tickmarkr 2.6.1 → 2.6.3

package/dist/run/journal.js

@@ -78,6 +78,171 @@ export const REVIEW_UPHELD_RELEASE = "review-upheld";
 // marks no gate satisfied: green merges directly, red returns to the existing ladder with attempts
 // and tried seats intact.
 export const RECHECK_RELEASE = "recheck";
+// OBS-1178: the daemon's answer to a pending approval that no longer binds to the park it names. It
+// enacts nothing and consumes the decision, so every fold reads the task as still parked.
+export const APPROVAL_REFUSED = "approval-refused";
+/** The token every surface prints and `approve --park` accepts: `<line>@<ts>`. */
+export const bindingToken = (binding) => `${binding.line}@${binding.ts}`;
+export function parseBindingToken(token) {
+    const match = /^([1-9]\d*)@(\S+)$/u.exec(token);
+    return match && Number.isSafeInteger(Number(match[1])) ? { line: Number(match[1]), ts: match[2] } : undefined;
+}
+/** The binding a task-approved row recorded under `park` or `failure`, when well formed. */
+export function recordedBinding(value) {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const { line, ts } = value;
+    return typeof line === "number" && Number.isSafeInteger(line) && line > 0 && typeof ts === "string" ? { line, ts } : undefined;
+}
+/** The newest failed gate before a park row — the gate a waive of that park would satisfy. */
+export function failedGateBeforePark(events, taskId, parkIndex) {
+    for (let i = parkIndex - 1; i >= 0; i -= 1) {
+        const event = events[i];
+        if (event.taskId !== taskId)
+            continue;
+        if (event.event === "task-approved" || event.event === "task-human" || event.event === "task-dispatch")
+            return undefined;
+        if (event.event === "gate-result" && event.data.pass === false
+            && typeof event.data.gate === "string" && GATE_NAMES.includes(event.data.gate)) {
+            return event.data.gate;
+        }
+    }
+    return undefined;
+}
+// OBS-1178: every row read from a journal file remembers its PHYSICAL 1-based line, so a decision
+// fold keys bindings and refusals by the line an operator's token names — never by a compacted index
+// a blank or torn line would shift. Rows built in memory (tests, fixtures) fall back to index + 1.
+const SOURCE_LINE = new WeakMap();
+/** The physical journal line of `events[i]` (see SOURCE_LINE). */
+export const physicalLine = (events, i) => SOURCE_LINE.get(events[i]) ?? i + 1;
+/** A row parsed outside this module (a cockpit capture) names its own physical line to the decision fold. */
+export const withPhysicalLine = (row, line) => { SOURCE_LINE.set(row, line); return row; };
+// Rows that enact (consume) the decisions open for their task: a dispatch, a battery, a recreation,
+// or the task closing done. A new task-human or task-failed row is NOT one — it proves nothing was
+// enacted, so an earlier decision stays open and is judged against the newer park or failure.
+const ENACTS_DECISIONS = new Set([
+    "task-dispatch", "repair-dispatch", "resume-restore", "worker-launch", "recheck-battery", "worktree-recreation",
+    "task-done",
+]);
+/**
+ * OBS-1178: THE decision fold. Every reader of task-approved rows — the replay folds, the daemon's
+ * startup, sweep and pending-action folds, scope-amendment replay and its audits, status and both
+ * cockpits — reads decisions through it, so no two surfaces can disagree on whether one happened.
+ *
+ * `effective` holds the PHYSICAL lines of the task-approved rows whose effects may apply: a row that
+ * was sound when an enactment row consumed it (bound by line and timestamp to the task's newest park,
+ * a waive also to that park's failed gate, or a recheck to the newest failure with no park after it;
+ * a legacy row carrying no binding only when no park or failure landed between it and that
+ * enactment), plus a row still open that is sound NOW. A refused row is never effective, and neither is an open row that no
+ * longer binds — a newer park or failure landed, or it names none — whatever unrelated rows landed
+ * around it. An enactment row also consumes the task's park and failure: a decision naming either
+ * after the task moved on is stale, while the decisions that enactment already consumed stay effective.
+ * `open` lists every unenacted, unrefused row with why it may not be enacted, and `refused` the lines
+ * an approval-refused row answered.
+ */
+export function foldDecisions(events) {
+    const lineOf = (i) => physicalLine(events, i);
+    const token = (i) => i === undefined ? "none" : bindingToken({ line: lineOf(i), ts: String(events[i].ts) });
+    const names = (binding, i) => i !== undefined && lineOf(i) === binding.line && events[i].ts === binding.ts;
+    const parks = new Map();
+    const failures = new Map();
+    const pending = new Map();
+    const effective = new Set();
+    const refused = new Set();
+    // Why the decision at `index` may not be enacted against the rows read so far; `open` refuses an unbound row outright.
+    const judge = (taskId, index, open) => {
+        const row = events[index];
+        const park = parks.get(taskId);
+        const failure = failures.get(taskId);
+        const parkBinding = recordedBinding(row.data.park);
+        const failureBinding = row.data.release === RECHECK_RELEASE ? recordedBinding(row.data.failure) : undefined;
+        if (parkBinding) {
+            if (!names(parkBinding, park))
+                return `bound to park ${bindingToken(parkBinding)} but the newest park is ${token(park)}`;
+            if ((failure ?? -1) > park)
+                return `bound to park ${bindingToken(parkBinding)} but the task failed since, at ${token(failure)}`;
+            if (row.data.release !== GATE_SATISFIED_RELEASE)
+                return undefined;
+            const gate = failedGateBeforePark(events, taskId, park);
+            return gate !== undefined && gate === row.data.gate ? undefined : `waive names gate ${String(row.data.gate ?? "none")} but park ${token(park)} failed ${gate ?? "no gate"}`;
+        }
+        if (failureBinding) {
+            return names(failureBinding, failure) && (park ?? -1) < failure
+                ? undefined
+                : `bound to failure ${bindingToken(failureBinding)} but the newest failure is ${token(failure)} and the newest park ${token(park)}`;
+        }
+        // Enacted history written before decisions carried bindings stays readable unless a park or failure
+        // superseded it before its enactment. An open unbound row is refused whatever order it landed in.
