tickmarkr 2.6.2 → 2.6.4

package/dist/run/lease.js

@@ -91,6 +91,38 @@ export class CommandLeases {
         }
     }
 }
+/** OBS-880/1071: the file lease's token, exported to the holder's descendants for the span it is held
+ * so a nested runner (a gate's suite under `tickmarkr verify`, a mutation child inside a leased suite)
+ * reenters instead of waiting on its own ancestor. Deliberately NOT COMMAND_LEASE_TOKEN_ENV: the
+ * installed daemon clears and rewrites that in-process token, and a command-lease token never names
+ * this file. Environment text alone proves nothing: see `reentrantHolder`. */
+export const REPOSITORY_LEASE_TOKEN_ENV = "TICKMARKR_REPOSITORY_LEASE_TOKEN";
+/** The strict ancestors of this process, from one `ps` snapshot; empty when unreadable (fail closed). */
+const ancestorPids = () => new Promise((ok) => execFile("ps", ["-A", "-o", "pid=,ppid="], { encoding: "utf8" }, (error, stdout) => {
+    const parent = new Map();
+    if (!error)
+        for (const line of stdout.split("\n")) {
+            const [pid, ppid] = line.trim().split(/\s+/).map(Number);
+            if (Number.isInteger(pid) && Number.isInteger(ppid))
+                parent.set(pid, ppid);
+        }
+    const seen = new Set();
+    for (let pid = error ? 0 : process.ppid; pid > 1 && !seen.has(pid); pid = parent.get(pid) ?? 0)
+        seen.add(pid);
+    ok(seen);
+}));
+/** Reentry is identity-bound: the inherited token must name the record at THIS repository's lease path
+ * right now, its holder must be alive, and that holder must be a strict ancestor of this process. A
+ * forged, stale (released or superseded), foreign-repository or command-lease token matches no record;
+ * an in-process sibling is not a descendant — each of those waits like any other runner. */
+export async function reentrantHolder(path, inherited) {
+    if (!inherited)
+        return undefined;
+    const holder = readHolder(path);
+    if (holder?.token !== inherited || holder.pid === process.pid || !alive(holder.pid))
+        return undefined;
+    return (await ancestorPids()).has(holder.pid) ? holder : undefined;
+}
 const LEASE_FILE = "tickmarkr-runner.lease";
 export async function repositoryLeasePath(cwd) {
     const commonDir = await new Promise((ok, fail) => execFile("git", ["rev-parse", "--git-common-dir"], { cwd, encoding: "utf8" }, (error, stdout) => error ? fail(error) : ok(stdout.trim())));
@@ -283,6 +315,9 @@ const inspectAndReserve = (path, mine) => {
 };
 export async function withRepositoryLease(cwd, run, opts = {}) {
     const path = await repositoryLeasePath(cwd);
+    // A descendant of the live holder runs inside its ancestor's reservation and releases nothing.
+    if (await reentrantHolder(path, opts.inherited ?? process.env[REPOSITORY_LEASE_TOKEN_ENV]))
+        return run();
     const pollMs = opts.pollMs ?? 1_000;
     const mine = { pid: process.pid, cwd, at: Date.now(), token: randomUUID() };
     let waitingOn;
@@ -297,10 +332,20 @@ export async function withRepositoryLease(cwd, run, opts = {}) {
         }
         await new Promise((wake) => setTimeout(wake, pollMs));
     }
+    // Exported before run() so every descendant forked or spawned during the hold can reenter; restored
+    // at release unless another reservation in this process has since exported its own.
+    const exported = process.env[REPOSITORY_LEASE_TOKEN_ENV];
+    process.env[REPOSITORY_LEASE_TOKEN_ENV] = mine.token;
     try {
         return await run();
     }
     finally {
+        if (process.env[REPOSITORY_LEASE_TOKEN_ENV] === mine.token) {
+            if (exported === undefined)
+                delete process.env[REPOSITORY_LEASE_TOKEN_ENV];
+            else
+                process.env[REPOSITORY_LEASE_TOKEN_ENV] = exported;
+        }
         // Release is serialized with reclamation/acquisition and removes only this generation.
         await withMutationLock(path, pollMs, undefined, () => {
             if (readHolder(path)?.token === mine.token)

