tickmarkr 2.6.3 → 2.6.5

package/dist/drivers/orca.js

@@ -76,6 +76,7 @@ export class OrcaError extends Error {
     raw;
     code;
     runtimeId;
+    launchCause;
     constructor(family, reason, raw, opts = {}) {
         super(`orca ${family} failed — ${reason}; raw response:\n${raw}`);
         this.family = family;
@@ -84,14 +85,15 @@ export class OrcaError extends Error {
         this.name = "OrcaError";
         this.code = opts.code;
         this.runtimeId = opts.runtimeId;
+        this.launchCause = opts.launchCause;
     }
 }
 /** The slot cannot be addressed: dead/unknown terminal record, or a handle that cannot be recovered
  *  to exactly one owned terminal in the slot's own worktree. Never a silent false or empty string. */
 export class OrcaUnavailableError extends OrcaError {
     terminalStatus;
-    constructor(family, reason, raw, terminalStatus) {
-        super(family, reason, raw, { code: "terminal_unavailable" });
+    constructor(family, reason, raw, terminalStatus, launchCause) {
+        super(family, reason, raw, { code: "terminal_unavailable", launchCause });
         this.terminalStatus = terminalStatus;
         this.name = "OrcaUnavailableError";
     }
@@ -209,7 +211,26 @@ export const CHECKOUT_MARK = "TICKMARKR_CHECKOUT";
 // never decode to this one; `A` versus `A B`, `…--T1` versus `…--T10` are different frames.
 const CHECKOUT_FRAME_RE = /TICKMARKR_CHECKOUT (\d+):([0-9a-f]*)(;?)/g;
 const PROOF_PAGES = 16; // pages read from the oldest cursor before the proof is declared absent
-const CHECKOUT_PROOF_TIMEOUT_MS = 2_000; // allow the wrapper shell to emit its startup proof
+// E1: the ceiling for the wrapper shell's startup proof. A loaded host can print a review seat's proof
+// long after the old 2 s window closed (the window a healthy seat was retired on); a proof first
+// arriving at 10 s is accepted, and 20 s still bounds a terminal that never proves anything.
+const CHECKOUT_PROOF_TIMEOUT_MS = 20_000;
+// E1: the printed mark's first bytes past the printf split. The typed command never carries them (the
+// mark is split at its underscore; exit trailers type `TICKMARKR_''EXIT`) and no other tickmarkr name
+// starts `TICKMARKR_C`, so any occurrence is proof bytes — whole, cut or with a header the frame
+// grammar cannot parse — and never an absent proof.
+const MARK_TRACE = CHECKOUT_MARK.slice(0, CHECKOUT_MARK.indexOf("_") + 2);
+/** E1: placement evidence in text actually read — a complete frame naming another checkout, a cut
+ *  frame, or a mark the frame grammar cannot parse (more mark traces than frames). It denies the
+ *  timeout exemption: only a terminal that printed no mark at all was merely slow.
+ *  ponytail: a wrapped frame split across the last page read (the ceiling or PROOF_PAGES stopped
+ *  paging) reads as cut — conservative (no exemption); it needs the proof line on that boundary. */
+function misplacedProof(text, checkout) {
+    const { complete, incomplete } = checkoutFrames(text);
+    const joined = joinWrapped(text);
+    return incomplete || complete.some((c) => c !== checkout)
+        || joined.split(MARK_TRACE).length - 1 > [...joined.matchAll(CHECKOUT_FRAME_RE)].length;
+}
 /** The exact bytes the create command prints as its first line. */
 export function checkoutProofLine(checkout) {
     const bytes = Buffer.from(checkout, "utf8");
@@ -752,9 +773,9 @@ export class OrcaDriver {
             throw new OrcaError("show", `unknown slot ${slot.id}`, "");
         return s;
     }
-    latched(family, st, reason, raw) {
+    latched(family, st, reason, raw, launchCause) {
         st.unavailable = reason;
-        return new OrcaUnavailableError(family, reason, raw);
+        return new OrcaUnavailableError(family, reason, raw, undefined, launchCause);
     }
     assertAvailable(family, st) {
         if (st.unavailable)
@@ -836,20 +857,39 @@ export class OrcaDriver {
             catch { /* already gone, or no longer provably ours — never a blind retry */ }
             throw this.latched("create", st, `create receipt bound to ${worktree ?? "no worktree"}, not the tracked ${tracked} enclosing ${st.cwd}`, env.raw);
         }
-        // A receipt only proves placement on the enclosing tracked checkout. Wait briefly for the
-        // startup command's proof before run() can resolve and the daemon can count a worker launch.
+        // A receipt only proves placement on the enclosing tracked checkout. Wait, up to the ceiling, for
+        // the startup command's proof before run() can resolve and the daemon can count a worker launch.
+        // Polls and reads are bounded by what is left of it, and proof read past it proves nothing.
+        // One absolute deadline, rechecked after every sleep: no read starts once it has passed.
         const deadline = this.time.now() + CHECKOUT_PROOF_TIMEOUT_MS;
-        let proof = await this.checkoutProven(handle, st.cwd, this.cliCwd(st), env.runtimeId);
-        while (!proof.proven && this.time.now() < deadline) {
-            await this.time.sleep(POLL_MS);
-            proof = await this.checkoutProven(handle, st.cwd, this.cliCwd(st), env.runtimeId);
+        // Evidence is kept across polls and never downgraded: once a poll read a misplaced mark or left
+        // output unread, no later poll — absent, cut or otherwise — turns the window back into absence.
+        let misplaced, unread;
+        let proof = await this.checkoutProven(handle, st.cwd, this.cliCwd(st), env.runtimeId, deadline);
+        for (;;) {
+            if (proof.proven)
+                break;
+            if (proof.seen === "misplaced")
+                misplaced = proof;
+            else if (proof.seen === "unread")
+                unread = proof;
+            const left = deadline - this.time.now();
+            if (left <= 0)
+                break;
+            await this.time.sleep(Math.min(POLL_MS, left));
+            if (this.time.now() >= deadline)
