tickmarkr 2.6.4 → 2.6.6

package/dist/drivers/orca.js

@@ -44,7 +44,7 @@ export const ORCA_RESPONSE_FAMILIES = [
     "status", "create", "list", "read", "send", "wait", "show", "close",
     "worktree-current", "worktree-set", "hooks-status", "split",
 ];
-export const ORCA_FIXTURE_VERSION = "1.4.195";
+export const ORCA_FIXTURE_VERSION = "1.4.218";
 export const ORCA_CLI_COMMAND_ENV = "ORCA_CLI_COMMAND";
 export const STALE_HANDLE_CODE = "terminal_handle_stale";
 export const TERMINAL_GONE_CODE = "terminal_gone";
@@ -76,6 +76,7 @@ export class OrcaError extends Error {
     raw;
     code;
     runtimeId;
+    launchCause;
     constructor(family, reason, raw, opts = {}) {
         super(`orca ${family} failed — ${reason}; raw response:\n${raw}`);
         this.family = family;
@@ -84,14 +85,15 @@ export class OrcaError extends Error {
         this.name = "OrcaError";
         this.code = opts.code;
         this.runtimeId = opts.runtimeId;
+        this.launchCause = opts.launchCause;
     }
 }
 /** The slot cannot be addressed: dead/unknown terminal record, or a handle that cannot be recovered
  *  to exactly one owned terminal in the slot's own worktree. Never a silent false or empty string. */
 export class OrcaUnavailableError extends OrcaError {
     terminalStatus;
-    constructor(family, reason, raw, terminalStatus) {
-        super(family, reason, raw, { code: "terminal_unavailable" });
+    constructor(family, reason, raw, terminalStatus, launchCause) {
+        super(family, reason, raw, { code: "terminal_unavailable", launchCause });
         this.terminalStatus = terminalStatus;
         this.name = "OrcaUnavailableError";
     }
@@ -209,7 +211,26 @@ export const CHECKOUT_MARK = "TICKMARKR_CHECKOUT";
 // never decode to this one; `A` versus `A B`, `…--T1` versus `…--T10` are different frames.
 const CHECKOUT_FRAME_RE = /TICKMARKR_CHECKOUT (\d+):([0-9a-f]*)(;?)/g;
 const PROOF_PAGES = 16; // pages read from the oldest cursor before the proof is declared absent
-const CHECKOUT_PROOF_TIMEOUT_MS = 2_000; // allow the wrapper shell to emit its startup proof
+// E1: the ceiling for the wrapper shell's startup proof. A loaded host can print a review seat's proof
+// long after the old 2 s window closed (the window a healthy seat was retired on); a proof first
+// arriving at 10 s is accepted, and 20 s still bounds a terminal that never proves anything.
+const CHECKOUT_PROOF_TIMEOUT_MS = 20_000;
+// E1: the printed mark's first bytes past the printf split. The typed command never carries them (the
+// mark is split at its underscore; exit trailers type `TICKMARKR_''EXIT`) and no other tickmarkr name
+// starts `TICKMARKR_C`, so any occurrence is proof bytes — whole, cut or with a header the frame
+// grammar cannot parse — and never an absent proof.
+const MARK_TRACE = CHECKOUT_MARK.slice(0, CHECKOUT_MARK.indexOf("_") + 2);
+/** E1: placement evidence in text actually read — a complete frame naming another checkout, a cut
+ *  frame, or a mark the frame grammar cannot parse (more mark traces than frames). It denies the
+ *  timeout exemption: only a terminal that printed no mark at all was merely slow.
