tickmarkr 2.6.1 → 2.6.3

package/dist/drivers/orca.js

@@ -5,7 +5,7 @@ import { shq } from "../adapters/types.js";
 import { createWorktree, FORK_CAP_ENV, resolvedForkCap, sh } from "../run/git.js";
 import { Journal, parseRunId } from "../run/journal.js";
 import { stateDirName } from "../graph/graph.js";
-import { readWatchBoard, requestWatchBoardStop, stopWatchBoard, WATCH_OWNER_ENV } from "../run/supervision.js";
+import { readWatchBoard, requestWatchBoardStop, stopWatchBoard, supervisionPresencePath, WATCH_OWNER_ENV } from "../run/supervision.js";
 import { MAX_BUF } from "./subprocess.js";
 import { formatOwnedName, panesToClose, parseOwnedName } from "./types.js";
 // Orca (onorca.dev) as a third execution surface beside herdr and subprocess. tickmarkr keeps
@@ -454,6 +454,26 @@ function lockEntryGeneration(entry) {
     const legacy = /^pid(?:\.(\d+))?$/.exec(entry);
     return owner ? Number(owner[1]) : legacy ? Number(legacy[1] ?? 0) : undefined;
 }
+/** The placing claim window: how long a narrator waits for its observer to claim the reservation. */
+const CLAIM_WINDOW_MS = 5000;
+/** Reservation tokens THIS process held after an indeterminate split receipt (OBS-1172). Any other
+ *  reserved or claimed record under a live placer is a placement in flight (or a crash still being
+ *  judged) and is refused untouched; a held one is reconciled again on every call, never split over. */
+const held = new Set();
+/** A claimed board's observer is live when its pid answers AND the arm it claimed with is present. */
+function observerLive(r) {
+    return typeof r.pid === "number" && pidLive(r.pid) && typeof r.armId === "string"
+        && existsSync(supervisionPresencePath(r.repo, "watch", r.armId));
+}
+/** Tombstone THIS reservation while it is still the untouched reservation; a record anyone else moved
+ *  is left to them. Answers the tombstone, or undefined when the record was not this reservation. */
+async function tombstoneReservation(path, cwd, runId, token, time, extra = {}) {
+    const now = readBoard(path, cwd, runId);
+    if (now?.record.token !== token || boardState(now.record) !== "reserved")
+        return undefined;
+    const record = { ...now.record, ...extra, retired: true };
+    return { raw: await casBoard("split", path, now.raw, record, time), record };
+}
 function pidLive(pid) {
     try {
         process.kill(pid, 0);
@@ -699,7 +719,28 @@ export class OrcaDriver {
                 this.pendingProjects.delete(owned.taskId);
             }
         }
-        return { id, name: title, cwd: worktree, group: opts?.group };
+        const slot = { id, name: title, cwd: worktree, group: opts?.group, readScreen: () => this.readScreen(slot) };
+        return slot;
+    }
+    /**
+     * OBS-1109: bind THIS instance to a terminal an earlier daemon created for an OWNED slot, so a
+     * resumed daemon can read the interrupted attempt's pane. Binding needs ownership evidence, never
+     * a title or handle alone: exactly one tab on the tracked worktree carries the FULL journaled owned
+     * title, it resolves to exactly one terminal, and that terminal's scrollback proves the exact task
+     * checkout `slot.cwd` (the frame only tickmarkr's own create command prints). Zero, ambiguous or
+     * foreign candidates leave the slot unbound: the throw is the caller's decline. The journaled
+     * nonce is then checked by the caller against the trailer this binding reads.
+     */
+    async adopt(slot) {
+        if (!parseOwnedName(slot.name))
+            throw new OrcaError("list", `slot ${slot.name} carries no owned title — nothing to adopt`, "");
+        const cwd = canonicalWorktreePath(slot.cwd);
+        const st = { title: slot.name, cwd, buf: "", recoveries: 0, recovering: false };
+        st.tracked = await this.trackedWorktree(cwd);
+        await this.recover("adopt", st, undefined, "", { proveCheckout: true });
+        const id = `orca-${++this.n}`;
+        this.slots.set(id, st);
+        return { id, name: slot.name, cwd, ...(slot.group === undefined ? {} : { group: slot.group }) };
     }
     /** Where to invoke the CLI for this slot's calls (see OrcaSlotState.dir). */
     cliCwd(st) {
@@ -979,7 +1020,7 @@ export class OrcaDriver {
             return { proven: false, reason: error instanceof Error ? error.message : String(error) };
         }
     }
-    async recover(family, st, newRuntimeId, raw) {
+    async recover(family, st, newRuntimeId, raw, opts) {
         if (st.recovering)
             throw this.latched(family, st, "handle recovery re-entered", raw);
         st.recovering = true;
@@ -1034,17 +1075,19 @@ export class OrcaDriver {
                 throw this.latched(family, st, `the owned tab resolves to ${panes.length} terminals in ${home}`, env.raw);
             }
             const handle = panes[0];
-            if (handle === old) {
-                // Handles are runtime-scoped: the same VALUE under a different runtime proves nothing about
