tickmarkr 2.6.2 → 2.6.4

package/dist/drivers/herdr.js

@@ -7,6 +7,7 @@ import { consumePaneLaunchIntent, PANE_IDENTITY_ENV, paneIdentityLine } from "..
 import { createWorktree, sh } from "../run/git.js";
 import { Journal } from "../run/journal.js";
 import { readSupervision, readWatchBoard, requestWatchBoardStop, reserveWatchBoard, stopWatchBoard, WATCH_OWNER_ENV } from "../run/supervision.js";
+import { canonicalWorktreePath } from "./orca.js";
 import { herdrSealShellPrefix } from "./subprocess.js";
 import { canonicalizeLegacyName, formatOwnedName, panesToClose, parseOwnedName } from "./types.js";
 // VIS-09 P43-03: adopted safety floor from 43-MEASUREMENT.md (narrowest safe 53 → floor 108).
@@ -153,6 +154,8 @@ export class HerdrDriver {
     deliverySerial = Promise.resolve();
     dispatchLeases = new WeakMap();
     deliveredPanes = new WeakMap();
+    /** OBS-1203: slots bound by adopt() — their reads are harvest evidence, so a failed read throws. */
+    adoptedSlots = new WeakSet();
     inputBoxes = new WeakMap();
     // OBS-253: the adapter-declared bootstrap this slot has already delivered. A fresh pane is a bare
     // shell, so it is the only thing that can put a TUI back under a typed turn that has to move.
@@ -452,6 +455,49 @@ export class HerdrDriver {
         // refcount, no groupSerial, no degrade latch — dedicated tabs have no shared state to guard (SUP-01).
         return slot; // label undefined → defaults to name (today's behavior)
     }
+    /**
+     * OBS-1203: bind THIS instance, READ-ONLY, to the pane an earlier daemon created for an owned slot,
+     * so a resumed daemon can read the interrupted attempt's trailer. slot() is never a substitute: it
+     * allocates a tab, reclaimStaleLabel closes the very pane holding the evidence, and it holds a
+     * dispatch lease only run() releases. Binding needs ownership evidence, never a label alone: exactly
+     * one pane carries the FULL owned label, herdr reports that pane's cwd as the journaled task
+     * checkout, and that path is a git checkout whose own top level it is. Zero, ambiguous or foreign
+     * candidates throw — the caller's decline. `pane list` and `git rev-parse` are the only calls made.
+     */
+    async adopt(slot) {
+        if (!parseOwnedName(slot.name))
+            throw new Error(`herdr adopt: slot ${slot.name} carries no owned label — nothing to adopt`);
+        const listed = await this.herdr("pane list");
+        let panes;
+        try {
+            const parsed = JSON.parse(listed.stdout).result?.panes;
+            if (listed.code !== 0 || !Array.isArray(parsed))
+                throw new Error("no panes array");
+            panes = parsed;
+        }
+        catch {
+            throw new Error(`herdr adopt: pane list unreadable (exit ${listed.code}) — cannot prove ownership of ${slot.name}`);
+        }
+        const owned = panes.filter((p) => p.label === slot.name && typeof p.pane_id === "string" && p.pane_id);
+        if (owned.length !== 1) {
+            throw new Error(`herdr adopt: ${owned.length === 0 ? "no pane carries" : `${owned.length} panes carry`} the owned label ${slot.name}`);
+        }
+        const pane = owned[0];
+        const checkout = canonicalWorktreePath(slot.cwd);
+        if (typeof pane.cwd !== "string" || canonicalWorktreePath(pane.cwd) !== checkout) {
+            throw new Error(`herdr adopt: pane ${pane.pane_id} labelled ${slot.name} sits in ${pane.cwd ?? "an unreported cwd"}, not the task checkout ${checkout} — foreign`);
+        }
+        const top = await sh("git rev-parse --show-toplevel", checkout);
+        if (top.code !== 0 || canonicalWorktreePath(top.stdout.trim()) !== checkout) {
+            throw new Error(`herdr adopt: ${checkout} is not its own git checkout — no checkout proof for ${slot.name}`);
+        }
+        const adopted = { id: pane.pane_id, name: slot.name, cwd: slot.cwd,
+            ...(pane.tab_id === undefined ? {} : { tabId: pane.tab_id }), ...(slot.group === undefined ? {} : { group: slot.group }) };
+        // Reads go to the pane ownership was proven on, never to a later re-resolution of the label.
+        this.deliveredPanes.set(adopted, pane.pane_id);
+        this.adoptedSlots.add(adopted);
+        return adopted;
+    }
     // today's per-slot tab path, plus the VIS-04 orphan reap
     // label defaults to the slot name; group tabs pass the STAGE name instead — a first-member label
     // outlives its member once keepPanes reaps it (run-20260709-104447: the codex pane sat in a tab
@@ -1099,6 +1145,11 @@ export class HerdrDriver {
     async read(slot, lines) {
         const pane = await this.paneId(slot);
         const r = await this.herdr(`pane read ${shq(pane)} --source recent-unwrapped --lines ${lines}`, slot.cwd);
+        // OBS-1203 review: an adopted pane's read decides a resume harvest; a failed read proves neither a
+        // trailer nor its absence, so it throws (the caller's decline) rather than read as an empty pane.
+        // ponytail: other slots keep the historical empty-on-failure read; widen once seed/consult callers catch.
+        if (r.code !== 0 && this.adoptedSlots.has(slot))
+            throw new Error(`herdr pane read ${pane} failed (exit ${r.code}): ${r.stderr || r.stdout}`);
         return r.stdout;
     }
     // v1.22 T5 / OBS-19: raw keystroke into the pane TUI (trust-dialog auto-answer). Resolves the pane

