tickmarkr 2.6.2 → 2.6.3

package/dist/run/interactive-seed.d.ts

@@ -1,4 +1,5 @@
 import { type Assignment, type WorkerAdapter } from "../adapters/types.js";
+import { DeliveryReadinessError } from "../drivers/herdr.js";
 import type { ExecutorDriver, Slot } from "../drivers/types.js";
 export interface InteractiveSeedResult {
     output: string;
@@ -8,6 +9,9 @@ export interface InteractiveSeedResult {
     trustAnswered: boolean;
 }
 type SeedDriver = Pick<ExecutorDriver, "run" | "waitOutput" | "read" | "sendKey">;
+export declare class SeedReadinessError extends DeliveryReadinessError {
+    constructor(waitedMs: number, transcript: string, readinessMatch: string);
+}
 export declare function runInteractiveSeed(opts: {
     driver: SeedDriver;
     slot: Slot;

package/dist/run/interactive-seed.js

@@ -1,4 +1,5 @@
 import { matchesTrustDialog } from "../adapters/types.js";
+import { DeliveryReadinessError } from "../drivers/herdr.js";
 // The workspace-trust prompt is a STARTUP gate: it renders before the readiness banner and blocks
 // it, so this wait is the only window in which anything can answer it. Observation therefore runs
 // for the WHOLE readiness budget. Review round 7 (material): a 60-second cutoff here was a window
@@ -9,6 +10,18 @@ import { matchesTrustDialog } from "../adapters/types.js";
 // blocked anyway, and it ends at the first of readiness, a modal, or the deadline.
 const TRUST_POLL_MS = 1_000;
 const TRUST_PANE_ROWS = 80;
+// OBS-1205 add.1: a launch whose readiness never appeared never received the brief, so its deadline is
+// the delivery-readiness class (OBS-142: the interface never became interactive), not a launched
+// worker. Thrown as that class, the daemon's existing catch journals `delivery-readiness-failed`,
+// closes the slot and walks the escalation ladder to a failover — with no `worker-launch` row, which is
+// where a funded repair's findings expire, so the repair the seed never delivered stays owed.
+export class SeedReadinessError extends DeliveryReadinessError {
+    constructor(waitedMs, transcript, readinessMatch) {
+        super(waitedMs, transcript);
+        this.name = "SeedReadinessError";
+        this.message = `seed readiness pattern not seen after ${waitedMs}ms: ${readinessMatch}`;
+    }
+}
 // v1.89 T19 / OBS-406: wait for readiness, answering a fingerprint-matched trust modal at most ONCE
 // on the way. The daemon's own trust loop runs only after runInteractiveSeed returns, and this wait
 // is exactly the window the modal blocks in — a declaration consulted only there is unreachable
@@ -17,23 +30,34 @@ async function awaitReadiness(opts) {
     const { driver, slot, readinessMatch, deadline } = opts;
     const dialog = opts.adapter.trustDialog;
     const left = () => Math.max(0, deadline - Date.now());
+    // Every wait below is awaited, and the budget can run out inside any of them (OrcaDriver.waitOutput
+    // checks its sweep before its clock). Readiness a wait returns after the deadline is expired — it may
+    // be what a key pressed at the edge produced — and a launch whose deadline passed has already
+    // failed, so neither a key nor a seed follows it. Both branches apply it.
+    const expired = () => Date.now() >= deadline;
+    const readyInTime = async (ms) => (await driver.waitOutput(slot, readinessMatch, ms)) && !expired();
     // Nothing this launch could answer (no declaration, an honest {kind:"none"}, or a driver with no
-    // keystroke surface): the single long wait, byte-identical to pre-T19 behaviour.
+    // keystroke surface): the single long wait, pre-T19 behaviour plus the post-await deadline check.
     if (!dialog || dialog.kind === "none" || !driver.sendKey) {
-        return { ready: await driver.waitOutput(slot, readinessMatch, left()), trustAnswered: false };
+        return { ready: await readyInTime(left()), trustAnswered: false };
     }
     let trustAnswered = false;
-    while (!trustAnswered && left() > 0) {
-        if (await driver.waitOutput(slot, readinessMatch, Math.min(TRUST_POLL_MS, left()))) {
+    while (!trustAnswered && !expired()) {
+        if (await readyInTime(Math.min(TRUST_POLL_MS, left()))) {
             return { ready: true, trustAnswered };
         }
         let paneText;
         try {
-            paneText = await driver.read(slot, TRUST_PANE_ROWS);
+            // OBS-1205: a cursor-drawn modal has text only on the RENDERED frame, so the slot's screen read
+            // is preferred when its driver has one. An unreadable or foreign frame is a failed read, never
+            // a cue to match the stream instead; drivers without a screen keep polling `read`.
+            paneText = await (slot.readScreen ? slot.readScreen() : driver.read(slot, TRUST_PANE_ROWS));
         }
         catch {
             continue; // a failed read is not a matched modal — keep observing, spend nothing
         }
+        if (expired())
+            break; // the wait or the read outlived the budget: no key after the deadline
         if (!matchesTrustDialog(paneText, dialog))
             continue;
         // Review round 7 (material): the latch is spent BEFORE the awaited send, not after it. A send
@@ -54,7 +78,8 @@ async function awaitReadiness(opts) {
             /* dispatched-then-rejected: never retried here, and never re-tried by the daemon either */
         }
     }
-    return { ready: await driver.waitOutput(slot, readinessMatch, left()), trustAnswered };
+    // An expired budget gets no closing sweep: a zero-length wait still reads the terminal once.
+    return { ready: !expired() && await readyInTime(left()), trustAnswered };
 }
 // v1.69 T6: launch-then-seed handoff for adapters whose real TUI cannot be argv-seeded.
 // Both the launch command and the seed line are delivered through the driver's existing `run`
@@ -65,6 +90,8 @@ export async function runInteractiveSeed(opts) {
     await opts.driver.run(opts.slot, seed.launch(opts.assignment.model));
     // `trustAnswered` rides EVERY return below, including both early ones: the daemon initializes its
     // per-slot latch from it, and an omission there reads as "no key was sent" — the second-Enter defect.
+    // The readiness deadline throws instead; `onTrustAnswered` already carried the latch out.
+    const launchedAt = Date.now();
     const { ready, trustAnswered } = await awaitReadiness({
         driver: opts.driver,
         slot: opts.slot,
@@ -74,9 +101,8 @@ export async function runInteractiveSeed(opts) {
         ...(opts.onTrustAnswered ? { onTrustAnswered: opts.onTrustAnswered } : {}),
     });
     const banner = await opts.driver.read(opts.slot, 1000);
-    if (!ready) {
-        return { output: banner, seedFailed: true, seedError: `readiness pattern not seen: ${seed.readinessMatch}`, trustAnswered };
-    }
+    if (!ready)
+        throw new SeedReadinessError(Date.now() - launchedAt, banner, seed.readinessMatch);
     let sessionId;
     if (seed.confirmBanner) {
         const confirm = seed.confirmBanner(banner, opts.assignment.model);