-                // which terminal it addresses, so it is never adopted.
-                throw this.latched(family, st, `replacement handle ${handle} is the old handle value reused by runtime ${newRuntimeId ?? env.runtimeId ?? "unknown"}`, env.raw);
-            }
-            if (st.tracked !== undefined && st.tracked !== st.cwd) {
+            // Handles are runtime-scoped: the same VALUE under a different runtime proves nothing about
+            // which terminal it addresses. OBS-1108: it is therefore reconciled exactly like any other
+            // replacement plus the checkout proof — never on the handle text (a 2.5.8 latch refused a live,
+            // finished worker for hours) and never adopted without that ownership evidence.
+            const reused = handle === old;
+            if (reused || opts?.proveCheckout || (st.tracked !== undefined && st.tracked !== st.cwd)) {
                 // FX-N01: a nested checkout shares its worktreePath with every sibling task's terminal, so
                 // the candidate must prove the checkout itself (read-only) before it is addressed as ours.
                 const proof = await this.checkoutProven(handle, st.cwd, this.cliCwd(st), env.runtimeId);
                 if (!proof.proven) {
-                    throw this.latched(family, st, `candidate ${handle} does not prove checkout ${st.cwd} (${proof.reason}); the sole same-titled tab on ${home} is not adopted`, env.raw);
+                    throw this.latched(family, st, reused
+                        ? `replacement handle ${handle} is the old handle value reused by runtime ${newRuntimeId ?? env.runtimeId ?? "unknown"} and does not prove checkout ${st.cwd} (${proof.reason}); a reused handle value is not adopted on its text`
+                        : `candidate ${handle} does not prove checkout ${st.cwd} (${proof.reason}); the sole same-titled tab on ${home} is not adopted`, env.raw);
                 }
             }
             st.handle = handle;
@@ -1133,14 +1176,14 @@ export class OrcaDriver {
             throw new OrcaUnavailableError(family, `exited-shaped stream page: show answered by runtime ${show.runtimeId}, not the bound ${st.runtimeId}`, show.raw, "exited");
         }
         this.liveShowTerm(family, st, show);
-        const screen = await this.readScreen(st);
+        const screen = await this.screenFrame(st);
         if (screen.source !== "screen") {
             throw new OrcaUnavailableError(family, `exited-shaped stream page and no rendered screen for ${st.handle}`, blind.raw, "exited");
         }
         return screen.term;
     }
     /** A rendered-frame liveness read. `--screen` and `--cursor` are mutually exclusive in Orca. */
-    async readScreen(st) {
+    async screenFrame(st) {
         const env = await this.terminalOp("status", st, (h) => this.call("read", [
             "terminal", "read", "--terminal", h, "--screen",
         ], this.cliCwd(st)));
@@ -1151,6 +1194,20 @@ export class OrcaDriver {
         }
         return { term, source };
     }
+    /**
+     * OBS-1205: the public rendered-screen read a slot carries (Slot.readScreen). Kimi draws its trust
+     * modal with cursor addressing, so the stream holds the box rules and no `Trust` text while the
+     * painted frame shows `❯ Trust this folder`. Same ownership discipline as every read — bound
+     * runtime, addressed handle, running status — and a frame the runtime could not render is
+     * unreadable, never an empty screen a caller could read as "no modal".
+     */
+    async readScreen(slot) {
+        const st = this.state(slot);
+        const { term, source } = await this.screenFrame(st);
+        if (source !== "screen")
+            throw new OrcaUnavailableError("read", `no rendered screen for ${st.handle}`, "");
+        return this.tailText("read", term, "");
+    }
     /** A single UNPAGED tail read — exactly what the caller asked for and nothing more. Markers split
      *  across cursor pages are not reassembled here; that is waitOutput's job. */
     async read(slot, lines) {
@@ -1227,7 +1284,7 @@ export class OrcaDriver {
             // reporting even when the show record alone would still look connected (show carries no
             // status field of its own, so a terminal can report "unknown"/"exited" on read while its
             // show row still says connected — the read leg is the only place that catches that).
-            const screen = await this.readScreen(st);
+            const screen = await this.screenFrame(st);
             if (`${st.runtimeId}:${st.handle}:${st.recoveries}` !== gen) {
                 continue;
             }
@@ -1365,7 +1422,7 @@ export class OrcaDriver {
     async sendKey(slot, key) {
         const st = this.state(slot);
         this.assertAvailable("send", st);
-        if (key === "enter") {
+        if (key === "enter" || key === "Enter") { // "Enter": every adapter's declared trust key (OBS-1205)
             await this.sendText(st, "");
             return;
         }
