tickmarkr 2.6.4 → 2.6.6

package/dist/run/daemon.js

@@ -4,7 +4,7 @@ import { COMMAND_LEASE_TOKEN_ENV, commandLeaseEnvironment, CommandLeases, curren
 import { execFileSync, spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { shq } from "../adapters/types.js";
-import { appendFileSync, closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, readlinkSync, readSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { appendFileSync, closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, readlinkSync, readSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
@@ -23,6 +23,7 @@ import { formatOwnedName } from "../drivers/types.js";
 import { captureBaseline, detectGateCommands, detectVacuousOracles } from "../gates/baseline.js";
 import { reobserveTestFiles, runGates } from "../gates/run-gates.js";
 import { isInfraResult } from "../gates/cache.js";
+import { RUNNER_INFRA_DIAGNOSTIC_RE, timeoutShaped } from "../gates/timeout-shaped.js";
 import { filesGlob } from "../graph/files-glob.js";
 import { addEvidence, attributeBlocked, batteryPriority, blockedTasks, getTask, graphDefinitionHash, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus, taskContentDigest, tickmarkrDir } from "../graph/graph.js";
 import { GATE_NAMES } from "../graph/schema.js";
@@ -32,11 +33,12 @@ import { executionSignal, remainingExecutionMs, withExecutionBudget, withoutExec
 import { repairSelectionDecision, repairSelectionEnabled } from "./repair-selection.js";
 import { failureDisposition, reserveInfrastructureRetry } from "./recovery.js";
 import { runEnvironment } from "./environment.js";
-import { changeRepresented, cleanupRunWorktrees, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER, preserveWorktree, producerFields, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shGit, SUITE_PARENT_ENV, verificationProtocol, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
+import { changeRepresented, cleanupRunWorktrees, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER, preserveWorktree, producerFields, removeWorktree, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shGit, SUITE_PARENT_ENV, verificationProtocol, WORKTREE_LAYOUT_CONTRACT, WORKTREES_DIR, worktreePath } from "./git.js";
+import { MASK } from "./redact.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
 import { classifyRepairDisposition, resolveScopeHints } from "./repair-disposition.js";
 import { applyScopeAmendments, activeRetryBan, interruptedAttempt, RESUME_HARVEST_SOURCE, resumeHarvestAuthor, approvalAction, APPROVAL_REFUSED, bindingToken, effectiveEvents, foldDecisions, physicalLine, staleApprovals, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, readableExcerpt, receiptOrigin, outstandingReviewFindings, pendingApprovalActions, pendingRechecks, pendingRepairFindings, phaseForGate, priorJudgments, readPriorRunEvidence, recordedTaskFailureKind, reraisedReviewChains, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, standingRulings, structuredFindings, upheldFeedbackByTask } from "./journal.js";
-import { gateReviewerFloor, isDiffCapPark, isGarbageReview, pickReviewer } from "../gates/review.js";
+import { carriedAuthorVendors, gateReviewerFloor, isDiffCapPark, isGarbageReview, pickReviewer } from "../gates/review.js";
 import { acquireApprovalSerialization, acquireRunLock, isPidLive, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, reusedTipEvidence, verifyIntegrationTip } from "./merge.js";
 import { channelExclusion, climbChannel, inTaskPool, marginalCostRank, nextChannel, poolExhaustion, route, taskPool } from "../route/router.js";
@@ -374,9 +376,49 @@ function classifyInfraResult(g) {
 // diagnostics (never-started files, a worker RPC timeout) that make such a red infrastructure-SHAPED.
 // Shape alone never parks anything: it only buys one isolated re-observation before a charge. A
 // fresh-fingerprint section masks digits to `#`, so both spellings of a number are read.
-const TIMEOUT_SHAPED_RE = /\b(?:Test|Hook) timed out in (?:\d+|#)\s*ms\b|\bexpected (?:\d+|#)(?:\.(?:\d+|#))? to be (?:less than|below)(?: or equal to)? (?:\d+|#)/i;
-const RUNNER_INFRA_DIAGNOSTIC_RE = /\bnever-started (?:[1-9]\d*|#)(?![\d#])|\[vitest-worker\]: Timeout calling\b/;
-const timeoutShaped = (details) => TIMEOUT_SHAPED_RE.test(readableExcerpt(details));
+/** C (E1): the one no-verdict that is the host's slowness, not the seat's — the same predicate run-gates
+ * applies to its run-scoped tally, read here for the live task strike and the resume reconstruction. */
+const proofTimeoutNote = (data) => data.cause === "seat-launch-failed" && data.launchCause === "checkout-proof-timeout";
+/** C: the gate-fresh-forced reason that bounds the out-of-scope re-execution, one per journaled subject. */
+const OUTSIDE_SCOPE_RED = "no-commit-out-of-scope-red";
+const NAMED_FAILURE_FILE_RE = /^\s*(\S+\.(?:test|spec)\.[cm]?[jt]sx?)\s+>/gm;
+/** D-854: the runner certificate the vitest manifest path appends to a red (test-manifest.ts). */
+const RUNNER_CERTIFICATE_RE = /runner-level diagnostic: never-started ([^;\s]+); reporter errors ([^;\s]+)/g;
+/** C: a journaled test red whose failing-file attribution is nonempty, trustworthy and complete (repair
+ * selection's own rule: a behavioral red on a real subject from a full suite or a screen that names
+ * every failure), POSITIVELY certified complete by its runner, uncontradicted by the files its own text
+ * names, and wholly outside a declared files[]. Empty files[] is unrestricted and never qualifies;
+ * every other shape keeps its replay. */
+function outsideScopeRed(t, taskId, data, commit) {
+    if (!t.files.length || data.gate !== "test" || data.pass !== false || data.skipped === true || data.commit !== commit
+        // a failed producer — an infra row, a dirty-tree refusal, a recovery the runner could not finish —
+        // never attributes anything, whatever files it lists
+        || data.infra === true || data.dirtyWorktree === true || data.recoveryBlocked !== undefined)
+        return false;
+    const attribution = repairSelectionDecision([{ event: "gate-result", taskId, data }], taskId, true);
+    if (attribution.reason !== "known-failing-files" || attribution.requiredFiles.length === 0)
+        return false;
+    const text = readableExcerpt(String(data.details ?? ""));
+    // D-854: validate, never filter. A collection failure has no module record, so failingFiles omits it
+    // and it lives only in the certificate's counts; any never-started file or reporter error, an unknown
+    // count, or no certificate at all leaves the attribution unproven.