package/dist/run/journal.d.ts

@@ -107,6 +107,8 @@ export interface StructuredFinding {
     observedFingerprints?: string[];
     /** Prior id validated against the reviewer's reraised list by the review gate. */
     reraisedFrom?: string;
+    /** OBS-1195: an anchor's explicitly named parent chain; it retires when that chain is resolved. */
+    boundTo?: string;
     /** Resolved definition AND defect identity; bare symbol spelling is never lineage. */
     codeIdentity?: {
         definition: string;
@@ -185,7 +187,10 @@ export declare function formatPriorFindingEvidence(evidence: PriorFindingEvidenc
 /** Normalized identity of a gate failure: the same defect, seen twice, normalizes to the same bytes. */
 export declare function normalizeGateFailure(details: string): string;
 export declare const GATE_FINGERPRINT_CAP = 2;
+/** The invocation a gate row's receipt names — the identity of the execution that observed it. */
+export declare const receiptOrigin: (data: Record<string, unknown>) => string | undefined;
 export declare function identicalGateFailures(events: JournalEvent[], taskId: string, gate: string, normalized: string): number;
+export declare const readableExcerpt: (text: string) => string;
 /** What each funded repair's next battery actually reached. A repair spends its budget only
  * when that battery reaches one of the gates it was funded to fix; an earlier red is evidence that
  * this repair never got its funded turn, not a charge against the repair ladder. */
@@ -309,7 +314,28 @@ export declare function carryReviewFindings(priors: readonly StructuredFinding[]
  * after round re-seats ONE fingerprint, and a revised rationale replaces the prior rationale on that
  * row. N rounds of the same concern therefore carry the newest accepted explanation once, not N rows.
  */
+/** OBS-1151: this task's journaled judgments, newest first — subjects to compare a fresh ruling against,
+ * never verdicts to reuse. A row without a well-formed judgment (legacy, park, unparseable) is skipped. */
+export declare function priorJudgments(events: readonly JournalEvent[], taskId: string): Array<{
+    commit: string;
+    judge?: string;
+    criteria: Array<{
+        id: string;
+        key: string;
+        met: boolean;
+        paths: string[];
+    }>;
+}>;
 export declare function outstandingReviewFindings(events: JournalEvent[], taskId: string): StructuredFinding[];
+/**
+ * OBS-1019 add.2: each outstanding material chain with the number of valid review verdicts that
+ * re-raised it since the last review pass or review-gate waive. Only a chain's own observed spellings
+ * count, so an unrelated finding sharing a path never lengthens it.
+ */
+export declare function reraisedReviewChains(events: JournalEvent[], taskId: string): Array<{
+    finding: StructuredFinding;
+    reraises: number;
+}>;
 /** The findings a funded repair must carry into the next dispatch, or undefined if none is pending. */
 export declare function pendingRepairFindings(events: JournalEvent[], taskId: string): string | undefined;
 /**

