tickmarkr 2.6.3 → 2.6.5

package/dist/route/router.js

@@ -1,6 +1,6 @@
 import { channelKey, channelsFromConfig } from "../adapters/types.js";
 import { TIER_RANK } from "../config/config.js";
-import { channelRouteIdentity, disallowedBy, modelRouteIdentity, routingModelProvider } from "./preference.js";
+import { disallowedBy, routingModelProvider } from "./preference.js";
 import { cellOf, EXPLORE_CAP, explorationBonus, learnedScore, MIN_SAMPLES } from "./profile.js";
 export const NO_EXPLORE_ENV = "TICKMARKR_NO_EXPLORE";
 // OBS-89 (v1.60): the TICKMARKR_QUALITY variable is RETIRED — nothing in src reads it anymore and
@@ -124,11 +124,33 @@ function spreadFrontierTies(sorted, task, prefer, tied) {
     }
     return out;
 }
+/**
+ * F (D-718): the one exclusion meaning route(), nextChannel() and climbChannel() share — explicit
+ * exclusions, demotions, tried and escalation history, and climb skips — exported so resume can test a
+ * restored assignment the same way. An excluded raw channel key always excludes itself (the fallback).
+ * The exclusion extends to another offered channel only when BOTH offered channels carry a probed
+ * identity and the two are equal. A missing identity is neutral: it never matches and never blocks.
+ * Residual, by ruling: an unprobed alias of an excluded model stays eligible by its raw key — this is
+ * not complete alias exclusion; reopen on an executed re-dispatch of a tried model through an alias
+ * with no probed identity. The daemon's nextChannel-null exhaustion fallback is not this policy's.
+ */
+export function channelExclusion(offered, excluded) {
+    const keys = new Set(excluded);
+    const identityOf = new Map(offered.flatMap((c) => (c.identity ? [[channelKey(c), c.identity]] : [])));
+    const identities = new Set([...keys].flatMap((k) => identityOf.get(k) ?? []));
+    return (seat) => {
+        const key = channelKey(seat);
+        const identity = identityOf.get(key);
+        return keys.has(key) || (identity !== undefined && identities.has(identity));
+    };
+}
 function withoutExcluded(channels, exclude) {
     if (!exclude?.size)
         return channels;
     // OBS-57: in-run demotion after consecutive no-trailer windows — route around poisoned channels for the rest of the run.
-    return channels.filter((c) => !exclude.has(channelKey(c)));
+    // D-718: a demoted channel's probed-identical alias is routed around too; an unprobed one is not.
+    const excluded = channelExclusion(channels, exclude);
+    return channels.filter((c) => !excluded(c));
 }
 // Pools spread providers before tier, independently within each marginal-cost run. Stable
 // cost sorting preserves declaration order when forming groups; gateways share the served
@@ -394,19 +416,18 @@ export function route(task, cfg, channels, profile, preferCtx, exclude, exploreC
     return { assignment: toAssignment(eligible[0]), ladder: ladderFor(task, entry), lints, provenance: `${degraded}${bound}, marginal-cost auto (${chosenBy})`, ...(deviation ? { deviation } : {}) };
 }
 function candidatePool(current, task, cfg, channels, tried, tierPredicate, exclude) {
-    channels = withoutExcluded(channels, exclude).filter((c) => inTaskPool(task, cfg, channelKey(c)));
+    // D-718: tried/escalated/demoted keys share channelExclusion's meaning, resolved against every offered
+    // channel; the provider-outage rule below still reads the raw-key remainder exactly as before.
+    const excluded = channelExclusion(channels, [...(exclude ?? []), ...tried]);
+    channels = channels.filter((c) => !exclude?.has(channelKey(c)) && inTaskPool(task, cfg, channelKey(c)));
     const triedKeys = new Set(tried);
-    const triedIdentities = new Set(tried.map((key) => {
-        const channel = channels.find((c) => channelKey(c) === key);
-        return channel ? modelRouteIdentity(channel.model, channel.vendor) : channelRouteIdentity(key);
-    }));
     // excludeAdapter is expanded by the daemon into every channel key of the failed adapter. Once that
     // complete set is present, the outage follows the current served provider across gateway aliases.