+                break;
+            proof = await this.checkoutProven(handle, st.cwd, this.cliCwd(st), env.runtimeId, deadline);
         }
         if (!proof.proven) {
             try {
                 await this.closeTerminal({ ...st, handle, runtimeId: env.runtimeId });
             }
             catch { /* best effort under the answering runtime; the latch prevents another launch */ }
-            throw this.latched("create", st, `terminal ${handle} does not prove checkout ${st.cwd} (${proof.reason})`, env.raw);
+            // The typed timeout only when EVERY poll read its whole scrollback inside the ceiling and found no
+            // trace of the mark; one misplaced or unread poll anywhere in the window denies it.
+            const evidence = misplaced ?? unread ?? proof;
+            throw this.latched("create", st, `terminal ${handle} does not prove checkout ${st.cwd} within ${CHECKOUT_PROOF_TIMEOUT_MS} ms (${evidence.reason})`, env.raw, evidence.seen === "absent" ? "checkout-proof-timeout" : undefined);
         }
         st.handle = handle;
         // The handle is bound to the runtime identity that ANSWERED its create.
@@ -972,12 +1012,38 @@ export class OrcaDriver {
      * that supplied the ownership listing — else another terminal's or another runtime's bytes were
      * answered and nothing is proven. Proven means provesCheckout: exact canonical full-path equality
      * of a complete frame, no other checkout named, no incomplete frame.
+     * E1: with a `deadline` (create's window) there is ONE absolute deadline: a read is issued only while
+     * budget is left and is handed exactly that budget, and a page that still lands past it is late —
+     * nothing late proves the checkout. `seen` is what the scrollback showed, for the typed timeout:
+     * `misplaced` — a frame naming another checkout, a cut frame or an unparseable mark in anything read
+     * (the anchor's tail and every page included, even when paging stopped or a later read threw);
+     * `absent` — ONLY when every page down to the start of the scrollback was read before the ceiling
+     * and none carries a trace of the mark; `unread` — every other exit: PROOF_PAGES reached, a limited
+     * read with no (or the same) next cursor or a truncated anchor without one, a read that threw, a read
+     * the ceiling cut off or never let start (the anchor included), or a page that landed late (even one
+     * carrying the right proof), a malformed page (its tail, cursors or paging flags), or a blind stream
+     * page (isBlindStreamPage). Unread output is unknown — never an empty page, never absence.
+     * Without a deadline (reconcile, recovery) only `proven` is consumed.
      */
-    async checkoutProven(handle, checkout, from, runtimeId) {
+    async checkoutProven(handle, checkout, from, runtimeId, deadline) {
+        let late = false;
         const page = async (cursor) => {
-            const env = await this.call("read", [
-                "terminal", "read", "--terminal", handle, ...(cursor === undefined ? [] : ["--cursor", cursor]), "--limit", String(this.pageLines),
-            ], from);
+            const budget = deadline === undefined ? undefined : deadline - this.time.now();
+            if (budget !== undefined && budget <= 0)
+                return undefined; // no budget left: the read is never issued
+            let env;
+            try {
+                env = await this.call("read", [
+                    "terminal", "read", "--terminal", handle, ...(cursor === undefined ? [] : ["--cursor", cursor]), "--limit", String(this.pageLines),
+                ], from, budget);
+            }
+            catch (error) {
+                if (deadline === undefined || this.time.now() < deadline)
+                    throw error;
+                return undefined; // the read the ceiling cut off: unread
+            }
+            if (deadline !== undefined && this.time.now() > deadline)
+                late = true;
             if (env.runtimeId !== runtimeId) {
                 throw new OrcaError("read", `proof page answered by runtime ${env.runtimeId}, not the listing's ${runtimeId}`, env.raw);
             }
@@ -985,39 +1051,103 @@ export class OrcaDriver {
             if (str(term.handle) !== handle) {
                 throw new OrcaError("read", `proof page names terminal ${str(term.handle) ?? "none"}, not the candidate ${handle}`, env.raw);
             }
-            return term;
+            // E1: only a well-formed page is read text. A tail that is missing, not an array or carries a
+            // non-string row (tailText), a cursor that is not a non-empty string, or a paging flag that is not
+            // a boolean is a malformed page: it throws, so it is unread output — never filtered to an empty
+            // page that would read as an absent proof.
+            for (const key of ["oldestCursor", "nextCursor"]) {
+                if (term[key] !== undefined && str(term[key]) === undefined)
+                    throw new OrcaError("read", `proof page ${key} is not a cursor`, env.raw);
+            }
+            for (const key of ["limited", "truncated"]) {
+                if (term[key] !== undefined && typeof term[key] !== "boolean")
+                    throw new OrcaError("read", `proof page ${key} is not a boolean`, env.raw);
+            }
+            // E1: the OBS-1011 add.1 blind stream (exited, empty tail, zero lines returned) is the shape a
+            // live terminal's stream answers while its screen still paints — and a dead terminal's too. The
+            // stream alone cannot tell them apart, so its empty tail is unread scrollback, never absence.
+            if (isBlindStreamPage(term))
+                throw new OrcaError("read", "proof page is a blind stream page (status exited, empty tail): its scrollback is unread", env.raw);
+            return { term, text: this.tailText("read", term, env.raw) };