package/dist/run/journal.js

@@ -713,21 +713,53 @@ export function normalizeGateFailure(details) {
 // operator approval is a new engagement, and nothing else resets the count. Resume re-measurements
 // are excluded because the interrupted attempt already bought the result they confirm.
 export const GATE_FINGERPRINT_CAP = 2;
+/** The invocation a gate row's receipt names — the identity of the execution that observed it. */
+export const receiptOrigin = (data) => {
+    const receipt = data.evidenceReceipt ?? (Array.isArray(data.evidenceReceipts) ? data.evidenceReceipts[0] : undefined);
+    const id = receipt && typeof receipt === "object" ? receipt.invocationId : undefined;
+    return typeof id === "string" && id ? `invocation:${id}` : undefined;
+};
+// OBS-1106 residual: occurrences are independent OBSERVATIONS, not rows. A journal replay
+// (`replayedFromAttempt`) and a verdict-cache hit (`reused`) re-state a measurement another row
+// already bought, so each resolves to that row's origin — its receipt's invocation when it carries
+// one, else the attempt (replay) or the newest observation on the same subject (cache) — and one
+// observation counts once however many copies the ledger holds, across resume. Only a fresh
+// execution mints a new origin.
 export function identicalGateFailures(events, taskId, gate, normalized) {
-    let n = 0;
-    for (const e of effectiveEvents(events)) { // OBS-1178: a refused or unsound approval is no new engagement
+    const counted = new Set();
+    const byAttempt = new Map();
+    const bySubject = new Map();
+    effectiveEvents(events).forEach((e, i) => {
         if (e.taskId !== taskId)
-            continue;
-        if (e.event === "task-approved")
-            n = 0;
-        else if (e.event === "gate-result" && e.data.gate === gate && e.data.pass === false
-            && e.data.replayMeasurement !== true
-            && typeof e.data.details === "string"
+            return;
+        if (e.event === "task-approved") {
+            counted.clear();
+            return;
+        }
+        if (e.event !== "gate-result" || e.data.gate !== gate)
+            return;
+        const commit = typeof e.data.commit === "string" ? e.data.commit : undefined;
+        const origin = typeof e.data.replayedFromAttempt === "number"
+            ? byAttempt.get(e.data.replayedFromAttempt) ?? receiptOrigin(e.data) ?? `attempt:${e.data.replayedFromAttempt}`
+            : e.data.reused === true
+                ? receiptOrigin(e.data) ?? (commit ? bySubject.get(commit) : undefined) ?? `reused:${commit ?? i}`
+                : receiptOrigin(e.data) ?? `row:${i}`;
+        if (typeof e.data.attempt === "number")
+            byAttempt.set(e.data.attempt, origin);
+        if (commit)
+            bySubject.set(commit, origin);
+        if (e.data.pass === false && e.data.replayMeasurement !== true && typeof e.data.details === "string"
             && normalizeGateFailure(e.data.details) === normalized)
-            n++;
-    }
-    return n;
-}
+            counted.add(origin);
+    });
+    return counted.size;
+}
+// OBS-1072 add.2: the controls a terminal would consume — OSC strings (ESC ] … BEL/ST), CSI sequences
+// (SGR included), other ESC sequences and stray C0 bytes but tab and newline. Applied only to the
+// human-facing excerpts a worker brief or a scope hint reads; the journal row, the receipt bytes and
+// the failure fingerprint keep the raw text.
+const TERMINAL_CONTROL_RE = /\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)?|\x1b\[[0-?]*[ -/]*[@-~]|\x1b[ -/]*[0-~]?|[\x00-\x08\x0b-\x1f\x7f]/g;
+export const readableExcerpt = (text) => text.replace(TERMINAL_CONTROL_RE, "");
 export function repairReachSinceApproval(events, taskId) {
     const repairs = [];
     for (const e of effectiveEvents(events)) { // OBS-1178: a refused or unsound approval resets no repair history
@@ -899,7 +931,7 @@ export function journaledFailureBrief(events, taskId) {
             rows = [];
         else if (e.event === "gate-result" && e.data.pass === false && e.data.skipped !== true
             && typeof e.data.details === "string")
-            rows.push(`${e.data.gate}: ${e.data.details}`);
+            rows.push(`${e.data.gate}: ${readableExcerpt(e.data.details)}`);
         else if (e.event === "delivery-readiness-failed" && typeof e.data.transcript === "string") {
             rows.push(`dispatch: delivery readiness failed after ${e.data.waitedMs}ms; pane transcript:\n${e.data.transcript}`);
         }
@@ -939,6 +971,17 @@ export function observedReviewFingerprints(finding) {
     return [...new Set([finding.fingerprint, ...observed])];
 }
 const reviewNoteIdentity = (note) => note.replace(LINE_REF_RE, "").replace(/\s+/g, " ").trim();
+/** OBS-1195: the anchor row a verdict's recorded settled comment spells, or undefined if malformed. */
+function settledAnchorRow(anchor) {
+    if (!anchor || typeof anchor !== "object")
+        return undefined;
+    const { path, line, body, disposition } = anchor;
+    if (typeof path !== "string" || !Number.isInteger(line) || typeof body !== "string")
+        return undefined;
+    if (disposition !== "deferred" && disposition !== "resolved")
+        return undefined;
+    return structuredFindings("review", `- ${path}:${line} — ${body}`).find((finding) => finding.class === "review:anchored");
+}
 function distinctReviewFinding(row) {
     const identity = JSON.stringify([reviewNoteIdentity(row.note), row.codeIdentity ?? null]);
     const symbol = `${row.symbol}#${createHash("sha256").update(identity).digest("hex").slice(0, 12)}`;
@@ -1042,6 +1085,23 @@ export function carryReviewFindings(priors, rows) {
  * after round re-seats ONE fingerprint, and a revised rationale replaces the prior rationale on that
  * row. N rounds of the same concern therefore carry the newest accepted explanation once, not N rows.
  */
+/** OBS-1151: this task's journaled judgments, newest first — subjects to compare a fresh ruling against,
+ * never verdicts to reuse. A row without a well-formed judgment (legacy, park, unparseable) is skipped. */
+export function priorJudgments(events, taskId) {
+    const out = [];
+    for (const e of events) {
+        const j = e.taskId === taskId && e.event === "gate-result" && e.data.gate === "acceptance" ? e.data.judgment : undefined;
+        if (!j || typeof j !== "object")
+            continue;
+        const { commit, judge, criteria } = j;
+        if (typeof commit !== "string" || !commit || !Array.isArray(criteria))
+            continue;
+        const rows = criteria.filter((c) => !!c && typeof c.id === "string" && typeof c.key === "string" && typeof c.met === "boolean"
+            && Array.isArray(c.paths) && c.paths.every((p) => typeof p === "string"));