     const currentAdapterExcluded = channels.some((c) => c.adapter === current.adapter)
         && channels.filter((c) => c.adapter === current.adapter).every((c) => triedKeys.has(channelKey(c)));
     const currentChannel = channels.find((c) => c.adapter === current.adapter && c.model === current.model);
     const excludedProvider = currentAdapterExcluded ? routingModelProvider(current.model, currentChannel?.vendor) : undefined;
-    return channels.filter((c) => !triedIdentities.has(modelRouteIdentity(c.model, c.vendor))
+    return channels.filter((c) => !excluded(c)
         && (!excludedProvider || routingModelProvider(c.model, c.vendor) !== excludedProvider)
         && tierPredicate(c.tier));
 }

package/dist/run/daemon.js

@@ -36,10 +36,10 @@ import { changeRepresented, cleanupRunWorktrees, deriveForkCap, FORK_CAP_ENV, gi
 import { runInteractiveSeed } from "./interactive-seed.js";
 import { classifyRepairDisposition, resolveScopeHints } from "./repair-disposition.js";
 import { applyScopeAmendments, activeRetryBan, interruptedAttempt, RESUME_HARVEST_SOURCE, resumeHarvestAuthor, approvalAction, APPROVAL_REFUSED, bindingToken, effectiveEvents, foldDecisions, physicalLine, staleApprovals, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, readableExcerpt, receiptOrigin, outstandingReviewFindings, pendingApprovalActions, pendingRechecks, pendingRepairFindings, phaseForGate, priorJudgments, readPriorRunEvidence, recordedTaskFailureKind, reraisedReviewChains, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, standingRulings, structuredFindings, upheldFeedbackByTask } from "./journal.js";
-import { gateReviewerFloor, isDiffCapPark, isGarbageReview, pickReviewer } from "../gates/review.js";
+import { carriedAuthorVendors, gateReviewerFloor, isDiffCapPark, isGarbageReview, pickReviewer } from "../gates/review.js";
 import { acquireApprovalSerialization, acquireRunLock, isPidLive, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, reusedTipEvidence, verifyIntegrationTip } from "./merge.js";
-import { climbChannel, inTaskPool, marginalCostRank, nextChannel, poolExhaustion, route, taskPool } from "../route/router.js";
+import { channelExclusion, climbChannel, inTaskPool, marginalCostRank, nextChannel, poolExhaustion, route, taskPool } from "../route/router.js";
 import { desiredPanes } from "./reconcile.js";
 import { readTierLiveness, readWatchBoard, supervisionPresencePath } from "./supervision.js";
 import { harvestCpuFlatWindowMs, NUDGEABLE_ADAPTERS, PANE_READ_ROWS, StallProgressTracker, stallSnapshotBannerRows, WorkerTreeCpuAccountant, reapOwnedProcessGroup, readOwnedProcessGroup, } from "./stall.js";
@@ -377,6 +377,49 @@ function classifyInfraResult(g) {
 const TIMEOUT_SHAPED_RE = /\b(?:Test|Hook) timed out in (?:\d+|#)\s*ms\b|\bexpected (?:\d+|#)(?:\.(?:\d+|#))? to be (?:less than|below)(?: or equal to)? (?:\d+|#)/i;
 const RUNNER_INFRA_DIAGNOSTIC_RE = /\bnever-started (?:[1-9]\d*|#)(?![\d#])|\[vitest-worker\]: Timeout calling\b/;
 const timeoutShaped = (details) => TIMEOUT_SHAPED_RE.test(readableExcerpt(details));
+/** C (E1): the one no-verdict that is the host's slowness, not the seat's — the same predicate run-gates
+ * applies to its run-scoped tally, read here for the live task strike and the resume reconstruction. */
+const proofTimeoutNote = (data) => data.cause === "seat-launch-failed" && data.launchCause === "checkout-proof-timeout";
+/** C: the gate-fresh-forced reason that bounds the out-of-scope re-execution, one per journaled subject. */
+const OUTSIDE_SCOPE_RED = "no-commit-out-of-scope-red";
+const NAMED_FAILURE_FILE_RE = /^\s*(\S+\.(?:test|spec)\.[cm]?[jt]sx?)\s+>/gm;
+/** D-854: the runner certificate the vitest manifest path appends to a red (test-manifest.ts). */
+const RUNNER_CERTIFICATE_RE = /runner-level diagnostic: never-started ([^;\s]+); reporter errors ([^;\s]+)/g;
+/** C: a journaled test red whose failing-file attribution is nonempty, trustworthy and complete (repair
+ * selection's own rule: a behavioral red on a real subject from a full suite or a screen that names
+ * every failure), POSITIVELY certified complete by its runner, uncontradicted by the files its own text
+ * names, and wholly outside a declared files[]. Empty files[] is unrestricted and never qualifies;
+ * every other shape keeps its replay. */
+function outsideScopeRed(t, taskId, data, commit) {
+    if (!t.files.length || data.gate !== "test" || data.pass !== false || data.skipped === true || data.commit !== commit
+        // a failed producer — an infra row, a dirty-tree refusal, a recovery the runner could not finish —
+        // never attributes anything, whatever files it lists
+        || data.infra === true || data.dirtyWorktree === true || data.recoveryBlocked !== undefined)
+        return false;
+    const attribution = repairSelectionDecision([{ event: "gate-result", taskId, data }], taskId, true);
+    if (attribution.reason !== "known-failing-files" || attribution.requiredFiles.length === 0)
+        return false;
+    const text = readableExcerpt(String(data.details ?? ""));
+    // D-854: validate, never filter. A collection failure has no module record, so failingFiles omits it
+    // and it lives only in the certificate's counts; any never-started file or reporter error, an unknown
+    // count, or no certificate at all leaves the attribution unproven.
