a next-contact-at schedule of its own — doubling per retry, bounded by the contact and
+                        // hard deadlines and NEVER by the poll slice, which clamps to 100 ms once the stall clock expires
+                        // and would otherwise collapse the backoff into ~10 orca calls a second for the rest of the window.
+                        const contactPauseMs = (sliceStart, slice, hardDeadline) => {
+                            const now = Date.now();
+                            if (!contactLost)
+                                return Math.max(0, Math.min(slice - (now - sliceStart), CONTACT_BACKOFF_BASE_MS));
+                            return Math.max(1, Math.min(CONTACT_BACKOFF_BASE_MS * 2 ** Math.min(contactLost.retries, CONTACT_BACKOFF_DOUBLINGS), contactLost.since + contactDeadlineMs - now, hardDeadline - now));
                         };
                         // T2 review: print mode's "the exit marker appeared". Kept apart from `finished` (the
                         // trailer) but still needed by the keepPanes decision below, whose contract is about a
@@ -4297,7 +4917,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                         let startupFailure = false;
                         let startupEvidence;
                         const startupDetector = new StartupFailureDetector(adapter);
+                        // OBS-1169: bootstrap text is evidence only inside the same startup prefix — every sample below
+                        // feeds it, so a tool frame, an input box or a saturated read seen at ANY poll closes it for good.
+                        const bootstrapDetector = new StartupFailureDetector(adapter, BOOTSTRAP_FAILURE_RE, true);
                         const startupFailureInWindow = (text, launchedAt) => {
+                            bootstrapDetector.sample(text, launchedAt);
                             startupEvidence ??= startupDetector.sample(text, launchedAt);
                             return startupEvidence !== undefined;
                         };
@@ -4307,8 +4931,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                             ? new SettledTrailerTracker(adapter.busyFrameMarkers) : undefined;
                         const sampleTrailer = (frame) => {
                             const parsed = adapter.parse(frame, nonce);
-                            const trailer = new RegExp(trailerPattern(nonce)).test(frame)
-                                && parsed.summary !== NO_TRAILER_SUMMARY && parsed.summary !== UNPARSEABLE_TRAILER_SUMMARY;
+                            // OBS-1175: the parser's cause, never the summary — a parsed trailer may carry a sentinel string.
+                            const trailer = new RegExp(trailerPattern(nonce)).test(frame) && parsed.cause === undefined;
                             return trailerFrames ? trailerFrames.sample(frame, trailer) : trailer;
                         };
                         let seedResult;
@@ -4363,6 +4987,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                             await park(t, "escalation ladder exhausted", "ladder-exhausted", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
                             return false;
                         };
+                        // OBS-1169: the tree this worker receives — commits past it are this attempt's own work; the
+                        // carried ones beneath it are not, and must not make a bootstrap death look like work.
+                        const launchHead = await gitHead(wt);
                         try {
                             if (interactive) {
                                 // v1.2 interactive: the TUI doesn't exit on completion — the trailer is the finish line.
@@ -4410,7 +5037,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         return;
                                     }
                                     await noteLaunched();
-                                    output = await workerTransport.read(slot, PANE_READ_ROWS);
+                                    // OBS-1108: the first owned-slot read joins the contact latch — an unreadable launch read is
+                                    // retried by the wait loop below under the same deadline, never a task failure on its own.
+                                    output = await workerTransport.read(slot, PANE_READ_ROWS).catch((error) => { noteDriverUnreadable(error); return ""; });
                                 }
                                 // The returning paths report the same fact on the result; both callbacks land on the one
                                 // latch, and the second is a no-op. A seed that answered is never re-answered by the loop.
@@ -4497,7 +5126,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                                 await sampleContext(); // final poll-seam sample before leaving the wait
                                                 break;
                                             }
-                                            if (adapter.parse(output, nonce).summary === UNPARSEABLE_TRAILER_SUMMARY)
+                                            if (adapter.parse(output, nonce).cause === "malformed-verdict")
                                                 break;
                                             if (trailerFrames && new RegExp(trailerPattern(nonce)).test(output)) {
                                                 // A matching busy frame is still a live turn. Preserve the rolling progress budget.