+        if (!open && Math.max(park ?? -1, failure ?? -1) < index)
+            return undefined;
+        return `an unbound decision names no park token (the newest park is ${token(park)}) — refusing an unbound release`;
+    };
+    events.forEach((e, i) => {
+        const taskId = e.taskId;
+        if (!taskId)
+            return;
+        if (e.event === "task-approved") {
+            pending.set(taskId, [...(pending.get(taskId) ?? []), i]);
+        }
+        else if (e.event === APPROVAL_REFUSED) {
+            // A refusal voids the rows its `lines` name (every open row of its task when it names none).
+            const named = Array.isArray(e.data.lines) ? new Set(e.data.lines) : undefined;
+            const kept = (pending.get(taskId) ?? []).filter((at) => {
+                if (named !== undefined && !named.has(lineOf(at)))
+                    return true;
+                refused.add(lineOf(at));
+                return false;
+            });
+            if (kept.length)
+                pending.set(taskId, kept);
+            else
+                pending.delete(taskId);
+        }
+        else if (ENACTS_DECISIONS.has(e.event)) {
+            for (const at of pending.get(taskId) ?? [])
+                if (judge(taskId, at, false) === undefined)
+                    effective.add(lineOf(at));
+            pending.delete(taskId);
+            // The task moved on: its park and failure are consumed, so a later decision naming either is stale.
+            parks.delete(taskId);
+            failures.delete(taskId);
+        }
+        else if (e.event === "task-human" || e.event === "task-failed") {
+            (e.event === "task-human" ? parks : failures).set(taskId, i);
+        }
+    });
+    const open = [];
+    for (const [taskId, rows] of pending) {
+        for (const at of rows) {
+            const stale = judge(taskId, at, true);
+            if (stale === undefined)
+                effective.add(lineOf(at));
+            open.push({ taskId, line: lineOf(at), ...(stale === undefined ? {} : { stale }) });
+        }
+    }
+    return { effective, open, refused };
+}
+/** The physical lines of the task-approved rows whose effects may apply (see foldDecisions). */
+export const effectiveDecisions = (events) => foldDecisions(events).effective;
+/**
+ * The journal as every decision reader must see it: task-approved rows that are not effective removed,
+ * every other row (and its physical line) kept. Order-only folds iterate this instead of skipping rows
+ * on their own.
+ */
+export function effectiveEvents(events) {
+    const effective = effectiveDecisions(events);
+    return events.filter((e, i) => e.event !== "task-approved" || effective.has(physicalLine(events, i)));
+}
+export function staleApprovals(events) {
+    const refused = new Map();
+    for (const { taskId, line, stale } of foldDecisions(events).open) {
+        if (stale === undefined)
+            continue;
+        const prior = refused.get(taskId);
+        refused.set(taskId, { reason: prior ? `${prior.reason}; #L${line} ${stale}` : `#L${line} ${stale}`, lines: [...(prior?.lines ?? []), line] });
+    }
+    return refused;
+}
 // OBS-738: one authority for every recovery surface. The ref is accepted only from the row that
 // preservation itself writes; task-human prose, branch heads and commit history are deliberately
 // absent from this fold. Keep every row in journal order — one task can be recreated more than once,
@@ -100,18 +265,21 @@ export function preservedRefsByTask(events) {
 // approval for the task. A whole-journal count re-parks an upheld task before its funded attempt can
 // dispatch (measured live on run-20260726-213539), making a fresh journal the only escape. A T15
 // replayMeasurement re-observes an interrupted round and is audit evidence, not a newly funded round.
-export function reviewRoundsSinceApproval(events, taskId) {
-    let rounds = 0;
-    for (const e of events) {
+// OBS-1178: only an effective decision opens an engagement — a refused or unsound approval resets nothing.
+// `rounds` narrows the decided rows AFTER the decision fold has read the whole journal (the daemon's
+// decisive-round filter drops gate rows a park's failed gate is read from).
+export function reviewRoundsSinceApproval(events, taskId, rounds = (decided) => decided) {
+    let drawn = 0;
+    for (const e of rounds(effectiveEvents(events))) {
         if (e.taskId !== taskId)
             continue;
         if (e.event === "task-approved")
-            rounds = 0;
+            drawn = 0;
         else if (e.event === "gate-result" && e.data.gate === "review" && e.data.pass === false
             && e.data.replayMeasurement !== true)
-            rounds++;
+            drawn++;
     }
-    return rounds;
+    return drawn;
 }
 // OBS-189/OBS-254: the uphold brief is the operator's funded decision, not attempt state. ONE fold,
 // two consumers — replayResumeState seeds it, and the daemon re-derives it from the journal at
@@ -545,24 +713,56 @@ export function normalizeGateFailure(details) {
 // operator approval is a new engagement, and nothing else resets the count. Resume re-measurements
 // are excluded because the interrupted attempt already bought the result they confirm.
 export const GATE_FINGERPRINT_CAP = 2;
+/** The invocation a gate row's receipt names — the identity of the execution that observed it. */
+export const receiptOrigin = (data) => {
+    const receipt = data.evidenceReceipt ?? (Array.isArray(data.evidenceReceipts) ? data.evidenceReceipts[0] : undefined);
+    const id = receipt && typeof receipt === "object" ? receipt.invocationId : undefined;
+    return typeof id === "string" && id ? `invocation:${id}` : undefined;
+};
+// OBS-1106 residual: occurrences are independent OBSERVATIONS, not rows. A journal replay
+// (`replayedFromAttempt`) and a verdict-cache hit (`reused`) re-state a measurement another row
+// already bought, so each resolves to that row's origin — its receipt's invocation when it carries
+// one, else the attempt (replay) or the newest observation on the same subject (cache) — and one
+// observation counts once however many copies the ledger holds, across resume. Only a fresh
+// execution mints a new origin.