+    // ponytail: a nonzero count never qualifies, even when each diagnostic names an outside file — the
+    // details interleave diagnostics with the stdout tail; map them only if outside-scope collection reds need it.
+    const certificates = [...text.matchAll(RUNNER_CERTIFICATE_RE)];
+    if (!certificates.length || certificates.some((m) => m[1] !== "0" || m[2] !== "0"))
+        return false;
+    const named = [...text.matchAll(ATTRIBUTED_FILE_RE), ...text.matchAll(NAMED_FAILURE_FILE_RE)].map((m) => m[1].replace(/^\.\//, ""));
+    if (named.some((file) => !attribution.requiredFiles.includes(file)))
+        return false; // contradictory
+    const inScope = filesGlob(t.files);
+    return attribution.requiredFiles.every((file) => !inScope(file));
+}
+/** C: every test red a round journaled on `commit` is an out-of-scope red (none means none). */
+const allOutsideScopeReds = (t, rows, commit) => {
+    const reds = rows.filter((e) => e.event === "gate-result" && e.data.gate === "test" && e.data.pass === false
+        && e.data.skipped !== true && e.data.commit === commit);
+    return reds.length > 0 && reds.every((e) => outsideScopeRed(t, e.taskId ?? t.id, e.data, commit));
+};
 const ATTRIBUTED_FILE_RE = /^\s*(?:FAIL|×|✗)\s+(?:\|[^|\n]*\|\s+)?(\S+\.(?:test|spec)\.[cm]?[jt]sx?)\b/gm;
 /** The failing files a red attributes to itself: the runner's own list, else its FAIL headlines. */
 const attributedFailingFiles = (g) => [...new Set(Array.isArray(g.meta?.failingFiles) && g.meta.failingFiles.length
@@ -2203,10 +2246,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                 // is what bounds a seat that flakes once per task (or once per session) across the run. Seeded from the
                 // journal's review-no-verdict rows — the same notes noteReviewEvent appends — so a resumed daemon keeps
                 // the count; run-gates appends to it in place, exactly as it does demotedReviewers.
+                // C (E1): a checkout-proof timeout never struck the live tally (run-gates), so a resume never seeds one.
                 const reviewNoVerdicts = new Map();
                 for (const event of journal.read()) {
                     if (event.event !== "review-no-verdict" || event.data.noVerdict !== true || typeof event.data.reviewer !== "string")
                         continue;
+                    if (proofTimeoutNote(event.data))
+                        continue;
                     reviewNoVerdicts.set(event.data.reviewer, [...(reviewNoVerdicts.get(event.data.reviewer) ?? []), String(event.data.cause)]);
                 }
                 const reviewHistory = journal.read()
@@ -2930,6 +2976,18 @@ export async function runDaemon(repoRoot, opts = {}) {
                     return red !== undefined
                         && identicalGateFailures(journal.read(), t.id, "test", normalizeGateFailure(String(red.data.details))) < GATE_FINGERPRINT_CAP;
                 };
+                // C: an unchanged cached test red attributed wholly outside files[] is re-executed ONCE per journaled
+                // subject — the worker cannot repair those files, so a copy of the red would only buy another round.
+                const owesOutsideScopeRefresh = (t, priorRows, commit) => allOutsideScopeReds(t, priorRows, commit)
+                    && !journal.read().some((e) => e.taskId === t.id && e.event === "gate-fresh-forced"
+                        && e.data.reason === OUTSIDE_SCOPE_RED && e.data.commit === commit);
+                // C: the forced re-execution's own round failed again only outside files[]: independent evidence the
+                // worker cannot act on. It keeps its red row and parks gate-fail before any cap, consult or repair move.
+                const freshOutsideScopeRed = (t, commit) => {
+                    const own = journal.read().filter((e) => e.taskId === t.id);
+                    return allOutsideScopeReds(t, own.slice(own.map((e) => e.event === "phase-start" && e.data.phase === "gates").lastIndexOf(true) + 1), commit);
+                };
+                const outsideScopePark = (t) => gateFailApprovalReason(t.id, "test: a fresh re-execution of the unchanged subject failed again only in files outside files[] — no repair can reach them");
                 // OBS-1106 residual: before a timeout or wall-budget red accompanied by runner infra diagnostics is
                 // charged, its attributed failing files are re-run ONCE, on the same checkout, under the suite
                 // lease. Only a reproduced assertion is charged. A pass, an infra rerun, a rerun naming none of the
@@ -3215,10 +3273,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // and a lastAssignment at zero attempts is a first dispatch whose capacity requeue was taken back:
                     // the seat is still in force, so restore it instead of failing over its own tried[] entry early.
                     // OBS-1187: a restored seat must still be a member of the task's pool (the operator may have closed it).