@@ -1398,7 +1455,7 @@ export class OrcaDriver {
                 return true;
             const deadline = this.time.now() + NUDGE_ECHO_TIMEOUT_MS;
             for (;;) {
-                const screen = await this.readScreen(st);
+                const screen = await this.screenFrame(st);
                 // ponytail: "composer emptied" is "the text is no longer on the frame" — a TUI that keeps the
                 // submitted turn on screen reads as undelivered until the timeout; the receipt stage is primary.
                 if (screen.source === "screen") {
@@ -1435,13 +1492,29 @@ export class OrcaDriver {
                 }
             }
             else if (current) {
-                const state = boardState(current.record);
+                let state = boardState(current.record);
+                const { placer, token: heldToken } = current.record;
+                if ((state === "reserved" || state === "claimed") && placer === process.pid && held.has(heldToken)) {
+                    // OBS-1172: THIS process held the placement after an indeterminate split receipt. Reconciled
+                    // again, never split over: adopted once proven, still held while unknown, and tombstoned
+                    // only once proven to have started nothing.
+                    const settled = await this.settleIndeterminate(cwd, path, runId, heldToken, launchingHandle, 0);
+                    if (settled.kind === "held") {
+                        throw new OrcaError("split", `Orca narrator placement remains unresolved for ${name} (${state}, held after an indeterminate split receipt): ${settled.why}; no second board is split over it; ${kept}`, "");
+                    }
+                    held.delete(heldToken);
+                    if (settled.kind === "adopted")
+                        return settled.slot;
+                    current = await tombstoneReservation(path, cwd, runId, heldToken, this.time);
+                    if (!current)
+                        throw new OrcaError("split", `Orca narrator placement remains unresolved for ${name}: the held reservation changed underneath; ${kept}`, "");
+                    state = boardState(current.record);
+                }
                 if (state === "reserved" || state === "claimed") {
                     // A reservation or claim with no bound pane is the placing narrator's normal intermediate
                     // state while that narrator lives (awaiting its receipt, listing, claim or bind): refused
                     // untouched, its observer never asked to stop. Only a DEAD placer (or one unrecorded) makes
                     // it a crash to recover.
-                    const { placer } = current.record;
                     if (typeof placer !== "number" || pidLive(placer)) {
                         throw new OrcaError("split", `Orca narrator placement remains unresolved for ${name} (${state}, no bound pane) while placing narrator ${placer ?? "unrecorded"} lives; ${kept}`, "");
                     }
@@ -1450,14 +1523,11 @@ export class OrcaDriver {
                     // The placing driver crashed between the observer's claim and its bind. The record is
                     // replaced only once that observer is proven gone: dead outright, or live and stopped with
                     // its acknowledgement awaited on injected time — unacknowledged, it is refused untouched.
-                    const pid = current.record.pid;
-                    if (pidLive(pid)) {
-                        try {
-                            await stopWatchBoard(current.record, this.time);
-                        }
-                        catch (error) {
-                            throw new OrcaError("split", `Orca narrator placement refused for ${name}: claimed board's live observer unacknowledged; ${kept}; ${errorText(error)}`, "");
-                        }
+                    try {
+                        await this.stopObserver(current.record);
+                    }
+                    catch (error) {
+                        throw new OrcaError("split", `Orca narrator placement refused for ${name}: claimed board's live observer unacknowledged; ${kept}; ${errorText(error)}`, "");
                     }
                     const retired = { ...current.record, retired: true };
                     current = { raw: await casBoard("split", path, current.raw, retired, this.time), record: retired };
@@ -1471,10 +1541,13 @@ export class OrcaDriver {
                 if (state === "bound") {
                     // The bound record is the durable truth of placement: the child handle PLUS the split
                     // envelope's runtime identity. A handle listed by a later runtime is a different pane.
-                    if (listedOnRuntime(await this.listAll(cwd), current.record.pane, current.record.runtimeId)) {
+                    // OBS-1131: it is adopted only while its observer lives — a resumed daemon retires the