+    // ponytail: a nonzero count never qualifies, even when each diagnostic names an outside file — the
+    // details interleave diagnostics with the stdout tail; map them only if outside-scope collection reds need it.
+    const certificates = [...text.matchAll(RUNNER_CERTIFICATE_RE)];
+    if (!certificates.length || certificates.some((m) => m[1] !== "0" || m[2] !== "0"))
+        return false;
+    const named = [...text.matchAll(ATTRIBUTED_FILE_RE), ...text.matchAll(NAMED_FAILURE_FILE_RE)].map((m) => m[1].replace(/^\.\//, ""));
+    if (named.some((file) => !attribution.requiredFiles.includes(file)))
+        return false; // contradictory
+    const inScope = filesGlob(t.files);
+    return attribution.requiredFiles.every((file) => !inScope(file));
+}
+/** C: every test red a round journaled on `commit` is an out-of-scope red (none means none). */
+const allOutsideScopeReds = (t, rows, commit) => {
+    const reds = rows.filter((e) => e.event === "gate-result" && e.data.gate === "test" && e.data.pass === false
+        && e.data.skipped !== true && e.data.commit === commit);
+    return reds.length > 0 && reds.every((e) => outsideScopeRed(t, e.taskId ?? t.id, e.data, commit));
+};
 const ATTRIBUTED_FILE_RE = /^\s*(?:FAIL|×|✗)\s+(?:\|[^|\n]*\|\s+)?(\S+\.(?:test|spec)\.[cm]?[jt]sx?)\b/gm;
 /** The failing files a red attributes to itself: the runner's own list, else its FAIL headlines. */
 const attributedFailingFiles = (g) => [...new Set(Array.isArray(g.meta?.failingFiles) && g.meta.failingFiles.length
@@ -2203,10 +2245,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                 // is what bounds a seat that flakes once per task (or once per session) across the run. Seeded from the
                 // journal's review-no-verdict rows — the same notes noteReviewEvent appends — so a resumed daemon keeps
                 // the count; run-gates appends to it in place, exactly as it does demotedReviewers.
+                // C (E1): a checkout-proof timeout never struck the live tally (run-gates), so a resume never seeds one.
                 const reviewNoVerdicts = new Map();
                 for (const event of journal.read()) {
                     if (event.event !== "review-no-verdict" || event.data.noVerdict !== true || typeof event.data.reviewer !== "string")
                         continue;
+                    if (proofTimeoutNote(event.data))
+                        continue;
                     reviewNoVerdicts.set(event.data.reviewer, [...(reviewNoVerdicts.get(event.data.reviewer) ?? []), String(event.data.cause)]);
                 }
                 const reviewHistory = journal.read()
@@ -2644,7 +2689,29 @@ export async function runDaemon(repoRoot, opts = {}) {
                             to: loadedHash,
                         });
                     }
-                    baseline = JSON.parse(readFileSync(join(journal.dir, "baseline.json"), "utf8"));
+                    // B (D-812): a daemon interrupted inside its capture leaves run-start without baseline.json. Only
+                    // that absence recaptures; existing bytes that do not parse fail closed and are never written over.
+                    const baselinePath = join(journal.dir, "baseline.json");
+                    let recapture = false;
+                    try {
+                        baseline = JSON.parse(readFileSync(baselinePath, "utf8"));
+                    }
+                    catch (error) {
+                        if (error.code !== "ENOENT") {
+                            throw new Error(`refusing to resume ${runId}: existing baseline.json is unreadable (${error instanceof Error ? error.message : String(error)}) — it is never recaptured over`);
+                        }
+                        // The recapture measures run-start's commands; current config is no authority for that base.
+                        // Only unmasked bytes prove equality: redaction maps a changed credential onto the same mask, so a
+                        // journaled command carrying the mask cannot be proven unchanged and is refused like a change.
+                        const recorded = (typeof start.data.commands === "object" && start.data.commands !== null ? start.data.commands : {});
+                        const effective = commands;
+                        const changed = [...new Set([...Object.keys(recorded), ...Object.keys(effective)])]
+                            .filter((name) => recorded[name] !== effective[name] || String(recorded[name]).includes(MASK)).sort();
+                        if (changed.length > 0) {
+                            throw new Error(`refusing to resume ${runId}: baseline recapture refused — effective commands differ from (or are masked in) run-start's journaled commands: ${changed.join(", ")}`);
+                        }
+                        recapture = true;
+                    }
                     const replayEvents = journal.read();
                     // journal.replayStatuses predates typed releases and re-pends even inert rows. Keep that
                     // legacy reader intact; scheduling accepts only the fold's recognised authorities.
@@ -2693,8 +2760,47 @@ export async function runDaemon(repoRoot, opts = {}) {
                     });
                     runStarted = true;
                     await placeBoard();
-                    // A terminal resume with no commands has no execution to admit.
-                    if (Object.keys(commands).length > 0 || graph.tasks.some(t => ["pending", "running", "gated"].includes(t.status))) {
+                    if (recapture) {
+                        // Moved HEAD is never baseline authority: measure the journaled base in a detached checkout this
+                        // daemon owns, and publish by rename so any interruption leaves no baseline.json or a whole one.