@@ -4524,9 +5153,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                                 });
                                             }
                                             await armCpuLeg(true);
-                                            const spent = Date.now() - sliceStart;
-                                            if (spent < slice)
-                                                await new Promise((r) => setTimeout(r, Math.min(slice - spent, 1_000)));
+                                            await new Promise((r) => setTimeout(r, contactPauseMs(sliceStart, slice, hardDeadline)));
                                             continue;
                                         }
                                         // waitOutput is only a wake hint; a driver may miss a trailer already painted.
@@ -4539,14 +5166,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             await sampleContext();
                                             break;
                                         }
-                                        if (adapter.parse(paneText, nonce).summary === UNPARSEABLE_TRAILER_SUMMARY) {
+                                        if (adapter.parse(paneText, nonce).cause === "malformed-verdict") {
                                             output = paneText;
                                             break;
                                         }
                                         if (driverProbeFailed) {
-                                            const spent = Date.now() - sliceStart;
-                                            if (spent < slice)
-                                                await new Promise((resolve) => setTimeout(resolve, Math.min(slice - spent, 1_000)));
+                                            await new Promise((resolve) => setTimeout(resolve, contactPauseMs(sliceStart, slice, hardDeadline)));
                                             continue;
                                         }
                                         if (paneText.length > 0)
@@ -4654,11 +5279,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                                                 });
                                             }
                                             await armCpuLeg(true);
-                                            const spent = Date.now() - sliceStart;
-                                            if (spent < slice)
-                                                await new Promise((r) => setTimeout(r, Math.min(slice - spent, 1_000)));
+                                            await new Promise((r) => setTimeout(r, contactPauseMs(sliceStart, slice, hardDeadline)));
                                             continue;
                                         }
+                                        // OBS-1108: every contact probe of this slice answered (a failed wait or read continues
+                                        // above), so only here — never after one probe while another stays latched — has contact returned.
+                                        noteContactReadable();
                                         if (st !== lastStatus) {
                                             lastStatus = st;
                                             journal.append("worker-status", t.id, { slot: slot.name, status: st, attempt });
@@ -4977,7 +5603,16 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         if (spent < slice)
                                             await new Promise((r) => setTimeout(r, Math.min(slice - spent, 1_000)));
                                     }
-                                    if (!finished && exitCode === null && adapter.parse(output, nonce).summary !== UNPARSEABLE_TRAILER_SUMMARY) {
+                                    // A wait that concludes on a clean slice's read (trailer, exit, startup failure) has contact back too.
+                                    if (!driverProbeFailed)
+                                        noteContactReadable();
+                                    if (!finished && exitCode === null && adapter.parse(output, nonce).cause !== "malformed-verdict") {
+                                        // OBS-1108: the hard deadline ended an attempt whose contact was still latched (its last
+                                        // probe failed). That is contact loss, not a stall: keep the one infra park and the preserved
+                                        // worktree instead of the hard-timeout classification and its repair charge.