 export function identicalGateFailures(events, taskId, gate, normalized) {
-    let n = 0;
-    for (const e of events) {
+    const counted = new Set();
+    const byAttempt = new Map();
+    const bySubject = new Map();
+    effectiveEvents(events).forEach((e, i) => {
         if (e.taskId !== taskId)
-            continue;
-        if (e.event === "task-approved")
-            n = 0;
-        else if (e.event === "gate-result" && e.data.gate === gate && e.data.pass === false
-            && e.data.replayMeasurement !== true
-            && typeof e.data.details === "string"
+            return;
+        if (e.event === "task-approved") {
+            counted.clear();
+            return;
+        }
+        if (e.event !== "gate-result" || e.data.gate !== gate)
+            return;
+        const commit = typeof e.data.commit === "string" ? e.data.commit : undefined;
+        const origin = typeof e.data.replayedFromAttempt === "number"
+            ? byAttempt.get(e.data.replayedFromAttempt) ?? receiptOrigin(e.data) ?? `attempt:${e.data.replayedFromAttempt}`
+            : e.data.reused === true
+                ? receiptOrigin(e.data) ?? (commit ? bySubject.get(commit) : undefined) ?? `reused:${commit ?? i}`
+                : receiptOrigin(e.data) ?? `row:${i}`;
+        if (typeof e.data.attempt === "number")
+            byAttempt.set(e.data.attempt, origin);
+        if (commit)
+            bySubject.set(commit, origin);
+        if (e.data.pass === false && e.data.replayMeasurement !== true && typeof e.data.details === "string"
             && normalizeGateFailure(e.data.details) === normalized)
-            n++;
-    }
-    return n;
+            counted.add(origin);
+    });
+    return counted.size;
 }
+// OBS-1072 add.2: the controls a terminal would consume — OSC strings (ESC ] … BEL/ST), CSI sequences
+// (SGR included), other ESC sequences and stray C0 bytes but tab and newline. Applied only to the
+// human-facing excerpts a worker brief or a scope hint reads; the journal row, the receipt bytes and
+// the failure fingerprint keep the raw text.
+const TERMINAL_CONTROL_RE = /\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)?|\x1b\[[0-?]*[ -/]*[@-~]|\x1b[ -/]*[0-~]?|[\x00-\x08\x0b-\x1f\x7f]/g;
+export const readableExcerpt = (text) => text.replace(TERMINAL_CONTROL_RE, "");
 export function repairReachSinceApproval(events, taskId) {
     const repairs = [];
-    for (const e of events) {
+    for (const e of effectiveEvents(events)) { // OBS-1178: a refused or unsound approval resets no repair history
         if (e.taskId !== taskId)
             continue;
         if (e.event === "task-approved") {
@@ -591,6 +791,9 @@ export function repairReachSinceApproval(events, taskId) {
                 else
                     repair.launched = true;
             }
+            else if (BOOTSTRAP_DEATH.has(e.event)) {
+                repair.launched = false; // that launch died in its CLI's bootstrap: the repair's turn is still owed
+            }
             else if (repair.launched && e.event === "gate-result" && typeof e.data.gate === "string") {
                 if (!repair.reached.includes(e.data.gate))
                     repair.reached.push(e.data.gate);
@@ -610,7 +813,7 @@ export function repairsSinceApproval(events, taskId) {
 /** Recheck releases not yet enacted by a battery (or by a legacy worker launch). */
 export function pendingRechecks(events) {
     const pending = new Set();
-    for (const e of events) {
+    for (const e of effectiveEvents(events)) { // OBS-1178: a refused or unsound recheck was never pending
         if (!e.taskId)
             continue;
         if (e.event === "task-approved" && e.data.release === RECHECK_RELEASE)
@@ -620,6 +823,7 @@ export function pendingRechecks(events) {
     }
     return pending;
 }
+// OBS-1178: only effective decisions (effectiveEvents) are pending actions; a refused or unsound row never is.
 const ENACTED_BY = {
     worker: ["task-dispatch", "worker-launch"],
     battery: ["recheck-battery"],
@@ -635,7 +839,7 @@ const ENACTED_BY = {
  */
 export function pendingApprovalActions(events) {
     const pending = new Map();
-    for (const e of events) {
+    for (const e of effectiveEvents(events)) {
         if (!e.taskId)
             continue;
         if (e.event === "task-approved") {
@@ -648,7 +852,7 @@ export function pendingApprovalActions(events) {
     }
     return pending;
 }
-function approvalAction(taskId, e) {
+export function approvalAction(taskId, e) {
     const { release, gate } = e.data;
     const base = { taskId, ts: e.ts };
     if (release === undefined)
@@ -675,15 +879,22 @@ function approvalAction(taskId, e) {
 // prompt with the repair findings gone, or re-run the banned channel. worker-launch is appended only
 // once the prompt has actually been delivered to a worker, which is the dispatch the decision governs.
 const DECISION_SPENT = "worker-launch";
+// OBS-1169: the daemon's rows closing a launch whose CLI died in its own bootstrap. That worker never
+// read the brief, so the launch spent nothing: its decision, failure brief and repair turn survive it,
+// and the dispatch it closes charges no attempt.
+const BOOTSTRAP_DEATH = new Set(["bootstrap-retry", "bootstrap-failover"]);
 function decisionForNextDispatch(events, taskId, event) {
     let pending;
+    let spent;
     for (const e of events) {
         if (e.taskId !== taskId)
             continue;
         if (e.event === event)
             pending = e;
         else if (e.event === DECISION_SPENT)
-            pending = undefined;
+            [spent, pending] = [pending, undefined];
+        else if (BOOTSTRAP_DEATH.has(e.event))
+            pending = spent;
     }
     return pending;
 }
@@ -702,25 +913,25 @@ function decisionForNextDispatch(events, taskId, event) {
  * failures OR the delivery failure that preceded it. Of the approvals, only a WAIVE clears (the operator
  * retired the findings by fiat — the uphold case re-derives its own brief separately). OBS-1074: a
  * plain approve, a scope grant or a recheck re-funds an attempt that must still see why the last one
- * parked, plus the operator's stated reason — v2.5.7's T11 looped four times on one hygiene oracle
- * because every approval erased exactly the finding the fresh attempt was funded to fix.