package/dist/run/protocol.d.ts

@@ -53,6 +53,15 @@ export declare const EvidenceArtifactSchema: z.ZodObject<{
     droppedBytes: z.ZodNumber;
     truncated: z.ZodBoolean;
 }, z.core.$strict>;
+export declare const RedactionSchema: z.ZodObject<{
+    material: z.ZodBoolean;
+    counts: z.ZodOptional<z.ZodObject<{
+        token: z.ZodNumber;
+        assignment: z.ZodNumber;
+        secretEnv: z.ZodNumber;
+        benignEnv: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
 export declare const GateEvidenceReceiptSchema: z.ZodObject<{
     invocationId: z.ZodString;
     nonce: z.ZodOptional<z.ZodString>;
@@ -85,6 +94,12 @@ export declare const GateEvidenceReceiptSchema: z.ZodObject<{
     }>;
     redaction: z.ZodObject<{
         material: z.ZodBoolean;
+        counts: z.ZodOptional<z.ZodObject<{
+            token: z.ZodNumber;
+            assignment: z.ZodNumber;
+            secretEnv: z.ZodNumber;
+            benignEnv: z.ZodNumber;
+        }, z.core.$strict>>;
     }, z.core.$strict>;
     stdout: z.ZodObject<{
         path: z.ZodString;

package/dist/run/protocol.js

@@ -47,6 +47,16 @@ export const EvidenceArtifactSchema = z.object({
     if (ref.availability === "available" && ref.sha256 === null)
         ctx.addIssue({ code: "custom", message: "available bytes require a hash" });
 });
+// OBS-1139: one count per original span, never a value. A legacy receipt carries `material` alone and
+// keeps it as recorded; a counted one must agree — benign HOME/TMPDIR substitutions are never material.
+const RedactionCountsSchema = z.object({
+    token: z.number().int().nonnegative(),
+    assignment: z.number().int().nonnegative(),
+    secretEnv: z.number().int().nonnegative(),
+    benignEnv: z.number().int().nonnegative(),
+}).strict();
+export const RedactionSchema = z.object({ material: z.boolean(), counts: RedactionCountsSchema.optional() }).strict()
+    .refine(r => !r.counts || r.material === (r.counts.token + r.counts.assignment + r.counts.secretEnv > 0), { message: "material must agree with the token, assignment and secret-environment counts" });
 export const GateEvidenceReceiptSchema = z.object({
     invocationId: NonEmptyStringSchema,
     nonce: NonEmptyStringSchema.optional(),
@@ -64,7 +74,7 @@ export const GateEvidenceReceiptSchema = z.object({
         timedOut: z.boolean().nullable(),
     }).strict(),
     availability: z.enum(EVIDENCE_AVAILABILITIES),
-    redaction: z.object({ material: z.boolean() }).strict(),
+    redaction: RedactionSchema,
     stdout: EvidenceArtifactSchema,
     stderr: EvidenceArtifactSchema,
 }).strict();

package/dist/run/receipt-resolver.d.ts

@@ -1,6 +1,18 @@
 import { type GateEvidenceReceipt } from "./protocol.js";
 export declare const RECEIPT_UNAVAILABLE_REASONS: readonly ["outside-root", "symlink", "hash-mismatch", "expired", "missing"];
 export type ReceiptUnavailableReason = (typeof RECEIPT_UNAVAILABLE_REASONS)[number];
+/** OBS-1140: at most this many newest eviction tombstones persist; an older eviction reads as missing. */
+export declare const EVICTION_TOMBSTONE_LIMIT = 256;
+/** Beside gate-evidence/, never inside it: tombstones are metadata, not retained artifact bytes. */
+export declare const EVICTION_TOMBSTONES_FILE = "evidence-evictions.json";
+/** Bound to the evicted bytes themselves, so a replacement artifact at the same path never inherits it. */
+export interface EvictionTombstone {
+    readonly path: string;
+    readonly sha256: string;
+    readonly retainedBytes: number;
+}
+/** Newest last, at most the limit; anything malformed is no tombstone at all (fail closed to missing). */
+export declare function parseEvictionTombstones(bytes: Buffer): EvictionTombstone[];
 export type ReceiptResolution = {
     readonly ok: true;
     readonly path: string;
@@ -12,6 +24,16 @@ export type ReceiptResolution = {
 };
 /** Resolve one artifact reference against the run root it was recorded under. Fails closed. */
 export declare function resolveReceipt(reference: unknown, runRoot: string): ReceiptResolution;
+export type ReceiptRedaction = {
+    readonly material: boolean;
+    readonly counts: GateEvidenceReceipt["redaction"]["counts"] | null;
+};
+/**
+ * OBS-1139: what a receipt says was withheld. A counted receipt reports its per-span counts; a legacy
+ * one keeps its recorded `material` with no counts; anything unparseable is material (fail closed).
+ */
+export declare function resolveReceiptRedaction(receipt: unknown): ReceiptRedaction;
+export declare function formatReceiptRedaction(r: ReceiptRedaction): string;
 /** Both artifacts of a receipt, stdout first, each resolved independently. */
 export declare function resolveReceiptArtifacts(receipt: GateEvidenceReceipt, runRoot: string): ReceiptResolution[];
 /** One line per artifact for a human surface: the reference, then its verified availability. */