+        };
+        // Every validated read is evidence, whatever stops the next one: the anchor's tail and the pages
+        // read from the oldest cursor are inspected even when paging hits PROOF_PAGES or a read throws.
+        let tail = "", text = "";
+        const described = (why) => {
+            const misplaced = checkout !== undefined && [text, tail].some((t) => misplacedProof(t, checkout));
+            const shown = [text, tail].map(checkoutFrames);
+            const named = [...new Set(shown.flatMap((f) => f.complete))];
+            const flaw = shown.some((f) => f.incomplete) ? " and carries an incomplete proof frame"
+                : misplaced && named.length === 0 ? " and carries a malformed proof marker" : "";
+            return {
+                proven: false,
+                reason: `${why}its scrollback ${named.length ? `names ${named.join(", ")}` : "names no checkout"}${flaw}`,
+                ...(misplaced ? { seen: "misplaced" } : {}),
+            };
         };
-        const lines = (term) => Array.isArray(term.tail) ? term.tail.filter((l) => typeof l === "string") : [];
         try {
-            const anchor = await page();
+            const first = await page();
+            if (first === undefined)
+                return { proven: false, reason: "the ceiling cut off the proof read before any scrollback was read", seen: "unread" };
+            const anchor = first.term;
+            tail = first.text;
             let cursor = str(anchor.oldestCursor);
-            let text = cursor === undefined ? lines(anchor).join("\n") : "";
-            for (let n = 0; cursor !== undefined && n < PROOF_PAGES; n++) {
-                const term = await page(cursor);
-                text += `${lines(term).join("\n")}\n`;
+            // why paging ended with scrollback still unread. Every exit is one of: complete (an anchor that
+            // is the whole scrollback, or a page that is not limited), whole frames found, or one of these.
+            let stop;
+            if (cursor === undefined) {
+                text = tail;
+                // A cursorless anchor that says it holds less than the scrollback leaves the rest unreadable.
+                if (anchor.truncated === true || anchor.limited === true)
+                    stop = "stalled";
+            }
+            for (let n = 0; cursor !== undefined; n++) {
+                if (n === PROOF_PAGES) {
+                    stop = "exhausted";
+                    break;
+                } // more scrollback than the bound: unread, not absent
+                const got = late ? undefined : await page(cursor);
+                if (got === undefined) {
+                    stop = "cut";
+                    break;
+                }
+                const term = got.term;
+                text += `${got.text}\n`;
                 const frames = checkoutFrames(text);
                 if (frames.complete.length > 0 && !frames.incomplete)
                     break; // whole frames, nothing dangling
+                if (term.limited !== true)
+                    break; // the last page: the scrollback was read to its end
                 const next = str(term.nextCursor);
-                if (term.limited !== true || next === undefined || next === cursor)
+                // A limited page with no next cursor, or the same one, says more scrollback exists that no
+                // read can reach: unread, never absent.
+                if (next === undefined || next === cursor) {
+                    stop = "stalled";
                     break;
+                }
                 cursor = next;
             }
             const frames = checkoutFrames(text);
             // Reconcile has no task-checkout path after a daemon restart, but the proof itself remains
             // an ownership record: exactly one complete, unambiguous checkout frame can only have been
             // written by tickmarkr's create command.  Slot recovery additionally requires its exact path.
-            if (checkout === undefined
+            // A stalled read proves only what it read, as before; a cut or exhausted one proves nothing.
+            const proven = stop !== "cut" && stop !== "exhausted" && (checkout === undefined
                 ? !frames.incomplete && frames.complete.length > 0 && new Set(frames.complete).size === 1
-                : provesCheckout(text, checkout))
+                : provesCheckout(text, checkout));
+            if (proven && !late)
                 return { proven: true, reason: "" };
-            return {
-                proven: false,
-                reason: `its scrollback ${frames.complete.length ? `names ${[...new Set(frames.complete)].join(", ")}` : "names no checkout"}${frames.incomplete ? " and carries an incomplete proof frame" : ""}`,
-            };
+            const why = `${late ? "read past the ceiling, " : ""}${stop === "cut" ? "the ceiling cut off paging, "
+                : stop === "exhausted" ? `paging stopped at ${PROOF_PAGES} pages with scrollback unread, `
+                    : stop === "stalled" ? "a limited read gave no next cursor with scrollback unread, " : ""}`;
+            const read = described(why);
+            return { ...read, seen: read.seen ?? (stop || late ? "unread" : "absent") };
         }
         catch (error) {
-            return { proven: false, reason: error instanceof Error ? error.message : String(error) };
+            // A read that failed midway keeps what was already read as evidence; what it could not read is
+            // unread output — never an absent proof.
+            const read = described(""), failed = error instanceof Error ? error.message : String(error);
+            return { ...read, reason: tail || text ? `${read.reason}; then a read failed — ${failed}` : failed, seen: read.seen ?? "unread" };
         }
     }
     async recover(family, st, newRuntimeId, raw, opts) {