+                    // board of a dead observer here (tombstone, stop request, handle-bound close) instead of
+                    // answering it and later spending a reopen to discover the death.
+                    if (observerLive(current.record) && listedOnRuntime(await this.listAll(cwd), current.record.pane, current.record.runtimeId)) {
                         return watchSlot(cwd, name, current.record.pane);
                     }
-                    // Lost: this runtime no longer has that pane. Tombstone before anything else.
+                    // Lost or dead: tombstone before anything else.
                     const retired = { ...current.record, retired: true };
                     current = { raw: await casBoard("split", path, current.raw, retired, this.time), record: retired };
                 }
@@ -1482,12 +1555,7 @@ export class OrcaDriver {
                 // observer must stop and ack on injected time before the handle-bound close; timeout keeps
                 // the tombstone and does not replace it.
                 try {
-                    if (typeof current.record.pid === "number" && pidLive(current.record.pid)) {
-                        await stopWatchBoard(current.record, this.time);
-                    }
-                    else {
-                        requestWatchBoardStop(current.record);
-                    }
+                    await this.stopObserver(current.record);
                 }
                 catch (error) {
                     throw new OrcaError("split", `Orca narrator placement refused for ${name}: retired board observer unacknowledged; ${kept}; ${errorText(error)}`, "");
@@ -1503,37 +1571,43 @@ export class OrcaDriver {
             // judged replaceable above.
             const token = randomUUID();
             await casBoard("split", path, current?.raw, { repo: realpathSync(cwd), runId, driver: this.id, workspace: ORCA_SPACE, pane: "", name, token, placer: process.pid }, this.time);
-            // A reservation that can never be bound — no usable receipt, or no claim — is tombstoned so the
-            // next narrator call splits afresh instead of refusing forever. Only THIS reservation, and only
-            // while it is still the untouched reservation; a record anyone else moved is left to them.
-            const tombstone = async (extra = {}) => {
-                try {
-                    const now = readBoard(path, cwd, runId);
-                    if (now?.record.token === token && boardState(now.record) === "reserved") {
-                        await casBoard("split", path, now.raw, { ...now.record, ...extra, retired: true }, this.time);
-                    }
+            // OBS-1172: a split whose receipt never arrived intact — a transport failure or timeout, an
+            // unparseable or handle-less body, a child the listing does not place in the launching tab —
+            // may still have started the board. It is reconciled before any failure: a uniquely proven
+            // live pane is adopted and bound; a split proven to have started nothing is tombstoned so the
+            // next call splits afresh; anything else is HELD — the reservation stays, and no later call
+            // splits a second board over it.
+            const indeterminate = async (reason, raw) => {
+                const settled = await this.settleIndeterminate(cwd, path, runId, token, launchingHandle, CLAIM_WINDOW_MS);
+                if (settled.kind === "adopted")
+                    return settled.slot;
+                if (settled.kind === "absent") {
+                    await tombstoneReservation(path, cwd, runId, token, this.time).catch(() => undefined);
+                    throw new OrcaError("split", `Orca narrator placement failed for ${name}: ${reason}; ${kept}`, raw);
                 }
-                catch { /* the record is kept as it stands; the next narrator judges it */ }
+                held.add(token);
+                throw new OrcaError("split", `Orca narrator placement unresolved for ${name}: ${reason}; ${settled.why} — the placement is held and no second board is split over it; ${kept}`, raw);
             };
             // Exactly one terminal split of the launching handle, horizontal, carrying token and command.
-            // An unknown receipt (transport failure, refusal, unparseable output) after the verb was issued
-            // is as indeterminate as a handle-less one: the pane may exist, so the reservation stays.
-            const env = await this.call("split", [
-                "terminal", "split",
-                "--terminal", launchingHandle,
-                "--direction", "horizontal",
-                "--command", `${WATCH_OWNER_ENV}=${shq(token)} ${command}`,
-            ], cwd).catch(async (error) => {
-                await tombstone();
-                throw new OrcaError("split", `Orca narrator placement failed for ${name}: split receipt is unknown (${error instanceof OrcaError ? error.reason : errorText(error)}); ${kept}`, error instanceof OrcaError ? error.raw : "");