package/dist/run/receipt-resolver.js

@@ -1,13 +1,28 @@
 import { createHash } from "node:crypto";
 import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
-import { EvidenceArtifactSchema } from "./protocol.js";
+import { EvidenceArtifactSchema, RedactionSchema } from "./protocol.js";
 // OBS-1101 retrieval (D-174): the one production reader of an execution-evidence receipt. It answers
 // from the bytes on disk under the run root the receipt was minted in and nothing else — no
 // re-execution, no substitute chosen by name or timestamp, no symlink followed anywhere: not in the
 // reference, not at the root, not above it. The caller hands a canonical root (its own trust anchor);
 // a root reached through any link is refused outright.
 export const RECEIPT_UNAVAILABLE_REASONS = ["outside-root", "symlink", "hash-mismatch", "expired", "missing"];
+/** OBS-1140: at most this many newest eviction tombstones persist; an older eviction reads as missing. */
+export const EVICTION_TOMBSTONE_LIMIT = 256;
+/** Beside gate-evidence/, never inside it: tombstones are metadata, not retained artifact bytes. */
+export const EVICTION_TOMBSTONES_FILE = "evidence-evictions.json";
+/** Newest last, at most the limit; anything malformed is no tombstone at all (fail closed to missing). */
+export function parseEvictionTombstones(bytes) {
+    try {
+        const raw = JSON.parse(bytes.toString("utf8"));
+        return Array.isArray(raw) ? raw.filter((t) => typeof t?.path === "string"
+            && typeof t.sha256 === "string" && Number.isInteger(t.retainedBytes)).slice(-EVICTION_TOMBSTONE_LIMIT) : [];
+    }
+    catch {
+        return [];
+    }
+}
 /** Resolve one artifact reference against the run root it was recorded under. Fails closed. */
 export function resolveReceipt(reference, runRoot) {
     const parsed = EvidenceArtifactSchema.safeParse(reference);
@@ -27,6 +42,8 @@ export function resolveReceipt(reference, runRoot) {
     if (!rel || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel))
         return { ok: false, path: ref.path, reason: "outside-root" };
     const read = readUnderRoot(root, rel.split(sep));
+    if (read === "missing" && evictedByQuota(root, ref))
+        return { ok: false, path: ref.path, reason: "expired" };
     if (typeof read === "string")
         return { ok: false, path: ref.path, reason: read };
     const sha256 = createHash("sha256").update(read).digest("hex");
@@ -34,6 +51,28 @@ export function resolveReceipt(reference, runRoot) {
         return { ok: false, path: ref.path, reason: "hash-mismatch" };
     return { ok: true, path: ref.path, sha256 };
 }
+/** A deletion is explained only by a tombstone naming this exact path, hash and length (OBS-1140). */
+function evictedByQuota(root, ref) {
+    const bytes = readUnderRoot(root, [EVICTION_TOMBSTONES_FILE]);
+    return typeof bytes !== "string" && parseEvictionTombstones(bytes)
+        .some(t => t.path === ref.path && t.sha256 === ref.sha256 && t.retainedBytes === ref.retainedBytes);
+}
+/**
+ * OBS-1139: what a receipt says was withheld. A counted receipt reports its per-span counts; a legacy
+ * one keeps its recorded `material` with no counts; anything unparseable is material (fail closed).
+ */
+export function resolveReceiptRedaction(receipt) {
+    const parsed = RedactionSchema.safeParse(receipt?.redaction);
+    if (!parsed.success)
+        return { material: true, counts: null };
+    return { material: parsed.data.material, counts: parsed.data.counts ?? null };
+}
+export function formatReceiptRedaction(r) {
+    const head = r.material ? "material" : "nonmaterial";
+    return r.counts
+        ? `redaction ${head} token=${r.counts.token} assignment=${r.counts.assignment} secret-env=${r.counts.secretEnv} benign-env=${r.counts.benignEnv}`
+        : `redaction ${head} (uncounted)`;
+}
 const same = (a, b) => a.dev === b.dev && a.ino === b.ino;
 /** Every ancestor of the root, root first excluded — "/" itself cannot be a link. */
 function ancestors(root) {