+        out.unshift({ commit, ...(typeof judge === "string" ? { judge } : {}), criteria: rows });
+    }
+    return out;
+}
 export function outstandingReviewFindings(events, taskId) {
     let open = [];
     for (const e of effectiveEvents(events)) { // OBS-1178: only an effective review waive retires findings
@@ -1059,6 +1119,9 @@ export function outstandingReviewFindings(events, taskId) {
             continue;
         // A failed review can resolve one chain while re-raising another. Only observed, uniquely
         // matched spellings retire a chain; skipped/no-verdict rows were excluded above.
+        // OBS-1195: every parent chain this verdict resolved or explicitly deferred; an anchor bound to one
+        // retires whether it was carried in or restated by this same verdict.
+        const retiredParents = new Set();
         if (Array.isArray(e.data.resolved)) {
             const resolved = e.data.resolved;
             const settled = new Set(resolved.flatMap((id) => {
@@ -1066,8 +1129,45 @@ export function outstandingReviewFindings(events, taskId) {
                     && observedReviewFingerprints(finding).some((fp) => reviewFingerprintMatches(id, fp)));
                 return matches.length === 1 ? matches : [];
             }));
+            // OBS-1195: an anchor explicitly bound to a settled chain retires with it; unbound ones stay.
+            for (const id of [...settled].flatMap(observedReviewFingerprints))
+                retiredParents.add(id);
             open = open.filter((finding) => !settled.has(finding));
         }
+        // OBS-1195: a failed verdict that restates a bound anchor's parent ONLY as a deferral (its deferred
+        // entry echoes the prior's id and no material entry claims it) has explicitly deferred that parent,
+        // so the anchor retires. The parent chain itself keeps whatever the closure lists said of it.
+        // A material row's `reraisedFrom` is this verdict's claim only when its own reraised list names that
+        // id; a link an earlier verdict drew (carried metadata) is lineage and claims nothing here. Without a
+        // reraised list to check against, every link counts as a claim — fail closed.
+        const rows = findingRows(e, "review");
+        const reraisedHere = Array.isArray(e.data.reraised) ? e.data.reraised.filter((id) => typeof id === "string") : undefined;
+        const claimedByMaterial = new Set(rows.filter((row) => !isDeferredFinding(row) && row.reraisedFrom
+            && (reraisedHere === undefined || reraisedHere.some((id) => reviewFingerprintMatches(id, row.reraisedFrom)))).map((row) => row.reraisedFrom));
+        const deferredParents = rows.filter((row) => isDeferredFinding(row) && row.reraisedFrom && !claimedByMaterial.has(row.reraisedFrom))
+            .map((row) => row.reraisedFrom);
+        for (const finding of open) {
+            if (finding.class !== "review:material" || !observedReviewFingerprints(finding).some((fp) => deferredParents.includes(fp)))
+                continue;
+            for (const id of observedReviewFingerprints(finding))
+                retiredParents.add(id);
+        }
+        const boundToRetired = (finding) => finding.boundTo !== undefined && retiredParents.has(finding.boundTo);
+        open = open.filter((finding) => !boundToRetired(finding));
+        // OBS-1195: a later verdict that re-anchors a carried anchor to a deferred entry or a resolved prior
+        // settles that anchor explicitly. Only its own identity (path, symbol and note), uniquely matched,
+        // retires it; a bare path coincidence binds nothing.
+        if (Array.isArray(e.data.settledAnchors)) {
+            const retired = new Set(e.data.settledAnchors.flatMap((anchor) => {
+                const row = settledAnchorRow(anchor);
+                // Identity, not fingerprint: a collision-disambiguated anchor carries a `symbol#hash` spelling.
+                const matches = row ? open.filter((finding) => finding.class === "review:anchored" && finding.path === row.path
+                    && (finding.symbol === row.symbol || finding.symbol.startsWith(`${row.symbol}#`))
+                    && reviewNoteIdentity(finding.note) === reviewNoteIdentity(row.note)) : [];
+                return matches.length === 1 ? matches : [];
+            }));
+            open = open.filter((finding) => !retired.has(finding));
+        }
         if (e.data.pass !== false) {
             // a later review PASSED on this task: every finding it BLOCKED on is settled …
             open = open.filter(isDeferredFinding);
@@ -1077,11 +1177,39 @@ export function outstandingReviewFindings(events, taskId) {
             // the very next round — the same silent drop by a different door.
             open = carryReviewFindings(open, findingRows(e, "review").filter(isDeferredFinding));
         }
-        else
-            open = carryReviewFindings(open, findingRows(e, "review"));
+        else {
+            // OBS-1195: a repeated comment bound to a parent this verdict resolved or deferred is not re-seated.
+            open = carryReviewFindings(open, rows).filter((finding) => !boundToRetired(finding));
+        }
     }
     return open;
 }
+/**
+ * OBS-1019 add.2: each outstanding material chain with the number of valid review verdicts that
+ * re-raised it since the last review pass or review-gate waive. Only a chain's own observed spellings
+ * count, so an unrelated finding sharing a path never lengthens it.
+ */
+export function reraisedReviewChains(events, taskId) {
+    let verdicts = [];
+    for (const e of effectiveEvents(events)) {
+        if (e.taskId !== taskId)
+            continue;
+        if (e.event === "task-approved" && e.data.release === GATE_SATISFIED_RELEASE && e.data.gate === "review")
+            verdicts = [];
+        if (e.event !== "gate-result" || e.data.gate !== "review" || e.data.skipped === true)
+            continue;
+        if (e.data.unparseable === true || e.data.noVerdict === true || e.data.cause !== undefined)
+            continue;
+        verdicts = e.data.pass === false ? [...verdicts, e] : [];
+    }
+    return outstandingReviewFindings(events, taskId)
+        .filter((finding) => finding.class === "review:material")
+        .map((finding) => ({
+        finding,
+        reraises: verdicts.filter((e) => Array.isArray(e.data.reraised) && e.data.reraised
+            .some((id) => observedReviewFingerprints(finding).some((fp) => reviewFingerprintMatches(id, fp)))).length,
+    }));
+}
 /** The findings a funded repair must carry into the next dispatch, or undefined if none is pending. */
 export function pendingRepairFindings(events, taskId) {
     const e = decisionForNextDispatch(events, taskId, "repair-attempt");

