tickmarkr 2.6.1 → 2.6.3

package/dist/run/lease.d.ts

@@ -33,7 +33,20 @@ export interface RepositoryLeaseOptions {
     signal?: AbortSignal;
     /** Called once per distinct holder the waiter is queued behind. */
     onWait?: (holder: RepositoryLeaseHolder) => void;
+    /** The token a descendant inherited; defaults to REPOSITORY_LEASE_TOKEN_ENV. */
+    inherited?: string;
 }
+/** OBS-880/1071: the file lease's token, exported to the holder's descendants for the span it is held
+ * so a nested runner (a gate's suite under `tickmarkr verify`, a mutation child inside a leased suite)
+ * reenters instead of waiting on its own ancestor. Deliberately NOT COMMAND_LEASE_TOKEN_ENV: the
+ * installed daemon clears and rewrites that in-process token, and a command-lease token never names
+ * this file. Environment text alone proves nothing: see `reentrantHolder`. */
+export declare const REPOSITORY_LEASE_TOKEN_ENV = "TICKMARKR_REPOSITORY_LEASE_TOKEN";
+/** Reentry is identity-bound: the inherited token must name the record at THIS repository's lease path
+ * right now, its holder must be alive, and that holder must be a strict ancestor of this process. A
+ * forged, stale (released or superseded), foreign-repository or command-lease token matches no record;
+ * an in-process sibling is not a descendant — each of those waits like any other runner. */
+export declare function reentrantHolder(path: string, inherited: string | undefined): Promise<RepositoryLeaseHolder | undefined>;
 export declare function repositoryLeasePath(cwd: string): Promise<string>;
 /** OBS-1057: dev+ino alone is not an identity across unlink/recreate — Linux hands the freed inode
  * number straight to the next file, so a stale observation of a dead or corrupt reservation matched

package/dist/run/lease.js

@@ -91,6 +91,38 @@ export class CommandLeases {
         }
     }
 }
+/** OBS-880/1071: the file lease's token, exported to the holder's descendants for the span it is held
+ * so a nested runner (a gate's suite under `tickmarkr verify`, a mutation child inside a leased suite)
+ * reenters instead of waiting on its own ancestor. Deliberately NOT COMMAND_LEASE_TOKEN_ENV: the
+ * installed daemon clears and rewrites that in-process token, and a command-lease token never names
+ * this file. Environment text alone proves nothing: see `reentrantHolder`. */
+export const REPOSITORY_LEASE_TOKEN_ENV = "TICKMARKR_REPOSITORY_LEASE_TOKEN";
+/** The strict ancestors of this process, from one `ps` snapshot; empty when unreadable (fail closed). */
+const ancestorPids = () => new Promise((ok) => execFile("ps", ["-A", "-o", "pid=,ppid="], { encoding: "utf8" }, (error, stdout) => {
+    const parent = new Map();
+    if (!error)
+        for (const line of stdout.split("\n")) {
+            const [pid, ppid] = line.trim().split(/\s+/).map(Number);
+            if (Number.isInteger(pid) && Number.isInteger(ppid))
+                parent.set(pid, ppid);
+        }
+    const seen = new Set();
+    for (let pid = error ? 0 : process.ppid; pid > 1 && !seen.has(pid); pid = parent.get(pid) ?? 0)
+        seen.add(pid);
+    ok(seen);
+}));
+/** Reentry is identity-bound: the inherited token must name the record at THIS repository's lease path
+ * right now, its holder must be alive, and that holder must be a strict ancestor of this process. A
+ * forged, stale (released or superseded), foreign-repository or command-lease token matches no record;
+ * an in-process sibling is not a descendant — each of those waits like any other runner. */
+export async function reentrantHolder(path, inherited) {
+    if (!inherited)
+        return undefined;
+    const holder = readHolder(path);
+    if (holder?.token !== inherited || holder.pid === process.pid || !alive(holder.pid))
+        return undefined;
+    return (await ancestorPids()).has(holder.pid) ? holder : undefined;
+}
 const LEASE_FILE = "tickmarkr-runner.lease";
 export async function repositoryLeasePath(cwd) {
     const commonDir = await new Promise((ok, fail) => execFile("git", ["rev-parse", "--git-common-dir"], { cwd, encoding: "utf8" }, (error, stdout) => error ? fail(error) : ok(stdout.trim())));
@@ -283,6 +315,9 @@ const inspectAndReserve = (path, mine) => {
 };
 export async function withRepositoryLease(cwd, run, opts = {}) {
     const path = await repositoryLeasePath(cwd);
+    // A descendant of the live holder runs inside its ancestor's reservation and releases nothing.
+    if (await reentrantHolder(path, opts.inherited ?? process.env[REPOSITORY_LEASE_TOKEN_ENV]))
+        return run();
     const pollMs = opts.pollMs ?? 1_000;
     const mine = { pid: process.pid, cwd, at: Date.now(), token: randomUUID() };
     let waitingOn;
@@ -297,10 +332,20 @@ export async function withRepositoryLease(cwd, run, opts = {}) {
         }
         await new Promise((wake) => setTimeout(wake, pollMs));
     }
+    // Exported before run() so every descendant forked or spawned during the hold can reenter; restored
+    // at release unless another reservation in this process has since exported its own.
+    const exported = process.env[REPOSITORY_LEASE_TOKEN_ENV];
+    process.env[REPOSITORY_LEASE_TOKEN_ENV] = mine.token;
     try {
         return await run();
     }
     finally {
+        if (process.env[REPOSITORY_LEASE_TOKEN_ENV] === mine.token) {
+            if (exported === undefined)
+                delete process.env[REPOSITORY_LEASE_TOKEN_ENV];
+            else
+                process.env[REPOSITORY_LEASE_TOKEN_ENV] = exported;
+        }
         // Release is serialized with reclamation/acquisition and removes only this generation.
         await withMutationLock(path, pollMs, undefined, () => {
             if (readHolder(path)?.token === mine.token)