-            });
+            let env;
+            try {
+                env = await this.call("split", [
+                    "terminal", "split",
+                    "--terminal", launchingHandle,
+                    "--direction", "horizontal",
+                    "--command", `${WATCH_OWNER_ENV}=${shq(token)} ${command}`,
+                ], cwd);
+            }
+            catch (error) {
+                return await indeterminate(`split receipt is unknown (${error instanceof OrcaError ? error.reason : errorText(error)})`, error instanceof OrcaError ? error.raw : "");
+            }
+            const malformed = "split receipt is unknown, malformed or handle-less";
             let child;
             try {
                 child = splitReceipt(env);
             }
             catch {
-                await tombstone();
-                throw new OrcaError("split", `Orca narrator placement failed for ${name}: split receipt is unknown, malformed or handle-less; ${kept}`, env.raw);
+                return await indeterminate(malformed, env.raw);
             }
             // Parent tabId must name the launching terminal's tab, and the child must actually appear
             // there. A handle-only object, a tabId for some other tab, or a handle the list does not
@@ -1543,21 +1617,19 @@ export class OrcaDriver {
                 listing = await this.listAll(cwd);
             }
             catch (error) {
-                await tombstone();
-                throw new OrcaError("split", `Orca narrator placement failed for ${name}: split receipt is unknown, malformed or handle-less; ${kept}`, error instanceof OrcaError ? error.raw : env.raw);
+                return await indeterminate(malformed, error instanceof OrcaError ? error.raw : env.raw);
             }
             const launchingTabId = terminalTabId(listing, launchingHandle);
             if (!launchingTabId
                 || child.tabId !== launchingTabId
                 || child.handle === launchingHandle
                 || terminalTabId(listing, child.handle) !== launchingTabId) {
-                await tombstone();
-                throw new OrcaError("split", `Orca narrator placement failed for ${name}: split receipt is unknown, malformed or handle-less; ${kept}`, env.raw);
+                return await indeterminate(malformed, env.raw);
             }
             const childHandle = child.handle;
             // The narrator writes nothing until the observer's single claim is visible, so neither write
             // can erase the other; after it the observer never writes the record again.
-            const claimDeadline = this.time.now() + 5000;
+            const claimDeadline = this.time.now() + CLAIM_WINDOW_MS;
             let claim;
             for (;;) {
                 const check = readBoard(path, cwd, runId);
@@ -1574,7 +1646,7 @@ export class OrcaDriver {
             if (!claim) {
                 // The receipt's handle may be closed; the reservation is tombstoned naming that pane so the
                 // next narrator can prove it gone (or close it) and split afresh.
-                await tombstone({ pane: childHandle, runtimeId: env.runtimeId });
+                await tombstoneReservation(path, cwd, runId, token, this.time, { pane: childHandle, runtimeId: env.runtimeId }).catch(() => undefined);
                 let pane;
                 try {
                     await this.closeRecordedPane(cwd, name, childHandle, env.runtimeId);
@@ -1589,6 +1661,67 @@ export class OrcaDriver {
             return watchSlot(cwd, name, childHandle);
         });
     }
+    /** OBS-1172: what an indeterminate split left behind, reconciled from the owner record and Orca's
+     *  terminal table — never from the receipt that did not arrive. The reservation's token reaches no
+     *  process but the split's own command, so a claim proves that split started a board; the owned
+     *  record (this driver, the watch title) is ours by that same token. The claimant must be live (pid
+     *  and arm presence), and it must name the terminal it runs in — a listed pane in the launching tab.
+     *  A claim that names none proves a board started, not WHICH pane hosts it: a sole neighbouring pane
+     *  (row titles are shell-controlled, never ownership keys) is not adopted, so the claim stays held.
+     *  No claim and no such pane: the split started nothing the table shows. Anything else is held. */
+    async settleIndeterminate(cwd, path, runId, token, launchingHandle, waitMs) {
+        const deadline = this.time.now() + waitMs;
+        let claim;
+        for (;;) {
+            let check;
+            try {
+                check = readBoard(path, cwd, runId);
+            }
+            catch (error) {
+                return { kind: "held", why: `the owner record is unreadable (${errorText(error)})` };
+            }
+            if (check?.record.token !== token || check.record.retired)
+                return { kind: "held", why: "the owner record changed underneath" };