+                    // F/W (D-718): and not excluded under the router's one meaning — its raw key, or a probed identity
+                    // it shares with an excluded channel; an unprobed seat is excluded by its raw key alone.
                     if (!hintsChanged && rs?.lastAssignment
                         && channels.some((c) => channelKey(c) === channelKey(rs.lastAssignment))
                         && inTaskPool(t, cfg, channelKey(rs.lastAssignment))
-                        && !demotedChannels.has(channelKey(rs.lastAssignment))) {
+                        && !channelExclusion(channels, demotedChannels)(rs.lastAssignment)) {
                         assignment = rs.lastAssignment; // restore the consult-chosen assignment (bypasses route()'s static re-pick)
                     }
                     else if (!hintsChanged && rs && rs.tried.length && !t.routingHints?.pin) {
@@ -3295,11 +3355,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                     }
                     // Keep one live list: recovery retries must see exclusions added by onGate during the round.
                     const badReviewers = [...replayedReviewerExclusions];
+                    // C (E1): a checkout-proof timeout is the host being slow, not the seat failing — it is excluded for
+                    // the CURRENT round only (so an always-timeout pool still ends the round), never struck task-wide.
+                    let roundTimeouts = [];
                     const noteReviewEvent = (e) => {
                         journal.append(e.name, t.id, e.payload);
                         if (e.name === "review-no-verdict" && typeof e.payload.reviewer === "string") {
-                            if (!badReviewers.includes(e.payload.reviewer))
-                                badReviewers.push(e.payload.reviewer);
+                            const strikes = proofTimeoutNote(e.payload) ? roundTimeouts : badReviewers;
+                            if (!strikes.includes(e.payload.reviewer))
+                                strikes.push(e.payload.reviewer);
                         }
                         // OBS-1196: a seat whose same-subject re-emission delivered a valid verdict was a delivery flake,
                         // not a bad reviewer — it stays seatable for this task's later rounds.
@@ -3335,17 +3399,31 @@ export async function runDaemon(repoRoot, opts = {}) {
                             gateRound: journal.read().filter((row) => row.taskId === task.id
                                 && row.event === "phase-start" && row.data.phase === "gates").length,
                         };
-                        const round = await runGates(task, ctx);
+                        roundTimeouts = [];
+                        // C: every gate-round boundary — a returned or a THROWN round — publishes the one row held behind
+                        // a still-pending sibling and forgets the pending set, before any park or task-failed row lands.
+                        const gateRound = async (subject) => {
+                            try {
+                                return await runGates(subject, { ...ctx, excludeReviewers: [...badReviewers, ...roundTimeouts] });
+                            }
+                            finally {
+                                settleParallelRound();
+                            }
+                        };
+                        const round = await gateRound(task);
                         let review = round.results.find((g) => g.gate === "review");
+                        // The recovery pick carries every preserved author, exactly as reviewGate's own pick does.
+                        const authors = ctx.carriedAuthors?.length ? [...ctx.carriedAuthors] : [channelKey(ctx.author)];
                         while (review?.meta?.noVerdict === true) {
                             // Recovery must honor the gate's floor, including the seats that just failed to
-                            // return a verdict; a below-floor alternative cannot replace the infra result.
-                            const { floor } = gateReviewerFloor(task, ctx.cfg, ctx.author, ctx.channels, [...(ctx.priorReviewers ?? []), ...badReviewers]);
-                            const next = pickReviewer(ctx.author, ctx.channels, badReviewers, cfg.review.prefer ?? [], floor, reviewHistory, undefined, demotedReviewers);
+                            // return a verdict; a below-floor alternative cannot replace the infra result. This round's
+                            // proof timeouts count too — runGates folds every excluded seat into its own floor.
+                            const { floor } = gateReviewerFloor(task, ctx.cfg, ctx.author, ctx.channels, [...(ctx.priorReviewers ?? []), ...badReviewers, ...roundTimeouts]);
+                            const next = pickReviewer(ctx.author, ctx.channels, [...badReviewers, ...roundTimeouts], cfg.review.prefer ?? [], floor, reviewHistory, undefined, demotedReviewers, carriedAuthorVendors(ctx.channels, authors), authors);
                             if (!next)
                                 break;
                             journal.append("review-infra-retry", t.id, { reviewer: channelKey(next), cause: review.meta.cause });
-                            const retried = await runGates({ ...task, gates: ["review"] }, ctx);
+                            const retried = await gateRound({ ...task, gates: ["review"] });
                             const replacement = retried.results.find((g) => g.gate === "review");
                             // A dirty tree or another pre-dispatch refusal must still fail closed.
                             if (!replacement) {
@@ -3372,13 +3450,16 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 gate: "review", flaked: rr.flaked, retried: rr.retried,
                                 ...(g.meta?.unparseable === true ? { secondUnparseable: true } : {}),
                             });
-                            badReviewers.push(rr.flaked);
+                            // C (E1): a seat re-routed after a checkout-proof timeout is excluded for this round only.
+                            if (!roundTimeouts.includes(rr.flaked))
+                                badReviewers.push(rr.flaked);
                         }
                     };
                     // v1.85 T3 (ruling R4): every BLOCKING review/judge result lands its findings in the journal
                     // structured — class + canonical path + stable symbol — so a retry, a consult or an auto-uphold
                     // decision reads identity instead of re-parsing prose, and line-number churn is not a new finding.