+                                        if (contactLost && driverProbeFailed && Date.now() >= hardDeadline) {
+                                            throw new ContactUnreadableExhausted(`contact with ${slot.name} unreadable for ${Date.now() - contactLost.since}ms, still latched at the attempt's hard deadline after ${contactLost.retries} retries`);
+                                        }
                                         // timed out (or only ever saw false positives): harvest whatever the pane holds now
                                         hardTimedOut = Date.now() >= hardDeadline;
                                         timedOut ||= hardTimedOut;
@@ -5013,7 +5648,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         const maxSettleRetries = 2;
                                         let settleTries = 0;
                                         settleParsed = adapter.parse(output, nonce);
-                                        while (settleParsed.summary === UNPARSEABLE_TRAILER_SUMMARY && settleTries < maxSettleRetries) {
+                                        while (settleParsed.cause === "malformed-verdict" && settleTries < maxSettleRetries) {
                                             const remaining = settleDeadline - Date.now();
                                             if (remaining <= 0)
                                                 break;
@@ -5023,8 +5658,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             settleParsed = adapter.parse(output, nonce);
                                             settleTries++;
                                         }
-                                        if (settleParsed.summary !== UNPARSEABLE_TRAILER_SUMMARY) {
-                                            finished = settleParsed.summary !== NO_TRAILER_SUMMARY && (!trailerFrames || trailerFrames.settled);
+                                        if (settleParsed.cause !== "malformed-verdict") {
+                                            finished = settleParsed.cause === undefined && (!trailerFrames || trailerFrames.settled);
                                         }
                                     }
                                 }
@@ -5117,6 +5752,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                         finally {
                             await cpuAccountant?.stop();
                         }
+                        // OBS-1169: the final pane read decides, at exit, whether the prefix is still the CLI's own startup.
+                        const bootstrapEvidence = processExited ? bootstrapDetector.sample(output, workerLaunchedAt) : undefined;
                         // SPEND-01 interactive metering race: the harvest loop breaks on the trailer, but the worker
                         // shell may still be running post-trailer bookkeeping (session-store flush, fake usage stamp,
                         // exit wrapper). Print mode already waits for TICKMARKR_EXIT, which follows that tail; drain
@@ -5246,6 +5883,58 @@ export async function runDaemon(repoRoot, opts = {}) {
                             stallReaps = 0;
                             stallSeat = undefined;
                         }
+                        // OBS-1169: a CLI that died in its own bootstrap never read the brief. Startup-owned evidence
+                        // (known bootstrap text in the startup prefix StartupFailureDetector owns: inside the window, before
+                        // any tool frame or input box, in an unsaturated read), and only when it exited nonzero with no
+                        // parsed trailer and no commit of its own: the carried commits
+                        // beneath launchHead are an earlier attempt's, and harvesting them would replay that attempt's
+                        // red as a second fingerprint occurrence. One same-channel retry after a bounded backoff charges
+                        // no attempt, repair or fingerprint; after that the whole adapter shares the broken bootstrap,
+                        // so its channels are escalated away from and the existing failover moves on or parks infra.
+                        const bootstrap = !workerFinished && exitCode !== null && exitCode !== 0 && bootstrapEvidence
+                            && (await commitsAheadOf(launchHead, wt)).length === 0 ? bootstrapEvidence.matchedBytes : undefined;
+                        if (bootstrap) {
+                            const from = channelKey(assignment);
+                            const retries = requeuesOn("bootstrap-retry", from);
+                            if (retries < BOOTSTRAP_RETRY_CAP) {
+                                journal.append("bootstrap-retry", t.id, {
+                                    attempt, retry: retries + 1, of: BOOTSTRAP_RETRY_CAP, channel: from, assignment,
+                                    matched: bootstrap, exitCode, backoffMs: bootstrapBackoffMs,
+                                });
+                                await new Promise((r) => setTimeout(r, bootstrapBackoffMs));
+                                attempt--;
+                                continue;
+                            }
+                            const reason = `vendor escalated: ${assignment.adapter} bootstrap failed on ${from}`;
+                            escalateAdapter(assignment.adapter, reason);
+                            const next = failover("bootstrap-failover");
+                            // `toAssignment` and `reason` let a resume replay this routing disposition, not only its refund.