+            if (boardState(check.record) === "claimed") {
+                claim = check;
+                break;
+            }
+            if (this.time.now() >= deadline)
+                break;
+            await this.time.sleep(20);
+        }
+        let listing;
+        try {
+            listing = await this.listAll(cwd);
+        }
+        catch (error) {
+            return { kind: "held", why: `the terminal table is unreadable (${errorText(error)})` };
+        }
+        const tab = terminalTabId(listing, launchingHandle);
+        if (!tab)
+            return { kind: "held", why: `the launching terminal ${launchingHandle} is not listed` };
+        const named = claim?.record.handle;
+        const panes = terminalRows(listing).map((row) => str(row.handle)).filter((h) => h !== undefined && h !== launchingHandle && terminalTabId(listing, h) === tab && (named === undefined || h === named));
+        if (!claim) {
+            return panes.length === 0 ? { kind: "absent" }
+                : { kind: "held", why: `no observer claimed the reservation and ${panes.length} pane(s) of unknown ownership share the launching tab` };
+        }
+        if (!observerLive(claim.record))
+            return { kind: "held", why: `the observer that claimed it (pid ${claim.record.pid}) is not live` };
+        if (named === undefined) {
+            return { kind: "held", why: `the observer that claimed it (pid ${claim.record.pid}) reports no terminal handle, so no listed pane is proven to host it` };
+        }
+        if (panes.length !== 1)
+            return { kind: "held", why: `its observer reports ${named}, which the launching tab does not list` };
+        const pane = panes[0];
+        try {
+            await casBoard("split", path, claim.raw, { ...claim.record, pane, runtimeId: listing.runtimeId }, this.time);
+        }
+        catch (error) {
+            return { kind: "held", why: `the bind was refused (${errorText(error)})` };
+        }
+        return { kind: "adopted", slot: watchSlot(cwd, claim.record.name, pane) };
+    }
     boardPath(cwd, runId) {
         return join(cwd, stateDirName(cwd), "supervision", `watch-board.${parseRunId(runId)}.json`);
     }
@@ -1626,13 +1759,28 @@ export class OrcaDriver {
     async retireAndClose(slot) {
         await this.serial(async () => {
             const retired = await this.retireBoard("close", slot);
-            if (typeof retired.pid === "number" && pidLive(retired.pid))
-                await stopWatchBoard(retired, this.time);
-            else
-                requestWatchBoardStop(retired);
+            await this.stopObserver(retired);
             await this.closeRecordedPane(slot.cwd, slot.name, slot.id, retired.runtimeId);
         });
     }
+    /** Stop a retired board's observer before its pane is closed. A live observer acknowledges on
+     *  injected time; a dead one never can, so it is only asked. OBS-1131: an acknowledgement timeout
+     *  is not proof of death — while the pid lives the owned pane stays protected — but a pid that died
+     *  during the wait is, and its pane is closed instead of leaked. */
+    async stopObserver(record) {
+        const pid = record.pid;
+        if (typeof pid !== "number" || !pidLive(pid)) {
+            requestWatchBoardStop(record);
+            return;
+        }
+        try {
+            await stopWatchBoard(record, this.time);
+        }
+        catch (error) {
+            if (pidLive(pid) || readWatchBoard(record.repo, record.runId)?.token !== record.token)
+                throw error;
+        }
+    }
     /** WB-1 seam: the daemon reports this board lost. "Lost" can be a stale beat or missing presence
      *  under a still-live owner pid, so it is not proof of a dead observer — retirement keeps close's
      *  acknowledgement discipline (Leg-2 T9 P1). */
@@ -1720,7 +1868,7 @@ export class OrcaDriver {
         const st = this.slots.get(slot.id);
         if (!st)
             return;
-        if (st.handle) {
+        if (st.handle && !st.swept) {
             await this.closeTerminal(st);
         }
         this.slots.delete(slot.id);
@@ -1889,6 +2037,13 @@ export class OrcaDriver {
                         recoveries: 0,
                         recovering: false,
                     });
+                    // A kept slot whose attempt the journal fold already retired (a seed readiness deadline
+                    // parks one) can still hold this exact terminal; its own close() must not re-address a
+                    // handle this driver just closed, or the run-end sweep latches on the vanished tab.
+                    for (const st of this.slots.values()) {
+                        if (st.handle === c.paneId && st.runtimeId === env.runtimeId)
+                            st.swept = true;
+                    }
                 }
                 catch { /* vanished, stale, or no longer provably ours — never a blind retry */ }
             }