+ * parked — v2.5.7's T11 looped four times on one hygiene oracle because every approval erased exactly
+ * the finding the fresh attempt was funded to fix. The operator's stated reasons ride after those rows
+ * as `standingRulings` (OBS-1150): no launch and no waive resets them.
  */
 export function journaledFailureBrief(events, taskId) {
     let rows = [];
-    for (const e of events) {
+    let spent = [];
+    for (const e of effectiveEvents(events)) { // OBS-1178: a refused or unsound waive retires nothing
         if (e.taskId !== taskId)
             continue;
         if (e.event === "worker-launch")
+            [spent, rows] = [rows, []];
+        else if (BOOTSTRAP_DEATH.has(e.event))
+            rows = [...spent, ...rows];
+        else if (e.event === "task-approved" && e.data.release === GATE_SATISFIED_RELEASE)
             rows = [];
-        else if (e.event === "task-approved") {
-            if (e.data.release === GATE_SATISFIED_RELEASE)
-                rows = [];
-            else if (typeof e.data.reason === "string" && e.data.reason.trim())
-                rows.push(`approval: ${e.data.reason.trim()}`);
-        }
         else if (e.event === "gate-result" && e.data.pass === false && e.data.skipped !== true
             && typeof e.data.details === "string")
-            rows.push(`${e.data.gate}: ${e.data.details}`);
+            rows.push(`${e.data.gate}: ${readableExcerpt(e.data.details)}`);
         else if (e.event === "delivery-readiness-failed" && typeof e.data.transcript === "string") {
             rows.push(`dispatch: delivery readiness failed after ${e.data.waitedMs}ms; pane transcript:\n${e.data.transcript}`);
         }
@@ -728,7 +939,26 @@ export function journaledFailureBrief(events, taskId) {
             rows.push(`dispatch: ${e.data.error}`);
         }
     }
-    return rows;
+    return [...rows, ...standingRulings(events, taskId).map((ruling) => `approval: ${ruling}`)];
+}
+/**
+ * OBS-1150: an operator's approval reason is a ruling on the TASK, not on the attempt it released.
+ * The failure rows above are spent at the next worker-launch and the review context once bound only
+ * the newest reason, so ruling A vanished at the first launch after it and a later ruling B replaced
+ * it. Every effective reason therefore stands, oldest first, for the whole run; a repeat is carried
+ * once. A gate-satisfied release accepts a gate's verdict rather than ruling on the work, so its
+ * reason adds no standing ruling — and, being no ruling, it retires none either.
+ */
+export function standingRulings(events, taskId) {
+    const rulings = [];
+    for (const e of effectiveEvents(events)) { // OBS-1178: a refused or unsound approval rules nothing
+        if (e.taskId !== taskId || e.event !== "task-approved" || e.data.release === GATE_SATISFIED_RELEASE)
+            continue;
+        const reason = typeof e.data.reason === "string" ? e.data.reason.trim() : "";
+        if (reason && !rulings.includes(reason))
+            rulings.push(reason);
+    }
+    return rulings;
 }
 /** Never infer a cross-path alias from a symbol, sentence, or hash. */
 export function reviewFingerprintMatches(candidate, fingerprint) {
@@ -741,6 +971,17 @@ export function observedReviewFingerprints(finding) {
     return [...new Set([finding.fingerprint, ...observed])];
 }
 const reviewNoteIdentity = (note) => note.replace(LINE_REF_RE, "").replace(/\s+/g, " ").trim();
+/** OBS-1195: the anchor row a verdict's recorded settled comment spells, or undefined if malformed. */
+function settledAnchorRow(anchor) {
+    if (!anchor || typeof anchor !== "object")
+        return undefined;
+    const { path, line, body, disposition } = anchor;
+    if (typeof path !== "string" || !Number.isInteger(line) || typeof body !== "string")
+        return undefined;
+    if (disposition !== "deferred" && disposition !== "resolved")
+        return undefined;
+    return structuredFindings("review", `- ${path}:${line} — ${body}`).find((finding) => finding.class === "review:anchored");
+}
 function distinctReviewFinding(row) {
     const identity = JSON.stringify([reviewNoteIdentity(row.note), row.codeIdentity ?? null]);
     const symbol = `${row.symbol}#${createHash("sha256").update(identity).digest("hex").slice(0, 12)}`;
@@ -844,9 +1085,26 @@ export function carryReviewFindings(priors, rows) {
  * after round re-seats ONE fingerprint, and a revised rationale replaces the prior rationale on that
  * row. N rounds of the same concern therefore carry the newest accepted explanation once, not N rows.
  */
+/** OBS-1151: this task's journaled judgments, newest first — subjects to compare a fresh ruling against,
+ * never verdicts to reuse. A row without a well-formed judgment (legacy, park, unparseable) is skipped. */
+export function priorJudgments(events, taskId) {
+    const out = [];
+    for (const e of events) {
+        const j = e.taskId === taskId && e.event === "gate-result" && e.data.gate === "acceptance" ? e.data.judgment : undefined;
+        if (!j || typeof j !== "object")
+            continue;
+        const { commit, judge, criteria } = j;
+        if (typeof commit !== "string" || !commit || !Array.isArray(criteria))
+            continue;
+        const rows = criteria.filter((c) => !!c && typeof c.id === "string" && typeof c.key === "string" && typeof c.met === "boolean"
+            && Array.isArray(c.paths) && c.paths.every((p) => typeof p === "string"));
+        out.unshift({ commit, ...(typeof judge === "string" ? { judge } : {}), criteria: rows });
+    }
+    return out;
+}
 export function outstandingReviewFindings(events, taskId) {
     let open = [];
-    for (const e of events) {
+    for (const e of effectiveEvents(events)) { // OBS-1178: only an effective review waive retires findings
         if (e.taskId !== taskId)
             continue;
         if (e.event === "task-approved") {
@@ -861,6 +1119,9 @@ export function outstandingReviewFindings(events, taskId) {
             continue;
         // A failed review can resolve one chain while re-raising another. Only observed, uniquely
         // matched spellings retire a chain; skipped/no-verdict rows were excluded above.