+                            journal.append("bootstrap-failover", t.id, {
+                                from, to: next ? channelKey(next) : null, ...(next ? { toAssignment: next } : {}), matched: bootstrap, retries,
+                                escalated: [...vendorEscalated].filter(([, why]) => why === reason).map(([k]) => k), reason,
+                            });
+                            if (next) {
+                                await driver.notify(`tickmarkr ${runId}: ${t.id} bootstrap failover`, { tier: "attention" });
+                                if (!keepForever) {
+                                    const idx = keptSlots.indexOf(slot);
+                                    if (idx >= 0) {
+                                        keptSlots.splice(idx, 1);
+                                        try {
+                                            await closeSlot(slot);
+                                        }
+                                        catch { /* cosmetic — reconcile is the backstop */ }
+                                    }
+                                    if (supersededWorkerSlot === slot)
+                                        supersededWorkerSlot = undefined;
+                                }
+                                assignment = next;
+                                tried.push(channelKey(next));
+                                attempt--; // the dead bootstrap bought no worker turn
+                                continue;
+                            }
+                            await park(t, `${from} failed at bootstrap after ${retries} same-channel retry and no eligible channel remains${poolExhaustion(t, cfg)}`, "infra", assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode, { cause: "bootstrap", channel: from, retries });
+                            return;
+                        }
                         const preHarvestResult = result;
                         // T2 (OBS-264): recognize committed no-trailer work BEFORE any no-trailer streak, provider,
                         // quota or dead-channel routing. Gates never trusted the trailer, so this successful synthesis
@@ -5322,7 +6011,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // the journal, never a loop-local counter, so a resume continues the count it left off at.
                         if (capacityMatch) {
                             const from = channelKey(assignment);
-                            const requeues = capacityRequeuesOn(from);
+                            const requeues = requeuesOn("capacity-requeue", from);
                             const source = capacityBannerKilled ? "banner" : "exit";
                             if (requeues < CAPACITY_REQUEUE_CAP) {
                                 journal.append("capacity-requeue", t.id, {
@@ -5355,7 +6044,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 tried.push(channelKey(next));
                                 continue;
                             }
-                            await park(t, `capacity exhausted on ${from} after ${requeues} requeues and no eligible channel at floor`, "quota", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode, { cause: "capacity", channel: from, requeues });
+                            await park(t, `capacity exhausted on ${from} after ${requeues} requeues and no eligible channel at floor${poolExhaustion(t, cfg)}`, "quota", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode, { cause: "capacity", channel: from, requeues });
                             return;
                         }
                         // quota exhaustion → failover within floor; does NOT consume the ladder (spec §4)
@@ -5418,7 +6107,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 tried.push(channelKey(next));
                                 continue;
                             }
-                            await park(t, "quota exhausted on every eligible channel", "quota", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
+                            await park(t, `quota exhausted on every eligible channel${poolExhaustion(t, cfg)}`, "quota", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
                             return;
                         }
                         // v1.65 T1: typed dead-channel failure — the parse boundary classified this no-trailer result
@@ -5466,7 +6155,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 continue;
                             }
                             const chargedAttempts = adapterStartupFailure || startupFailure ? attempt : attempt + 1;
-                            await park(t, `dead channel (${dead}) and no eligible channel remains`, "reroute-exhausted", assignment, chargedAttempts, startMs, gateFails, consults, tokens, metered, retryMode);
+                            await park(t, `dead channel (${dead}) and no eligible channel remains${poolExhaustion(t, cfg)}`, "reroute-exhausted", assignment, chargedAttempts, startMs, gateFails, consults, tokens, metered, retryMode);
                             return;
                         }
                         if (!finished) {
@@ -5511,6 +6200,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                             }
                         }
                         const onGate = async (e) => {
+                            if (!liveEngagement())
+                                return;
                             if (e.phase === "start") {
                                 notePhaseStart(e);
                                 journal.phaseStart(t.id, phaseForGate(e.gate), { gate: e.gate, index: e.index, total: e.total, ...(e.parentAt === undefined ? {} : { parallel: true }) });
@@ -5544,9 +6235,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 journalGateResult(g);
                                 noteReviewRetry(g);
                                 // v1.1 failover: never re-ask a reviewer channel that produced garbage for this task
-                                if (g.gate === "review" && !g.pass && /unparseable/.test(g.details) && typeof g.meta?.reviewer === "string") {
+                                if (isGarbageReview(g))
                                     badReviewers.push(g.meta.reviewer);
-                                }
                             });
                         };
                         let results = [];
@@ -5562,12 +6252,16 @@ export async function runDaemon(repoRoot, opts = {}) {
                             // sees the replay, without buying another command or reviewer invocation.