                     // One helper, both onGate sites (satisfied-gate resume + main attempt loop).
+                    // `journaledGates` narrows replayMeasurement to the gates an interrupted round already journaled (C).
                     let gateSubject;
                     const journalGateResult = (g) => {
                         const blocking = g.meta?.infra !== true && gateFailed(g) && (g.gate === "review" || g.gate === "acceptance");
@@ -3414,7 +3495,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             // for the worktree it ran in; absent only for a row that never went through the battery.
                             ...(g.meta?.verification !== undefined ? { verification: g.meta.verification } : {}),
                             ...(gateSubject ? { commit: gateSubject.commit, attempt: gateSubject.attempt } : {}),
-                            ...(gateSubject?.replayMeasurement ? { replayMeasurement: true } : {}),
+                            ...(gateSubject?.replayMeasurement && (gateSubject.journaledGates?.includes(g.gate) ?? true) ? { replayMeasurement: true } : {}),
                             ...(gateSubject?.replayedFromAttempt !== undefined ? { replayedFromAttempt: gateSubject.replayedFromAttempt } : {}),
                             ...(g.meta?.skipped === true || noVerdictReview ? { skipped: true } : {}),
                             // T9: an infra-only exit is journaled AS one. The operator reading a red `test` row has to
@@ -3528,10 +3609,17 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // ever held, and only while an earlier sibling is still in flight — a review that finishes first
                     // waits for acceptance, never the reverse. That keeps T4's durability where it pays (the first
                     // verdict to land is still published immediately) and bounds the exposure to one row for the
-                    // remainder of one already-running gate. A gate that THROWS kills the round before merge, so a
-                    // row held behind it is lost with the round it belonged to — not a verdict that could have merged.
+                    // remainder of one already-running gate. A gate that THROWS still ends its round: C publishes the
+                    // row held behind it at that boundary (settleParallelRound), so it is never lost or carried over.
                     const parallelPending = new Set();
                     let heldParallel;
+                    const settleParallelRound = () => {
+                        parallelPending.clear();
+                        const held = heldParallel;
+                        heldParallel = undefined;
+                        if (liveEngagement())
+                            held?.();
+                    };
                     const notePhaseStart = (e) => {
                         const active = activeGatePhases.get(t.id) ?? new Set();
                         active.add(e.gate);
@@ -4016,7 +4104,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 const followsApproved = GATE_NAMES.indexOf(gate) > satisfiedIndex;
                                 const otherRed = prior?.pass === false;
                                 const needsFullSuite = gate === "test" && prior?.fullSuite !== true;
-                                return followsApproved || otherRed || needsFullSuite;
+                                // W: a red evidence/scope screen ends the round before the battery, so a gate that PRECEDES
+                                // the waived one may never have run: no prior-round row is no verdict — run it as declared.
+                                const unobserved = prior === undefined;
+                                return followsApproved || otherRed || needsFullSuite || unobserved;
                             });
                         }
                         else {
@@ -4091,6 +4182,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             journal.append("gate-provisioned", t.id, provisionedRow);
                         const resumedTask = { ...t, gates: remainingGates };
                         const operatorContext = approvalReviewContext(journal.read(), t.id);
+                        let outsideScopeForced = false;
                         gateLoop: while (true) {
                             fatalStop.signal.throwIfAborted();
                             executionSignal()?.throwIfAborted();
@@ -4119,13 +4211,42 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 const own = journal.read().filter((e) => e.taskId === t.id);
                                 return own.slice(own.map((e) => e.event === "phase-start" && e.data.phase === "gates").lastIndexOf(true) + 1);
                             })();
-                            const freshTimeout = !recheck && !satisfiedGate && ((harvestAuthor !== undefined && owesTimeoutRefresh(t, lastRound, gateSubject.commit))
-                                || (lastRound.some((e) => e.event === "gate-fresh-forced" && e.data.commit === gateSubject.commit)
-                                    && !lastRound.some((e) => e.event === "gate-result" && e.data.gate === "test")));
+                            // C: a passing selected-test screen is never a forced round's conclusive test result (the
+                            // journal's own replay rule): its full suite is still owed, fresh, under the round's bypass.
+                            const measured = lastRound.filter((e) => e.event === "gate-result" && !(e.data.gate === "test"
+                                && Array.isArray(e.data.selectedTests) && e.data.fullSuite !== true && e.data.pass !== false));
+                            const forcedUnmeasured = (outside) => lastRound.some((e) => e.event === "gate-fresh-forced"
+                                && e.data.commit === gateSubject.commit && (e.data.reason === OUTSIDE_SCOPE_RED) === outside)
+                                && !measured.some((e) => e.data.gate === "test");
+                            // C: a crash after the forced re-execution journaled its red but before its park still owes that
+                            // park — restored from the journaled subject and result, never re-measured, replayed or repaired.
+                            // Infra adjudication stays authoritative, exactly as it is ahead of the live park.