package/dist/run/lease.d.ts

@@ -33,7 +33,20 @@ export interface RepositoryLeaseOptions {
     signal?: AbortSignal;
     /** Called once per distinct holder the waiter is queued behind. */
     onWait?: (holder: RepositoryLeaseHolder) => void;
+    /** The token a descendant inherited; defaults to REPOSITORY_LEASE_TOKEN_ENV. */
+    inherited?: string;
 }
+/** OBS-880/1071: the file lease's token, exported to the holder's descendants for the span it is held
+ * so a nested runner (a gate's suite under `tickmarkr verify`, a mutation child inside a leased suite)
+ * reenters instead of waiting on its own ancestor. Deliberately NOT COMMAND_LEASE_TOKEN_ENV: the
+ * installed daemon clears and rewrites that in-process token, and a command-lease token never names
+ * this file. Environment text alone proves nothing: see `reentrantHolder`. */
+export declare const REPOSITORY_LEASE_TOKEN_ENV = "TICKMARKR_REPOSITORY_LEASE_TOKEN";
+/** Reentry is identity-bound: the inherited token must name the record at THIS repository's lease path
+ * right now, its holder must be alive, and that holder must be a strict ancestor of this process. A
+ * forged, stale (released or superseded), foreign-repository or command-lease token matches no record;
+ * an in-process sibling is not a descendant — each of those waits like any other runner. */
+export declare function reentrantHolder(path: string, inherited: string | undefined): Promise<RepositoryLeaseHolder | undefined>;
 export declare function repositoryLeasePath(cwd: string): Promise<string>;
 /** OBS-1057: dev+ino alone is not an identity across unlink/recreate — Linux hands the freed inode
  * number straight to the next file, so a stale observation of a dead or corrupt reservation matched