package/dist/gates/cache.d.ts

@@ -13,6 +13,10 @@ export declare function getWorktreeTree(worktree: string): Promise<string>;
  * ponytail: a named list, not the whole env (pids and terminal vars would defeat every reuse); extend
  * it when another variable is shown to change what a runner executes. */
 export declare const RUNNER_ENV_KEYS: readonly ["PATH", "NODE_OPTIONS", "NODE_PATH", "NODE_ENV", "TZ"];
+/** A2: NODE_OPTIONS is hashed as the child RECEIVES it (shell appends the Darwin title preload), plus the
+ * preload's content identity, so a replaced preload, the opt-out or a refused preflight never reuses a
+ * verdict or baseline measured under another mode. Native mode hashes the pre-A2 inputs less any inherited
+ * managed preload, which shell removes from that child too. */
 export declare function runnerInputsHash(env?: NodeJS.ProcessEnv): string;
 export interface GateEnvironmentInput {
     nodeRuntime?: string;

package/dist/gates/cache.js

@@ -5,6 +5,7 @@ import { dirname, join, relative, resolve } from "node:path";
 import { tmpdir } from "node:os";
 import { checkoutIncarnation, describeCapacity, inventoryDependencyLinks, resolvedCapacity, shGit, verificationProtocol } from "../run/git.js";
 import { shq } from "../adapters/types.js";
+import { titleEnvironment } from "../run/title-environment.js";
 export const DEFAULT_VERDICT_CACHE_BOUND = 128;
 let testCacheBound;
 export function setVerdictCacheBoundForTests(bound) {
@@ -81,9 +82,16 @@ export async function getWorktreeTree(worktree) {
  * ponytail: a named list, not the whole env (pids and terminal vars would defeat every reuse); extend
  * it when another variable is shown to change what a runner executes. */
 export const RUNNER_ENV_KEYS = ["PATH", "NODE_OPTIONS", "NODE_PATH", "NODE_ENV", "TZ"];
+/** A2: NODE_OPTIONS is hashed as the child RECEIVES it (shell appends the Darwin title preload), plus the
+ * preload's content identity, so a replaced preload, the opt-out or a refused preflight never reuses a
+ * verdict or baseline measured under another mode. Native mode hashes the pre-A2 inputs less any inherited
+ * managed preload, which shell removes from that child too. */
 export function runnerInputsHash(env = process.env) {
-    return createHash("sha256").update(canonicalJson(Object.fromEntries(RUNNER_ENV_KEYS.map((k) => [k, env[k] ?? null]))))
-        .digest("hex").slice(0, 16);
+    const title = titleEnvironment(env);
+    const inputs = Object.fromEntries(RUNNER_ENV_KEYS.map((k) => [k, (k === "NODE_OPTIONS" ? title.nodeOptions : env[k]) ?? null]));
+    if (title.mode === "preload")
+        inputs.titlePreload = title.identity;
+    return createHash("sha256").update(canonicalJson(inputs)).digest("hex").slice(0, 16);
 }
 export function environmentFingerprint(env) {
     const nodeRuntime = env.nodeRuntime ?? process.version;