package/dist/drivers/types.d.ts

@@ -5,6 +5,7 @@ export interface Slot {
     cwd: string;
     tabId?: string;
     group?: string;
+    readScreen?: () => Promise<string>;
 }
 export type NotifyTier = "routine" | "attention" | "decision";
 export interface NotifyOpts {
@@ -92,6 +93,7 @@ export interface ExecutorDriver {
     focus?(target: FocusTarget): Promise<FocusResult>;
     describe?(slot: Slot): SlotPlacement | Promise<SlotPlacement> | undefined;
     slot(cwd: string, name: string, opts?: SlotOpts): Promise<Slot>;
+    adopt?(slot: Slot): Promise<Slot>;
     run(slot: Slot, cmd: string): Promise<void>;
     waitOutput(slot: Slot, pattern: string, timeoutMs: number, opts?: {
         regex?: boolean;

package/dist/drivers/types.js

@@ -63,8 +63,8 @@ export function canonicalizeLegacyName(name, runId) {
         return { role: "worker", taskId: w[1], attempt: Number(w[2]), runId: `run-${w[3]}` };
     const g = GATE_ROLE_RE.exec(name);
     if (g) {
-        const retry = g[2].endsWith("-r1");
-        return { role: g[1], taskId: retry ? g[2].slice(0, -3) : g[2], attempt: retry ? 1 : 0, runId };
+        const hop = /-r([1-9])$/.exec(g[2]);
+        return { role: g[1], taskId: hop ? g[2].slice(0, -hop[0].length) : g[2], attempt: hop ? Number(hop[1]) : 0, runId };
     }
     if (NARRATOR_RE.test(name))
         return { role: "watch", taskId: "run", attempt: 0, runId };

package/dist/eval/canary.d.ts

@@ -1,4 +1,5 @@
 import type { WorkerAdapter } from "../adapters/types.js";
+import type { Effort } from "../graph/schema.js";
 import { type Fixture } from "./fixtures.js";
 export declare const CANARY_FIXTURE_ID = "canary";
 export interface CanaryJudgeResult {
@@ -35,7 +36,7 @@ export declare function ensureCanary(fixtures: Fixture[], root: string): Fixture
  * is evaluated against the resulting diff. A correct judge returns pass=false; any pass=true
  * verdict is flagged as a judge-integrity breach.
  */
-export declare function runCanaryJudge(fixture: Fixture, judgeAdapter: WorkerAdapter, model: string): Promise<CanaryJudgeResult>;
+export declare function runCanaryJudge(fixture: Fixture, judgeAdapter: WorkerAdapter, model: string, effort?: Effort): Promise<CanaryJudgeResult>;
 /**
  * Aggregate per-channel qualification totals from fixture-channel results.
  * Results marked as canary (by the supplied predicate, defaulting to isCanaryResult) are excluded

package/dist/eval/canary.js

@@ -53,7 +53,7 @@ async function applyKnownBadChange(repo) {
  * is evaluated against the resulting diff. A correct judge returns pass=false; any pass=true
  * verdict is flagged as a judge-integrity breach.
  */
-export async function runCanaryJudge(fixture, judgeAdapter, model) {
+export async function runCanaryJudge(fixture, judgeAdapter, model, effort) {
     if (!isCanaryFixture(fixture)) {
         throw new Error(`fixture ${fixture.id} is not the canary fixture`);
     }
@@ -62,7 +62,7 @@ export async function runCanaryJudge(fixture, judgeAdapter, model) {
     const initialCommit = (await shGitOk("git rev-parse HEAD", seeded.repo)).trim();
     try {
         await applyKnownBadChange(seeded.repo);
-        const gateResult = await acceptanceGate(task, seeded.repo, initialCommit, { adapter: judgeAdapter, model });
+        const gateResult = await acceptanceGate(task, seeded.repo, initialCommit, { adapter: judgeAdapter, model, effort });
         const expectedPass = false;
         const judgePass = gateResult.pass;
         const breach = judgePass === true && expectedPass === false;

package/dist/eval/dispatch.js

@@ -157,6 +157,7 @@ async function dispatchChannel(task, channel, adapter, promptFile, nonce, fixtur
         model: channel.model,
         channel: channel.channel,
         tier: channel.tier,
+        ...(channel.effort ? { effort: channel.effort } : {}), // OBS-1182: measured at the effort it would run at
     };
     const invocation = adapter.invoke(task, seeded.repo, assignment, { promptFile });
     const run = await sh(invocation.command, seeded.repo, cfg.taskTimeoutMinutes * 60_000);

package/dist/gates/acceptance.d.ts

@@ -1,5 +1,5 @@
 import { type WorkerAdapter } from "../adapters/types.js";
-import { type AcceptanceItem, type Task } from "../graph/schema.js";
+import { type Effort, type AcceptanceItem, type Task } from "../graph/schema.js";
 import { type LlmVia } from "./llm.js";
 import type { GateResult } from "./types.js";
 export interface EvidenceCitation {
@@ -55,6 +55,13 @@ export type AcceptanceCorpusAuditResult = {
     };
 };
 export declare function auditAcceptanceCorpus(corpusRoot: string, listedTests: readonly VitestListedTest[]): AcceptanceCorpusAuditResult[];
+/** OBS-1151: one criterion of a parsed judge verdict, as the contradiction check compares it. */
+export interface JudgedCriterion {
+    id: string;
+    criterion: string;
+    met: boolean;
+    paths: string[];
+}
 export interface AcceptanceGateOpts {
     testCmd?: string;
     diffCap?: number;
@@ -62,4 +69,5 @@ export interface AcceptanceGateOpts {
 export declare function acceptanceGate(task: Task, worktree: string, baseRef: string, judge: {
     adapter: WorkerAdapter;
     model: string;
+    effort?: Effort;
 }, via?: LlmVia, opts?: AcceptanceGateOpts): Promise<GateResult>;