package/dist/run/repair-selection.d.ts

@@ -2,9 +2,19 @@ import type { JournalEvent } from "./journal.js";
 export interface RepairSelectionDecision {
     selectTests: boolean;
     requiredFiles: string[];
-    reason: "no-test-failure" | "known-failing-files" | "legacy-test-failure" | "unattributed-test-failure" | "full-suite-failure";
+    reason: "no-test-failure" | "known-failing-files" | "legacy-test-failure" | "unattributed-test-failure";
 }
 type SelectionEvent = Pick<JournalEvent, "event" | "taskId" | "data">;
+/** OBS-1199: repair selection is on unless a config says otherwise, independent of the optional
+ * execution budget (which stays subprocess-only). Either explicit `false` turns it off. */
+export declare function repairSelectionEnabled(cfg?: {
+    executionPolicy?: {
+        repairSelection?: unknown;
+    };
+    gates?: {
+        repairSelection?: unknown;
+    };
+}): boolean;
 /** Diagnostic selection only: neither a narrow pass nor this decision can authorize integration.
  * Distrust and known failing files survive later green results, approvals and resume. A historical
  * ambiguous failure is never reinterpreted using a newly enabled policy. */

package/dist/run/repair-selection.js

@@ -1,3 +1,8 @@
+/** OBS-1199: repair selection is on unless a config says otherwise, independent of the optional
+ * execution budget (which stays subprocess-only). Either explicit `false` turns it off. */
+export function repairSelectionEnabled(cfg) {
+    return cfg?.executionPolicy?.repairSelection !== false && cfg?.gates?.repairSelection !== false;
+}
 /** These are literal repository-relative identities. Existence and selection support are checked
  * against the current worktree by the gate; this journal fold cannot establish either. */
 function fileIdentities(value) {
@@ -32,16 +37,19 @@ export function repairSelectionDecision(events, taskId, enabled) {
             distrust ??= "unattributed-test-failure";
             continue;
         }
-        // A replacement full-suite failure follows a passing screen in the current pipeline. No
-        // ordinary full-suite failure establishes that a selector safely covers the failed behavior.
-        if (data.fullSuite === true) {
-            distrust ??= "full-suite-failure";
-            continue;
-        }
-        const selected = fileIdentities(data.selectedTests);
+        // OBS-1199: a full-suite red counts only when it positively says it was full — the replacement
+        // after a screen (`fullSuite`), or an ordinary full run whose recorded selection decision says
+        // so — and names its failing files. Those files join every later screen even when no selector
+        // reaches them; the merge candidate still runs the complete suite. No attribution means full.
         const failing = fileIdentities(data.failingFiles);
-        if (!selected || !failing || failing.some((file) => !selected.includes(file))
-            || (data.fullSuite !== undefined && data.fullSuite !== false)) {
+        const selected = fileIdentities(data.selectedTests);
+        const decision = data.selectionDecision;
+        const replacement = data.fullSuite === true;
+        const ordinaryFull = data.fullSuite === undefined && data.selectedTests === undefined
+            && typeof decision === "object" && decision !== null && decision.scope === "full";
+        const screen = (data.fullSuite === undefined || data.fullSuite === false) && selected !== undefined
+            && failing !== undefined && failing.every((file) => selected.includes(file));
+        if (!failing || !(replacement || ordinaryFull || screen)) {
             distrust ??= "unattributed-test-failure";
             continue;
         }