+                        journal.append("baseline-recapture-start", undefined, { baseRef, commands, capacity: resolvedCapacity() });
+                        baselinePending = true;
+                        baselineCapture = withCommandContext(undefined, async () => {
+                            const parent = join(tickmarkrDir(repoRoot), WORKTREES_DIR);
+                            mkdirSync(parent, { recursive: true });
+                            // A killed daemon never reaches the finally below; sweep checkouts whose owner is dead.
+                            for (const entry of readdirSync(parent)) {
+                                const owner = /^baseline-recapture-(\d+)-\w{6}$/.exec(entry)?.[1];
+                                if (owner && !isPidLive(Number(owner)))
+                                    await removeWorktree(repoRoot, join(parent, entry));
+                            }
+                            const pristine = mkdtempSync(join(parent, `baseline-recapture-${process.pid}-`));
+                            const staged = `${baselinePath}.${process.pid}.tmp`;
+                            try {
+                                const added = await shGit(`git worktree add --detach ${shq(pristine)} ${shq(baseRef)}`, repoRoot);
+                                if (added.code !== 0)
+                                    throw new Error(`baseline recapture: journaled base ${baseRef} cannot be checked out: ${added.stderr.trim()}`);
+                                if (!linkNodeModules(repoRoot, pristine, { force: true }))
+                                    throw new Error("baseline recapture: pristine node_modules link could not be provisioned");
+                                await initializeHost();
+                                const captured = { ...await captureBaseline(pristine, commands),
+                                    provenance: { baseRef, capturedAt: new Date().toISOString() } };
+                                writeFileSync(staged, JSON.stringify(captured, null, 2));
+                                renameSync(staged, baselinePath);
+                                baseline = captured;
+                                journal.append("baseline-recapture-complete", undefined, { provenance: captured.provenance });
+                                for (const warning of captured.warnings ?? [])
+                                    journal.append("baseline-warning", undefined, { ...warning });
+                            }
+                            finally {
+                                rmSync(staged, { force: true });
+                                await removeWorktree(repoRoot, pristine);
+                            }
+                        }).finally(() => { baselinePending = false; });
+                        void baselineCapture.catch(() => { baselineFailed = true; });
+                    }
+                    else if (Object.keys(commands).length > 0 || graph.tasks.some(t => ["pending", "running", "gated"].includes(t.status))) {
+                        // A terminal resume with no commands has no execution to admit.
                         baselineCapture = initializeHost();
                         void baselineCapture.catch(() => { baselineFailed = true; });
                     }
@@ -2930,6 +3036,18 @@ export async function runDaemon(repoRoot, opts = {}) {
                     return red !== undefined
                         && identicalGateFailures(journal.read(), t.id, "test", normalizeGateFailure(String(red.data.details))) < GATE_FINGERPRINT_CAP;
                 };
+                // C: an unchanged cached test red attributed wholly outside files[] is re-executed ONCE per journaled
+                // subject — the worker cannot repair those files, so a copy of the red would only buy another round.
+                const owesOutsideScopeRefresh = (t, priorRows, commit) => allOutsideScopeReds(t, priorRows, commit)
+                    && !journal.read().some((e) => e.taskId === t.id && e.event === "gate-fresh-forced"
+                        && e.data.reason === OUTSIDE_SCOPE_RED && e.data.commit === commit);
+                // C: the forced re-execution's own round failed again only outside files[]: independent evidence the
+                // worker cannot act on. It keeps its red row and parks gate-fail before any cap, consult or repair move.
+                const freshOutsideScopeRed = (t, commit) => {
+                    const own = journal.read().filter((e) => e.taskId === t.id);
+                    return allOutsideScopeReds(t, own.slice(own.map((e) => e.event === "phase-start" && e.data.phase === "gates").lastIndexOf(true) + 1), commit);
+                };
+                const outsideScopePark = (t) => gateFailApprovalReason(t.id, "test: a fresh re-execution of the unchanged subject failed again only in files outside files[] — no repair can reach them");
                 // OBS-1106 residual: before a timeout or wall-budget red accompanied by runner infra diagnostics is
                 // charged, its attributed failing files are re-run ONCE, on the same checkout, under the suite
                 // lease. Only a reproduced assertion is charged. A pass, an infra rerun, a rerun naming none of the
@@ -3297,11 +3415,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                     }
                     // Keep one live list: recovery retries must see exclusions added by onGate during the round.
                     const badReviewers = [...replayedReviewerExclusions];
+                    // C (E1): a checkout-proof timeout is the host being slow, not the seat failing — it is excluded for
+                    // the CURRENT round only (so an always-timeout pool still ends the round), never struck task-wide.
+                    let roundTimeouts = [];
                     const noteReviewEvent = (e) => {
                         journal.append(e.name, t.id, e.payload);
                         if (e.name === "review-no-verdict" && typeof e.payload.reviewer === "string") {
-                            if (!badReviewers.includes(e.payload.reviewer))
-                                badReviewers.push(e.payload.reviewer);
+                            const strikes = proofTimeoutNote(e.payload) ? roundTimeouts : badReviewers;
+                            if (!strikes.includes(e.payload.reviewer))
+                                strikes.push(e.payload.reviewer);
                         }
                         // OBS-1196: a seat whose same-subject re-emission delivered a valid verdict was a delivery flake,
                         // not a bad reviewer — it stays seatable for this task's later rounds.
@@ -3337,17 +3459,31 @@ export async function runDaemon(repoRoot, opts = {}) {
                             gateRound: journal.read().filter((row) => row.taskId === task.id
                                 && row.event === "phase-start" && row.data.phase === "gates").length,
                         };
-                        const round = await runGates(task, ctx);
+                        roundTimeouts = [];
+                        // C: every gate-round boundary — a returned or a THROWN round — publishes the one row held behind
+                        // a still-pending sibling and forgets the pending set, before any park or task-failed row lands.