package/dist/run/lease.js

@@ -91,6 +91,38 @@ export class CommandLeases {
         }
     }
 }
+/** OBS-880/1071: the file lease's token, exported to the holder's descendants for the span it is held
+ * so a nested runner (a gate's suite under `tickmarkr verify`, a mutation child inside a leased suite)
+ * reenters instead of waiting on its own ancestor. Deliberately NOT COMMAND_LEASE_TOKEN_ENV: the
+ * installed daemon clears and rewrites that in-process token, and a command-lease token never names
+ * this file. Environment text alone proves nothing: see `reentrantHolder`. */
+export const REPOSITORY_LEASE_TOKEN_ENV = "TICKMARKR_REPOSITORY_LEASE_TOKEN";
+/** The strict ancestors of this process, from one `ps` snapshot; empty when unreadable (fail closed). */
+const ancestorPids = () => new Promise((ok) => execFile("ps", ["-A", "-o", "pid=,ppid="], { encoding: "utf8" }, (error, stdout) => {
+    const parent = new Map();
+    if (!error)
+        for (const line of stdout.split("\n")) {
+            const [pid, ppid] = line.trim().split(/\s+/).map(Number);
+            if (Number.isInteger(pid) && Number.isInteger(ppid))
+                parent.set(pid, ppid);
+        }
+    const seen = new Set();
+    for (let pid = error ? 0 : process.ppid; pid > 1 && !seen.has(pid); pid = parent.get(pid) ?? 0)
+        seen.add(pid);
+    ok(seen);
+}));
+/** Reentry is identity-bound: the inherited token must name the record at THIS repository's lease path
+ * right now, its holder must be alive, and that holder must be a strict ancestor of this process. A
+ * forged, stale (released or superseded), foreign-repository or command-lease token matches no record;
+ * an in-process sibling is not a descendant — each of those waits like any other runner. */
+export async function reentrantHolder(path, inherited) {
+    if (!inherited)
+        return undefined;
+    const holder = readHolder(path);
+    if (holder?.token !== inherited || holder.pid === process.pid || !alive(holder.pid))
+        return undefined;
+    return (await ancestorPids()).has(holder.pid) ? holder : undefined;
+}
 const LEASE_FILE = "tickmarkr-runner.lease";
 export async function repositoryLeasePath(cwd) {
     const commonDir = await new Promise((ok, fail) => execFile("git", ["rev-parse", "--git-common-dir"], { cwd, encoding: "utf8" }, (error, stdout) => error ? fail(error) : ok(stdout.trim())));
@@ -283,6 +315,9 @@ const inspectAndReserve = (path, mine) => {
 };
 export async function withRepositoryLease(cwd, run, opts = {}) {
     const path = await repositoryLeasePath(cwd);
+    // A descendant of the live holder runs inside its ancestor's reservation and releases nothing.
+    if (await reentrantHolder(path, opts.inherited ?? process.env[REPOSITORY_LEASE_TOKEN_ENV]))
+        return run();
     const pollMs = opts.pollMs ?? 1_000;
     const mine = { pid: process.pid, cwd, at: Date.now(), token: randomUUID() };
     let waitingOn;
@@ -297,10 +332,20 @@ export async function withRepositoryLease(cwd, run, opts = {}) {
         }
         await new Promise((wake) => setTimeout(wake, pollMs));
     }
+    // Exported before run() so every descendant forked or spawned during the hold can reenter; restored
+    // at release unless another reservation in this process has since exported its own.
+    const exported = process.env[REPOSITORY_LEASE_TOKEN_ENV];
+    process.env[REPOSITORY_LEASE_TOKEN_ENV] = mine.token;
     try {
         return await run();
     }
     finally {
+        if (process.env[REPOSITORY_LEASE_TOKEN_ENV] === mine.token) {
+            if (exported === undefined)
+                delete process.env[REPOSITORY_LEASE_TOKEN_ENV];
+            else
+                process.env[REPOSITORY_LEASE_TOKEN_ENV] = exported;
+        }
         // Release is serialized with reclamation/acquisition and removes only this generation.
         await withMutationLock(path, pollMs, undefined, () => {
             if (readHolder(path)?.token === mine.token)