package/dist/drivers/orca.d.ts

@@ -274,7 +274,15 @@ export declare class OrcaDriver implements ExecutorDriver {
      */
     private screenBehindBlindStream;
     /** A rendered-frame liveness read. `--screen` and `--cursor` are mutually exclusive in Orca. */
-    private readScreen;
+    private screenFrame;
+    /**
+     * OBS-1205: the public rendered-screen read a slot carries (Slot.readScreen). Kimi draws its trust
+     * modal with cursor addressing, so the stream holds the box rules and no `Trust` text while the
+     * painted frame shows `❯ Trust this folder`. Same ownership discipline as every read — bound
+     * runtime, addressed handle, running status — and a frame the runtime could not render is
+     * unreadable, never an empty screen a caller could read as "no modal".
+     */
+    readScreen(slot: Slot): Promise<string>;
     /** A single UNPAGED tail read — exactly what the caller asked for and nothing more. Markers split
      *  across cursor pages are not reassembled here; that is waitOutput's job. */
     read(slot: Slot, lines: number): Promise<string>;

package/dist/drivers/orca.js

@@ -719,7 +719,8 @@ export class OrcaDriver {
                 this.pendingProjects.delete(owned.taskId);
             }
         }
-        return { id, name: title, cwd: worktree, group: opts?.group };
+        const slot = { id, name: title, cwd: worktree, group: opts?.group, readScreen: () => this.readScreen(slot) };
+        return slot;
     }
     /**
      * OBS-1109: bind THIS instance to a terminal an earlier daemon created for an OWNED slot, so a
@@ -1175,14 +1176,14 @@ export class OrcaDriver {
             throw new OrcaUnavailableError(family, `exited-shaped stream page: show answered by runtime ${show.runtimeId}, not the bound ${st.runtimeId}`, show.raw, "exited");
         }
         this.liveShowTerm(family, st, show);
-        const screen = await this.readScreen(st);
+        const screen = await this.screenFrame(st);
         if (screen.source !== "screen") {
             throw new OrcaUnavailableError(family, `exited-shaped stream page and no rendered screen for ${st.handle}`, blind.raw, "exited");
         }
         return screen.term;
     }
     /** A rendered-frame liveness read. `--screen` and `--cursor` are mutually exclusive in Orca. */
-    async readScreen(st) {
+    async screenFrame(st) {
         const env = await this.terminalOp("status", st, (h) => this.call("read", [
             "terminal", "read", "--terminal", h, "--screen",
         ], this.cliCwd(st)));
@@ -1193,6 +1194,20 @@ export class OrcaDriver {
         }
         return { term, source };
     }
+    /**
+     * OBS-1205: the public rendered-screen read a slot carries (Slot.readScreen). Kimi draws its trust
+     * modal with cursor addressing, so the stream holds the box rules and no `Trust` text while the
+     * painted frame shows `❯ Trust this folder`. Same ownership discipline as every read — bound
+     * runtime, addressed handle, running status — and a frame the runtime could not render is
+     * unreadable, never an empty screen a caller could read as "no modal".
+     */
+    async readScreen(slot) {
+        const st = this.state(slot);
+        const { term, source } = await this.screenFrame(st);
+        if (source !== "screen")
+            throw new OrcaUnavailableError("read", `no rendered screen for ${st.handle}`, "");
+        return this.tailText("read", term, "");
+    }
     /** A single UNPAGED tail read — exactly what the caller asked for and nothing more. Markers split
      *  across cursor pages are not reassembled here; that is waitOutput's job. */
     async read(slot, lines) {
@@ -1269,7 +1284,7 @@ export class OrcaDriver {
             // reporting even when the show record alone would still look connected (show carries no
             // status field of its own, so a terminal can report "unknown"/"exited" on read while its
             // show row still says connected — the read leg is the only place that catches that).
-            const screen = await this.readScreen(st);
+            const screen = await this.screenFrame(st);
             if (`${st.runtimeId}:${st.handle}:${st.recoveries}` !== gen) {
                 continue;
             }
@@ -1407,7 +1422,7 @@ export class OrcaDriver {
     async sendKey(slot, key) {
         const st = this.state(slot);
         this.assertAvailable("send", st);
-        if (key === "enter") {
+        if (key === "enter" || key === "Enter") { // "Enter": every adapter's declared trust key (OBS-1205)
             await this.sendText(st, "");
             return;
         }
@@ -1440,7 +1455,7 @@ export class OrcaDriver {
                 return true;
             const deadline = this.time.now() + NUDGE_ECHO_TIMEOUT_MS;
             for (;;) {
-                const screen = await this.readScreen(st);
+                const screen = await this.screenFrame(st);
                 // ponytail: "composer emptied" is "the text is no longer on the frame" — a TUI that keeps the
                 // submitted turn on screen reads as undelivered until the timeout; the receipt stage is primary.
                 if (screen.source === "screen") {
@@ -1853,7 +1868,7 @@ export class OrcaDriver {
         const st = this.slots.get(slot.id);
         if (!st)
             return;
-        if (st.handle) {
+        if (st.handle && !st.swept) {
             await this.closeTerminal(st);
         }
         this.slots.delete(slot.id);
@@ -2022,6 +2037,13 @@ export class OrcaDriver {
                         recoveries: 0,
                         recovering: false,
                     });
+                    // A kept slot whose attempt the journal fold already retired (a seed readiness deadline
+                    // parks one) can still hold this exact terminal; its own close() must not re-address a
+                    // handle this driver just closed, or the run-end sweep latches on the vanished tab.
+                    for (const st of this.slots.values()) {
+                        if (st.handle === c.paneId && st.runtimeId === env.runtimeId)
+                            st.swept = true;
+                    }
                 }
                 catch { /* vanished, stale, or no longer provably ours — never a blind retry */ }
             }