package/dist/gates/llm.d.ts

@@ -1,6 +1,7 @@
 import { type WorkerAdapter } from "../adapters/types.js";
 import type { Effort } from "../graph/schema.js";
 import { type ExecutorDriver, type Slot } from "../drivers/types.js";
+import type { SeatLaunchCause } from "../drivers/orca.js";
 export declare const GATE_PANE_SEP = " \u00B7 ";
 export declare const COMPLETION_FAKING_CHECKLIST = "## Completion-faking checklist\nHunt for these concrete completion-faking shortcuts before ruling on any criterion:\n- hardcoded-result: output or fixture hardcoded to satisfy the stated criterion instead of real logic\n- test-weakening: tests skipped, deleted, or assertions loosened until failing behavior looks green\n- vacuous-assertion: a test that cannot fail (asserts a constant, asserts its own setup, no assertion)\n- fixture-overfit: implementation narrowed to the exact test inputs rather than the described behavior\n- echo-not-implement: criterion text echoed in names, comments, or strings without the behavior itself\n- stub-left-behind: TODO, throw, or no-op stub where the real implementation should be\n- error-swallowing: catch or fallback that hides failures instead of handling them\n- self-mocking: the code under test mocked or faked so the test exercises the mock\n- check-bypass: lint, type, or CI checks disabled, relaxed, or excluded to get green\n- rename-as-work: code moved or renamed and presented as the requested change\n- scope-padding: unrelated edits padding the diff while the criterion's behavior is untouched\nWhen a criterion fails, the verdict MUST name which shortcut above it matches, or state that none does.";
 /** Fable F3: per-call nonce echoed in verdict JSON and gate exit markers. */
@@ -70,9 +71,11 @@ export interface LlmRunResult {
 export declare const PROMPT_GLYPHS: readonly ["➜", "❯", "$", "%", ">>", ">"];
 export declare function reviewSeatOutput(raw: string, nonce: string, adapterBannerRows?: readonly string[]): string;
 /** OBS-1168(b): a judge/review seat whose pane could not be created or launched. Typed so the gates can
- * contain it as seat recovery (another seat) or an infra park — never as a worker failure. */
+ * contain it as seat recovery (another seat) or an infra park — never as a worker failure. E1: the
+ * driver's typed launch cause survives the wrap as a field; the message alone is prose. */
 export declare class SeatLaunchError extends Error {
     readonly seat: string;
+    readonly launchCause?: SeatLaunchCause;
     constructor(seat: string, cause: unknown);
 }
 export declare const REVIEW_FIRST_LIVENESS_MS = 30000;

package/dist/gates/llm.js

@@ -303,13 +303,18 @@ export function reviewSeatOutput(raw, nonce, adapterBannerRows = []) {
     return trailer ? seat.slice(0, trailer.index) : seat;
 }
 /** OBS-1168(b): a judge/review seat whose pane could not be created or launched. Typed so the gates can
- * contain it as seat recovery (another seat) or an infra park — never as a worker failure. */
+ * contain it as seat recovery (another seat) or an infra park — never as a worker failure. E1: the
+ * driver's typed launch cause survives the wrap as a field; the message alone is prose. */
 export class SeatLaunchError extends Error {
     seat;
+    launchCause;
     constructor(seat, cause) {
         super(`seat ${seat} failed to launch: ${cause instanceof Error ? cause.message : String(cause)}`);
         this.seat = seat;
         this.name = "SeatLaunchError";
+        const launchCause = cause?.launchCause;
+        if (launchCause === "checkout-proof-timeout")
+            this.launchCause = launchCause;
     }
 }
 export const REVIEW_FIRST_LIVENESS_MS = 30_000;

package/dist/gates/review.js

@@ -367,7 +367,9 @@ function daemonRepoRoot(worktree, artifactDir) {
 export function renderPriorMaterials(priorMaterials) {
     const fingerprints = priorMaterials.map((finding, i) => {
         const observed = observedReviewFingerprints(finding);
-        const heading = observed.length > 1 ? `Finding ${i + 1} (choose one observed spelling):\n` : "";
+        // E2 (T4 D-766): every finding is headed. A one-spelling finding left unheaded read as one more
+        // spelling of the multi-spelling finding above it, so a faithful seat closed F1 alone.
+        const heading = observed.length > 1 ? `Finding ${i + 1} (choose one observed spelling):\n` : `Finding ${i + 1}:\n`;
         return heading + observed.map((id) => `Fingerprint: ${id}`).join("\n");
     }).join("\n");
     return `## Prior materials this attempt must close
@@ -642,11 +644,14 @@ ${responseRequirement}
             throw error;
         // OBS-1168(b): the seat never launched, so there is no verdict and nothing about the WORK. A typed
         // no-verdict re-routes to another seat in run-gates; an exhausted pool is an infra park.
+        // E1: the cause stays seat-launch-failed; a typed launchCause rides beside it, never replaces it.
+        const launch = error.launchCause ? `; launchCause: ${error.launchCause}` : "";
         return { gate: "review", pass: false,
-            details: `review dispatch failed — ${error.message} (reviewer ${reviewer.adapter}:${reviewer.model}; vendor: ${reviewer.vendor}; provider: ${provider}; cause: seat-launch-failed) — failing closed`,
+            details: `review dispatch failed — ${error.message} (reviewer ${reviewer.adapter}:${reviewer.model}; vendor: ${reviewer.vendor}; provider: ${provider}; cause: seat-launch-failed${launch}) — failing closed`,
             meta: { ...policyMeta, ...rotationMeta, ...floorMeta, reviewer: channelKey(reviewer), reviewerTier: reviewer.tier,
                 vendor: reviewer.vendor, provider, noVerdict: true, classification: "infra", infra: true,
-                cause: "seat-launch-failed", ...(savedBrief ? { briefPath: savedBrief } : {}) } };
+                cause: "seat-launch-failed", ...(error.launchCause ? { launchCause: error.launchCause } : {}),
+                ...(savedBrief ? { briefPath: savedBrief } : {}) } };
     }
     const raw = llm.output;
     let saved;