package/dist/run/merge.d.ts

@@ -1,5 +1,5 @@
 import type { TickmarkrConfig } from "../config/config.js";
-import { type Baseline, type GateEvidenceOptions, type FailureClassification } from "../gates/baseline.js";
+import { type Baseline, type BaselineProvenance, type GateEvidenceOptions, type FailureClassification } from "../gates/baseline.js";
 import type { GateEvidenceReceipt } from "./protocol.js";
 export interface TipVerifyResult {
     evidenceReceipt?: GateEvidenceReceipt;
@@ -21,6 +21,8 @@ export interface TipVerifyResult {
     spawnedCommand?: string;
     /** Q121s: nonzero exit whose failures are ALL baseline-recorded — forgiven exactly as the battery forgives. */
     forgiven?: boolean;
+    /** OBS-1123: the capture that recorded the forgiven fingerprints; absent for a legacy baseline that never said. */
+    baselineProvenance?: BaselineProvenance;
     /** D-131: carried from a persisted per-gate verdict — this cycle did NOT execute the command. */
     reused?: true;
     /**

package/dist/run/merge.js

@@ -225,6 +225,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
                 exitCode: hit.exitCode ?? 0,
                 fingerprints: hit.meta?.fingerprints ?? [],
                 ...(hit.meta?.forgiven ? { forgiven: true } : {}),
+                ...(hit.meta?.forgiven && hit.meta.baselineProvenance ? { baselineProvenance: hit.meta.baselineProvenance } : {}),
                 details: formatReusedDetails(hit.details, id),
                 ...(hit.meta?.reportPath ? { reportPath: hit.meta.reportPath } : {}),
                 ...(hit.meta?.spawnedCommand ? { spawnedCommand: hit.meta.spawnedCommand } : {}),
@@ -382,7 +383,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
                                 + `${describeCapacity(entry?.capacity)} and this verification ran under ${describeCapacity(r.capacity)} `
                                 + `— forgiveness across a changed capacity is not evidence`
                             : `exit ${r.code}`)),
-            ...(forgiven && !deficit ? { forgiven: true } : {}),
+            ...(forgiven && !deficit ? { forgiven: true, ...(baseline?.provenance ? { baselineProvenance: baseline.provenance } : {}) } : {}),
             ...(cause ? { cause } : {}),
             ...(pass ? {} : { artifact }),
         };
@@ -401,7 +402,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
         const id = pending.get(result.gate);
         if (id && id.tree === completedTree && !isInfraResult(result)) {
             store.set(id, { ...result, meta: {
-                    fingerprints: result.fingerprints, forgiven: result.forgiven,
+                    fingerprints: result.fingerprints, forgiven: result.forgiven, baselineProvenance: result.baselineProvenance,
                     reportPath: result.reportPath, spawnedCommand: result.spawnedCommand,
                     artifact: result.artifact,
                     evidenceReceipt: result.evidenceReceipt, evidenceReceipts: result.evidenceReceipts,