+        // OBS-1195: every parent chain this verdict resolved or explicitly deferred; an anchor bound to one
+        // retires whether it was carried in or restated by this same verdict.
+        const retiredParents = new Set();
         if (Array.isArray(e.data.resolved)) {
             const resolved = e.data.resolved;
             const settled = new Set(resolved.flatMap((id) => {
@@ -868,8 +1129,45 @@ export function outstandingReviewFindings(events, taskId) {
                     && observedReviewFingerprints(finding).some((fp) => reviewFingerprintMatches(id, fp)));
                 return matches.length === 1 ? matches : [];
             }));
+            // OBS-1195: an anchor explicitly bound to a settled chain retires with it; unbound ones stay.
+            for (const id of [...settled].flatMap(observedReviewFingerprints))
+                retiredParents.add(id);
             open = open.filter((finding) => !settled.has(finding));
         }
+        // OBS-1195: a failed verdict that restates a bound anchor's parent ONLY as a deferral (its deferred
+        // entry echoes the prior's id and no material entry claims it) has explicitly deferred that parent,
+        // so the anchor retires. The parent chain itself keeps whatever the closure lists said of it.
+        // A material row's `reraisedFrom` is this verdict's claim only when its own reraised list names that
+        // id; a link an earlier verdict drew (carried metadata) is lineage and claims nothing here. Without a
+        // reraised list to check against, every link counts as a claim — fail closed.
+        const rows = findingRows(e, "review");
+        const reraisedHere = Array.isArray(e.data.reraised) ? e.data.reraised.filter((id) => typeof id === "string") : undefined;
+        const claimedByMaterial = new Set(rows.filter((row) => !isDeferredFinding(row) && row.reraisedFrom
+            && (reraisedHere === undefined || reraisedHere.some((id) => reviewFingerprintMatches(id, row.reraisedFrom)))).map((row) => row.reraisedFrom));
+        const deferredParents = rows.filter((row) => isDeferredFinding(row) && row.reraisedFrom && !claimedByMaterial.has(row.reraisedFrom))
+            .map((row) => row.reraisedFrom);
+        for (const finding of open) {
+            if (finding.class !== "review:material" || !observedReviewFingerprints(finding).some((fp) => deferredParents.includes(fp)))
+                continue;
+            for (const id of observedReviewFingerprints(finding))
+                retiredParents.add(id);
+        }
+        const boundToRetired = (finding) => finding.boundTo !== undefined && retiredParents.has(finding.boundTo);
+        open = open.filter((finding) => !boundToRetired(finding));
+        // OBS-1195: a later verdict that re-anchors a carried anchor to a deferred entry or a resolved prior
+        // settles that anchor explicitly. Only its own identity (path, symbol and note), uniquely matched,
+        // retires it; a bare path coincidence binds nothing.
+        if (Array.isArray(e.data.settledAnchors)) {
+            const retired = new Set(e.data.settledAnchors.flatMap((anchor) => {
+                const row = settledAnchorRow(anchor);
+                // Identity, not fingerprint: a collision-disambiguated anchor carries a `symbol#hash` spelling.
+                const matches = row ? open.filter((finding) => finding.class === "review:anchored" && finding.path === row.path
+                    && (finding.symbol === row.symbol || finding.symbol.startsWith(`${row.symbol}#`))
+                    && reviewNoteIdentity(finding.note) === reviewNoteIdentity(row.note)) : [];
+                return matches.length === 1 ? matches : [];
+            }));
+            open = open.filter((finding) => !retired.has(finding));
+        }
         if (e.data.pass !== false) {
             // a later review PASSED on this task: every finding it BLOCKED on is settled …
             open = open.filter(isDeferredFinding);
@@ -879,11 +1177,39 @@ export function outstandingReviewFindings(events, taskId) {
             // the very next round — the same silent drop by a different door.
             open = carryReviewFindings(open, findingRows(e, "review").filter(isDeferredFinding));
         }
-        else
-            open = carryReviewFindings(open, findingRows(e, "review"));
+        else {
+            // OBS-1195: a repeated comment bound to a parent this verdict resolved or deferred is not re-seated.
+            open = carryReviewFindings(open, rows).filter((finding) => !boundToRetired(finding));
+        }
     }
     return open;
 }
+/**
+ * OBS-1019 add.2: each outstanding material chain with the number of valid review verdicts that
+ * re-raised it since the last review pass or review-gate waive. Only a chain's own observed spellings
+ * count, so an unrelated finding sharing a path never lengthens it.
+ */
+export function reraisedReviewChains(events, taskId) {
+    let verdicts = [];
+    for (const e of effectiveEvents(events)) {
+        if (e.taskId !== taskId)
+            continue;
+        if (e.event === "task-approved" && e.data.release === GATE_SATISFIED_RELEASE && e.data.gate === "review")
+            verdicts = [];
+        if (e.event !== "gate-result" || e.data.gate !== "review" || e.data.skipped === true)
+            continue;
+        if (e.data.unparseable === true || e.data.noVerdict === true || e.data.cause !== undefined)
+            continue;
+        verdicts = e.data.pass === false ? [...verdicts, e] : [];
+    }
+    return outstandingReviewFindings(events, taskId)
+        .filter((finding) => finding.class === "review:material")
+        .map((finding) => ({
+        finding,
+        reraises: verdicts.filter((e) => Array.isArray(e.data.reraised) && e.data.reraised
+            .some((id) => observedReviewFingerprints(finding).some((fp) => reviewFingerprintMatches(id, fp)))).length,
+    }));
+}
 /** The findings a funded repair must carry into the next dispatch, or undefined if none is pending. */
 export function pendingRepairFindings(events, taskId) {
     const e = decisionForNextDispatch(events, taskId, "repair-attempt");
@@ -896,7 +1222,7 @@ export function pendingRepairFindings(events, taskId) {
  */
 export function activeRetryBan(events, taskId, channel) {
     let pending;
-    for (const e of events) {
+    for (const e of effectiveEvents(events)) { // OBS-1178: a refused or unsound recheck lifts no ban
         if (e.taskId !== taskId)
             continue;
         if (e.event === "gate-fingerprint-cap")
@@ -982,6 +1308,60 @@ export function recordedTaskFailureKind(events, taskId) {
     }
     return undefined;
 }
+// OBS-1109: the `source` a resume harvest stamps on its worker-result and worker-result-harvested rows.