package/dist/drivers/types.d.ts

@@ -5,6 +5,7 @@ export interface Slot {
     cwd: string;
     tabId?: string;
     group?: string;
+    readScreen?: () => Promise<string>;
 }
 export type NotifyTier = "routine" | "attention" | "decision";
 export interface NotifyOpts {
@@ -92,6 +93,7 @@ export interface ExecutorDriver {
     focus?(target: FocusTarget): Promise<FocusResult>;
     describe?(slot: Slot): SlotPlacement | Promise<SlotPlacement> | undefined;
     slot(cwd: string, name: string, opts?: SlotOpts): Promise<Slot>;
+    adopt?(slot: Slot): Promise<Slot>;
     run(slot: Slot, cmd: string): Promise<void>;
     waitOutput(slot: Slot, pattern: string, timeoutMs: number, opts?: {
         regex?: boolean;

package/dist/drivers/types.js

@@ -63,8 +63,8 @@ export function canonicalizeLegacyName(name, runId) {
         return { role: "worker", taskId: w[1], attempt: Number(w[2]), runId: `run-${w[3]}` };
     const g = GATE_ROLE_RE.exec(name);
     if (g) {
-        const retry = g[2].endsWith("-r1");
-        return { role: g[1], taskId: retry ? g[2].slice(0, -3) : g[2], attempt: retry ? 1 : 0, runId };
+        const hop = /-r([1-9])$/.exec(g[2]);
+        return { role: g[1], taskId: hop ? g[2].slice(0, -hop[0].length) : g[2], attempt: hop ? Number(hop[1]) : 0, runId };
     }
     if (NARRATOR_RE.test(name))
         return { role: "watch", taskId: "run", attempt: 0, runId };

package/dist/gates/acceptance.d.ts

@@ -55,6 +55,13 @@ export type AcceptanceCorpusAuditResult = {
     };
 };
 export declare function auditAcceptanceCorpus(corpusRoot: string, listedTests: readonly VitestListedTest[]): AcceptanceCorpusAuditResult[];
+/** OBS-1151: one criterion of a parsed judge verdict, as the contradiction check compares it. */
+export interface JudgedCriterion {
+    id: string;
+    criterion: string;
+    met: boolean;
+    paths: string[];
+}
 export interface AcceptanceGateOpts {
     testCmd?: string;
     diffCap?: number;