+                            if (!recheck && !satisfiedGate && lastRound.some((e) => e.event === "gate-fresh-forced"
+                                && e.data.reason === OUTSIDE_SCOPE_RED && e.data.commit === gateSubject.commit)
+                                && allOutsideScopeReds(t, lastRound, gateSubject.commit)) {
+                                const restored = lastRound.filter((e) => e.event === "gate-result" && e.data.gate === "test" && e.data.pass === false)
+                                    .map((e) => ({ gate: "test", pass: false, details: String(e.data.details ?? ""), meta: e.data }));
+                                if (await adjudicateInfraShapedRed(t, restored, wt, gateSubject.commit, rs?.attempts ?? 0, true, (reason) => park(t, reason, "infra", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode)))
+                                    return;
+                                await park(t, outsideScopePark(t), "gate-fail", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
+                                return;
+                            }
+                            // C: the same out-of-scope re-execution the live loop owes, and a crash inside it still owes it. It
+                            // takes precedence over a timeout refresh: a qualifying red keeps its own bypass and park.
+                            outsideScopeForced = !recheck && !satisfiedGate && ((harvestAuthor !== undefined && owesOutsideScopeRefresh(t, lastRound, gateSubject.commit)) || forcedUnmeasured(true));
+                            const freshTimeout = !recheck && !satisfiedGate && !outsideScopeForced && ((harvestAuthor !== undefined && owesTimeoutRefresh(t, lastRound, gateSubject.commit)) || forcedUnmeasured(false));
+                            // C: a measurement this forced round EXECUTES fresh — its forced test above all — is independent
+                            // evidence, never a replay measurement; only a gate the interrupted round already journaled is.
+                            if (outsideScopeForced) {
+                                gateSubject = { ...gateSubject, journaledGates: measured.map((e) => String(e.data.gate)) };
+                            }
                             journal.phaseStart(t.id, "gates");
                             if (freshTimeout) {
                                 journal.append("gate-fresh-forced", t.id, { gate: "test", attempt: gateSubject.attempt, commit: gateSubject.commit, reason: "no-commit-timeout-red", resumed: true });
                             }
+                            if (outsideScopeForced) {
+                                journal.append("gate-fresh-forced", t.id, { gate: "test", attempt: gateSubject.attempt, commit: gateSubject.commit, reason: OUTSIDE_SCOPE_RED, resumed: true });
+                            }
                             const { results } = await withCommandContext(t.id, async () => runReviewRecovery(resumedTask, {
                                 carriedAuthors: await subjectAuthors(journal.read(), t.id, wt, taskBase),
                                 producer: producerNow(),
@@ -4150,7 +4271,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // flaking seat is re-asked on every task.
                                 reviewNoVerdicts,
                                 recheck, // OBS-1055: a recheck discards cached reds — the battery re-measures what the operator questioned
-                                cachedRedBypass: freshTimeout ? "timeout-fresh" : undefined,
+                                cachedRedBypass: freshTimeout ? "timeout-fresh" : outsideScopeForced ? "out-of-scope-fresh" : undefined,
                                 onGate: async (e) => {
                                     if (!liveEngagement())
                                         return;
@@ -4215,6 +4336,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // assignment back with it.
                                 if (await adjudicateInfraShapedRed(t, results, wt, gateSubject.commit, rs?.attempts ?? 0, false, (reason) => park(t, reason, "infra", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode)))
                                     return;
+                                if (outsideScopeForced && freshOutsideScopeRed(t, gateSubject.commit)) {
+                                    await park(t, outsideScopePark(t), "gate-fail", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
+                                    return;
+                                }
                                 const classified = journal.classifiedDispatch(t.id);
                                 if (await dispositionScopeRed(t, results, classified?.assignment ?? gateAuthor, classified ? (rs?.attempts ?? 0) : Math.max(0, (rs?.attempts ?? 0) - 1), startMs, gateFails, consults, tokens, metered, retryMode, await treeOrDiffPaths(taskBase, wt)))
                                     return;
@@ -6241,6 +6366,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         };
                         let results = [];
                         let commits = [];
+                        let outsideScopeForced = false;
                         gateLoop: while (true) {
                             fatalStop.signal.throwIfAborted();
                             executionSignal()?.throwIfAborted();
@@ -6256,12 +6382,18 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 && e.data.attempt === attempt - 1);
                             const previousRows = retryMode === "repair" ? lastRoundRows : [];
                             // OBS-1106 residual: see owesTimeoutRefresh — the replay below and the verdict cache are both refused.
-                            const freshTimeout = !explicitlyFundedAttempt && owesTimeoutRefresh(t, lastRoundRows, gateSubject.commit);
+                            // C: an unchanged red wholly outside files[] is re-executed once instead of copied (journal or cache);
+                            // it outranks the timeout refresh, so a timeout-shaped qualifying red keeps its own bypass and park.