package/dist/run/operator-summary.d.ts

@@ -13,6 +13,9 @@ export interface OperatorDecisionSnapshot {
         readonly kind: string | undefined;
         readonly tombstone: boolean;
         readonly reason?: string;
+        /** OBS-1178: the park row's physical line and timestamp — the token a decision binds to. */
+        readonly line?: number;
+        readonly ts?: string;
     };
     readonly verbs: readonly string[];
     readonly diagnostic?: string;

package/dist/run/operator-summary.js

@@ -25,7 +25,9 @@ export function projectOperatorSummary(tasks, decisions) {
                 decisionRequired: verbs.length > 0,
                 ...(diagnostic !== undefined || park.reason !== undefined
                     ? { diagnostic: diagnostic ?? park.reason } : {}),
-                nextAction: verbs.length > 0 ? `Choose a decision: ${verbs.join(", ")}` : null,
+                nextAction: verbs.length > 0
+                    ? `Choose a decision: ${verbs.join(", ")}${park.line !== undefined && park.ts !== undefined ? ` (--park ${park.line}@${park.ts})` : ""}`
+                    : null,
             };
             if (!park.tombstone && park.kind === "infra" && task.missingCapability) {
                 const { capability, diagnostic: capabilityDiagnostic } = task.missingCapability;

package/dist/run/protocol.d.ts

@@ -53,6 +53,15 @@ export declare const EvidenceArtifactSchema: z.ZodObject<{
     droppedBytes: z.ZodNumber;
     truncated: z.ZodBoolean;
 }, z.core.$strict>;
+export declare const RedactionSchema: z.ZodObject<{
+    material: z.ZodBoolean;
+    counts: z.ZodOptional<z.ZodObject<{
+        token: z.ZodNumber;
+        assignment: z.ZodNumber;
+        secretEnv: z.ZodNumber;
+        benignEnv: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
 export declare const GateEvidenceReceiptSchema: z.ZodObject<{
     invocationId: z.ZodString;
     nonce: z.ZodOptional<z.ZodString>;
@@ -66,10 +75,10 @@ export declare const GateEvidenceReceiptSchema: z.ZodObject<{
     termination: z.ZodObject<{
         kind: z.ZodEnum<{
             unknown: "unknown";
+            timeout: "timeout";
             signal: "signal";
             "not-started": "not-started";
             exit: "exit";
-            timeout: "timeout";
         }>;
         exitCode: z.ZodNullable<z.ZodNumber>;
         signal: z.ZodNullable<z.ZodString>;
@@ -85,6 +94,12 @@ export declare const GateEvidenceReceiptSchema: z.ZodObject<{
     }>;
     redaction: z.ZodObject<{
         material: z.ZodBoolean;
+        counts: z.ZodOptional<z.ZodObject<{
+            token: z.ZodNumber;
+            assignment: z.ZodNumber;
+            secretEnv: z.ZodNumber;
+            benignEnv: z.ZodNumber;
+        }, z.core.$strict>>;
     }, z.core.$strict>;
     stdout: z.ZodObject<{
         path: z.ZodString;
@@ -222,6 +237,11 @@ export declare const RoleInvocationStartEventSchema: z.ZodObject<{
         adapter: z.ZodOptional<z.ZodString>;
         model: z.ZodOptional<z.ZodString>;
         vendor: z.ZodOptional<z.ZodString>;
+        effort: z.ZodOptional<z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+        }>>;
         evidence: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, z.core.$strict>;
 }, z.core.$strict>;
@@ -240,6 +260,11 @@ export declare const RoleInvocationTerminalEventSchema: z.ZodObject<{
         adapter: z.ZodOptional<z.ZodString>;
         model: z.ZodOptional<z.ZodString>;
         vendor: z.ZodOptional<z.ZodString>;
+        effort: z.ZodOptional<z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+        }>>;
         evidence: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         outcome: z.ZodEnum<{
             failed: "failed";
@@ -352,6 +377,11 @@ export declare const DecisionEventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         adapter: z.ZodOptional<z.ZodString>;
         model: z.ZodOptional<z.ZodString>;
         vendor: z.ZodOptional<z.ZodString>;
+        effort: z.ZodOptional<z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+        }>>;
         evidence: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, z.core.$strict>;
 }, z.core.$strict>, z.ZodObject<{
@@ -369,6 +399,11 @@ export declare const DecisionEventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         adapter: z.ZodOptional<z.ZodString>;
         model: z.ZodOptional<z.ZodString>;
         vendor: z.ZodOptional<z.ZodString>;
+        effort: z.ZodOptional<z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+        }>>;
         evidence: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         outcome: z.ZodEnum<{
             failed: "failed";
@@ -473,6 +508,11 @@ export declare const DecisionEventWriteSchema: z.ZodDiscriminatedUnion<[z.ZodObj
         adapter: z.ZodOptional<z.ZodString>;
         model: z.ZodOptional<z.ZodString>;
         vendor: z.ZodOptional<z.ZodString>;
+        effort: z.ZodOptional<z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+        }>>;
         evidence: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, z.core.$strict>;
     event: z.ZodLiteral<"role-invocation-start">;
@@ -489,6 +529,11 @@ export declare const DecisionEventWriteSchema: z.ZodDiscriminatedUnion<[z.ZodObj
         adapter: z.ZodOptional<z.ZodString>;
         model: z.ZodOptional<z.ZodString>;
         vendor: z.ZodOptional<z.ZodString>;
+        effort: z.ZodOptional<z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+        }>>;
         evidence: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         outcome: z.ZodEnum<{
             failed: "failed";