package/dist/gates/acceptance.js

@@ -7,7 +7,7 @@ import { DEFAULT_DIFF_CAP } from "../config/config.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
 import { sh } from "../run/git.js";
 import { checkTaskDiffCaps, fetchTaskDiff, isProtectedEvidence, setAsideReceiptPath } from "./review.js";
-import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
+import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, SeatLaunchError, verdictNonceLine } from "./llm.js";
 import { classifyVerdictCause } from "./verdict-cause.js";
 import { reviewableLogicDiff } from "./artifact-manifest.js";
 import { classifyFailureOutput } from "./baseline.js";
@@ -442,9 +442,19 @@ Each criteria[].evidence MUST be a structured citation {"path", "line"} whose "p
 The top-level comments array is optional. Use it only for actionable line-anchored feedback.
 `;
     // OBS-1182: an unset seat passes no effort argument at all — the CLI default, and the call shape callers pin.
-    const raw = await (judge.effort
-        ? runLlm(judge.adapter, judge.model, prompt, worktree, via, JUDGE_TIMEOUT_MS, judge.effort)
-        : runLlm(judge.adapter, judge.model, prompt, worktree, via, JUDGE_TIMEOUT_MS));
+    let raw;
+    try {
+        raw = await (judge.effort
+            ? runLlm(judge.adapter, judge.model, prompt, worktree, via, JUDGE_TIMEOUT_MS, judge.effort)
+            : runLlm(judge.adapter, judge.model, prompt, worktree, via, JUDGE_TIMEOUT_MS));
+    }
+    catch (error) {
+        if (!(error instanceof SeatLaunchError))
+            throw error;
+        // OBS-1168(b): no seat, no verdict — run-gates re-routes the judge or parks infra; never a worker charge.
+        return { gate: "acceptance", pass: false, details: `${warn}${detBlock}judge dispatch failed — ${error.message} — failing closed`,
+            meta: { unparseable: true, cause: "seat-launch-failed", judge: channelKey({ adapter: judge.adapter.id, model: judge.model }) } };
+    }
     const extracted = extractVerdictJson(raw, nonce);
     if (!extracted) {
         const cause = classifyVerdictCause(raw, nonce, "pass");
@@ -476,5 +486,17 @@ The top-level comments array is optional. Use it only for actionable line-anchor
         lines.push("judge verdict pass=false");
     lines.push(...inconsistencies);
     const prose = warn + detBlock + (lines.join("\n") || "judge passed");
-    return { gate: "acceptance", pass, details: appendAnchoredReview(prose, extracted) };
+    // OBS-1151: each criterion's canonical text, ruling and the paths its evidence cites. A legacy quote
+    // cites no path, so its criterion has no comparable subject (missing evidence is unknown). An
+    // inconsistent verdict (a duplicate row ruling both ways, a missing id) carries NO judgment: it is not
+    // a comparable subject, and as an adjudicator it can confirm nothing — run-gates parks it infra.
+    const judgment = inconsistencies.length ? undefined : v.criteria.flatMap((row) => {
+        const index = expectedIds.indexOf(row.criterion);
+        if (index < 0)
+            return [];
+        return [{ id: row.criterion, criterion: renderAcceptanceItem(judgeItems[index]), met: row.met,
+                paths: typeof row.evidence === "string" ? [] : [row.evidence.path] }];
+    });
+    return { gate: "acceptance", pass, details: appendAnchoredReview(prose, extracted),
+        meta: { judge: channelKey({ adapter: judge.adapter.id, model: judge.model }), ...(judgment ? { judgment } : {}) } };
 }