package/dist/gates/run-gates.d.ts

@@ -75,8 +75,9 @@ export interface GateContext {
     reviewNoVerdicts?: Map<string, string[]>;
     recheck?: boolean;
     /** Explicit worker funding requires fresh red measurements, never a gate waiver. OBS-1106: so does
-     * a retry that landed nothing on a timeout-class red — its one fresh re-observation. */
-    cachedRedBypass?: "operator-rerun" | "timeout-fresh";
+     * a retry that landed nothing on a timeout-class red — its one fresh re-observation. C: and one whose
+     * unchanged red is attributed wholly outside the task's files[] — its one fresh re-execution. */
+    cachedRedBypass?: "operator-rerun" | "timeout-fresh" | "out-of-scope-fresh";
     carriedAuthors?: readonly string[];
     /** The attempt whose worker last wrote the gated checkout; a dirty-tree refusal stamps it on the
      * preserve commit and its row. Absent (standalone verify, gate-only restores) preserves as "unknown". */

package/dist/gates/run-gates.js

@@ -467,16 +467,28 @@ export async function runGates(task, ctx) {
     };
     const shapeGates = ctx.cfg.gates.byShape?.[task.shape];
     const enabled = (g) => task.gates.includes(g) && (g !== "acceptance" && g !== "review" || shapeGates?.[g] !== false);
-    const failed = () => results.some((r) => !r.pass);
     // T4 (OBS-265): a GREEN selected-test run is a screen, not the round's verdict — the merge-candidate
     // round re-runs the full suite on the same commit and THAT is what the round reports. With no
     // semantic gate to act on it, the screen is held so its full suite speaks for it in one row.
     // (A RED screen IS the verdict: the round ends there, so it is recorded immediately.)
     let heldTest;
+    const semantic = enabled("acceptance") || enabled("review");
+    // v2.6.5 T6 (D): the closed repair-mode table. A repair the REVIEW sent back (carried review:material)
+    // whose test history is clean — selection allowed, no required repair test — asks the question it
+    // was sent back for first: cheap gates → acceptance ‖ review → screen → merge-candidate full suite,
+    // so a semantic red costs zero test starts. selectTests false or a nonempty requiredRepairTests is a
+    // test-red repair and keeps battery-first order; so does every first attempt (nothing carried).
+    const semanticFirst = semantic && ctx.selectTests === true && !ctx.requiredRepairTests?.length
+        && (ctx.carriedFindings ?? []).some((f) => f.class === "review:material");
+    // Semantic-first, a review that returned NO verdict is not a red that ends the round before its
+    // test proof: the daemon re-asks only the review (runReviewRecovery) and merges on the rows beside
+    // it, so the round still buys its screen and full suite. The row stays red; the round is unsatisfied.
+    const failed = () => results.some((r) => !r.pass && !(semanticFirst && r.gate === "review" && r.meta?.noVerdict === true));
     // OBS-1176: when acceptance/review WILL act on a green screen, the screen is published before they
     // start, as its own selected row. The full suite afterwards is a second invocation on its own row —
     // it carries only its own receipts and interval, so it neither erases nor re-counts the screen.
-    const publishScreen = enabled("acceptance") || enabled("review");
+    // Semantic-first, nothing acts on the screen but its full suite: it is held like a gate-less round's.
+    const publishScreen = semantic && !semanticFirst;
     // v2.0 T2 (OBS-554): this round's per-gate measurement. Every interval a gate actually spends
     // executing is added HERE, at the call site that runs it, so a gate that runs twice (the test
     // gate's screen and its full suite) sums to its own cost and never to the span between them.
@@ -1126,8 +1138,12 @@ export async function runGates(task, ctx) {
                 if (typeof rv.meta.reviewer === "string") {
                     const reviewer = rv.meta.reviewer;
                     const cause = String(rv.meta.cause);
+                    // E1: a checkout-proof timeout is the host being slow to print the seat's proof, not the seat
+                    // failing. It is still a no-verdict re-routed away from for THIS round, but it never strikes the
+                    // run-scoped tally; every other launch failure (foreign or malformed proof included) does.
+                    const proofTimeout = cause === "seat-launch-failed" && rv.meta.launchCause === "checkout-proof-timeout";
                     // OBS-1025 add.2: the run-scoped tally; two no-verdicts retire the seat for the rest of the run.
-                    const causes = rv.meta.noVerdict === true && ctx.reviewNoVerdicts
+                    const causes = rv.meta.noVerdict === true && ctx.reviewNoVerdicts && !proofTimeout
                         ? [...(ctx.reviewNoVerdicts.get(reviewer) ?? []), cause] : undefined;
                     if (causes)
                         ctx.reviewNoVerdicts.set(reviewer, causes);
@@ -1272,51 +1288,9 @@ export async function runGates(task, ctx) {
         if (failed())
             return done();
     }
-    // A non-final round may run only the tests covering its own diff; the merge-candidate round below
-    // pays the full suite anyway, so a selection that misses costs a round and can never merge.
-    let selected = ctx.selectTests && enabled("test") && ctx.commands.test
-        ? await coveringTests(ctx.worktree, ctx.baseRef)
-        : undefined;
-    let selectionReason = ctx.selectionReason ?? (selected ? "affected-tests" : "full-suite-fallback");
-    if (selected && ctx.requiredRepairTests?.length) {
-        const required = ctx.requiredRepairTests;
-        const safe = required.every((path) => posix.normalize(path) === path && !path.startsWith("../")
-            && !path.startsWith("/") && TEST_FILE_RE.test(path) && existsSync(join(ctx.worktree, path)));
-        const listed = safe ? await shGit(`git ls-files -z -- ${required.map(shq).join(" ")}`, ctx.worktree) : undefined;
-        const tracked = new Set(listed?.stdout.split("\0").filter(Boolean));
-        if (!listed || listed.code !== 0 || required.some((path) => !tracked.has(path))) {
-            selected = undefined;
-            selectionReason = "required-repair-test-unavailable";
-        }
-        else
-            selected = [...new Set([...selected, ...required])].sort();
-    }
-    // OBS-635: a screen buys nothing when the full suite that must follow it already has a qualified
-    // green on this exact identity (read BEFORE any screen), or when the harness-measured screen costs
-    // at least 75 % of it — then the full suite runs in the battery instead. Unknown timing keeps the
-    // screen. A selected-only green never answers here: its identity names its selection.
-    let promotion;
-    if (selected) {
-        const hit = verdictStore.get(await fullTestIdentity());
-        const costRatio = screenCostRatio(ctx.baseline, selected);
-        if (hit?.pass === true && !isInfraResult(hit) && await certifiesFullManifest(hit))