package/dist/gates/acceptance.js

@@ -7,7 +7,7 @@ import { DEFAULT_DIFF_CAP } from "../config/config.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
 import { sh } from "../run/git.js";
 import { checkTaskDiffCaps, fetchTaskDiff, isProtectedEvidence, setAsideReceiptPath } from "./review.js";
-import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
+import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, SeatLaunchError, verdictNonceLine } from "./llm.js";
 import { classifyVerdictCause } from "./verdict-cause.js";
 import { reviewableLogicDiff } from "./artifact-manifest.js";
 import { classifyFailureOutput } from "./baseline.js";
@@ -342,7 +342,9 @@ function citesChangedLocation(evidence, changed, diff) {
         return evidence.trim().length > 0 && diff.includes(evidence);
     return changed.get(evidence.path)?.has(evidence.line) ?? false;
 }
-export async function acceptanceGate(task, worktree, baseRef, judge, via, opts = {}) {
+export async function acceptanceGate(task, worktree, baseRef, 
+// OBS-1182: the judge seat's OWN effort (absent = CLI default) — never the worker's.
+judge, via, opts = {}) {
     // 1. deterministic oracles — exit code decides, fail-closed, zero LLM calls (spec §2, T2).
     //    A failure returns here, before any runLlm() call: a judge can never override it.
     const passedDet = [];
@@ -439,7 +441,20 @@ Each criteria[].criterion MUST be the stable id from the rubric (c1, c2, ...) ex
 Each criteria[].evidence MUST be a structured citation {"path", "line"} whose "path" and "line" appear in the "Citable evidence lines" list above (a new-file line number inside a changed hunk); a citation outside every changed hunk or to an untouched file voids the whole verdict.
 The top-level comments array is optional. Use it only for actionable line-anchored feedback.
 `;
-    const raw = await runLlm(judge.adapter, judge.model, prompt, worktree, via, JUDGE_TIMEOUT_MS);
+    // OBS-1182: an unset seat passes no effort argument at all — the CLI default, and the call shape callers pin.
+    let raw;
+    try {
+        raw = await (judge.effort
+            ? runLlm(judge.adapter, judge.model, prompt, worktree, via, JUDGE_TIMEOUT_MS, judge.effort)
+            : runLlm(judge.adapter, judge.model, prompt, worktree, via, JUDGE_TIMEOUT_MS));
+    }
+    catch (error) {
+        if (!(error instanceof SeatLaunchError))
+            throw error;
+        // OBS-1168(b): no seat, no verdict — run-gates re-routes the judge or parks infra; never a worker charge.
+        return { gate: "acceptance", pass: false, details: `${warn}${detBlock}judge dispatch failed — ${error.message} — failing closed`,
+            meta: { unparseable: true, cause: "seat-launch-failed", judge: channelKey({ adapter: judge.adapter.id, model: judge.model }) } };
+    }
     const extracted = extractVerdictJson(raw, nonce);
     if (!extracted) {
         const cause = classifyVerdictCause(raw, nonce, "pass");
@@ -471,5 +486,17 @@ The top-level comments array is optional. Use it only for actionable line-anchor
         lines.push("judge verdict pass=false");
     lines.push(...inconsistencies);
     const prose = warn + detBlock + (lines.join("\n") || "judge passed");
-    return { gate: "acceptance", pass, details: appendAnchoredReview(prose, extracted) };
+    // OBS-1151: each criterion's canonical text, ruling and the paths its evidence cites. A legacy quote
+    // cites no path, so its criterion has no comparable subject (missing evidence is unknown). An
+    // inconsistent verdict (a duplicate row ruling both ways, a missing id) carries NO judgment: it is not
+    // a comparable subject, and as an adjudicator it can confirm nothing — run-gates parks it infra.
+    const judgment = inconsistencies.length ? undefined : v.criteria.flatMap((row) => {
+        const index = expectedIds.indexOf(row.criterion);
+        if (index < 0)
+            return [];
+        return [{ id: row.criterion, criterion: renderAcceptanceItem(judgeItems[index]), met: row.met,
+                paths: typeof row.evidence === "string" ? [] : [row.evidence.path] }];
+    });
+    return { gate: "acceptance", pass, details: appendAnchoredReview(prose, extracted),
+        meta: { judge: channelKey({ adapter: judge.adapter.id, model: judge.model }), ...(judgment ? { judgment } : {}) } };
 }