                             const taskEvents = journal.read().filter((e) => e.taskId === t.id);
                             const previousRound = taskEvents.map((e) => e.event === "phase-start" && e.data.phase === "gates").lastIndexOf(true);
-                            const previousRows = retryMode === "repair"
-                                ? taskEvents.slice(previousRound + 1).filter((e) => e.event === "gate-result"
-                                    && e.data.attempt === attempt - 1)
-                                : [];
+                            const lastRoundRows = taskEvents.slice(previousRound + 1).filter((e) => e.event === "gate-result"
+                                && e.data.attempt === attempt - 1);
+                            const previousRows = retryMode === "repair" ? lastRoundRows : [];
+                            // OBS-1106 residual: see owesTimeoutRefresh — the replay below and the verdict cache are both refused.
+                            const freshTimeout = !explicitlyFundedAttempt && owesTimeoutRefresh(t, lastRoundRows, gateSubject.commit);
                             journal.phaseStart(t.id, "gates");
-                            const replay = !explicitlyFundedAttempt && previousRows.length > 0
+                            if (freshTimeout) {
+                                journal.append("gate-fresh-forced", t.id, { gate: "test", attempt, priorAttempt: attempt - 1, commit: gateSubject.commit, reason: "no-commit-timeout-red" });
+                            }
+                            const replay = !explicitlyFundedAttempt && !freshTimeout && previousRows.length > 0
                                 && previousRows.every((e) => e.data.commit === gateSubject.commit)
                                 && previousRows.some((e) => e.data.pass === false && e.data.skipped !== true);
                             if (replay) {
@@ -5597,10 +6291,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     carriedFindings: outstandingFindings,
                                     operatorContext,
                                     worktree: wt, baseRef: taskBase, result, author: assignment,
-                                    commands, baseline, channels: pools.review, judgeChannels: pools.judge, adapters, cfg, artifactDir: journal.dir,
+                                    commands, baseline, channels: pools.review, judgeChannels: pools.judge, health, adapters, cfg, artifactDir: journal.dir,
                                     collateral: collateral.get(t.id) ?? [],
                                     selectTests: !testGateFailed,
-                                    cachedRedBypass: explicitlyFundedAttempt ? "operator-rerun" : undefined,
+                                    cachedRedBypass: explicitlyFundedAttempt ? "operator-rerun" : freshTimeout ? "timeout-fresh" : undefined,
                                     via: cfg.visibility.llm === "pane"
                                         ? {
                                             driver: trackedDriver,
@@ -5707,6 +6401,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                             await park(t, `${capTrip.gate}: ${capTrip.details}`, "diff-cap", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
                             return;
                         }
+                        if (await adjudicateInfraShapedRed(t, results, wt, gateSubject.commit, attempt, gateSubject.replayedFromAttempt !== undefined, (reason) => park(t, reason, "infra", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode)))
+                            return;
                         // OBS-547: who pays for this red is decided by the run's collateral prediction (see
                         // dispositionScopeRed) — an authoring defect parks unchargeable before any accounting below.