+ *  ponytail: a wrapped frame split across the last page read (the ceiling or PROOF_PAGES stopped
+ *  paging) reads as cut — conservative (no exemption); it needs the proof line on that boundary. */
+function misplacedProof(text, checkout) {
+    const { complete, incomplete } = checkoutFrames(text);
+    const joined = joinWrapped(text);
+    return incomplete || complete.some((c) => c !== checkout)
+        || joined.split(MARK_TRACE).length - 1 > [...joined.matchAll(CHECKOUT_FRAME_RE)].length;
+}
 /** The exact bytes the create command prints as its first line. */
 export function checkoutProofLine(checkout) {
     const bytes = Buffer.from(checkout, "utf8");
@@ -587,6 +608,31 @@ export function isBlindStreamPage(term) {
         && Array.isArray(term.tail) && term.tail.length === 0
         && (term.returnedLineCount === undefined || term.returnedLineCount === 0);
 }
+/**
+ * F (D-832): what one proof page's OWN metadata says about the scrollback it was read from — the closed
+ * seam checkoutProven decides paging and absence by. `complete`: explicit `limited:false` and
+ * `truncated:false` with cursors that agree — nothing lies past this page. `partial`: explicit booleans,
+ * one of them true, cursors that agree — more scrollback exists. `unread`: everything else — a flag
+ * missing or not a boolean, a cursor that is not a string, `limited:false` with a next cursor short of
+ * the latest one (the contradictory "last" page), a blind stream page
+ * (isBlindStreamPage), or a source that is not the stream (`screen-unavailable`). Missing metadata is
+ * never inferred complete: its page's bytes still count as read evidence, but no absence rests on it.
+ */
+export function classifyProofPage(term) {
+    const { limited, truncated } = term;
+    if (typeof limited !== "boolean" || typeof truncated !== "boolean")
+        return "unread";
+    if (isBlindStreamPage(term) || (term.source !== undefined && term.source !== "stream"))
+        return "unread";
+    const next = str(term.nextCursor), latest = str(term.latestCursor);
+    if ((term.nextCursor !== undefined && next === undefined) || (term.latestCursor !== undefined && latest === undefined))
+        return "unread";
+    // a page that says it is the last while its next cursor stops short of the latest one contradicts itself.
+    // (A limited page whose next cursor IS the latest is not: the read from that cursor settles it.)
+    if (!limited && next !== undefined && latest !== undefined && next !== latest)
+        return "unread";
+    return limited || truncated ? "partial" : "complete";
+}
 export class OrcaDriver {
     id = "orca";
     interactive = true; // a visible terminal the operator can watch and answer
@@ -752,9 +798,9 @@ export class OrcaDriver {
             throw new OrcaError("show", `unknown slot ${slot.id}`, "");
         return s;
     }
-    latched(family, st, reason, raw) {
+    latched(family, st, reason, raw, launchCause) {
         st.unavailable = reason;
-        return new OrcaUnavailableError(family, reason, raw);
+        return new OrcaUnavailableError(family, reason, raw, undefined, launchCause);
     }
     assertAvailable(family, st) {
         if (st.unavailable)
@@ -836,20 +882,39 @@ export class OrcaDriver {
             catch { /* already gone, or no longer provably ours — never a blind retry */ }
             throw this.latched("create", st, `create receipt bound to ${worktree ?? "no worktree"}, not the tracked ${tracked} enclosing ${st.cwd}`, env.raw);
         }
-        // A receipt only proves placement on the enclosing tracked checkout. Wait briefly for the
-        // startup command's proof before run() can resolve and the daemon can count a worker launch.
+        // A receipt only proves placement on the enclosing tracked checkout. Wait, up to the ceiling, for
+        // the startup command's proof before run() can resolve and the daemon can count a worker launch.
+        // Polls and reads are bounded by what is left of it, and proof read past it proves nothing.
+        // One absolute deadline, rechecked after every sleep: no read starts once it has passed.
         const deadline = this.time.now() + CHECKOUT_PROOF_TIMEOUT_MS;
-        let proof = await this.checkoutProven(handle, st.cwd, this.cliCwd(st), env.runtimeId);
-        while (!proof.proven && this.time.now() < deadline) {
-            await this.time.sleep(POLL_MS);
-            proof = await this.checkoutProven(handle, st.cwd, this.cliCwd(st), env.runtimeId);
+        // Evidence is kept across polls and never downgraded: once a poll read a misplaced mark or left
+        // output unread, no later poll — absent, cut or otherwise — turns the window back into absence.