package/dist/gates/baseline.d.ts

@@ -1,5 +1,5 @@
 import { type EvidenceArtifact, type GateEvidenceReceipt, type ShellReceipt } from "../run/protocol.js";
-import type { TickmarkrConfig } from "../config/config.js";
+import { type TickmarkrConfig } from "../config/config.js";
 import type { AcceptanceItem } from "../graph/schema.js";
 import { type RunCapacity, type ShellOptions, type ShResult } from "../run/git.js";
 import type { GateResult } from "./types.js";
@@ -31,8 +31,21 @@ export interface GateEvidenceOptions {
     write?: (path: string, bytes: Buffer) => void;
 }
 export declare const EVIDENCE_TAIL_BYTES: number;
+/** The default per-run quota; `gates.evidenceQuotaBytes` in config overrides it (OBS-1140). */
 export declare const EVIDENCE_RUN_QUOTA_BYTES: number;
+export type RedactionCounts = NonNullable<GateEvidenceReceipt["redaction"]["counts"]>;
+/**
+ * OBS-1139: every category scans the ORIGINAL text on its own; overlapping spans then merge into one
+ * span counted once under its highest-priority member — token, assignment, secret environment, benign
+ * HOME/TMPDIR — so precedence never depends on which match starts first. Counts only: never a value.
+ */
+export declare function classifyGateOutput(text: string, env: NodeJS.ProcessEnv): {
+    text: string;
+    counts: RedactionCounts;
+};
 export declare function redactGateOutput(text: string, env: NodeJS.ProcessEnv): string;
+/** Material means bytes were withheld; a benign location substitution withholds nothing. */
+export declare const redactionMaterial: (c: RedactionCounts) => boolean;
 /** Resolve a snapshot reference against actual bytes: eviction never fabricates a live artifact. */
 export declare function resolveEvidenceArtifact(root: string, ref: EvidenceArtifact): EvidenceArtifact;
 export declare function beginGateEvidence(cwd: string, gate: string, command: string, opts?: GateEvidenceOptions, nonce?: string): {
@@ -55,6 +68,12 @@ export declare function beginGateEvidence(cwd: string, gate: string, command: st
         availability: "available" | "not-started" | "capture-failed" | "killed" | "expired" | "missing";
         redaction: {
             material: boolean;
+            counts?: {
+                token: number;
+                assignment: number;
+                secretEnv: number;
+                benignEnv: number;
+            } | undefined;
         };
         stdout: {
             path: string;