package/dist/run/wall-budget.d.ts

@@ -0,0 +1,48 @@
+import type { JournalEvent } from "./journal.js";
+/**
+ * OBS-1201: where a run's wall time went. Every instant of the engagement window lands in exactly ONE
+ * bucket — the first of WALL_PRIORITY with a span covering it — and what no span covers is residual,
+ * so the exposed buckets always sum to the wall. Task-time sums every span as recorded, so concurrent
+ * work (two workers, four suites waiting on one lease) stays visible without inflating the wall.
+ *
+ * Only journaled observations become spans: a fresh gate row's measured duration less the matched
+ * suite waits inside it, a worker launch matched to its result, a suite wait matched to its admission,
+ * and the gap a restart left between one engagement's last row and the next run-resume. A copy of
+ * evidence — a cache reuse, a journal replay, a row naming an invocation already counted — never adds
+ * a span; a reused full suite's row still times the fresh screen it carries. A row without a duration, a launch, wait or gate start with no matching end, and one cut by
+ * a restart are counted, never timed. Residual
+ * is unattributed time, not a claim of idleness. Pure: journal rows in, numbers out.
+ */
+export declare const WALL_PRIORITY: readonly ["interruption", "test", "semantics", "worker", "queue", "other-gate"];
+export type WallBucket = (typeof WALL_PRIORITY)[number];
+type PerBucket = Record<WallBucket, number>;
+export interface WallBudget {
+    wallMs: number;
+    exposedMs: PerBucket;
+    residualMs: number;
+    taskMs: PerBucket;
+    /** Gate-result rows by provenance. A declined gate never ran and is none of these. */
+    evidence: {
+        fresh: number;
+        replay: number;
+        reuse: number;
+        unknown: number;
+    };
+    /** Evidence that exists but carries no timing: rows without a duration, unmatched and interrupted starts. */
+    untimed: Record<WallBucket, {
+        unknown: number;
+        unmatched: number;
+        interrupted: number;
+    }>;
+}
+/** Undefined when the journal names no measurable window (no run-start, or unreadable timestamps). */
+export declare function wallBudget(events: readonly JournalEvent[]): WallBudget | undefined;
+/** Whole seconds past a minute, one decimal below ten seconds — never a rounded-away "0s" for a real span. */
+export declare const formatSpan: (ms: number) => string;
+/**
+ * One fact per bucket, then residual and the evidence tally — the words every surface prints. A
+ * bucket whose only evidence is untimed reads `unknown`, never a zero it did not measure.
+ */
+export declare function wallBudgetFacts(b: WallBudget): Array<[label: string, fact: string]>;
+export declare const WALL_PRIORITY_TEXT: string;
+export {};