+export const RESUME_HARVEST_SOURCE = "resume";
+// Any harvest row — a live daemon's no-trailer synthesis or a resume's — means the attempt's result is
+// on record: whichever daemon died after it, the next resume gates that record and never redispatches.
+const isHarvested = (e) => e.event === "worker-result-harvested";
+const newestDispatch = (events, taskId) => {
+    const rows = effectiveEvents(events).filter((e) => e.taskId === taskId);
+    const at = rows.map((e) => e.event).lastIndexOf("task-dispatch");
+    if (at < 0)
+        return undefined;
+    const assignment = DispatchAssignmentSchema.safeParse(rows[at].data.assignment);
+    return { dispatch: rows[at], since: rows.slice(at + 1), assignment: assignment.success ? assignment.data : undefined };
+};
+// OBS-1109: the author of a harvested attempt. It holds through every gate result, park or release
+// recorded on that harvest — only a newer dispatch (new work, new author) ends it.
+export function resumeHarvestAuthor(events, taskId) {
+    const newest = newestDispatch(events, taskId);
+    return newest?.since.some(isHarvested) ? newest.assignment : undefined;
+}
+// OBS-1109: the newest dispatch of a task that no result, verdict or decision has closed yet — the
+// attempt a dead daemon left between worker-launch and worker-result. Only a launch row that recorded
+// its nonce and dispatch script is owned evidence; a legacy launch (or none) stays on the ordinary path.
+export function interruptedAttempt(events, taskId) {
+    const newest = newestDispatch(events, taskId);
+    if (!newest)
+        return undefined;
+    const { dispatch, since, assignment } = newest;
+    // A declined harvest is on the ordinary recovery path: its pane is no longer evidence to spare.
+    if (since.some((e) => ["gate-result", "task-done", "task-failed", "task-human", "task-approved", "resume-harvest-declined"].includes(e.event)))
+        return undefined;
+    const attempt = dispatch.data.attempt;
+    if (!assignment || !Number.isInteger(attempt))
+        return undefined; // no recorded author, no harvest
+    const base = { attempt: attempt, assignment };
+    if (since.some(isHarvested))
+        return base;
+    const launched = [...since].reverse().find((e) => e.event === "worker-launch" && e.data.attempt === attempt);
+    const slot = launched?.data.slot;
+    const launch = typeof launched?.data.nonce === "string" && typeof launched.data.dispatchScript === "string"
+        && typeof slot?.id === "string" && typeof slot.name === "string" && typeof slot.cwd === "string"
+        ? { nonce: launched.data.nonce, dispatchScript: launched.data.dispatchScript, slot: { id: slot.id, name: slot.name, cwd: slot.cwd } }
+        : undefined;
+    // A worker-result with no verdict after it — a live daemon's, or a resume harvest's torn off before
+    // its harvest row — is a finished attempt whose gating never happened: finish its record, never redispatch.
+    const resulted = since.find((e) => e.event === "worker-result");
+    if (resulted) {
+        return { ...base, ...(launch ? { launch } : {}), result: {
+                finished: resulted.data.finished === true,
+                summary: typeof resulted.data.summary === "string" ? resulted.data.summary : "",
+                reaped: resulted.data.source === RESUME_HARVEST_SOURCE,
+            } };
+    }
+    return launch ? { ...base, launch } : undefined;
+}
 // Runs can end and later resume in the same journal. The newest lifecycle marker decides whether
 // an unresolved task is still recoverable by this live daemon or belongs to an ended run.
 export function runHasEnded(events) {
@@ -1115,9 +1495,14 @@ export function recordedGraphDefinitionHash(events) {
         return undefined;
     const origin = typeof start.data.graphDefinitionHash === "string" ? start.data.graphDefinitionHash : null;
     let recorded = origin;
+    // OBS-1178: an approval's own rehash moves the identity only while that approval is effective.
+    const granted = new Set(effectiveEvents(events).filter((e) => e.event === "task-approved" && e.data.release === "scope-request")
+        .map((e) => `${e.taskId}\0${e.ts}`));
     for (const e of events) {
         if (e.event !== "graph-rehash")
             continue;
+        if (e.data.source === "approval" && e.data.replay !== true && !granted.has(`${e.taskId}\0${String(e.data.approval)}`))
+            continue;
         const audited = e.data.from === recorded || e.data.from === origin;
         recorded = audited && typeof e.data.to === "string" ? e.data.to : null;
     }
@@ -1154,7 +1539,7 @@ export const ScopeAmendmentSchema = z.object({
  * older than v2.5.7): the caller reads it from the run's materialized graph snapshot.
  */
 export function replayScopeAmendments(graph, events, release = false, approvedDefinitions = new Map()) {
-    const amendments = events.filter((e) => e.event === "task-approved" && e.data.release === "scope-request")
+    const amendments = effectiveEvents(events).filter((e) => e.event === "task-approved" && e.data.release === "scope-request")
         .map((event) => ({ event, amendment: ScopeAmendmentSchema.parse(event.data.amendment) }));
     if (!amendments.length)
         return graph;
@@ -1203,7 +1588,7 @@ export function replayScopeAmendments(graph, events, release = false, approvedDe
 export function applyScopeAmendments(graph, journal, auditReplay = false, release = false) {
     const events = journal.read();
     const result = replayScopeAmendments(graph, events, release, release ? snapshotDefinitions(journal) : new Map()); // validate all before moving any identity
-    const approvals = events.filter((e) => e.event === "task-approved" && e.data.release === "scope-request");
+    const approvals = effectiveEvents(events).filter((e) => e.event === "task-approved" && e.data.release === "scope-request");
     for (const approval of approvals) {
         const amendment = ScopeAmendmentSchema.parse(approval.data.amendment);
         if (!events.some((e) => e.event === "graph-rehash" && e.data.approval === approval.ts && e.taskId === approval.taskId
@@ -1282,14 +1667,19 @@ const runsDir = (repoRoot) => join(repoRoot, stateDirName(repoRoot), "runs");
 // One JSONL reader for every append-only log: skip blanks, drop any line that
 // won't parse, keeping everything before it intact.