+                        const gateRound = async (subject) => {
+                            try {
+                                return await runGates(subject, { ...ctx, excludeReviewers: [...badReviewers, ...roundTimeouts] });
+                            }
+                            finally {
+                                settleParallelRound();
+                            }
+                        };
+                        const round = await gateRound(task);
                         let review = round.results.find((g) => g.gate === "review");
+                        // The recovery pick carries every preserved author, exactly as reviewGate's own pick does.
+                        const authors = ctx.carriedAuthors?.length ? [...ctx.carriedAuthors] : [channelKey(ctx.author)];
                         while (review?.meta?.noVerdict === true) {
                             // Recovery must honor the gate's floor, including the seats that just failed to
-                            // return a verdict; a below-floor alternative cannot replace the infra result.
-                            const { floor } = gateReviewerFloor(task, ctx.cfg, ctx.author, ctx.channels, [...(ctx.priorReviewers ?? []), ...badReviewers]);
-                            const next = pickReviewer(ctx.author, ctx.channels, badReviewers, cfg.review.prefer ?? [], floor, reviewHistory, undefined, demotedReviewers);
+                            // return a verdict; a below-floor alternative cannot replace the infra result. This round's
+                            // proof timeouts count too — runGates folds every excluded seat into its own floor.
+                            const { floor } = gateReviewerFloor(task, ctx.cfg, ctx.author, ctx.channels, [...(ctx.priorReviewers ?? []), ...badReviewers, ...roundTimeouts]);
+                            const next = pickReviewer(ctx.author, ctx.channels, [...badReviewers, ...roundTimeouts], cfg.review.prefer ?? [], floor, reviewHistory, undefined, demotedReviewers, carriedAuthorVendors(ctx.channels, authors), authors);
                             if (!next)
                                 break;
                             journal.append("review-infra-retry", t.id, { reviewer: channelKey(next), cause: review.meta.cause });
-                            const retried = await runGates({ ...task, gates: ["review"] }, ctx);
+                            const retried = await gateRound({ ...task, gates: ["review"] });
                             const replacement = retried.results.find((g) => g.gate === "review");
                             // A dirty tree or another pre-dispatch refusal must still fail closed.
                             if (!replacement) {
@@ -3374,13 +3510,16 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 gate: "review", flaked: rr.flaked, retried: rr.retried,
                                 ...(g.meta?.unparseable === true ? { secondUnparseable: true } : {}),
                             });
-                            badReviewers.push(rr.flaked);
+                            // C (E1): a seat re-routed after a checkout-proof timeout is excluded for this round only.
+                            if (!roundTimeouts.includes(rr.flaked))
+                                badReviewers.push(rr.flaked);
                         }
                     };
                     // v1.85 T3 (ruling R4): every BLOCKING review/judge result lands its findings in the journal
                     // structured — class + canonical path + stable symbol — so a retry, a consult or an auto-uphold
                     // decision reads identity instead of re-parsing prose, and line-number churn is not a new finding.
                     // One helper, both onGate sites (satisfied-gate resume + main attempt loop).
+                    // `journaledGates` narrows replayMeasurement to the gates an interrupted round already journaled (C).
                     let gateSubject;
                     const journalGateResult = (g) => {
                         const blocking = g.meta?.infra !== true && gateFailed(g) && (g.gate === "review" || g.gate === "acceptance");
@@ -3416,7 +3555,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             // for the worktree it ran in; absent only for a row that never went through the battery.
                             ...(g.meta?.verification !== undefined ? { verification: g.meta.verification } : {}),
                             ...(gateSubject ? { commit: gateSubject.commit, attempt: gateSubject.attempt } : {}),
-                            ...(gateSubject?.replayMeasurement ? { replayMeasurement: true } : {}),
+                            ...(gateSubject?.replayMeasurement && (gateSubject.journaledGates?.includes(g.gate) ?? true) ? { replayMeasurement: true } : {}),
                             ...(gateSubject?.replayedFromAttempt !== undefined ? { replayedFromAttempt: gateSubject.replayedFromAttempt } : {}),
                             ...(g.meta?.skipped === true || noVerdictReview ? { skipped: true } : {}),
                             // T9: an infra-only exit is journaled AS one. The operator reading a red `test` row has to
@@ -3530,10 +3669,17 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // ever held, and only while an earlier sibling is still in flight — a review that finishes first
                     // waits for acceptance, never the reverse. That keeps T4's durability where it pays (the first
                     // verdict to land is still published immediately) and bounds the exposure to one row for the
-                    // remainder of one already-running gate. A gate that THROWS kills the round before merge, so a
-                    // row held behind it is lost with the round it belonged to — not a verdict that could have merged.
+                    // remainder of one already-running gate. A gate that THROWS still ends its round: C publishes the
+                    // row held behind it at that boundary (settleParallelRound), so it is never lost or carried over.
                     const parallelPending = new Set();
                     let heldParallel;
+                    const settleParallelRound = () => {
+                        parallelPending.clear();
+                        const held = heldParallel;
+                        heldParallel = undefined;
+                        if (liveEngagement())
+                            held?.();
+                    };
                     const notePhaseStart = (e) => {
                         const active = activeGatePhases.get(t.id) ?? new Set();
                         active.add(e.gate);
@@ -3623,6 +3769,81 @@ export async function runDaemon(repoRoot, opts = {}) {
                     let testGateFailed = journal.read().some((e) => e.event === "gate-result" && e.taskId === t.id && e.data.gate === "test" && e.data.pass === false
                         && !(cfg.executionPolicy?.boundedInfrastructure && e.data.disposition === "infrastructure"));
                     let retryMode = "fresh";
+                    // v2.6.6 A: the ONE post-result settlement both gate loops call. Order is the contract:
+                    // satisfied → merge (tip-moved once regates, twice parks; a conflict goes back to the caller), else
+                    // noEligible → infra → diff-cap → adjudication → outside-scope → disposition, and whatever survives
+                    // is the caller's "red". Every declared resume/live difference arrives as a parameter; nothing here
+                    // normalizes one. Preparation, replay, conflict handling, repair funding, feedback and cleanup stay
+                    // in the callers.