+        let misplaced, unread;
+        let proof = await this.checkoutProven(handle, st.cwd, this.cliCwd(st), env.runtimeId, deadline);
+        for (;;) {
+            if (proof.proven)
+                break;
+            if (proof.seen === "misplaced")
+                misplaced = proof;
+            else if (proof.seen === "unread")
+                unread = proof;
+            const left = deadline - this.time.now();
+            if (left <= 0)
+                break;
+            await this.time.sleep(Math.min(POLL_MS, left));
+            if (this.time.now() >= deadline)
+                break;
+            proof = await this.checkoutProven(handle, st.cwd, this.cliCwd(st), env.runtimeId, deadline);
         }
         if (!proof.proven) {
             try {
                 await this.closeTerminal({ ...st, handle, runtimeId: env.runtimeId });
             }
             catch { /* best effort under the answering runtime; the latch prevents another launch */ }
-            throw this.latched("create", st, `terminal ${handle} does not prove checkout ${st.cwd} (${proof.reason})`, env.raw);
+            // The typed timeout only when EVERY poll read its whole scrollback inside the ceiling and found no
+            // trace of the mark; one misplaced or unread poll anywhere in the window denies it.
+            const evidence = misplaced ?? unread ?? proof;
+            throw this.latched("create", st, `terminal ${handle} does not prove checkout ${st.cwd} within ${CHECKOUT_PROOF_TIMEOUT_MS} ms (${evidence.reason})`, env.raw, evidence.seen === "absent" ? "checkout-proof-timeout" : undefined);
         }
         st.handle = handle;
         // The handle is bound to the runtime identity that ANSWERED its create.
@@ -972,12 +1037,43 @@ export class OrcaDriver {
      * that supplied the ownership listing — else another terminal's or another runtime's bytes were
      * answered and nothing is proven. Proven means provesCheckout: exact canonical full-path equality
      * of a complete frame, no other checkout named, no incomplete frame.
+     * E1: with a `deadline` (create's window) there is ONE absolute deadline: a read is issued only while
+     * budget is left and is handed exactly that budget, and a page that still lands past it is late —
+     * nothing late proves the checkout. `seen` is what the scrollback showed, for the typed timeout:
+     * `misplaced` — a frame naming another checkout, a cut frame or an unparseable mark in anything read
+     * (the anchor's tail and every page included, even when paging stopped or a later read threw);
+     * `absent` — ONLY when every page down to the start of the scrollback was read before the ceiling
+     * and none carries a trace of the mark; `unread` — every other exit: PROOF_PAGES reached, a limited
+     * read with no (or the same) next cursor or a truncated anchor without one, a read that threw, a read
+     * the ceiling cut off or never let start (the anchor included), or a page that landed late (even one
+     * carrying the right proof), a malformed page (its tail or cursors), a blind stream page
+     * (isBlindStreamPage), or — F (D-832) — any page read whose paging metadata classifyProofPage cannot
+     * call complete or partial (flags missing, not boolean or contradicted; even when they were omitted,
+     * that page's bytes stay evidence and its matching proof still proves). Unread output is unknown —
+     * never an empty page, never absence.
+     * Without a deadline (reconcile, recovery) only `proven` is consumed.
      */
-    async checkoutProven(handle, checkout, from, runtimeId) {
+    async checkoutProven(handle, checkout, from, runtimeId, deadline) {
+        // F (D-832): a page read whose own metadata does not say how complete it is (classifyProofPage):
+        // its bytes are evidence, but the scrollback it came from is not known to be read whole.