package/dist/gates/baseline.js

@@ -1,25 +1,81 @@
 import { createHash, randomUUID } from "node:crypto";
 import { execFileSync } from "node:child_process";
-import { existsSync, readFileSync, mkdirSync, readdirSync, statSync, unlinkSync, writeFileSync, rmdirSync } from "node:fs";
+import { EVICTION_TOMBSTONE_LIMIT, EVICTION_TOMBSTONES_FILE, parseEvictionTombstones } from "../run/receipt-resolver.js";
+import { existsSync, readFileSync, mkdirSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync, rmdirSync } from "node:fs";
 import { availableParallelism, loadavg, tmpdir } from "node:os";
-import { join } from "node:path";
+import { basename, join } from "node:path";
+import { DEFAULT_EVIDENCE_QUOTA_BYTES } from "../config/config.js";
 import { dependencyLinkRefusal, DEFAULT_SHELL_TIMEOUT_MS, describeCapacity, sameCapacity, sh } from "../run/git.js";
 import { executionSignal } from "../run/execution-budget.js";
 import { isVitestTestCommand, manifestFileCount } from "./test-manifest.js";
 export const EVIDENCE_TAIL_BYTES = 16 * 1024;
-export const EVIDENCE_RUN_QUOTA_BYTES = 8 * 1024 * 1024;
-export function redactGateOutput(text, env) {
-    // One pass over the original bytes: replacing an environment value must not break a token
-    // recognizer, and a short environment value must not rewrite the redaction marker itself.
+/** The default per-run quota; `gates.evidenceQuotaBytes` in config overrides it (OBS-1140). */
+export const EVIDENCE_RUN_QUOTA_BYTES = DEFAULT_EVIDENCE_QUOTA_BYTES;
+/** Benign environment locations substituted by name; every other redaction is material. */
+const BENIGN_ENV_KEYS = ["HOME", "TMPDIR"];
+const REDACTION_CATEGORIES = ["token", "assignment", "secretEnv", "benignEnv"];
+/**
+ * OBS-1139: every category scans the ORIGINAL text on its own; overlapping spans then merge into one
+ * span counted once under its highest-priority member — token, assignment, secret environment, benign
+ * HOME/TMPDIR — so precedence never depends on which match starts first. Counts only: never a value.
+ */
+export function classifyGateOutput(text, env) {
+    // HOME/TMPDIR substitute by name at any length; "/" alone would rewrite every path separator.
+    const benign = BENIGN_ENV_KEYS.flatMap(key => { const value = env[key]; return value && value.length > 1 ? [{ value, label: `$${key}` }] : []; });
     // Short operational values (0, true, vi, test) occur throughout ordinary diagnostics.
-    // Only secret-named keys justify redacting short values.
-    const values = [...new Set(Object.entries(env)
-            .filter(([key, value]) => !!value && (value.length >= 8 || /KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|AUTH/i.test(key)))
-            .map(([, value]) => value))]
-        .sort((a, b) => b.length - a.length).map(v => v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+    // Only secret-named keys justify redacting short values. A secret-named value that happens to equal
+    // HOME/TMPDIR stays a secret candidate: precedence decides the span, never candidate pruning.
+    const secrets = [...new Set(Object.entries(env)
+            .filter(([key, value]) => !!value && !BENIGN_ENV_KEYS.includes(key)
+            && (value.length >= 8 || /KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|AUTH/i.test(key)))
+            .map(([, value]) => value))];
+    const literal = (v) => v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     const tokens = String.raw `\b(?:sk-[A-Za-z0-9_-]{12,}|gh[pousr]_[A-Za-z0-9_]{16,}|github_pat_[A-Za-z0-9_]{16,}|AKIA[A-Z0-9]{16}|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)\b`;
     const assignments = String.raw `(?:authorization\s*:\s*bearer|(?:api[_-]?key|token|password|secret)\s*[:=])\s*[^\s"']+`;
-    return text.replace(new RegExp([tokens, assignments, ...values].join("|"), "gi"), "[REDACTED]");
+    // Every value scans the original text on its own: an alternation would consume the first match and
+    // skip a longer overlapping value's tail, so precedence is resolved on the collected spans instead.
+    const scan = (source, rank, label) => [...text.matchAll(new RegExp(source, "gi"))].map(m => ({ start: m.index, end: m.index + m[0].length, rank, label }));
+    const spans = [
+        ...scan(tokens, 0), ...scan(assignments, 1),
+        ...secrets.flatMap(v => scan(literal(v), 2)),
+        ...benign.flatMap(b => scan(literal(b.value), 3, b.label)),
+    ].sort((a, b) => a.start - b.start || b.end - a.end);
+    const merged = [];
+    for (const span of spans) {
+        const last = merged.at(-1);
+        if (!last || span.start >= last.end) {
+            merged.push({ ...span });
+            continue;
+        }
+        // C-11 (D-673): a benign value nested in (or identical to) another is one location, named by the containing
+        // span, which sorts first. Only a PARTIAL overlap of two different benign values is ambiguous: withhold it.
+        if (last.rank === 3 && span.rank === 3 && last.label !== span.label && span.end > last.end)
+            last.rank = 2;
+        else
+            last.rank = Math.min(last.rank, span.rank);
+        last.end = Math.max(last.end, span.end);
+    }
+    const counts = { token: 0, assignment: 0, secretEnv: 0, benignEnv: 0 };
+    let out = "", at = 0;
+    for (const { start, end, rank, label } of merged) {
+        counts[REDACTION_CATEGORIES[rank]]++;
+        out += text.slice(at, start) + (rank === 3 ? label : "[REDACTED]");
+        at = end;
+    }
+    return { text: out + text.slice(at), counts };
+}
+export function redactGateOutput(text, env) {
+    return classifyGateOutput(text, env).text;
+}
+/** Material means bytes were withheld; a benign location substitution withholds nothing. */
+export const redactionMaterial = (c) => c.token + c.assignment + c.secretEnv > 0;
+function readEvictionTombstones(root) {
+    try {
+        return parseEvictionTombstones(readFileSync(join(root, EVICTION_TOMBSTONES_FILE)));
+    }
+    catch {
+        return [];
+    }
 }
 /** Resolve a snapshot reference against actual bytes: eviction never fabricates a live artifact. */
 export function resolveEvidenceArtifact(root, ref) {
@@ -75,7 +131,12 @@ export function beginGateEvidence(cwd, gate, command, opts = {}, nonce) {
                 exitCode: observed?.exitCode ?? null, signal: observed?.signal ?? null,
                 timedOut: observed ? observed.outcome === "timed-out" : null,
             };
-            const clean = [redactGateOutput(stdout, env), redactGateOutput(stderr, env)];
+            const classified = [classifyGateOutput(stdout, env), classifyGateOutput(stderr, env)];
+            const clean = classified.map(c => c.text);
+            const counts = { token: 0, assignment: 0, secretEnv: 0, benignEnv: 0 };
+            for (const c of classified)
+                for (const k of Object.keys(counts))
+                    counts[k] += c.counts[k];
             const refs = clean.map((text, i) => {
                 const bytes = Buffer.from(text);
                 const tail = bytes.subarray(-EVIDENCE_TAIL_BYTES);
@@ -94,19 +155,38 @@ export function beginGateEvidence(cwd, gate, command, opts = {}, nonce) {
                     lock = join(dir, ".write-lock");
                     const quota = opts.quotaBytes !== undefined && Number.isFinite(opts.quotaBytes)
                         ? Math.max(0, Math.floor(opts.quotaBytes)) : EVIDENCE_RUN_QUOTA_BYTES;
+                    // An empty artifact costs no quota, so it is never evicted: every eviction frees bytes.
                     const files = readdirSync(dir).filter(f => /^[a-zA-Z0-9-]+-(stdout|stderr)\.log$/.test(f)).map(f => ({ path: join(dir, f), stat: statSync(join(dir, f)) }))
-                        .sort((a, b) => a.stat.mtimeMs - b.stat.mtimeMs || a.path.localeCompare(b.path));
+                        .filter(f => f.stat.size > 0).sort((a, b) => a.stat.mtimeMs - b.stat.mtimeMs || a.path.localeCompare(b.path));
                     let total = files.reduce((sum, f) => sum + f.stat.size, 0);
                     const incoming = refs.reduce((sum, ref) => sum + ref.retainedBytes, 0);
-                    if (incoming > quota)
-                        throw new Error("evidence quota cannot retain this invocation");
-                    while (files.length && total + incoming > quota) {
+                    // OBS-1140: the quota binds what is already retained too, so a resumed run at zero quota keeps
+                    // zero bytes. An invocation larger than the whole quota is expired at birth; older artifacts
+                    // are evicted only as far as the quota itself demands, never for bytes that could not fit.
+                    const fits = incoming <= quota;
+                    const evicted = [];
+                    while (files.length && total + (fits ? incoming : 0) > quota) {
                         const oldest = files.shift();
+                        const bytes = readFileSync(oldest.path);
                         unlinkSync(oldest.path);
                         total -= oldest.stat.size;
+                        evicted.push({ path: `gate-evidence/${basename(oldest.path)}`, sha256: createHash("sha256").update(bytes).digest("hex"), retainedBytes: bytes.length });
+                    }
+                    if (evicted.length) {
+                        // Identity-bound (path + hash + length) and bounded: the newest 256 survive a restart.
+                        const tombstones = join(root, EVICTION_TOMBSTONES_FILE);
+                        writeFileSync(`${tombstones}.tmp`, JSON.stringify([...readEvictionTombstones(root), ...evicted].slice(-EVICTION_TOMBSTONE_LIMIT)));
+                        renameSync(`${tombstones}.tmp`, tombstones);
                     }
-                    for (const [i, ref] of refs.entries()) {
-                        (opts.write ?? writeFileSync)(join(root, ref.path), Buffer.from(clean[i]).subarray(-EVIDENCE_TAIL_BYTES));
+                    if (!fits) {
+                        availability = "expired";
+                        for (const ref of refs)
+                            ref.availability = "expired";
+                    }
+                    else {
+                        for (const [i, ref] of refs.entries()) {
+                            (opts.write ?? writeFileSync)(join(root, ref.path), Buffer.from(clean[i]).subarray(-EVIDENCE_TAIL_BYTES));
+                        }
                     }
                 }
                 catch {
@@ -131,7 +211,7 @@ export function beginGateEvidence(cwd, gate, command, opts = {}, nonce) {
             }
             return { invocationId, ...(nonce ? { nonce } : {}),
                 subject: { runId: opts.runId ?? "standalone", taskId: opts.taskId ?? null, attempt: opts.attempt ?? null, gate, subjectCommit },
-                termination, availability, redaction: { material: clean[0] !== stdout || clean[1] !== stderr }, stdout: refs[0], stderr: refs[1] };
+                termination, availability, redaction: { material: redactionMaterial(counts), counts }, stdout: refs[0], stderr: refs[1] };
         },
     };
 }