package/dist/run/protocol.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { GATE_NAMES } from "../graph/schema.js";
+import { EFFORTS, GATE_NAMES } from "../graph/schema.js";
 import { normalizeGateOutcome } from "./outcome.js";
 // T32 (F2): the decision protocol is deliberately smaller than the journal. Existing journals contain
 // many observational event types and must remain readable; only the five event names below assert a
@@ -47,6 +47,16 @@ export const EvidenceArtifactSchema = z.object({
     if (ref.availability === "available" && ref.sha256 === null)
         ctx.addIssue({ code: "custom", message: "available bytes require a hash" });
 });
+// OBS-1139: one count per original span, never a value. A legacy receipt carries `material` alone and
+// keeps it as recorded; a counted one must agree — benign HOME/TMPDIR substitutions are never material.
+const RedactionCountsSchema = z.object({
+    token: z.number().int().nonnegative(),
+    assignment: z.number().int().nonnegative(),
+    secretEnv: z.number().int().nonnegative(),
+    benignEnv: z.number().int().nonnegative(),
+}).strict();
+export const RedactionSchema = z.object({ material: z.boolean(), counts: RedactionCountsSchema.optional() }).strict()
+    .refine(r => !r.counts || r.material === (r.counts.token + r.counts.assignment + r.counts.secretEnv > 0), { message: "material must agree with the token, assignment and secret-environment counts" });
 export const GateEvidenceReceiptSchema = z.object({
     invocationId: NonEmptyStringSchema,
     nonce: NonEmptyStringSchema.optional(),
@@ -64,7 +74,7 @@ export const GateEvidenceReceiptSchema = z.object({
         timedOut: z.boolean().nullable(),
     }).strict(),
     availability: z.enum(EVIDENCE_AVAILABILITIES),
-    redaction: z.object({ material: z.boolean() }).strict(),
+    redaction: RedactionSchema,
     stdout: EvidenceArtifactSchema,
     stderr: EvidenceArtifactSchema,
 }).strict();
@@ -133,6 +143,8 @@ const RoleInvocationIdentityDataSchema = z.object({
     adapter: NonEmptyStringSchema.optional(),
     model: NonEmptyStringSchema.optional(),
     vendor: NonEmptyStringSchema.optional(),
+    // OBS-1182: the effort the seat actually launched at; absent = the CLI's own default, never a level.
+    effort: z.enum(EFFORTS).optional(),
     evidence: EvidenceSchema.optional(),
 });
 const RoleInvocationStartDataSchema = RoleInvocationIdentityDataSchema.strict();