+                    const settleResults = async (results, p) => {
+                        const parkAs = (reason, kind) => park(t, reason, kind, p.author, p.attempts, startMs, gateFails, consults, tokens, metered, retryMode);
+                        if (results.every(gateSatisfied)) {
+                            p.beforeMerge?.();
+                            const m = await mergeSerial(p.taskBranch, t, p.gated);
+                            if (m.tipMoved) {
+                                journal.append("tip-moved", t.id, m.tipMoved);
+                                if (tipMoves++ === 0)
+                                    return { kind: "regate" };
+                                await parkAs("task branch tip moved twice after gating", "tip-moved");
+                                return { kind: "parked" };
+                            }
+                            if (!m.ok) {
+                                journal.append("merge-conflict", t.id, { conflict: m.conflict });
+                                return { kind: "conflict", conflict: m.conflict };
+                            }
+                            graph = setStatus(graph, t.id, "done");
+                            saveGraph(repoRoot, graph);
+                            journal.append("task-done", t.id, {
+                                attempts: p.attempts, assignment: p.author, taskContentDigest: contentDigest,
+                                authors: mergedAuthors(await subjectAuthors(journal.read(), t.id, p.wt, p.taskBase)),
+                            });
+                            journal.append("merge", t.id, { branch: p.taskBranch, commit: await integrationHead(intWt) });
+                            await trackedDriver.project?.(t.id, "completed");
+                            // firstAttemptOk/gateFails/consults are recorded FACTS, not policy — a parkKind:"stall" row is
+                            // recorded but NOT quality-negative in v1.6; Phase 12 owns reward policy, so flipping it later needs zero data migration.
+                            journal.telemetry({
+                                taskId: t.id, shape: t.shape, adapter: p.author.adapter, model: p.author.model,
+                                channel: p.author.channel, attempts: p.attempts, outcome: "done",
+                                durationMs: Date.now() - startMs, firstAttemptOk: p.firstAttemptOk, gateFails, consults, ...p.metering, retryMode,
+                            });
+                            return { kind: "merged" };
+                        }
+                        // OBS-540: infra is a fail-closed NON-verdict, not quality degradation. Park with the blocker
+                        // already journaled by onGate, before gateFails and before any ladder selection can fund an
+                        // identical retry in the same environment. Parsed judge refusals never carry infra and keep
+                        // flowing through the chargeable quality path below.
+                        const unavailableReview = results.find((g) => gateFailed(g) && g.meta?.noEligibleReviewer === true);
+                        if (unavailableReview) {
+                            await parkAs(gateFailApprovalReason(t.id, unavailableReview.details, true), "gate-fail");
+                            return { kind: "parked" };
+                        }
+                        // OBS-1106: same predicate as classification — an infra replay is parked, never repaired.
+                        const infra = results.find((g) => gateFailed(g) && isInfraResult(g));
+                        if (infra) {
+                            await parkAs(p.infraReason(infra), "infra");
+                            return { kind: "parked" };
+                        }
+                        // OBS-1007: a cap trip is a typed park of its own — the diff cannot shrink by retrying and the
+                        // only honest verb is a recheck under a raised cap. Decided BEFORE the authoring classifier, which
+                        // used to lift `gates.diffCap` out of the cap prose as a files[] hint.
+                        const capTrip = results.find(isDiffCapPark);
+                        if (capTrip) {
+                            await parkAs(`${capTrip.gate}: ${capTrip.details}`, "diff-cap");
+                            return { kind: "parked" };
+                        }
+                        if (await adjudicateInfraShapedRed(t, results, p.wt, p.commit, p.reobserve.attempt, p.reobserve.replayed, (reason) => parkAs(reason, "infra")))
+                            return { kind: "parked" };
+                        if (p.outsideScopeForced && freshOutsideScopeRed(t, p.commit)) {
+                            await parkAs(outsideScopePark(t), "gate-fail");
+                            return { kind: "parked" };
+                        }
+                        // OBS-547: who pays for this red is decided by the run's collateral prediction (see
+                        // dispositionScopeRed) — an authoring defect parks unchargeable before any accounting below.
+                        const d = p.disposition();
+                        if (await dispositionScopeRed(t, results, d.author, d.attempt, startMs, gateFails, consults, tokens, metered, retryMode, await treeOrDiffPaths(p.taskBase, p.wt)))
+                            return { kind: "parked" };
+                        return { kind: "red" };
+                    };
                     let lastContextTokens; // v1.23 reset signal, including stalled/quota attempts
                     // v1.29: only a gate-failed attempt can seed same-session retry. The next attempt consumes this
                     // once; a changed channel, unknown context, or missing resumeCommand falls back to fresh.