 function readJsonl(path) {
-    if (!existsSync(path))
-        return [];
+    return existsSync(path) ? parseJournalText(readFileSync(path, "utf8")) : [];
+}
+/** The journal reader rule over bytes in hand: skip blanks, drop a torn line, keep each row's physical line. */
+export function parseJournalText(raw) {
     const out = [];
-    for (const line of readFileSync(path, "utf8").split("\n")) {
+    for (const [sourceIndex, line] of raw.split("\n").entries()) {
         if (!line.trim())
             continue;
         try {
-            out.push(JSON.parse(line));
+            const row = JSON.parse(line);
+            if (row && typeof row === "object")
+                SOURCE_LINE.set(row, sourceIndex + 1);
+            out.push(row);
         }
         catch {
             // torn trailing write after a crash — ignore; everything before it is intact
@@ -1307,7 +1697,10 @@ function readJsonlSource(path) {
         if (!line.trim())
             continue;
         try {
-            out.push({ sourceIndex, raw: JSON.parse(line) });
+            const raw = JSON.parse(line);
+            if (raw && typeof raw === "object")
+                SOURCE_LINE.set(raw, sourceIndex + 1);
+            out.push({ sourceIndex, raw });
         }
         catch {
             // torn trailing write after a crash — ignore; everything before it is intact
@@ -1367,6 +1760,78 @@ export function readPriorRunEvidence(repoRoot, tasks, opts = {}) {
             && current.get(evidence.taskId) === evidence.taskContentDigest),
     };
 }
+// OBS-1052(3): measured review no-verdict history, per reviewer channel, over the last ten COMPLETED
+// run journals. Advisory display only — nothing here feeds discovery, routing or the review rotation
+// (the run-scoped tally in run-gates is the only thing that retires a seat).
+export const REVIEW_NO_VERDICT_RUN_WINDOW = 10;
+export const REVIEW_NO_VERDICT_ADVISORY_AT = 2;
+// Unlike readJsonl, one unparseable row voids the whole journal: it may have been the missing event.
+function readJournalStrict(path) {
+    try {
+        return readFileSync(path, "utf8").split("\n").filter((line) => line.trim()).map((line) => {
+            const row = JSON.parse(line);
+            if (!row || typeof row !== "object" || typeof row.event !== "string")
+                throw new Error("not a journal row");
+            return row;
+        });
+    }
+    catch {
+        return undefined;
+    }
+}
+export function readReviewNoVerdictHistory(repoRoot, window = REVIEW_NO_VERDICT_RUN_WINDOW) {
+    const history = { runs: [], unreadable: [], counts: new Map() };
+    const dir = runsDir(repoRoot);
+    if (!existsSync(dir))
+        return history;
+    const runIds = readdirSync(dir)
+        .filter((runId) => runId.startsWith("run-") && existsSync(join(dir, runId, "journal.jsonl")))
+        .sort()
+        .reverse();
+    for (const runId of runIds) {
+        // an unreadable journal holds its slot: skipping it would reach an eleventh run in its place
+        if (history.runs.length + history.unreadable.length >= window)
+            break;
+        const events = readJournalStrict(join(dir, runId, "journal.jsonl"));
+        if (!events) {
+            history.unreadable.unshift(runId);
+            continue;
+        }
+        if (!runHasEnded(events))
+            continue;
+        history.runs.unshift(runId);
+        for (const event of events) {
+            const reviewer = event.data?.reviewer;
+            if (typeof reviewer !== "string")
+                continue;
+            // Count each observation once: the terminal review gate-result repeats the last seat's
+            // no-verdict note, so only the note counts and the gate row merely marks the seat as measured.
+            if (event.event === "review-no-verdict")
+                history.counts.set(reviewer, (history.counts.get(reviewer) ?? 0) + 1);
+            else if (event.event === "gate-result" && event.data.gate === "review")
+                history.counts.set(reviewer, history.counts.get(reviewer) ?? 0);
+        }
+    }
+    return history;
+}
+/** One row per measured channel (plus one naming unreadable journals); doctor prints all, Fleet the warn rows. */
+export function reviewNoVerdictRows(history) {
+    const span = `the last ${history.runs.length} completed run${history.runs.length === 1 ? "" : "s"}`;
+    const unreadable = history.unreadable.length;
+    const rows = [...history.counts].sort(([a], [b]) => a.localeCompare(b)).map(([channel, n]) => {
+        const counted = `${n} review no-verdict${n === 1 ? "" : "s"} in ${span}`;
+        if (n >= REVIEW_NO_VERDICT_ADVISORY_AT) {
+            return { channel, verdict: "warn", value: `${counted} — advisory; review eligibility unchanged` };
+        }
+        return unreadable
+            ? { channel, verdict: "warn", value: `unknown — at least ${n} in ${span}; ${unreadable} run journal${unreadable === 1 ? "" : "s"} unreadable` }
+            : { channel, verdict: "pass", value: counted };
+    });
+    if (unreadable) {
+        rows.push({ channel: "unreadable", verdict: "warn", value: `unknown — ${history.unreadable.join(", ")} did not parse; review no-verdicts there are unmeasured` });
+    }
+    return rows;
+}
 // VIS-03 reset cursor — one trimmed runId line at .tickmarkr/profile-since; absent/empty ⇒ undefined.