+        let late = false, unknown = false;
         const page = async (cursor) => {
-            const env = await this.call("read", [
-                "terminal", "read", "--terminal", handle, ...(cursor === undefined ? [] : ["--cursor", cursor]), "--limit", String(this.pageLines),
-            ], from);
+            const budget = deadline === undefined ? undefined : deadline - this.time.now();
+            if (budget !== undefined && budget <= 0)
+                return undefined; // no budget left: the read is never issued
+            let env;
+            try {
+                env = await this.call("read", [
+                    "terminal", "read", "--terminal", handle, ...(cursor === undefined ? [] : ["--cursor", cursor]), "--limit", String(this.pageLines),
+                ], from, budget);
+            }
+            catch (error) {
+                if (deadline === undefined || this.time.now() < deadline)
+                    throw error;
+                return undefined; // the read the ceiling cut off: unread
+            }
+            if (deadline !== undefined && this.time.now() > deadline)
+                late = true;
             if (env.runtimeId !== runtimeId) {
                 throw new OrcaError("read", `proof page answered by runtime ${env.runtimeId}, not the listing's ${runtimeId}`, env.raw);
             }
@@ -985,39 +1081,117 @@ export class OrcaDriver {
             if (str(term.handle) !== handle) {
                 throw new OrcaError("read", `proof page names terminal ${str(term.handle) ?? "none"}, not the candidate ${handle}`, env.raw);
             }
-            return term;
+            // E1: only a well-formed page is read text. A tail that is missing, not an array or carries a
+            // non-string row (tailText), or a cursor that is not a non-empty string is a malformed page: it
+            // throws, so it is unread output — never filtered to an empty page that would read as an absent proof.
+            for (const key of ["oldestCursor", "nextCursor"]) {
+                if (term[key] !== undefined && str(term[key]) === undefined)
+                    throw new OrcaError("read", `proof page ${key} is not a cursor`, env.raw);
+            }
+            // E1: the OBS-1011 add.1 blind stream (exited, empty tail, zero lines returned) is the shape a
+            // live terminal's stream answers while its screen still paints — and a dead terminal's too. The
+            // stream alone cannot tell them apart, so its empty tail is unread scrollback, never absence.
+            if (isBlindStreamPage(term))
+                throw new OrcaError("read", "proof page is a blind stream page (status exited, empty tail): its scrollback is unread", env.raw);
+            const text = this.tailText("read", term, env.raw);
+            // F: paging flags missing, not boolean or contradicted by the cursors leave the page's bytes read
+            // but its completeness unknown — it ends paging, and the poll can never read as absent.
+            const kind = classifyProofPage(term);
+            if (kind === "unread")
+                unknown = true;
+            return { term, text, kind };
+        };
+        // Every validated read is evidence, whatever stops the next one: the anchor's tail and the pages
+        // read from the oldest cursor are inspected even when paging hits PROOF_PAGES or a read throws.
+        let tail = "", text = "";
+        const described = (why) => {
+            const misplaced = checkout !== undefined && [text, tail].some((t) => misplacedProof(t, checkout));
+            const shown = [text, tail].map(checkoutFrames);
+            const named = [...new Set(shown.flatMap((f) => f.complete))];
+            const flaw = shown.some((f) => f.incomplete) ? " and carries an incomplete proof frame"
+                : misplaced && named.length === 0 ? " and carries a malformed proof marker" : "";
+            return {
+                proven: false,
+                reason: `${why}its scrollback ${named.length ? `names ${named.join(", ")}` : "names no checkout"}${flaw}`,
+                ...(misplaced ? { seen: "misplaced" } : {}),
+            };
         };
-        const lines = (term) => Array.isArray(term.tail) ? term.tail.filter((l) => typeof l === "string") : [];
         try {
-            const anchor = await page();
+            const first = await page();
+            if (first === undefined)
+                return { proven: false, reason: "the ceiling cut off the proof read before any scrollback was read", seen: "unread" };
+            const anchor = first.term;
+            tail = first.text;
             let cursor = str(anchor.oldestCursor);
-            let text = cursor === undefined ? lines(anchor).join("\n") : "";
-            for (let n = 0; cursor !== undefined && n < PROOF_PAGES; n++) {
-                const term = await page(cursor);
-                text += `${lines(term).join("\n")}\n`;
+            // why paging ended with scrollback still unread. Every exit is one of: complete (an anchor that
+            // is the whole scrollback, or a page whose metadata says it is the last), whole frames found, a
+            // page whose completeness is unknown (`unknown`, classifyProofPage), or one of these.