@@ -4096,6 +4317,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             journal.append("gate-provisioned", t.id, provisionedRow);
                         const resumedTask = { ...t, gates: remainingGates };
                         const operatorContext = approvalReviewContext(journal.read(), t.id);
+                        let outsideScopeForced = false;
                         gateLoop: while (true) {
                             fatalStop.signal.throwIfAborted();
                             executionSignal()?.throwIfAborted();
@@ -4124,13 +4346,42 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 const own = journal.read().filter((e) => e.taskId === t.id);
                                 return own.slice(own.map((e) => e.event === "phase-start" && e.data.phase === "gates").lastIndexOf(true) + 1);
                             })();
-                            const freshTimeout = !recheck && !satisfiedGate && ((harvestAuthor !== undefined && owesTimeoutRefresh(t, lastRound, gateSubject.commit))
-                                || (lastRound.some((e) => e.event === "gate-fresh-forced" && e.data.commit === gateSubject.commit)
-                                    && !lastRound.some((e) => e.event === "gate-result" && e.data.gate === "test")));
+                            // C: a passing selected-test screen is never a forced round's conclusive test result (the
+                            // journal's own replay rule): its full suite is still owed, fresh, under the round's bypass.
+                            const measured = lastRound.filter((e) => e.event === "gate-result" && !(e.data.gate === "test"
+                                && Array.isArray(e.data.selectedTests) && e.data.fullSuite !== true && e.data.pass !== false));
+                            const forcedUnmeasured = (outside) => lastRound.some((e) => e.event === "gate-fresh-forced"
+                                && e.data.commit === gateSubject.commit && (e.data.reason === OUTSIDE_SCOPE_RED) === outside)
+                                && !measured.some((e) => e.data.gate === "test");
+                            // C: a crash after the forced re-execution journaled its red but before its park still owes that
+                            // park — restored from the journaled subject and result, never re-measured, replayed or repaired.
+                            // Infra adjudication stays authoritative, exactly as it is ahead of the live park.
+                            if (!recheck && !satisfiedGate && lastRound.some((e) => e.event === "gate-fresh-forced"
+                                && e.data.reason === OUTSIDE_SCOPE_RED && e.data.commit === gateSubject.commit)
+                                && allOutsideScopeReds(t, lastRound, gateSubject.commit)) {
+                                const restored = lastRound.filter((e) => e.event === "gate-result" && e.data.gate === "test" && e.data.pass === false)
+                                    .map((e) => ({ gate: "test", pass: false, details: String(e.data.details ?? ""), meta: e.data }));
+                                if (await adjudicateInfraShapedRed(t, restored, wt, gateSubject.commit, rs?.attempts ?? 0, true, (reason) => park(t, reason, "infra", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode)))
+                                    return;
+                                await park(t, outsideScopePark(t), "gate-fail", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
+                                return;
+                            }
+                            // C: the same out-of-scope re-execution the live loop owes, and a crash inside it still owes it. It
+                            // takes precedence over a timeout refresh: a qualifying red keeps its own bypass and park.
+                            outsideScopeForced = !recheck && !satisfiedGate && ((harvestAuthor !== undefined && owesOutsideScopeRefresh(t, lastRound, gateSubject.commit)) || forcedUnmeasured(true));
+                            const freshTimeout = !recheck && !satisfiedGate && !outsideScopeForced && ((harvestAuthor !== undefined && owesTimeoutRefresh(t, lastRound, gateSubject.commit)) || forcedUnmeasured(false));
+                            // C: a measurement this forced round EXECUTES fresh — its forced test above all — is independent
+                            // evidence, never a replay measurement; only a gate the interrupted round already journaled is.
+                            if (outsideScopeForced) {
+                                gateSubject = { ...gateSubject, journaledGates: measured.map((e) => String(e.data.gate)) };
+                            }
                             journal.phaseStart(t.id, "gates");
                             if (freshTimeout) {
                                 journal.append("gate-fresh-forced", t.id, { gate: "test", attempt: gateSubject.attempt, commit: gateSubject.commit, reason: "no-commit-timeout-red", resumed: true });
                             }
+                            if (outsideScopeForced) {
+                                journal.append("gate-fresh-forced", t.id, { gate: "test", attempt: gateSubject.attempt, commit: gateSubject.commit, reason: OUTSIDE_SCOPE_RED, resumed: true });
+                            }
                             const { results } = await withCommandContext(t.id, async () => runReviewRecovery(resumedTask, {
                                 carriedAuthors: await subjectAuthors(journal.read(), t.id, wt, taskBase),
                                 producer: producerNow(),
@@ -4155,7 +4406,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // flaking seat is re-asked on every task.
                                 reviewNoVerdicts,
                                 recheck, // OBS-1055: a recheck discards cached reds — the battery re-measures what the operator questioned
-                                cachedRedBypass: freshTimeout ? "timeout-fresh" : undefined,
+                                cachedRedBypass: freshTimeout ? "timeout-fresh" : outsideScopeForced ? "out-of-scope-fresh" : undefined,
                                 onGate: async (e) => {
                                     if (!liveEngagement())
                                         return;
@@ -4190,23 +4441,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                             const approvedCommits = await commitsAheadOf(taskBase, wt);
                             graph = addEvidence(graph, t.id, { commits: approvedCommits, gateResults: results });
                             saveGraph(repoRoot, graph);
-                            if (!results.every(gateSatisfied)) {
-                                const unavailableReview = results.find((g) => gateFailed(g) && g.meta?.noEligibleReviewer === true);
-                                if (unavailableReview) {
-                                    await park(t, gateFailApprovalReason(t.id, unavailableReview.details, true), "gate-fail", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
-                                    return;
-                                }
-                                // OBS-1106: same predicate as classification — an infra replay is parked, never repaired.
-                                const infra = results.find((g) => gateFailed(g) && isInfraResult(g));
-                                if (infra) {
-                                    await park(t, `${infra.gate}: ${infra.details}`, "infra", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
-                                    return;
-                                }
-                                const capTrip = results.find(isDiffCapPark);
-                                if (capTrip) {
-                                    await park(t, `${capTrip.gate}: ${capTrip.details}`, "diff-cap", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
-                                    return;
-                                }
+                            const n = rs?.attempts ?? 0;
+                            const settled = await settleResults(results, {
+                                wt, taskBase, taskBranch, gated, commit: gateSubject.commit, outsideScopeForced,
+                                author: gateAuthor, attempts: n, infraReason: (g) => `${g.gate}: ${g.details}`,
+                                reobserve: { attempt: n, replayed: false }, firstAttemptOk: false, metering: {},
                                 // OBS-547: disposition FIRST, and through the same helper the ordinary attempt path uses. A
                                 // crash between a journaled scope red and its classification must not turn a predicted red
                                 // into a charged one just because a resume is what observed it.