package/dist/run/receipt-resolver.d.ts

@@ -1,6 +1,18 @@
 import { type GateEvidenceReceipt } from "./protocol.js";
 export declare const RECEIPT_UNAVAILABLE_REASONS: readonly ["outside-root", "symlink", "hash-mismatch", "expired", "missing"];
 export type ReceiptUnavailableReason = (typeof RECEIPT_UNAVAILABLE_REASONS)[number];
+/** OBS-1140: at most this many newest eviction tombstones persist; an older eviction reads as missing. */
+export declare const EVICTION_TOMBSTONE_LIMIT = 256;
+/** Beside gate-evidence/, never inside it: tombstones are metadata, not retained artifact bytes. */
+export declare const EVICTION_TOMBSTONES_FILE = "evidence-evictions.json";
+/** Bound to the evicted bytes themselves, so a replacement artifact at the same path never inherits it. */
+export interface EvictionTombstone {
+    readonly path: string;
+    readonly sha256: string;
+    readonly retainedBytes: number;
+}
+/** Newest last, at most the limit; anything malformed is no tombstone at all (fail closed to missing). */
+export declare function parseEvictionTombstones(bytes: Buffer): EvictionTombstone[];
 export type ReceiptResolution = {
     readonly ok: true;
     readonly path: string;
@@ -12,6 +24,16 @@ export type ReceiptResolution = {
 };
 /** Resolve one artifact reference against the run root it was recorded under. Fails closed. */
 export declare function resolveReceipt(reference: unknown, runRoot: string): ReceiptResolution;
+export type ReceiptRedaction = {
+    readonly material: boolean;
+    readonly counts: GateEvidenceReceipt["redaction"]["counts"] | null;
+};
+/**
+ * OBS-1139: what a receipt says was withheld. A counted receipt reports its per-span counts; a legacy
+ * one keeps its recorded `material` with no counts; anything unparseable is material (fail closed).
+ */
+export declare function resolveReceiptRedaction(receipt: unknown): ReceiptRedaction;
+export declare function formatReceiptRedaction(r: ReceiptRedaction): string;
 /** Both artifacts of a receipt, stdout first, each resolved independently. */
 export declare function resolveReceiptArtifacts(receipt: GateEvidenceReceipt, runRoot: string): ReceiptResolution[];
 /** One line per artifact for a human surface: the reference, then its verified availability. */