+            let stop;
+            if (cursor === undefined) {
+                text = tail;
+                // A cursorless anchor that says it holds less than the scrollback leaves the rest unreadable.
+                if (first.kind === "partial")
+                    stop = "stalled";
+            }
+            for (let n = 0; cursor !== undefined; n++) {
+                if (n === PROOF_PAGES) {
+                    stop = "exhausted";
+                    break;
+                } // more scrollback than the bound: unread, not absent
+                const got = late ? undefined : await page(cursor);
+                if (got === undefined) {
+                    stop = "cut";
+                    break;
+                }
+                const term = got.term;
+                text += `${got.text}\n`;
                 const frames = checkoutFrames(text);
                 if (frames.complete.length > 0 && !frames.incomplete)
                     break; // whole frames, nothing dangling
+                if (got.kind === "complete")
+                    break; // the last page: the scrollback was read to its end
                 const next = str(term.nextCursor);
-                if (term.limited !== true || next === undefined || next === cursor)
+                const advancing = next !== undefined && next !== cursor;
+                if (got.kind === "unread") {
+                    // F: no absence rests on this page (`unknown`), but a cursor that still advances toward more
+                    // scrollback — the page says limited, or its next cursor is short of the latest one — is
+                    // followed for positive proof, inside PROOF_PAGES and the ceiling.
+                    if (advancing && (term.limited === true || next !== str(term.latestCursor))) {
+                        cursor = next;
+                        continue;
+                    }
+                    break;
+                }
+                // A partial page that is not limited, or a limited one with no next cursor or the same one, says
+                // more scrollback exists that no read can reach: unread, never absent.
+                if (term.limited !== true || !advancing) {
+                    stop = "stalled";
                     break;
+                }
                 cursor = next;
             }
             const frames = checkoutFrames(text);
             // Reconcile has no task-checkout path after a daemon restart, but the proof itself remains
             // an ownership record: exactly one complete, unambiguous checkout frame can only have been
             // written by tickmarkr's create command.  Slot recovery additionally requires its exact path.
-            if (checkout === undefined
+            // A stalled read proves only what it read, as before; a cut or exhausted one proves nothing.
+            const proven = stop !== "cut" && stop !== "exhausted" && (checkout === undefined
                 ? !frames.incomplete && frames.complete.length > 0 && new Set(frames.complete).size === 1
-                : provesCheckout(text, checkout))
+                : provesCheckout(text, checkout));
+            if (proven && !late)
                 return { proven: true, reason: "" };
-            return {
-                proven: false,
-                reason: `its scrollback ${frames.complete.length ? `names ${[...new Set(frames.complete)].join(", ")}` : "names no checkout"}${frames.incomplete ? " and carries an incomplete proof frame" : ""}`,
-            };
+            const why = `${late ? "read past the ceiling, " : ""}${stop === "cut" ? "the ceiling cut off paging, "
+                : stop === "exhausted" ? `paging stopped at ${PROOF_PAGES} pages with scrollback unread, `
+                    : stop === "stalled" ? "a limited read gave no next cursor with scrollback unread, " : ""}${unknown ? "a page carried missing, non-boolean or contradictory paging metadata, " : ""}`;
+            const read = described(why);
+            // F: absent only when every page read said, explicitly and consistently, how complete it was.