package/dist/run/wall-budget.js

@@ -0,0 +1,280 @@
+import { gateDeclined } from "../report/bundle.js";
+/**
+ * OBS-1201: where a run's wall time went. Every instant of the engagement window lands in exactly ONE
+ * bucket — the first of WALL_PRIORITY with a span covering it — and what no span covers is residual,
+ * so the exposed buckets always sum to the wall. Task-time sums every span as recorded, so concurrent
+ * work (two workers, four suites waiting on one lease) stays visible without inflating the wall.
+ *
+ * Only journaled observations become spans: a fresh gate row's measured duration less the matched
+ * suite waits inside it, a worker launch matched to its result, a suite wait matched to its admission,
+ * and the gap a restart left between one engagement's last row and the next run-resume. A copy of
+ * evidence — a cache reuse, a journal replay, a row naming an invocation already counted — never adds
+ * a span; a reused full suite's row still times the fresh screen it carries. A row without a duration, a launch, wait or gate start with no matching end, and one cut by
+ * a restart are counted, never timed. Residual
+ * is unattributed time, not a claim of idleness. Pure: journal rows in, numbers out.
+ */
+export const WALL_PRIORITY = ["interruption", "test", "semantics", "worker", "queue", "other-gate"];
+const perBucket = () => Object.fromEntries(WALL_PRIORITY.map((bucket) => [bucket, 0]));
+const at = (e) => Date.parse(e.ts);
+const measured = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
+const bucketOf = (gate) => gate === "test" ? "test" : gate === "acceptance" || gate === "review" ? "semantics" : "other-gate";
+// Rows another process writes around a restart — the operator's approval, the resuming daemon's
+// reclaim and rehash audit — so the prior engagement's own last row is the one before them.
+// ponytail: a closed list; a new out-of-engagement writer lengthens the interruption it precedes.
+const OUTSIDE_ENGAGEMENT = new Set(["task-approved", "graph-rehash", "lock-reclaimed", "superseded"]);
+const outsideEngagement = (e) => OUTSIDE_ENGAGEMENT.has(e.event) || (e.event === "exit-cause" && e.data.cause === "unclean");
+const WORKER_END = new Set(["worker-result", "worker-dead", "worker-hard-timeout"]);
+const invocationOf = (data) => {
+    if (typeof data.nonce === "string")
+        return data.nonce;
+    const receipt = data.evidenceReceipt;
+    return typeof receipt?.invocationId === "string" ? receipt.invocationId : undefined;
+};
+/** Undefined when the journal names no measurable window (no run-start, or unreadable timestamps). */
+export function wallBudget(events) {
+    const first = events.findIndex((e) => e.event === "run-start");
+    if (first < 0)
+        return undefined;
+    const lastOf = (event) => events.map((e) => e.event).lastIndexOf(event);
+    const lastEnd = lastOf("run-end");
+    const lastResume = lastOf("run-resume");
+    const from = at(events[first]);
+    // A closed engagement ends at its run-end; an open or crashed one at its newest row.
+    const to = at(events[lastEnd > lastResume ? lastEnd : events.length - 1]);
+    if (!Number.isFinite(from) || !Number.isFinite(to) || to < from)
+        return undefined;
+    const spans = [];
+    const span = (bucket, a, b) => {
+        const s = Math.max(a, from);
+        const t = Math.min(b, to);
+        if (Number.isFinite(s) && Number.isFinite(t) && t > s)
+            spans.push({ bucket, from: s, to: t });
+    };
+    const evidence = { fresh: 0, replay: 0, reuse: 0, unknown: 0 };
+    const untimed = Object.fromEntries(WALL_PRIORITY.map((bucket) => [bucket, { unknown: 0, unmatched: 0, interrupted: 0 }]));
+    const counted = new Set();
+    // A gate row is journaled when its whole round settles (acceptance, review and test often share one
+    // timestamp), so its measured duration is anchored at the gate's FIRST phase-start in the round.
+    const gateStarts = new Map();
+    const workers = new Map();
+    // A dispatch that never journals a launch (every pre-launch-row journal) ran a worker nobody timed.
+    const dispatched = new Set();
+    // A wait is owned by the gate whose command was admitted (the daemon names it when the phase is
+    // unambiguous; a parallel sibling leaves it absent). Its measurement started before admission, so
+    // a matched wait inside that gate's own span is queue, not service, and is cut out before priority
+    // applies. Sibling gates keep executing through it, so nothing is cut from them. A wait naming no
+    // gate belongs to the suite lease, which is the test gate's.
+    const owner = (task, gate) => `${task}\0${typeof gate === "string" ? gate : "test"}`;
+    const waits = new Map();
+    const queued = new Map();
+    const admit = (task, gate, ts) => {
+        const key = owner(task, gate);
+        const opened = waits.get(key);
+        if (opened === undefined)
+            return;
+        span("queue", opened, ts);
+        // One open wait per owner, closed in journal order: the list stays sorted and non-overlapping.
+        queued.set(key, [...(queued.get(key) ?? []), [opened, ts]]);
+        waits.delete(key);
+    };
+    const service = (gate, task, a, b) => {
+        const bucket = bucketOf(gate);
+        // One linear sweep over the sorted waits; span() drops any empty or inverted piece.