package/dist/gates/cache.d.ts

@@ -9,8 +9,15 @@ export declare function lockfileHash(worktree: string): string;
 export declare function canonicalJson(obj: unknown): string;
 export declare function baselineIdentity(baseline?: Baseline): string;
 export declare function getWorktreeTree(worktree: string): Promise<string>;
+/** OBS-635: environment inputs a runner child reads that capacity and lifecycle do not already bind.
+ * ponytail: a named list, not the whole env (pids and terminal vars would defeat every reuse); extend
+ * it when another variable is shown to change what a runner executes. */
+export declare const RUNNER_ENV_KEYS: readonly ["PATH", "NODE_OPTIONS", "NODE_PATH", "NODE_ENV", "TZ"];
+export declare function runnerInputsHash(env?: NodeJS.ProcessEnv): string;
 export interface GateEnvironmentInput {
     nodeRuntime?: string;
+    /** the runner inputs hash; defaults to this process's (runnerInputsHash) */
+    runner?: string;
     lockfile?: string;
     worktree?: string;
     capacity?: RunCapacity;
@@ -21,6 +28,7 @@ export interface GateEnvironmentInput {
 }
 export interface EnvironmentParts {
     nodeRuntime: string;
+    runner: string;
     lockfile: string;
     capacity: RunCapacity;
     selectedSet?: readonly string[];