+            return { ...read, seen: read.seen ?? (stop || late || unknown ? "unread" : "absent") };
         }
         catch (error) {
-            return { proven: false, reason: error instanceof Error ? error.message : String(error) };
+            // A read that failed midway keeps what was already read as evidence; what it could not read is
+            // unread output — never an absent proof.
+            const read = described(""), failed = error instanceof Error ? error.message : String(error);
+            return { ...read, reason: tail || text ? `${read.reason}; then a read failed — ${failed}` : failed, seen: read.seen ?? "unread" };
         }
     }
     async recover(family, st, newRuntimeId, raw, opts) {

package/dist/gates/cache.d.ts

@@ -13,6 +13,10 @@ export declare function getWorktreeTree(worktree: string): Promise<string>;
  * ponytail: a named list, not the whole env (pids and terminal vars would defeat every reuse); extend
  * it when another variable is shown to change what a runner executes. */
 export declare const RUNNER_ENV_KEYS: readonly ["PATH", "NODE_OPTIONS", "NODE_PATH", "NODE_ENV", "TZ"];
+/** A2: NODE_OPTIONS is hashed as the child RECEIVES it (shell appends the Darwin title preload), plus the
+ * preload's content identity, so a replaced preload, the opt-out or a refused preflight never reuses a
+ * verdict or baseline measured under another mode. Native mode hashes the pre-A2 inputs less any inherited
+ * managed preload, which shell removes from that child too. */
 export declare function runnerInputsHash(env?: NodeJS.ProcessEnv): string;
 export interface GateEnvironmentInput {
     nodeRuntime?: string;

package/dist/gates/cache.js

@@ -5,6 +5,7 @@ import { dirname, join, relative, resolve } from "node:path";
 import { tmpdir } from "node:os";
 import { checkoutIncarnation, describeCapacity, inventoryDependencyLinks, resolvedCapacity, shGit, verificationProtocol } from "../run/git.js";
 import { shq } from "../adapters/types.js";
+import { titleEnvironment } from "../run/title-environment.js";
 export const DEFAULT_VERDICT_CACHE_BOUND = 128;
 let testCacheBound;
 export function setVerdictCacheBoundForTests(bound) {
@@ -81,9 +82,16 @@ export async function getWorktreeTree(worktree) {
  * ponytail: a named list, not the whole env (pids and terminal vars would defeat every reuse); extend
  * it when another variable is shown to change what a runner executes. */
 export const RUNNER_ENV_KEYS = ["PATH", "NODE_OPTIONS", "NODE_PATH", "NODE_ENV", "TZ"];
+/** A2: NODE_OPTIONS is hashed as the child RECEIVES it (shell appends the Darwin title preload), plus the
+ * preload's content identity, so a replaced preload, the opt-out or a refused preflight never reuses a
+ * verdict or baseline measured under another mode. Native mode hashes the pre-A2 inputs less any inherited
+ * managed preload, which shell removes from that child too. */
 export function runnerInputsHash(env = process.env) {
-    return createHash("sha256").update(canonicalJson(Object.fromEntries(RUNNER_ENV_KEYS.map((k) => [k, env[k] ?? null]))))
-        .digest("hex").slice(0, 16);
+    const title = titleEnvironment(env);
+    const inputs = Object.fromEntries(RUNNER_ENV_KEYS.map((k) => [k, (k === "NODE_OPTIONS" ? title.nodeOptions : env[k]) ?? null]));
+    if (title.mode === "preload")
+        inputs.titlePreload = title.identity;
+    return createHash("sha256").update(canonicalJson(inputs)).digest("hex").slice(0, 16);
 }
 export function environmentFingerprint(env) {
     const nodeRuntime = env.nodeRuntime ?? process.version;

package/dist/gates/llm.d.ts

@@ -1,6 +1,7 @@
 import { type WorkerAdapter } from "../adapters/types.js";
 import type { Effort } from "../graph/schema.js";
 import { type ExecutorDriver, type Slot } from "../drivers/types.js";
+import type { SeatLaunchCause } from "../drivers/orca.js";
 export declare const GATE_PANE_SEP = " \u00B7 ";