-            promotion = { reason: "full-green-cache" };
-        else if (costRatio !== undefined && costRatio >= SCREEN_PROMOTION_RATIO)
-            promotion = { reason: "screen-cost-promoted", costRatio };
-        if (promotion)
-            selected = undefined;
-    }
-    if (ctx.selectionReason || promotion)
-        selectionDecision = {
-            scope: selected ? "selected" : "full", reason: promotion?.reason ?? (selected ? selectionReason
-                : selectionReason === "known-failing-files" ? "unsupported-selection-full-suite" : selectionReason),
-            requiredFiles: [...(ctx.requiredRepairTests ?? [])],
-            ...(promotion?.costRatio !== undefined ? { costRatio: promotion.costRatio } : {}),
-        };
-    await runBattery(selected ? { ...ctx.commands, test: testCommandForFiles(ctx.commands.test, selected) } : ctx.commands, selected, enabled("test") ? ["test"] : []);
-    if (failed())
-        return done();
-    if (enabled("acceptance") || enabled("review")) {
+    // The judge and the reviewer, together. Returns true when the round ends here: a red, or a
+    // cancelled sibling — a cancelled seat's round never goes on to borrow a test row.
+    const runSemantics = async () => {
         // Judge and review are launched TOGETHER (96m of serialization over 5 runs). Enforcement is
         // unchanged — it is still the AND of both, both still fail closed, and neither reads the other's
         // verdict: each gets the same commit and the same brief it always got, and neither promise is
@@ -1365,16 +1339,83 @@ export async function runGates(task, ctx) {
         if (failure)
             throw failure.reason;
         executionSignal()?.throwIfAborted();
-        if (failed())
+        return cancelled || failed();
+    };
+    if (semanticFirst) {
+        if (await runSemantics()) {
+            // A cancelled round starts no test, yet its no-verdict review can still be re-asked alone. Its test
+            // proof is recorded OWED — unsatisfied, never a verdict — so that re-ask cannot merge an unrun subject.
+            if (!failed() && enabled("test") && ctx.commands.test !== undefined) {
+                await record({ gate: "test", pass: false, details: "test not run — the semantic round was cancelled before its "
+                        + "test screen; the merge-candidate full suite is still owed on this subject",
+                    meta: { skipped: true, infra: true, classification: "infra", retryable: false, testOwed: true } });
+            }
+            return done();
+        }
+        // Subject freshness: the semantic gates ran oracles and vendor CLIs in this worktree. Their dirt is
+        // not the committed subject, so no screen measures it and no cached green row answers for it.
+        const dirt = enabled("test") && ctx.commands.test !== undefined ? await dirtyWorktree() : undefined;
+        if (dirt) {
+            await emitStart("test");
+            await record(await dirtyRefusal("test", dirt));
             return done();
+        }
+    }
+    // A non-final round may run only the tests covering its own diff; the merge-candidate round below
+    // pays the full suite anyway, so a selection that misses costs a round and can never merge.
+    let selected = ctx.selectTests && enabled("test") && ctx.commands.test
+        ? await coveringTests(ctx.worktree, ctx.baseRef)
+        : undefined;
+    let selectionReason = ctx.selectionReason ?? (selected ? "affected-tests" : "full-suite-fallback");
+    if (selected && ctx.requiredRepairTests?.length) {
+        const required = ctx.requiredRepairTests;
+        const safe = required.every((path) => posix.normalize(path) === path && !path.startsWith("../")
+            && !path.startsWith("/") && TEST_FILE_RE.test(path) && existsSync(join(ctx.worktree, path)));
+        const listed = safe ? await shGit(`git ls-files -z -- ${required.map(shq).join(" ")}`, ctx.worktree) : undefined;
+        const tracked = new Set(listed?.stdout.split("\0").filter(Boolean));
+        if (!listed || listed.code !== 0 || required.some((path) => !tracked.has(path))) {
+            selected = undefined;
+            selectionReason = "required-repair-test-unavailable";
+        }
+        else
+            selected = [...new Set([...selected, ...required])].sort();
+    }
+    // OBS-635: a screen buys nothing when the full suite that must follow it already has a qualified
+    // green on this exact identity (read BEFORE any screen), or when the harness-measured screen costs
+    // at least 75 % of it — then the full suite runs in the battery instead. Unknown timing keeps the
+    // screen. A selected-only green never answers here: its identity names its selection.
+    let promotion;
+    if (selected) {
+        const hit = verdictStore.get(await fullTestIdentity());
+        const costRatio = screenCostRatio(ctx.baseline, selected);
+        if (hit?.pass === true && !isInfraResult(hit) && await certifiesFullManifest(hit))
+            promotion = { reason: "full-green-cache" };
+        else if (costRatio !== undefined && costRatio >= SCREEN_PROMOTION_RATIO)
+            promotion = { reason: "screen-cost-promoted", costRatio };
+        if (promotion)
+            selected = undefined;
     }
+    if (ctx.selectionReason || promotion)
+        selectionDecision = {
+            scope: selected ? "selected" : "full", reason: promotion?.reason ?? (selected ? selectionReason
+                : selectionReason === "known-failing-files" ? "unsupported-selection-full-suite" : selectionReason),
+            requiredFiles: [...(ctx.requiredRepairTests ?? [])],
+            ...(promotion?.costRatio !== undefined ? { costRatio: promotion.costRatio } : {}),
+        };
+    await runBattery(selected ? { ...ctx.commands, test: testCommandForFiles(ctx.commands.test, selected) } : ctx.commands, selected, enabled("test") ? ["test"] : []);
+    if (failed())
+        return done();
+    if (semantic && !semanticFirst && await runSemantics())
+        return done();
     // OBS-635: the semantic gates ran oracles and vendor CLIs in this worktree after an in-battery full
     // suite spoke, and its green stands only for the identity it measured. Oracle dirt withdraws it; a
     // changed or unmeasurable identity — tree, command, baseline, environment, dependency resolution,
     // capacity, protocol, lifecycle, full manifest — buys a fresh merge-candidate suite below.
+    // Semantic-first too: an in-battery full suite that ran AFTER the semantic gates is clear of their
+    // dirt, never of its own test command's effects (an ignored lockfile, a newly collected test).
     let rerunFull = false;
     listing = undefined;
-    if (fullInBattery && ctx.commands.test !== undefined && (enabled("acceptance") || enabled("review"))) {
+    if (fullInBattery && ctx.commands.test !== undefined && semantic) {
         const dirt = await dirtyWorktree();
         if (dirt) {
             const refusal = withTelemetry(await dirtyRoundRefusal("test", dirt));