@@ -4218,11 +4457,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // erase an EARLIER chargeable attempt and attribute the park to the assignment the rewind
                                 // restored. Ask the journal which state this is, and take the classified dispatch's own
                                 // assignment back with it.
-                                if (await adjudicateInfraShapedRed(t, results, wt, gateSubject.commit, rs?.attempts ?? 0, false, (reason) => park(t, reason, "infra", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode)))
-                                    return;
-                                const classified = journal.classifiedDispatch(t.id);
-                                if (await dispositionScopeRed(t, results, classified?.assignment ?? gateAuthor, classified ? (rs?.attempts ?? 0) : Math.max(0, (rs?.attempts ?? 0) - 1), startMs, gateFails, consults, tokens, metered, retryMode, await treeOrDiffPaths(taskBase, wt)))
-                                    return;
+                                disposition: () => {
+                                    const classified = journal.classifiedDispatch(t.id);
+                                    return { author: classified?.assignment ?? gateAuthor, attempt: classified ? n : Math.max(0, n - 1) };
+                                },
+                            });
+                            if (settled.kind === "red") {
                                 gateFails++;
                                 // Observed green gates are only measurements. If the resumed suffix is red, preserve that
                                 // result in the journal and return to the ordinary attempt/consult ladder, which rebuilds
@@ -4265,32 +4505,14 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 await park(t, gateFailApprovalReason(t.id, "post-approval gate failed", results.some((g) => g.gate === "review" && gateFailed(g))), "gate-fail", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
                                 return;
                             }
-                            const m = await mergeSerial(taskBranch, t, gated);
-                            if (m.tipMoved) {
-                                journal.append("tip-moved", t.id, m.tipMoved);
-                                if (tipMoves++ === 0)
-                                    continue gateLoop;
-                                await park(t, "task branch tip moved twice after gating", "tip-moved", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
+                            if (settled.kind === "regate")
+                                continue gateLoop;
+                            if (settled.kind === "parked")
                                 return;
-                            }
-                            if (!m.ok) {
-                                journal.append("merge-conflict", t.id, { conflict: m.conflict });
-                                await park(t, `merge conflict after ${resumeReason}: ${m.conflict ?? "unknown conflict"}`, "merge-conflict", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
+                            if (settled.kind === "conflict") {
+                                await park(t, `merge conflict after ${resumeReason}: ${settled.conflict ?? "unknown conflict"}`, "merge-conflict", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
                                 return;
                             }
-                            graph = setStatus(graph, t.id, "done");
-                            saveGraph(repoRoot, graph);
-                            journal.append("task-done", t.id, {
-                                attempts: rs?.attempts ?? 0, assignment: gateAuthor, taskContentDigest: contentDigest,
-                                authors: mergedAuthors(await subjectAuthors(journal.read(), t.id, wt, taskBase)),
-                            });
-                            journal.append("merge", t.id, { branch: taskBranch, commit: await integrationHead(intWt) });
-                            await trackedDriver.project?.(t.id, "completed");
-                            journal.telemetry({
-                                taskId: t.id, shape: t.shape, adapter: gateAuthor.adapter, model: gateAuthor.model,
-                                channel: gateAuthor.channel, attempts: rs?.attempts ?? 0, outcome: "done",
-                                durationMs: Date.now() - startMs, firstAttemptOk: false, gateFails, consults, retryMode,
-                            });
                             await reconcile({ spareLiveLlm: true });
                             return;
                         }
@@ -6246,6 +6468,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         };
                         let results = [];
                         let commits = [];
+                        let outsideScopeForced = false;
                         gateLoop: while (true) {
                             fatalStop.signal.throwIfAborted();
                             executionSignal()?.throwIfAborted();
@@ -6261,12 +6484,18 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 && e.data.attempt === attempt - 1);
                             const previousRows = retryMode === "repair" ? lastRoundRows : [];
                             // OBS-1106 residual: see owesTimeoutRefresh — the replay below and the verdict cache are both refused.
-                            const freshTimeout = !explicitlyFundedAttempt && owesTimeoutRefresh(t, lastRoundRows, gateSubject.commit);
+                            // C: an unchanged red wholly outside files[] is re-executed once instead of copied (journal or cache);
+                            // it outranks the timeout refresh, so a timeout-shaped qualifying red keeps its own bypass and park.