 // Opaque: used ONLY in the runId > comparison above, never a shell or path join beyond .tickmarkr/.
 export function readProfileCursor(repoRoot) {
@@ -1473,7 +1938,7 @@ export class Journal {
                 const preservedRefs = [...preservedRefsByTask(priorEvents)].flatMap(([preservedTaskId, refs]) => refs.map(({ ref, diffCommand }) => ({ taskId: preservedTaskId, ref, diffCommand })));
                 return preservedRefs.length > 0 ? { ...inputData, preservedRefs } : inputData;
             })()
-            : event === "resume-restore" && rowTaskId && upheldFeedbackByTask(priorEvents).has(rowTaskId)
+            : event === "resume-restore" && rowTaskId && upheldFeedbackByTask(effectiveEvents(priorEvents)).has(rowTaskId)
                 ? {
                     ...inputData,
                     upheldFeedbackRestoredFor: rowTaskId,
@@ -1540,12 +2005,27 @@ export class Journal {
     read() {
         return readJsonl(this.journalPath);
     }
+    /** Parsed rows paired with their physical 1-based journal lines (OBS-1178 bindings name lines). */
+    readSourced() {
+        const rows = readJsonlSource(this.journalPath);
+        return { events: rows.map((row) => row.raw), lines: rows.map((row) => row.sourceIndex + 1) };
+    }
+    /** OBS-1178: the binding of a task's newest park (or `task-failed`) row — what a decision on it names. */
+    newestBinding(taskId, event = "task-human") {
+        const { events, lines } = this.readSourced();
+        for (let i = events.length - 1; i >= 0; i -= 1) {
+            const e = events[i];
+            if (e.event === event && e.taskId === taskId)
+                return typeof e.ts === "string" ? { line: lines[i], ts: e.ts } : undefined;
+        }
+        return undefined;
+    }
     readTracked() {
         return trackJournalRows(this.runId, readJsonlSource(this.journalPath));
     }
     replayStatuses() {
         const s = new Map();
-        for (const e of this.read()) {
+        for (const e of effectiveEvents(this.read())) { // OBS-1178: a refused or unsound decision released nothing
             if (!e.taskId)
                 continue;
             if (e.event === "task-dispatch")
@@ -1608,7 +2088,7 @@ export class Journal {
     }
     replayResumeState() {
         const m = new Map();
-        const events = this.read();
+        const events = effectiveEvents(this.read()); // OBS-1178: a refused or unsound decision funds no budget
         // Keep the legacy resume-state field aligned with the journal-authoritative prompt-time fold.
         // In particular, a review pass after an uphold must erase the fallback daemon.ts may consult.
         const activeUpheldFeedback = upheldFeedbackByTask(events);
@@ -1639,6 +2119,8 @@ export class Journal {
                     const added = !st.tried.includes(key);
                     if (added)
                         st.tried.push(key);
+                    if (st.escalated)
+                        delete st.escalated[key];
                     lastDispatch.set(e.taskId, {
                         ...(added ? { addedKey: key } : {}),
                         prevAssignment: st.lastAssignment,
@@ -1673,14 +2155,31 @@ export class Journal {
                     lastDispatch.delete(e.taskId);
                 }
             }
-            else if (e.event === "capacity-requeue") {
+            else if (e.event === "capacity-requeue" || BOOTSTRAP_DEATH.has(e.event)) {
                 // OBS-1161: a capacity requeue is free — the daemon re-dispatches the SAME attempt on the SAME
                 // seat — so the dispatch it closes must not count, or a resume bills every busy-seat wait
                 // against MAX_ATTEMPTS. Only the attempt rewinds: the seat stays tried and in force (busy, not
                 // burned). Idempotent by the same rule as the scope rewind: only the OUTSTANDING dispatch.
+                // OBS-1169: a bootstrap death bought no worker turn either, retried in place or failed over.
                 const st = m.get(e.taskId);
                 if (st && lastDispatch.delete(e.taskId))
                     st.attempts = Math.max(0, st.attempts - 1);
+                if (st && e.event === "bootstrap-failover") {
+                    // OBS-1169: the failover's routing disposition outlives the process too — its escalated
+                    // siblings stay excluded with their reason, and a crash before the destination's dispatch
+                    // resumes ON that destination instead of relaunching the exhausted source channel.
+                    const reason = typeof e.data.reason === "string" ? e.data.reason : "vendor escalated";
+                    for (const k of Array.isArray(e.data.escalated) ? e.data.escalated : []) {
+                        if (typeof k === "string" && !st.tried.includes(k))
+                            st.escalated = { ...st.escalated, [k]: reason };
+                    }
+                    // The whole ADAPTER of `from` (a channel key, `adapter:model`) is excluded, sibling or none.
+                    const adapter = typeof e.data.from === "string" ? e.data.from.split(":")[0] : undefined;
+                    if (adapter && !st.escalatedAdapters?.includes(adapter))
+                        st.escalatedAdapters = [...(st.escalatedAdapters ?? []), adapter];
+                    const to = DispatchAssignmentSchema.safeParse(e.data.toAssignment);
+                    st.lastAssignment = to.success ? to.data : undefined;
+                }
             }
             else if (e.event === "consult-verdict" && e.data.action === "reroute") {
                 // A reroute bans the in-force channel; retry/decompose/human verdicts ban nothing (D-03).
@@ -1699,6 +2198,8 @@ export class Journal {
                     st.attempts = 0;
                     st.tried = [];
                     st.lastAssignment = undefined;
+                    delete st.escalated;
+                    delete st.escalatedAdapters;
                 }
             }
             else if (e.event === "task-approved" && e.data.release === RECHECK_RELEASE) {
@@ -1752,7 +2253,7 @@ export class Journal {
         const reviewSubjects = new Map();
         const subjects = new Map();
         const reviewWaivers = new Map();
-        for (const e of this.read()) {
+        for (const e of effectiveEvents(this.read())) { // OBS-1178: a refused or unsound waive satisfies nothing
             if (!e.taskId)
                 continue;
             if (e.event === "task-dispatch") {
@@ -1812,7 +2313,7 @@ export class Journal {
     // exclusively to replaySatisfiedGates(), whose typed release-marker contract above is unchanged.
     replayCurrentAttemptGateResults() {
         const replay = new Map();
-        for (const e of this.read()) {
+        for (const e of effectiveEvents(this.read())) {
             if (!e.taskId)
                 continue;
             if (e.event === "task-dispatch") {