+                            outsideScopeForced = !explicitlyFundedAttempt && owesOutsideScopeRefresh(t, lastRoundRows, gateSubject.commit);
+                            const freshTimeout = !explicitlyFundedAttempt && !outsideScopeForced && owesTimeoutRefresh(t, lastRoundRows, gateSubject.commit);
                             journal.phaseStart(t.id, "gates");
                             if (freshTimeout) {
                                 journal.append("gate-fresh-forced", t.id, { gate: "test", attempt, priorAttempt: attempt - 1, commit: gateSubject.commit, reason: "no-commit-timeout-red" });
                             }
-                            const replay = !explicitlyFundedAttempt && !freshTimeout && previousRows.length > 0
+                            if (outsideScopeForced) {
+                                journal.append("gate-fresh-forced", t.id, { gate: "test", attempt, priorAttempt: attempt - 1, commit: gateSubject.commit, reason: OUTSIDE_SCOPE_RED });
+                            }
+                            const replay = !explicitlyFundedAttempt && !freshTimeout && !outsideScopeForced && previousRows.length > 0
                                 && previousRows.every((e) => e.data.commit === gateSubject.commit)
                                 && previousRows.some((e) => e.data.pass === false && e.data.skipped !== true);
                             if (replay) {
@@ -6294,7 +6426,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     commands, baseline, channels: pools.review, judgeChannels: pools.judge, health, adapters, cfg, artifactDir: journal.dir,
                                     collateral: collateral.get(t.id) ?? [],
                                     selectTests: !testGateFailed,
-                                    cachedRedBypass: explicitlyFundedAttempt ? "operator-rerun" : freshTimeout ? "timeout-fresh" : undefined,
+                                    cachedRedBypass: explicitlyFundedAttempt ? "operator-rerun" : freshTimeout ? "timeout-fresh" : outsideScopeForced ? "out-of-scope-fresh" : undefined,
                                     via: cfg.visibility.llm === "pane"
                                         ? {
                                             driver: trackedDriver,
@@ -6403,6 +6535,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                         }
                         if (await adjudicateInfraShapedRed(t, results, wt, gateSubject.commit, attempt, gateSubject.replayedFromAttempt !== undefined, (reason) => park(t, reason, "infra", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode)))
                             return;
+                        if (outsideScopeForced && freshOutsideScopeRed(t, gateSubject.commit)) {
+                            await park(t, outsideScopePark(t), "gate-fail", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
+                            return;
+                        }
                         // OBS-547: who pays for this red is decided by the run's collateral prediction (see
                         // dispositionScopeRed) — an authoring defect parks unchargeable before any accounting below.
                         if (await dispositionScopeRed(t, results, assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode, await treeOrDiffPaths(taskBase, wt)))

package/dist/run/git.js

@@ -9,6 +9,7 @@ import { StringDecoder } from "node:string_decoder";
 import { shq } from "../adapters/types.js";
 import { tickmarkrDir } from "../graph/graph.js";
 import { ROUTING_ENV_SEAMS } from "../route/router.js";
+import { titleEnvironment } from "./title-environment.js";
 export { ROUTING_ENV_SEAMS };
 // OBS-110: gate/baseline/tip-verify children are vitest suites; without a fork cap, concurrent
 // full-suite gate runs fork a worker-per-core pool per worktree and saturate the operator box.
@@ -324,6 +325,14 @@ function executeShell(cmd, cwd, timeoutMs, login, options, observation) {
     // OBS-854: descendants can leave the checkout (nested fixture suites do), so cwd alone cannot
     // attribute them. Every daemon shell exports the daemon pid as their durable parentage marker.
     env[SUITE_PARENT_ENV] = String(process.pid);
+    // A2: on Darwin a Node child's title writes stay in JavaScript (title-environment.ts); runnerInputsHash
+    // hashes this same effective NODE_OPTIONS, so a verdict is only reused under the identical mode. Native
+    // mode is applied too: it drops a preload a nested shell inherited from its parent (unset when that was all).