package/dist/run/receipt-resolver.js

@@ -1,13 +1,28 @@
 import { createHash } from "node:crypto";
 import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
-import { EvidenceArtifactSchema } from "./protocol.js";
+import { EvidenceArtifactSchema, RedactionSchema } from "./protocol.js";
 // OBS-1101 retrieval (D-174): the one production reader of an execution-evidence receipt. It answers
 // from the bytes on disk under the run root the receipt was minted in and nothing else — no
 // re-execution, no substitute chosen by name or timestamp, no symlink followed anywhere: not in the
 // reference, not at the root, not above it. The caller hands a canonical root (its own trust anchor);
 // a root reached through any link is refused outright.
 export const RECEIPT_UNAVAILABLE_REASONS = ["outside-root", "symlink", "hash-mismatch", "expired", "missing"];
+/** OBS-1140: at most this many newest eviction tombstones persist; an older eviction reads as missing. */
+export const EVICTION_TOMBSTONE_LIMIT = 256;
+/** Beside gate-evidence/, never inside it: tombstones are metadata, not retained artifact bytes. */
+export const EVICTION_TOMBSTONES_FILE = "evidence-evictions.json";
+/** Newest last, at most the limit; anything malformed is no tombstone at all (fail closed to missing). */
+export function parseEvictionTombstones(bytes) {
+    try {
+        const raw = JSON.parse(bytes.toString("utf8"));
+        return Array.isArray(raw) ? raw.filter((t) => typeof t?.path === "string"
+            && typeof t.sha256 === "string" && Number.isInteger(t.retainedBytes)).slice(-EVICTION_TOMBSTONE_LIMIT) : [];
+    }
+    catch {
+        return [];
+    }
+}
 /** Resolve one artifact reference against the run root it was recorded under. Fails closed. */
 export function resolveReceipt(reference, runRoot) {
     const parsed = EvidenceArtifactSchema.safeParse(reference);
@@ -27,6 +42,8 @@ export function resolveReceipt(reference, runRoot) {
     if (!rel || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel))
         return { ok: false, path: ref.path, reason: "outside-root" };
     const read = readUnderRoot(root, rel.split(sep));
+    if (read === "missing" && evictedByQuota(root, ref))
+        return { ok: false, path: ref.path, reason: "expired" };
     if (typeof read === "string")
         return { ok: false, path: ref.path, reason: read };
     const sha256 = createHash("sha256").update(read).digest("hex");
@@ -34,6 +51,28 @@ export function resolveReceipt(reference, runRoot) {
         return { ok: false, path: ref.path, reason: "hash-mismatch" };
     return { ok: true, path: ref.path, sha256 };
 }
+/** A deletion is explained only by a tombstone naming this exact path, hash and length (OBS-1140). */
+function evictedByQuota(root, ref) {
+    const bytes = readUnderRoot(root, [EVICTION_TOMBSTONES_FILE]);
+    return typeof bytes !== "string" && parseEvictionTombstones(bytes)
+        .some(t => t.path === ref.path && t.sha256 === ref.sha256 && t.retainedBytes === ref.retainedBytes);
+}
+/**
+ * OBS-1139: what a receipt says was withheld. A counted receipt reports its per-span counts; a legacy
+ * one keeps its recorded `material` with no counts; anything unparseable is material (fail closed).
+ */
+export function resolveReceiptRedaction(receipt) {
+    const parsed = RedactionSchema.safeParse(receipt?.redaction);
+    if (!parsed.success)
+        return { material: true, counts: null };
+    return { material: parsed.data.material, counts: parsed.data.counts ?? null };
+}
+export function formatReceiptRedaction(r) {
+    const head = r.material ? "material" : "nonmaterial";
+    return r.counts
+        ? `redaction ${head} token=${r.counts.token} assignment=${r.counts.assignment} secret-env=${r.counts.secretEnv} benign-env=${r.counts.benignEnv}`
+        : `redaction ${head} (uncounted)`;
+}
 const same = (a, b) => a.dev === b.dev && a.ino === b.ino;
 /** Every ancestor of the root, root first excluded — "/" itself cannot be a link. */
 function ancestors(root) {

package/dist/run/repair-selection.d.ts

@@ -2,9 +2,19 @@ import type { JournalEvent } from "./journal.js";
 export interface RepairSelectionDecision {
     selectTests: boolean;
     requiredFiles: string[];
-    reason: "no-test-failure" | "known-failing-files" | "legacy-test-failure" | "unattributed-test-failure" | "full-suite-failure";
+    reason: "no-test-failure" | "known-failing-files" | "legacy-test-failure" | "unattributed-test-failure";
 }
 type SelectionEvent = Pick<JournalEvent, "event" | "taskId" | "data">;
+/** OBS-1199: repair selection is on unless a config says otherwise, independent of the optional
+ * execution budget (which stays subprocess-only). Either explicit `false` turns it off. */
+export declare function repairSelectionEnabled(cfg?: {
+    executionPolicy?: {
+        repairSelection?: unknown;
+    };
+    gates?: {
+        repairSelection?: unknown;
+    };
+}): boolean;
 /** Diagnostic selection only: neither a narrow pass nor this decision can authorize integration.
  * Distrust and known failing files survive later green results, approvals and resume. A historical
  * ambiguous failure is never reinterpreted using a newly enabled policy. */