package/dist/run/protocol.d.ts

@@ -53,6 +53,15 @@ export declare const EvidenceArtifactSchema: z.ZodObject<{
     droppedBytes: z.ZodNumber;
     truncated: z.ZodBoolean;
 }, z.core.$strict>;
+export declare const RedactionSchema: z.ZodObject<{
+    material: z.ZodBoolean;
+    counts: z.ZodOptional<z.ZodObject<{
+        token: z.ZodNumber;
+        assignment: z.ZodNumber;
+        secretEnv: z.ZodNumber;
+        benignEnv: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
 export declare const GateEvidenceReceiptSchema: z.ZodObject<{
     invocationId: z.ZodString;
     nonce: z.ZodOptional<z.ZodString>;
@@ -85,6 +94,12 @@ export declare const GateEvidenceReceiptSchema: z.ZodObject<{
     }>;
     redaction: z.ZodObject<{
         material: z.ZodBoolean;
+        counts: z.ZodOptional<z.ZodObject<{
+            token: z.ZodNumber;
+            assignment: z.ZodNumber;
+            secretEnv: z.ZodNumber;
+            benignEnv: z.ZodNumber;
+        }, z.core.$strict>>;
     }, z.core.$strict>;
     stdout: z.ZodObject<{
         path: z.ZodString;

package/dist/run/protocol.js

@@ -47,6 +47,16 @@ export const EvidenceArtifactSchema = z.object({
     if (ref.availability === "available" && ref.sha256 === null)
         ctx.addIssue({ code: "custom", message: "available bytes require a hash" });
 });
+// OBS-1139: one count per original span, never a value. A legacy receipt carries `material` alone and
+// keeps it as recorded; a counted one must agree — benign HOME/TMPDIR substitutions are never material.
+const RedactionCountsSchema = z.object({
+    token: z.number().int().nonnegative(),
+    assignment: z.number().int().nonnegative(),
+    secretEnv: z.number().int().nonnegative(),
+    benignEnv: z.number().int().nonnegative(),
+}).strict();
+export const RedactionSchema = z.object({ material: z.boolean(), counts: RedactionCountsSchema.optional() }).strict()
+    .refine(r => !r.counts || r.material === (r.counts.token + r.counts.assignment + r.counts.secretEnv > 0), { message: "material must agree with the token, assignment and secret-environment counts" });
 export const GateEvidenceReceiptSchema = z.object({
     invocationId: NonEmptyStringSchema,
     nonce: NonEmptyStringSchema.optional(),
@@ -64,7 +74,7 @@ export const GateEvidenceReceiptSchema = z.object({
         timedOut: z.boolean().nullable(),
     }).strict(),
     availability: z.enum(EVIDENCE_AVAILABILITIES),
-    redaction: z.object({ material: z.boolean() }).strict(),
+    redaction: RedactionSchema,
     stdout: EvidenceArtifactSchema,
     stderr: EvidenceArtifactSchema,
 }).strict();

package/dist/run/receipt-resolver.d.ts

@@ -1,6 +1,18 @@
 import { type GateEvidenceReceipt } from "./protocol.js";
 export declare const RECEIPT_UNAVAILABLE_REASONS: readonly ["outside-root", "symlink", "hash-mismatch", "expired", "missing"];
 export type ReceiptUnavailableReason = (typeof RECEIPT_UNAVAILABLE_REASONS)[number];
+/** OBS-1140: at most this many newest eviction tombstones persist; an older eviction reads as missing. */
+export declare const EVICTION_TOMBSTONE_LIMIT = 256;
+/** Beside gate-evidence/, never inside it: tombstones are metadata, not retained artifact bytes. */
+export declare const EVICTION_TOMBSTONES_FILE = "evidence-evictions.json";
+/** Bound to the evicted bytes themselves, so a replacement artifact at the same path never inherits it. */
+export interface EvictionTombstone {
+    readonly path: string;
+    readonly sha256: string;
+    readonly retainedBytes: number;
+}
+/** Newest last, at most the limit; anything malformed is no tombstone at all (fail closed to missing). */
+export declare function parseEvictionTombstones(bytes: Buffer): EvictionTombstone[];
 export type ReceiptResolution = {
     readonly ok: true;
     readonly path: string;
@@ -12,6 +24,16 @@ export type ReceiptResolution = {
 };
 /** Resolve one artifact reference against the run root it was recorded under. Fails closed. */
 export declare function resolveReceipt(reference: unknown, runRoot: string): ReceiptResolution;
+export type ReceiptRedaction = {
+    readonly material: boolean;
+    readonly counts: GateEvidenceReceipt["redaction"]["counts"] | null;
+};
+/**
+ * OBS-1139: what a receipt says was withheld. A counted receipt reports its per-span counts; a legacy
+ * one keeps its recorded `material` with no counts; anything unparseable is material (fail closed).
+ */
+export declare function resolveReceiptRedaction(receipt: unknown): ReceiptRedaction;
+export declare function formatReceiptRedaction(r: ReceiptRedaction): string;
 /** Both artifacts of a receipt, stdout first, each resolved independently. */
 export declare function resolveReceiptArtifacts(receipt: GateEvidenceReceipt, runRoot: string): ReceiptResolution[];
 /** One line per artifact for a human surface: the reference, then its verified availability. */