+    const { nodeOptions } = titleEnvironment(env);
+    if (nodeOptions === undefined)
+        delete env.NODE_OPTIONS;
+    else
+        env.NODE_OPTIONS = nodeOptions;
     // T7: the capacity every result of this shell carries, read HERE — off the environment the child
     // is about to receive, after the precedence above has settled. An operator export is already in
     // `env`, so what gets recorded is the operator's number, which is the case a release was re-taken

package/dist/run/journal.d.ts

@@ -435,8 +435,8 @@ export declare const TelemetryRowSchema: z.ZodObject<{
     quotaFailover: z.ZodOptional<z.ZodLiteral<true>>;
     overrun: z.ZodOptional<z.ZodLiteral<true>>;
     retryMode: z.ZodOptional<z.ZodEnum<{
-        repair: "repair";
         resume: "resume";
+        repair: "repair";
         fresh: "fresh";
     }>>;
     signalQuality: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<0>, z.ZodLiteral<0.25>, z.ZodLiteral<0.5>, z.ZodLiteral<0.75>, z.ZodLiteral<1>]>>;
@@ -593,4 +593,104 @@ export declare class Journal {
     readTelemetry(): TelemetryRow[];
     readJudgeTelemetry(): TelemetryRow[];
 }
+export declare const OWED_CHECK_VERSION: 1;
+export declare const OWED_DISCHARGE_EVENT: "owed-check-discharged";
+export interface OwedCheck {
+    version: typeof OWED_CHECK_VERSION;
+    id: string;
+    runId: string;
+    taskId: string;
+    gate: GateName;
+    /** The immutable range the waived gate measured, and its canonical subject (daemon gateCommitSubject). */
+    base: string;
+    head: string;
+    subject: string;
+    /** Verbatim (whitespace-sensitive) patch identity of the whole range and of each commit, in order — the integration mapping key. */
+    patch: string;
+    patches: string[];
+    criteria: string;
+    /** The task's file scope at waive time: a discharge gates exactly this allowlist, never a wider one. */
+    files: string[];
+    authors: string[];
+    /** The channels this repository's adapters declared under its config at waive time (key → vendor):
+     *  the only seats a review discharge's reviewer and author channels may resolve to. */
+    declared: ChannelFact[];
+    cause: string;
+    evidence: string;
+    disposition: "accepted-risk";
+    known: boolean;
+    unknownReason?: string;
+}
+export interface OwedFold {
+    known: boolean;
+    debt: number | "unknown";
+    outstanding: OwedCheck[];
+    acceptedRisk: OwedCheck[];
+    discharged: string[];
+    unknown: Array<{
+        taskId?: string;
+        gate?: string;
+        reason: string;
+    }>;
+}
+export declare const owedCriteria: (acceptance: unknown) => string;
+/** The daemon's canonical gate subject for base..head (daemon.ts gateCommitSubject), byte for byte. */
+export declare const owedSubject: (cwd: string, base: string, head: string) => string;
+/** Ordered verbatim patch ids of the commits in base..head; an empty commit authored no patch. */
+export declare const rangePatches: (cwd: string, base: string, head: string) => string[];
+/** Verbatim patch identity of the whole change base..head introduces. */
+export declare const rangePatch: (cwd: string, base: string, head: string) => string;
+/**
+ * `head` is the task's own recorded integration merge of the obligation's range — exactly. Its first
+ * parent is `mergeBase`; its second parent replays the waived history source tree for source tree from
+ * a base with the waived base's tree (a carry may mint new commit objects, never new content — and
+ * patch ids alone ignore where a hunk lands); its tree is git's own clean merge of the two (no
+ * resolution, no amend); and it introduced the same ordered verbatim patch series and total patch.
+ * Squashed, reordered, relocated, re-indented, reverted or conflict-resolved history fails one of
+ * these and is refused as ambiguous; containment never counts.
+ * Both verify (before discharging) and the fold (re-reading every discharge) decide through here.
+ */
+export declare function integrationMapped(cwd: string, events: readonly JournalEvent[], o: OwedCheck, mergeBase: unknown, head: unknown, memo?: OwedProofMemo): boolean;
+/** I2: a caller-scoped set of completed integration re-proofs (see integrationMapped); absent, every fold re-proves. */
+export type OwedProofMemo = Set<string>;
+/**
+ * Lifetime patch authors of base..head, read from the run: the daemon's subjectAuthors fold
+ * (daemon.ts, not exported and not this task's to edit) restated synchronously so the waive row is
+ * written without yielding. Recreation rows name SOURCE hashes, so ownership joins by stable patch
+ * identity across changed commit objects; a gate-only restore (resume-restore's seat, a recreation
+ * after work started) never becomes an author. Unreadable history names an unknown author.
+ */
+export declare function owedAuthors(events: readonly JournalEvent[], taskId: string, cwd: string, base: string, head: string): string[];
+/**
+ * The obligation a waive of `gate` leaves on the task branch's current range. Synchronous on purpose:
+ * approve writes it into the waive row under the approval serialization without yielding, so a live
+ * daemon's boundary sees the same single append it always did. Anything not bound exactly — the
+ * waived row measured another subject, unreadable refs, unresolved authors, unreadable criteria — is
+ * recorded, never guessed, as known: false.
+ */
+export declare function captureOwedCheck(input: {
+    cwd: string;
+    runId: string;
+    taskId: string;
+    gate: GateName;
+    cause: string;
+    acceptance: unknown;
+    files: unknown;
+    declared: readonly ChannelFact[] | undefined;
+    taskRef: string;
+    integrationRef: string;
+    events: readonly JournalEvent[];
+}): OwedCheck;
+export type ChannelFact = {
+    key: string;
+    vendor: string;
+};
+/**
+ * The CURRENT owed-check fold: accepted-risk history, outstanding debt, and whether it is known.
+ * `cwd` is any checkout of the run's repository (integration discharges are re-proved from git).
+ * It never throws: a fold that cannot be computed is unknown debt, not a crash and never zero.
+ * `memo` (I2, optional): a store-scoped table reusing the immutable git re-proof of an integration mapping
+ * across folds; every artifact, hash, criteria and reviewer condition is still re-read on every fold.
+ */
+export declare function foldOwedChecks(events: readonly JournalEvent[], cwd: string, memo?: OwedProofMemo): OwedFold;
 export {};