package/dist/run/repair-selection.js

@@ -1,3 +1,8 @@
+/** OBS-1199: repair selection is on unless a config says otherwise, independent of the optional
+ * execution budget (which stays subprocess-only). Either explicit `false` turns it off. */
+export function repairSelectionEnabled(cfg) {
+    return cfg?.executionPolicy?.repairSelection !== false && cfg?.gates?.repairSelection !== false;
+}
 /** These are literal repository-relative identities. Existence and selection support are checked
  * against the current worktree by the gate; this journal fold cannot establish either. */
 function fileIdentities(value) {
@@ -32,16 +37,19 @@ export function repairSelectionDecision(events, taskId, enabled) {
             distrust ??= "unattributed-test-failure";
             continue;
         }
-        // A replacement full-suite failure follows a passing screen in the current pipeline. No
-        // ordinary full-suite failure establishes that a selector safely covers the failed behavior.
-        if (data.fullSuite === true) {
-            distrust ??= "full-suite-failure";
-            continue;
-        }
-        const selected = fileIdentities(data.selectedTests);
+        // OBS-1199: a full-suite red counts only when it positively says it was full — the replacement
+        // after a screen (`fullSuite`), or an ordinary full run whose recorded selection decision says
+        // so — and names its failing files. Those files join every later screen even when no selector
+        // reaches them; the merge candidate still runs the complete suite. No attribution means full.
         const failing = fileIdentities(data.failingFiles);
-        if (!selected || !failing || failing.some((file) => !selected.includes(file))
-            || (data.fullSuite !== undefined && data.fullSuite !== false)) {
+        const selected = fileIdentities(data.selectedTests);
+        const decision = data.selectionDecision;
+        const replacement = data.fullSuite === true;
+        const ordinaryFull = data.fullSuite === undefined && data.selectedTests === undefined
+            && typeof decision === "object" && decision !== null && decision.scope === "full";
+        const screen = (data.fullSuite === undefined || data.fullSuite === false) && selected !== undefined
+            && failing !== undefined && failing.every((file) => selected.includes(file));
+        if (!failing || !(replacement || ordinaryFull || screen)) {
             distrust ??= "unattributed-test-failure";
             continue;
         }

package/dist/run/supervision.d.ts

@@ -48,6 +48,7 @@ export interface SupervisionArm {
 export declare const supervisionArmPath: (repoRoot: string, tier: SupervisionTier) => string;
 /** Explicit arming acknowledges the current marker without deleting it. */
 export declare function newSupervisionArm(repoRoot: string, tier: SupervisionTier, armId?: string, initial?: boolean): SupervisionArm;
+export declare const supervisionPresencePath: (repoRoot: string, tier: SupervisionTier, id: string) => string;
 export declare function beatSupervision(repoRoot: string, tier: SupervisionTier, seat?: string, observation?: SupervisionBeatObservation, options?: {
     arm?: SupervisionArm;
     armId?: string;
@@ -69,7 +70,10 @@ export declare function supervisionStatus(repoRoot: string, tier: SupervisionTie
 export declare const readSupervision: (repoRoot: string, now?: number) => TierLiveness[];
 /** One line, one word per tier. Shared by both status surfaces so neither can render a state twice. */
 export declare const supervisionText: (tiers: readonly TierLiveness[], divider?: string) => string;
-/** A board's durable identity is independent of its short title and of other observers. */
+/** A board's durable identity is independent of its short title and of other observers.
+ *  `handle` is the terminal the claiming observer reports running in, when its host exports one: the
+ *  one fact that names the board's pane when the placing split's receipt never arrived (OBS-1172).
+ *  `retired` marks a tombstone a driver keeps in the record's place; it is never answered again. */
 export interface WatchBoardOwner {
     repo: string;
     runId: string;
@@ -80,6 +84,8 @@ export interface WatchBoardOwner {
     token: string;
     pid?: number;
     armId?: string;
+    handle?: string;
+    retired?: true;
 }
 export declare const WATCH_OWNER_ENV = "TICKMARKR_WATCH_OWNER";
 export declare function readWatchBoard(repo: string, runId: string): WatchBoardOwner | undefined;