 export declare const COMPLETION_FAKING_CHECKLIST = "## Completion-faking checklist\nHunt for these concrete completion-faking shortcuts before ruling on any criterion:\n- hardcoded-result: output or fixture hardcoded to satisfy the stated criterion instead of real logic\n- test-weakening: tests skipped, deleted, or assertions loosened until failing behavior looks green\n- vacuous-assertion: a test that cannot fail (asserts a constant, asserts its own setup, no assertion)\n- fixture-overfit: implementation narrowed to the exact test inputs rather than the described behavior\n- echo-not-implement: criterion text echoed in names, comments, or strings without the behavior itself\n- stub-left-behind: TODO, throw, or no-op stub where the real implementation should be\n- error-swallowing: catch or fallback that hides failures instead of handling them\n- self-mocking: the code under test mocked or faked so the test exercises the mock\n- check-bypass: lint, type, or CI checks disabled, relaxed, or excluded to get green\n- rename-as-work: code moved or renamed and presented as the requested change\n- scope-padding: unrelated edits padding the diff while the criterion's behavior is untouched\nWhen a criterion fails, the verdict MUST name which shortcut above it matches, or state that none does.";
 /** Fable F3: per-call nonce echoed in verdict JSON and gate exit markers. */
@@ -70,9 +71,11 @@ export interface LlmRunResult {
 export declare const PROMPT_GLYPHS: readonly ["➜", "❯", "$", "%", ">>", ">"];
 export declare function reviewSeatOutput(raw: string, nonce: string, adapterBannerRows?: readonly string[]): string;
 /** OBS-1168(b): a judge/review seat whose pane could not be created or launched. Typed so the gates can
- * contain it as seat recovery (another seat) or an infra park — never as a worker failure. */
+ * contain it as seat recovery (another seat) or an infra park — never as a worker failure. E1: the
+ * driver's typed launch cause survives the wrap as a field; the message alone is prose. */
 export declare class SeatLaunchError extends Error {
     readonly seat: string;
+    readonly launchCause?: SeatLaunchCause;
     constructor(seat: string, cause: unknown);
 }
 export declare const REVIEW_FIRST_LIVENESS_MS = 30000;

package/dist/gates/llm.js

@@ -303,13 +303,18 @@ export function reviewSeatOutput(raw, nonce, adapterBannerRows = []) {
     return trailer ? seat.slice(0, trailer.index) : seat;
 }
 /** OBS-1168(b): a judge/review seat whose pane could not be created or launched. Typed so the gates can
- * contain it as seat recovery (another seat) or an infra park — never as a worker failure. */
+ * contain it as seat recovery (another seat) or an infra park — never as a worker failure. E1: the
+ * driver's typed launch cause survives the wrap as a field; the message alone is prose. */
 export class SeatLaunchError extends Error {
     seat;
+    launchCause;
     constructor(seat, cause) {
         super(`seat ${seat} failed to launch: ${cause instanceof Error ? cause.message : String(cause)}`);
         this.seat = seat;
         this.name = "SeatLaunchError";
+        const launchCause = cause?.launchCause;
+        if (launchCause === "checkout-proof-timeout")
+            this.launchCause = launchCause;
     }
 }
 export const REVIEW_FIRST_LIVENESS_MS = 30_000;

package/dist/gates/review.js

@@ -367,7 +367,9 @@ function daemonRepoRoot(worktree, artifactDir) {
 export function renderPriorMaterials(priorMaterials) {
     const fingerprints = priorMaterials.map((finding, i) => {
         const observed = observedReviewFingerprints(finding);
-        const heading = observed.length > 1 ? `Finding ${i + 1} (choose one observed spelling):\n` : "";
+        // E2 (T4 D-766): every finding is headed. A one-spelling finding left unheaded read as one more
+        // spelling of the multi-spelling finding above it, so a faithful seat closed F1 alone.