package/dist/gates/cache.js

@@ -77,8 +77,17 @@ export async function getWorktreeTree(worktree) {
         rmSync(scratch, { recursive: true, force: true });
     }
 }
+/** OBS-635: environment inputs a runner child reads that capacity and lifecycle do not already bind.
+ * ponytail: a named list, not the whole env (pids and terminal vars would defeat every reuse); extend
+ * it when another variable is shown to change what a runner executes. */
+export const RUNNER_ENV_KEYS = ["PATH", "NODE_OPTIONS", "NODE_PATH", "NODE_ENV", "TZ"];
+export function runnerInputsHash(env = process.env) {
+    return createHash("sha256").update(canonicalJson(Object.fromEntries(RUNNER_ENV_KEYS.map((k) => [k, env[k] ?? null]))))
+        .digest("hex").slice(0, 16);
+}
 export function environmentFingerprint(env) {
     const nodeRuntime = env.nodeRuntime ?? process.version;
+    const runner = env.runner ?? runnerInputsHash();
     const lockfile = env.lockfile ?? (env.worktree ? lockfileHash(env.worktree) : "no-lockfile");
     const cap = env.capacity ?? resolvedCapacity();
     const capacity = { forkCap: cap.forkCap, cores: cap.cores };
@@ -97,6 +106,7 @@ export function environmentFingerprint(env) {
     // explicit `false` and an npmrc `false` are the same policy for the child that ran.
     const payload = canonicalJson({
         nodeRuntime,
+        runner,
         lockfile,
         capacity,
         resolution,
@@ -107,7 +117,7 @@ export function environmentFingerprint(env) {
     const fingerprint = createHash("sha256").update(payload).digest("hex").slice(0, 16);
     return {
         fingerprint,
-        parts: { nodeRuntime, lockfile, capacity, selectedSet, verification },
+        parts: { nodeRuntime, runner, lockfile, capacity, selectedSet, verification },
     };
 }
 export async function computeVerificationIdentity(params) {
@@ -151,7 +161,7 @@ export function verificationIdentityKey(id) {
 export function formatReusedDetails(originalDetails, id) {
     const unadorned = originalDetails.replace(/^reused verdict \(identity: [^)]+\):\s*/, "");
     const envDesc = id.envParts
-        ? ` [node=${id.envParts.nodeRuntime}, lockfile=${id.envParts.lockfile}, capacity=${describeCapacity(id.envParts.capacity)}${id.envParts.selectedSet ? `, selected=${id.envParts.selectedSet.join(",")}` : ""}, protocol=${id.envParts.verification.protocol}, lifecycle=${id.envParts.verification.lifecycle} (${id.envParts.verification.source})]`
+        ? ` [node=${id.envParts.nodeRuntime}, runner=${id.envParts.runner}, lockfile=${id.envParts.lockfile}, capacity=${describeCapacity(id.envParts.capacity)}${id.envParts.selectedSet ? `, selected=${id.envParts.selectedSet.join(",")}` : ""}, protocol=${id.envParts.verification.protocol}, lifecycle=${id.envParts.verification.lifecycle} (${id.envParts.verification.source})]`
         : "";
     const gate = id.gate ?? "gate";
     const prefix = `reused ${id.scope === "tip" ? "tip " : ""}verdict (identity: gate=${gate} tree=${id.tree}${id.worktree ? ` worktree=${id.worktree}` : ""} command=${id.command} baseline=${id.baseline} env=${id.environment}${envDesc})`;

package/dist/gates/llm.d.ts

@@ -69,6 +69,12 @@ export interface LlmRunResult {
 }
 export declare const PROMPT_GLYPHS: readonly ["➜", "❯", "$", "%", ">>", ">"];
 export declare function reviewSeatOutput(raw: string, nonce: string, adapterBannerRows?: readonly string[]): string;
+/** OBS-1168(b): a judge/review seat whose pane could not be created or launched. Typed so the gates can
+ * contain it as seat recovery (another seat) or an infra park — never as a worker failure. */
+export declare class SeatLaunchError extends Error {
+    readonly seat: string;
+    constructor(seat: string, cause: unknown);
+}
 export declare const REVIEW_FIRST_LIVENESS_MS = 30000;
 export declare const REVIEW_SILENT_BYTE_FLOOR = 64;
 export declare function runHeadless(adapter: WorkerAdapter, model: string, prompt: string, cwd: string, timeoutMs?: number, effort?: Effort): Promise<string>;