+        let cursor = a;
+        for (const [ws, we] of queued.get(owner(task, gate)) ?? []) {
+            if (we <= cursor || ws >= b)
+                continue;
+            span(bucket, cursor, ws);
+            cursor = Math.max(cursor, we);
+        }
+        span(bucket, cursor, b);
+    };
+    // A gate that started and never journaled its result is evidence without timing, never a zero.
+    const untimedStarts = (starts, kind) => {
+        for (const gate of starts?.keys() ?? [])
+            untimed[bucketOf(gate)][kind]++;
+    };
+    for (let i = first + 1; i < events.length; i++) {
+        const e = events[i];
+        const task = e.taskId ?? "";
+        const ts = at(e);
+        switch (e.event) {
+            case "run-resume": {
+                let last = i - 1;
+                while (last > first && outsideEngagement(events[last]))
+                    last--;
+                span("interruption", at(events[last]), ts);
+                untimed.worker.interrupted += workers.size;
+                untimed.worker.unknown += dispatched.size;
+                untimed.queue.interrupted += waits.size;
+                for (const starts of gateStarts.values())
+                    untimedStarts(starts, "interrupted");
+                workers.clear();
+                dispatched.clear();
+                waits.clear();
+                gateStarts.clear();
+                break;
+            }
+            case "phase-start": {
+                if (e.data.phase === "gates") {
+                    untimedStarts(gateStarts.get(task), "unmatched");
+                    gateStarts.delete(task);
+                }
+                else if (typeof e.data.gate === "string") {
+                    const starts = gateStarts.get(task) ?? new Map();
+                    if (!starts.has(e.data.gate))
+                        starts.set(e.data.gate, ts);
+                    gateStarts.set(task, starts);
+                }
+                if (e.data.admitted === true)
+                    admit(task, e.data.gate, ts);
+                break;
+            }
+            case "suite-admitted":
+                admit(task, undefined, ts);
+                break;
+            case "suite-wait":
+                // Repeated rows while a wait is open re-report its count; they do not open a second wait.
+                if (!waits.has(owner(task, e.data.gate)))
+                    waits.set(owner(task, e.data.gate), ts);
+                break;
+            case "task-dispatch":
+                if (dispatched.has(task))
+                    untimed.worker.unknown++;
+                dispatched.add(task);
+                break;
+            case "worker-launch":
+                if (workers.has(task))
+                    untimed.worker.unmatched++;
+                workers.set(task, ts);
+                dispatched.delete(task);
+                break;
+            case "gate-provisioned":
+                if (measured(e.data.durationMs))
+                    service(typeof e.data.gate === "string" ? e.data.gate : "build", task, ts - e.data.durationMs, ts);
+                break;
+            case "gate-result": {
+                const gate = e.data.gate;
+                if (typeof gate !== "string")
+                    break;
+                const anchor = gateStarts.get(task)?.get(gate);
+                gateStarts.get(task)?.delete(gate);
+                if (gateDeclined(e.data))
+                    break;
+                const bucket = bucketOf(gate);
+                const invocation = invocationOf(e.data);
+                const identity = invocation === undefined ? undefined : `${gate}\0${invocation}`;
+                if (e.data.reused === true) {
+                    evidence.reuse++;
+                    // A held screen runs fresh before its full suite is carried from the cache, and the one
+                    // merge-candidate row holds both: the screen's measured interval is fresh execution, the
+                    // carried suite adds none. A replay's copy is not a measurement of this attempt.
+                    const screen = e.data.fullSuite === true && e.data.replayedFromAttempt === undefined ? e.data.selectedDurationMs : undefined;
+                    if (!measured(screen) || screen <= 0)
+                        break;
+                    evidence.fresh++;
+                    const screenFrom = anchor ?? ts - screen;
+                    service(gate, task, screenFrom, Math.min(screenFrom + screen, ts));
+                    break;
+                }
+                if (e.data.replayedFromAttempt !== undefined || (identity !== undefined && counted.has(identity))) {
+                    evidence.replay++;
+                    break;
+                }
+                if (identity !== undefined)
+                    counted.add(identity);
+                const d = e.data.durationMs;
+                if (!measured(d)) {
+                    evidence.unknown++;
+                    untimed[bucket].unknown++;
+                    break;
+                }
+                evidence.fresh++;
+                const full = e.data.fullSuite === true && measured(e.data.fullDurationMs) && measured(e.data.selectedDurationMs);
+                if (anchor === undefined)
+                    service(gate, task, ts - d, ts);