package/dist/route/router.d.ts

@@ -55,6 +55,17 @@ export declare const taskPool: (task: Task, cfg: TickmarkrConfig) => {
 /** Park-reason suffix naming the pool an exhausted re-dispatch stayed inside; empty when unpooled. */
 export declare const poolExhaustion: (task: Task, cfg: TickmarkrConfig) => string;
 export declare const inTaskPool: (task: Task, cfg: TickmarkrConfig, key: string) => boolean;
+/**
+ * F (D-718): the one exclusion meaning route(), nextChannel() and climbChannel() share — explicit
+ * exclusions, demotions, tried and escalation history, and climb skips — exported so resume can test a
+ * restored assignment the same way. An excluded raw channel key always excludes itself (the fallback).
+ * The exclusion extends to another offered channel only when BOTH offered channels carry a probed
+ * identity and the two are equal. A missing identity is neutral: it never matches and never blocks.
+ * Residual, by ruling: an unprobed alias of an excluded model stays eligible by its raw key — this is
+ * not complete alias exclusion; reopen on an executed re-dispatch of a tried model through an alias
+ * with no probed identity. The daemon's nextChannel-null exhaustion fallback is not this policy's.
+ */
+export declare function channelExclusion(offered: readonly BillingChannel[], excluded: Iterable<string>): (seat: ChannelSeat) => boolean;
 export declare function route(task: Task, cfg: TickmarkrConfig, channels: BillingChannel[], profile?: RoutingProfile, preferCtx?: RoutingPreferContext, exclude?: ReadonlySet<string>, exploreCtx?: ExploreContext): Route;
 export declare function nextChannel(current: Assignment, task: Task, cfg: TickmarkrConfig, channels: BillingChannel[], tried: string[], profile?: RoutingProfile, exclude?: ReadonlySet<string>): Assignment | null;
 export type ClimbPick = Assignment & {