package/dist/run/supervision.js

@@ -154,7 +154,7 @@ const supervisionObligationPath = (repoRoot, tier) => join(supervisionDir(repoRo
 // Freshness decides presence, never a process table (SUP-02): a watcher that is killed cannot remove
 // its own file, and an unremoved file ages past the same ceiling a beat does and stops counting.
 const presencePrefix = (tier) => `${tier}.live.`;
-const supervisionPresencePath = (repoRoot, tier, id) => join(supervisionDir(repoRoot), `${presencePrefix(tier)}${id}`);
+export const supervisionPresencePath = (repoRoot, tier, id) => join(supervisionDir(repoRoot), `${presencePrefix(tier)}${id}`);
 /** Every presence file on this tier, by name. Missing directory ⇒ nobody is present. */
 const presenceNames = (repoRoot, tier) => {
     try {
@@ -567,6 +567,8 @@ export const supervisionText = (tiers, divider = " · ") => `supervision: ${tier
     `${t.clearOwedSince ? ` CLEAR-OWED since ${t.clearOwedSince}` : ""}` +
     `${t.clearOwedUnreadable ? " CLEAR-OWED unreadable" : ""}`).join(divider)}`;
 export const WATCH_OWNER_ENV = "TICKMARKR_WATCH_OWNER";
+/** Orca exports each terminal's own handle into the processes it runs. */
+const TERMINAL_HANDLE_ENV = "ORCA_TERMINAL_HANDLE";
 const boardPath = (repo, runId) => join(supervisionDir(repo), `watch-board.${parseRunId(runId)}.json`);
 const boardMessagePath = (owner, kind) => {
     if (!/^[a-f0-9-]{36}$/.test(owner.token))
@@ -642,7 +644,8 @@ export function observeNamedRun(repo, runId, env = process.env) {
             const candidate = readWatchBoard(repo, runId);
             if (!candidate || candidate.token !== token || candidate.pid !== undefined)
                 throw new Error("watch ownership unknown; refusing narrator acknowledgement");
-            owner = { ...candidate, pid: process.pid, armId: armed.id };
+            const handle = env[TERMINAL_HANDLE_ENV]?.trim();
+            owner = { ...candidate, pid: process.pid, armId: armed.id, ...(handle ? { handle } : {}) };
             atomicRecord(boardPath(repo, runId), owner);
         }
     }

package/dist/run/wall-budget.d.ts

@@ -0,0 +1,48 @@
+import type { JournalEvent } from "./journal.js";
+/**
+ * OBS-1201: where a run's wall time went. Every instant of the engagement window lands in exactly ONE
+ * bucket — the first of WALL_PRIORITY with a span covering it — and what no span covers is residual,
+ * so the exposed buckets always sum to the wall. Task-time sums every span as recorded, so concurrent
+ * work (two workers, four suites waiting on one lease) stays visible without inflating the wall.
+ *
+ * Only journaled observations become spans: a fresh gate row's measured duration less the matched
+ * suite waits inside it, a worker launch matched to its result, a suite wait matched to its admission,
+ * and the gap a restart left between one engagement's last row and the next run-resume. A copy of
+ * evidence — a cache reuse, a journal replay, a row naming an invocation already counted — never adds
+ * a span; a reused full suite's row still times the fresh screen it carries. A row without a duration, a launch, wait or gate start with no matching end, and one cut by
+ * a restart are counted, never timed. Residual
+ * is unattributed time, not a claim of idleness. Pure: journal rows in, numbers out.
+ */
+export declare const WALL_PRIORITY: readonly ["interruption", "test", "semantics", "worker", "queue", "other-gate"];
+export type WallBucket = (typeof WALL_PRIORITY)[number];
+type PerBucket = Record<WallBucket, number>;
+export interface WallBudget {
+    wallMs: number;
+    exposedMs: PerBucket;
+    residualMs: number;
+    taskMs: PerBucket;
+    /** Gate-result rows by provenance. A declined gate never ran and is none of these. */
+    evidence: {
+        fresh: number;
+        replay: number;
+        reuse: number;
+        unknown: number;
+    };
+    /** Evidence that exists but carries no timing: rows without a duration, unmatched and interrupted starts. */
+    untimed: Record<WallBucket, {
+        unknown: number;
+        unmatched: number;
+        interrupted: number;
+    }>;
+}
+/** Undefined when the journal names no measurable window (no run-start, or unreadable timestamps). */
+export declare function wallBudget(events: readonly JournalEvent[]): WallBudget | undefined;
+/** Whole seconds past a minute, one decimal below ten seconds — never a rounded-away "0s" for a real span. */
+export declare const formatSpan: (ms: number) => string;
+/**
+ * One fact per bucket, then residual and the evidence tally — the words every surface prints. A
+ * bucket whose only evidence is untimed reads `unknown`, never a zero it did not measure.
+ */
+export declare function wallBudgetFacts(b: WallBudget): Array<[label: string, fact: string]>;
+export declare const WALL_PRIORITY_TEXT: string;
+export {};