+        const heading = observed.length > 1 ? `Finding ${i + 1} (choose one observed spelling):\n` : `Finding ${i + 1}:\n`;
         return heading + observed.map((id) => `Fingerprint: ${id}`).join("\n");
     }).join("\n");
     return `## Prior materials this attempt must close
@@ -642,11 +644,14 @@ ${responseRequirement}
             throw error;
         // OBS-1168(b): the seat never launched, so there is no verdict and nothing about the WORK. A typed
         // no-verdict re-routes to another seat in run-gates; an exhausted pool is an infra park.
+        // E1: the cause stays seat-launch-failed; a typed launchCause rides beside it, never replaces it.
+        const launch = error.launchCause ? `; launchCause: ${error.launchCause}` : "";
         return { gate: "review", pass: false,
-            details: `review dispatch failed — ${error.message} (reviewer ${reviewer.adapter}:${reviewer.model}; vendor: ${reviewer.vendor}; provider: ${provider}; cause: seat-launch-failed) — failing closed`,
+            details: `review dispatch failed — ${error.message} (reviewer ${reviewer.adapter}:${reviewer.model}; vendor: ${reviewer.vendor}; provider: ${provider}; cause: seat-launch-failed${launch}) — failing closed`,
             meta: { ...policyMeta, ...rotationMeta, ...floorMeta, reviewer: channelKey(reviewer), reviewerTier: reviewer.tier,
                 vendor: reviewer.vendor, provider, noVerdict: true, classification: "infra", infra: true,
-                cause: "seat-launch-failed", ...(savedBrief ? { briefPath: savedBrief } : {}) } };
+                cause: "seat-launch-failed", ...(error.launchCause ? { launchCause: error.launchCause } : {}),
+                ...(savedBrief ? { briefPath: savedBrief } : {}) } };
     }
     const raw = llm.output;
     let saved;

package/dist/gates/run-gates.d.ts

@@ -75,8 +75,9 @@ export interface GateContext {
     reviewNoVerdicts?: Map<string, string[]>;
     recheck?: boolean;
     /** Explicit worker funding requires fresh red measurements, never a gate waiver. OBS-1106: so does
-     * a retry that landed nothing on a timeout-class red — its one fresh re-observation. */
-    cachedRedBypass?: "operator-rerun" | "timeout-fresh";
+     * a retry that landed nothing on a timeout-class red — its one fresh re-observation. C: and one whose
+     * unchanged red is attributed wholly outside the task's files[] — its one fresh re-execution. */
+    cachedRedBypass?: "operator-rerun" | "timeout-fresh" | "out-of-scope-fresh";
     carriedAuthors?: readonly string[];
     /** The attempt whose worker last wrote the gated checkout; a dirty-tree refusal stamps it on the
      * preserve commit and its row. Absent (standalone verify, gate-only restores) preserves as "unknown". */
@@ -108,7 +109,8 @@ export declare function screenCostRatio(baseline: Baseline, selected: readonly s
 /** A retry base no runner invocation parses. evaluateManifestedTest builds its stranded single-fork
  * retry from the base it is handed, and one it cannot parse throws before any spawn — so this base
  * disables that inner recovery: a worker-RPC-stranded re-observation comes back infra (the caller
- * parks it as ambiguous) instead of launching a second execution. */
+ * parks it as ambiguous) instead of launching a second execution. runVitestManifestGate reads it as
+ * the mark of a diagnostic subset, which never buys the outer timeout-shaped remeasurement either. */
 export declare const REOBSERVATION_RETRY_BASE = "tickmarkr-reobservation-refuses-stranded-retry";
 /** OBS-1106 residual: ONE isolated re-observation of a timeout-shaped red's attributed failing files on
  * the same checkout, narrowed exactly as a screen is. Never cached and never a verdict: the caller