                         if (await dispositionScopeRed(t, results, assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode, await treeOrDiffPaths(taskBase, wt)))
@@ -5799,6 +6495,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                             journal.append("consult-verdict", t.id, {
                                 action: v.action, notes: v.notes,
                                 adapter: v.adapter ?? "unknown", model: v.model ?? "unknown", vendor: v.vendor ?? "unknown",
+                                ...(v.effort ? { effort: v.effort } : {}),
+                                ...(v.invocations?.length ? { invocations: v.invocations } : {}),
                                 capAdvisory: true,
                             });
                         }
@@ -5937,6 +6635,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         for (const t of ready) {
                             const p = executeWithPolicy(t)
                                 .catch(async (err) => {
+                                engagements.delete(t.id);
                                 const cleanupErrors = [];
                                 for (const [slot, owner] of workerOwners) {
                                     if (owner.taskId !== t.id || !liveSlots.has(slot))
@@ -5968,7 +6667,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             throw new Error(`could not preserve ${head}: ${saved.stderr}`);
                                     }
                                     journal.append("worktree-preserved", t.id, { ref, ...producerFields(producer) });
-                                    await park(t, err.message, "infra", null, 0, Date.now(), 0, 0, undefined, 0, "fresh", { disposition: "transport-uncertain", ref, ...cleanupEvidence });
+                                    await park(t, err.message, "infra", null, 0, Date.now(), 0, 0, undefined, 0, "fresh", { disposition: err instanceof ContactUnreadableExhausted ? "contact-unreadable" : "transport-uncertain", ref, ...cleanupEvidence });
                                     return;
                                 }
                                 if (err instanceof ExecutionBudgetExceeded) {
@@ -5995,7 +6694,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 journal.telemetry({ taskId: t.id, shape: t.shape, adapter: "-", model: "-", channel: "-", attempts: 0, outcome: "failed", durationMs: 0 });
                                 await reconcile({ spareLiveLlm: true }); // task-failed is a terminal event
                             })
-                                .finally(() => inflight.delete(t.id));
+                                .finally(() => { inflight.delete(t.id); engagements.delete(t.id); });
                             inflight.set(t.id, p);
                         }
                         if (inflight.size === 0) {
@@ -6031,8 +6730,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const waiters = [...inflight.values(), aborted];
                         // A free slot is itself a scheduling boundary: poll the append-only approval stream instead of
                         // sleeping until an unrelated long-running task settles.
-                        // An open board is polled on the same cadence, so a dead cockpit is noticed mid-task.
-                        if (inflight.size < concurrency || boardOpened) {
+                        // An open board is polled on the same cadence, so a dead cockpit is noticed mid-task; so is a
+                        // held reservation still awaiting its claim or its adoption.
+                        if (inflight.size < concurrency || boardOpened || heldRetry) {
                             waiters.push(new Promise((wake) => setTimeout(wake, APPROVAL_POLL_MS)));
                         }
                         await Promise.race(waiters); // aborted rejects on termination — unwinds the run
@@ -6094,7 +6794,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         poll = setTimeout(pollApprovals, APPROVAL_POLL_MS);
                         let tipFailed;
                         try {
-                            const verification = withCommandContext(undefined, () => verifyIntegrationTipCached(intWt, commands, journal, { lastMergedTask, baseline, signal: controller.signal }), controller.signal);
+                            const verification = withCommandContext(undefined, () => verifyIntegrationTipCached(intWt, commands, journal, { lastMergedTask, baseline, signal: controller.signal, evidence: { quotaBytes: cfg.gates?.evidenceQuotaBytes } }), controller.signal);
                             activeTipVerify = { controller, settled: verification.then(() => { }, () => { }) };
                             tipFailed = await verification;
                         }
@@ -6139,6 +6839,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                     summary.approvalDisposition = outstanding.length === 0 ? "complete" : "outstanding";
                     if (outstanding.length > 0)
                         summary.outstandingApprovals = outstanding;
+                    const forgiven = forgivenFingerprints(journal.read());
+                    if (forgiven.length > 0)
+                        summary.forgiven = forgiven;
                     journal.append("run-end", undefined, { ...summary });
                     await reconcile(); // run-end boundary: nothing in flight — full sweep (empty desired set)
                     // OBS-28: lingering worktrees starve CLI probes; keepPanes:forever is the debug override.