+                else if (full) {
+                    // The full suite ends at the row; the selected run began at the gate's first phase-start.
+                    const fullFrom = ts - e.data.fullDurationMs;
+                    service(gate, task, anchor, Math.min(anchor + e.data.selectedDurationMs, fullFrom));
+                    service(gate, task, fullFrom, ts);
+                }
+                else
+                    service(gate, task, anchor, Math.min(anchor + d, ts));
+                break;
+            }
+            default:
+                if (WORKER_END.has(e.event) && workers.has(task)) {
+                    span("worker", workers.get(task), ts);
+                    workers.delete(task);
+                }
+        }
+    }
+    untimed.worker.unmatched += workers.size;
+    untimed.worker.unknown += dispatched.size;
+    untimed.queue.unmatched += waits.size;
+    for (const starts of gateStarts.values())
+        untimedStarts(starts, "unmatched");
+    const taskMs = perBucket();
+    for (const s of spans)
+        taskMs[s.bucket] += s.to - s.from;
+    // One sweep over span edges: each segment goes to the highest-priority bucket still open over it.
+    const rank = (bucket) => WALL_PRIORITY.indexOf(bucket);
+    const edges = spans.flatMap((s) => [[s.from, rank(s.bucket), 1], [s.to, rank(s.bucket), -1]])
+        .sort((a, b) => a[0] - b[0]);
+    const open = WALL_PRIORITY.map(() => 0);
+    const exposedMs = perBucket();
+    let cursor = from;
+    for (const [t, r, delta] of edges) {
+        if (t > cursor) {
+            const top = open.findIndex((n) => n > 0);
+            if (top >= 0)
+                exposedMs[WALL_PRIORITY[top]] += t - cursor;
+            cursor = t;
+        }
+        open[r] += delta;
+    }
+    const wallMs = to - from;
+    const residualMs = wallMs - WALL_PRIORITY.reduce((sum, bucket) => sum + exposedMs[bucket], 0);
+    return { wallMs, exposedMs, residualMs, taskMs, evidence, untimed };
+}
+/** Whole seconds past a minute, one decimal below ten seconds — never a rounded-away "0s" for a real span. */
+export const formatSpan = (ms) => {
+    if (ms > 0 && ms < 10_000)
+        return `${(Math.ceil(ms / 100) / 10).toString()}s`;
+    const s = Math.round(ms / 1_000);
+    if (s < 60)
+        return `${s}s`;
+    if (s < 3_600)
+        return `${Math.floor(s / 60)}m ${s % 60}s`;
+    return `${Math.floor(s / 3_600)}h ${Math.floor((s % 3_600) / 60)}m`;
+};
+const plural = (n, noun) => `${n} ${noun}${n === 1 ? "" : "s"}`;
+/**
+ * One fact per bucket, then residual and the evidence tally — the words every surface prints. A
+ * bucket whose only evidence is untimed reads `unknown`, never a zero it did not measure.
+ */
+export function wallBudgetFacts(b) {
+    const pct = (ms) => b.wallMs > 0 ? ` (${Math.round((100 * ms) / b.wallMs)}%)` : "";
+    const facts = WALL_PRIORITY.map((bucket) => {
+        const { unknown, unmatched, interrupted } = b.untimed[bucket];
+        const notes = [
+            ...(unknown ? [bucket === "worker"
+                    ? `${unknown} ${unknown === 1 ? "dispatch" : "dispatches"} without a launch row`
+                    : `${plural(unknown, "row")} without a duration`] : []),
+            ...(unmatched ? [`${unmatched} unmatched`] : []),
+            ...(interrupted ? [`${interrupted} cut by a restart`] : []),
+        ];
+        if (!b.exposedMs[bucket] && !b.taskMs[bucket] && notes.length)
+            return [bucket, `unknown — ${notes.join(" · ")}`];
+        const timed = `${formatSpan(b.exposedMs[bucket])}${pct(b.exposedMs[bucket])} · task-time ${formatSpan(b.taskMs[bucket])}`;
+        return [bucket, [timed, ...notes.map((note) => `${note}, untimed`)].join(" · ")];
+    });
+    const { fresh, replay, reuse, unknown } = b.evidence;
+    return [
+        ...facts,
+        ["residual", `${formatSpan(b.residualMs)}${pct(b.residualMs)} — unattributed, not proven idle`],
+        ["gate evidence", `fresh ${fresh} · replay ${replay} · reuse ${reuse} · unknown ${unknown}`],
+    ];
+}
+export const WALL_PRIORITY_TEXT = [...WALL_PRIORITY, "residual"].join(" › ");

package/dist/tui/cockpit/live-store.d.ts

@@ -1,6 +1,8 @@
 import { type JournalEvent } from "../../run/journal.js";
 import { type OperatorRecord } from "../../run/operator-state.js";
 export declare const OBSERVATION_INTERVAL_MS = 1000;
+/** Stat-to-fstat observations one poll spends on a journal a writer keeps appending to. */
+export declare const APPEND_RACE_OBSERVATIONS = 3;
 export declare const STORE_LIMITS: {
     readonly graphBytes: number;
     readonly history: 256;
@@ -61,12 +63,16 @@ export declare class JournalTail {
     private bytesRead;
     private lastSuccessfulReadAt?;
     private failure?;
+    private stale;
     constructor(source: string, hooks?: {
         record?: (record: OperatorRecord) => void;
         reset?: () => void;
     });
     private reset;
+    /** A same-inode append between stat and fstat is retried; exhaustion keeps the last good snapshot, pending. */
     poll(now?: number): TailSnapshot;
+    /** One stat-to-fstat observation. False when an append raced it; nothing was consumed or reset. */
+    private observe;
     private appendCarry;
     snapshot(): TailSnapshot;
     /** Demand paging scans with fixed buffers, independent of the retained history; no growing line index. */