package/dist/run/receipt-resolver.js

@@ -1,13 +1,28 @@
 import { createHash } from "node:crypto";
 import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
-import { EvidenceArtifactSchema } from "./protocol.js";
+import { EvidenceArtifactSchema, RedactionSchema } from "./protocol.js";
 // OBS-1101 retrieval (D-174): the one production reader of an execution-evidence receipt. It answers
 // from the bytes on disk under the run root the receipt was minted in and nothing else — no
 // re-execution, no substitute chosen by name or timestamp, no symlink followed anywhere: not in the
 // reference, not at the root, not above it. The caller hands a canonical root (its own trust anchor);
 // a root reached through any link is refused outright.
 export const RECEIPT_UNAVAILABLE_REASONS = ["outside-root", "symlink", "hash-mismatch", "expired", "missing"];
+/** OBS-1140: at most this many newest eviction tombstones persist; an older eviction reads as missing. */
+export const EVICTION_TOMBSTONE_LIMIT = 256;
+/** Beside gate-evidence/, never inside it: tombstones are metadata, not retained artifact bytes. */
+export const EVICTION_TOMBSTONES_FILE = "evidence-evictions.json";
+/** Newest last, at most the limit; anything malformed is no tombstone at all (fail closed to missing). */
+export function parseEvictionTombstones(bytes) {
+    try {
+        const raw = JSON.parse(bytes.toString("utf8"));
+        return Array.isArray(raw) ? raw.filter((t) => typeof t?.path === "string"
+            && typeof t.sha256 === "string" && Number.isInteger(t.retainedBytes)).slice(-EVICTION_TOMBSTONE_LIMIT) : [];
+    }
+    catch {
+        return [];
+    }
+}
 /** Resolve one artifact reference against the run root it was recorded under. Fails closed. */
 export function resolveReceipt(reference, runRoot) {
     const parsed = EvidenceArtifactSchema.safeParse(reference);
@@ -27,6 +42,8 @@ export function resolveReceipt(reference, runRoot) {
     if (!rel || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel))
         return { ok: false, path: ref.path, reason: "outside-root" };
     const read = readUnderRoot(root, rel.split(sep));
+    if (read === "missing" && evictedByQuota(root, ref))
+        return { ok: false, path: ref.path, reason: "expired" };
     if (typeof read === "string")
         return { ok: false, path: ref.path, reason: read };
     const sha256 = createHash("sha256").update(read).digest("hex");
@@ -34,6 +51,28 @@ export function resolveReceipt(reference, runRoot) {
         return { ok: false, path: ref.path, reason: "hash-mismatch" };
     return { ok: true, path: ref.path, sha256 };
 }
+/** A deletion is explained only by a tombstone naming this exact path, hash and length (OBS-1140). */
+function evictedByQuota(root, ref) {
+    const bytes = readUnderRoot(root, [EVICTION_TOMBSTONES_FILE]);
+    return typeof bytes !== "string" && parseEvictionTombstones(bytes)
+        .some(t => t.path === ref.path && t.sha256 === ref.sha256 && t.retainedBytes === ref.retainedBytes);
+}
+/**
+ * OBS-1139: what a receipt says was withheld. A counted receipt reports its per-span counts; a legacy
+ * one keeps its recorded `material` with no counts; anything unparseable is material (fail closed).
+ */
+export function resolveReceiptRedaction(receipt) {
+    const parsed = RedactionSchema.safeParse(receipt?.redaction);
+    if (!parsed.success)
+        return { material: true, counts: null };
+    return { material: parsed.data.material, counts: parsed.data.counts ?? null };
+}
+export function formatReceiptRedaction(r) {
+    const head = r.material ? "material" : "nonmaterial";
+    return r.counts
+        ? `redaction ${head} token=${r.counts.token} assignment=${r.counts.assignment} secret-env=${r.counts.secretEnv} benign-env=${r.counts.benignEnv}`
+        : `redaction ${head} (uncounted)`;
+}
 const same = (a, b) => a.dev === b.dev && a.ino === b.ino;
 /** Every ancestor of the root, root first excluded — "/" itself cannot be a link. */
 function ancestors(root) {