+                            outsideScopeForced = !explicitlyFundedAttempt && owesOutsideScopeRefresh(t, lastRoundRows, gateSubject.commit);
+                            const freshTimeout = !explicitlyFundedAttempt && !outsideScopeForced && owesTimeoutRefresh(t, lastRoundRows, gateSubject.commit);
                             journal.phaseStart(t.id, "gates");
                             if (freshTimeout) {
                                 journal.append("gate-fresh-forced", t.id, { gate: "test", attempt, priorAttempt: attempt - 1, commit: gateSubject.commit, reason: "no-commit-timeout-red" });
                             }
-                            const replay = !explicitlyFundedAttempt && !freshTimeout && previousRows.length > 0
+                            if (outsideScopeForced) {
+                                journal.append("gate-fresh-forced", t.id, { gate: "test", attempt, priorAttempt: attempt - 1, commit: gateSubject.commit, reason: OUTSIDE_SCOPE_RED });
+                            }
+                            const replay = !explicitlyFundedAttempt && !freshTimeout && !outsideScopeForced && previousRows.length > 0
                                 && previousRows.every((e) => e.data.commit === gateSubject.commit)
                                 && previousRows.some((e) => e.data.pass === false && e.data.skipped !== true);
                             if (replay) {
@@ -6299,7 +6528,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     commands, baseline, channels: pools.review, judgeChannels: pools.judge, health, adapters, cfg, artifactDir: journal.dir,
                                     collateral: collateral.get(t.id) ?? [],
                                     selectTests: !testGateFailed,
-                                    cachedRedBypass: explicitlyFundedAttempt ? "operator-rerun" : freshTimeout ? "timeout-fresh" : undefined,
+                                    cachedRedBypass: explicitlyFundedAttempt ? "operator-rerun" : freshTimeout ? "timeout-fresh" : outsideScopeForced ? "out-of-scope-fresh" : undefined,
                                     via: cfg.visibility.llm === "pane"
                                         ? {
                                             driver: trackedDriver,
@@ -6328,7 +6557,14 @@ export async function runDaemon(repoRoot, opts = {}) {
                             if (results.some((g) => g.gate === "test" && !g.pass
                                 && !(cfg.executionPolicy?.boundedInfrastructure && failureDisposition(g) === "infrastructure")))
                                 testGateFailed = true;
-                            if (results.every(gateSatisfied)) {
+                            const live = assignment;
+                            const settled = await settleResults(results, {
+                                wt, taskBase, taskBranch, gated, commit: gateSubject.commit, outsideScopeForced,
+                                author: live, attempts: attempt + 1,
+                                infraReason: (g) => `${g.gate}: ${g.details}${g.meta?.recoveryBlocked ? ` — ${g.meta.recoveryBlocked}` : ""}`,
+                                reobserve: { attempt, replayed: gateSubject.replayedFromAttempt !== undefined },
+                                disposition: () => ({ author: live, attempt }),
+                                firstAttemptOk: attempt === 0, metering: { tokens, meteredAttempts: tokens ? metered : undefined },
                                 // T6: every gate — the review included — is satisfied on this commit, so the failure brief
                                 // this loop is still holding describes nothing outstanding. It is dropped HERE, before the
                                 // merge, because a conflict below sends the task around the attempt loop again: a brief kept
@@ -6337,35 +6573,23 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // leaving that dispatch's row indistinguishable from an amnesiac one. Rebuilt exactly as the
                                 // gate-fail brief is, so prior-RUN evidence (retired by its own rule, not by this reviewer)
                                 // survives and only this run's settled findings go.
-                                feedback = withCarriedEvidence("");
-                                fatalStop.signal.throwIfAborted();
-                                executionSignal()?.throwIfAborted();
-                                const m = await mergeSerial(taskBranch, t, gated);
-                                if (m.tipMoved) {
-                                    journal.append("tip-moved", t.id, m.tipMoved);
-                                    if (tipMoves++ === 0)
-                                        continue gateLoop;
-                                    await park(t, "task branch tip moved twice after gating", "tip-moved", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
-                                    return;
-                                }
-                                if (!m.ok) {
-                                    journal.append("merge-conflict", t.id, { conflict: m.conflict });
-                                    const v = await runConsult("merge-conflict", output, m.conflict ?? "", results);
-                                    if (await applyVerdict(v, attempt + 1, "merge-conflict"))
-                                        continue attempts;
-                                    return;
-                                }
-                                graph = setStatus(graph, t.id, "done");
-                                saveGraph(repoRoot, graph);
-                                journal.append("task-done", t.id, {
-                                    attempts: attempt + 1, assignment, taskContentDigest: contentDigest,
-                                    authors: mergedAuthors(await subjectAuthors(journal.read(), t.id, wt, taskBase)),
-                                });
-                                journal.append("merge", t.id, { branch: taskBranch, commit: await integrationHead(intWt) });
-                                await trackedDriver.project?.(t.id, "completed");
-                                // firstAttemptOk/gateFails/consults are recorded FACTS, not policy — a parkKind:"stall" row is
-                                // recorded but NOT quality-negative in v1.6; Phase 12 owns reward policy, so flipping it later needs zero data migration.
-                                journal.telemetry({ taskId: t.id, shape: t.shape, adapter: assignment.adapter, model: assignment.model, channel: assignment.channel, attempts: attempt + 1, outcome: "done", durationMs: Date.now() - startMs, firstAttemptOk: attempt === 0, gateFails, consults, tokens, meteredAttempts: tokens ? metered : undefined, retryMode });
+                                beforeMerge: () => {
+                                    feedback = withCarriedEvidence("");
+                                    fatalStop.signal.throwIfAborted();
+                                    executionSignal()?.throwIfAborted();
+                                },
+                            });
+                            if (settled.kind === "regate")
+                                continue gateLoop;
+                            if (settled.kind === "parked")
+                                return;
+                            if (settled.kind === "conflict") {
+                                const v = await runConsult("merge-conflict", output, settled.conflict ?? "", results);
+                                if (await applyVerdict(v, attempt + 1, "merge-conflict"))
+                                    continue attempts;
+                                return;
+                            }
+                            if (settled.kind === "merged") {
                                 // D-07 done means gone (merged-P42-01-worker incident): a merged task's worker pane closes on
                                 // the task-done path, not at run end. Only THIS successful attempt's `slot` is in scope — prior
                                 // failed attempts' slots stay in keptSlots governed by keepPanes (they hold failure context the
@@ -6384,34 +6608,6 @@ export async function runDaemon(repoRoot, opts = {}) {
                             }
                             break gateLoop;
                         }
-                        // OBS-540: infra is a fail-closed NON-verdict, not quality degradation. Park with the blocker
-                        // already journaled by onGate, before gateFails and before any ladder selection can fund an
-                        // identical retry in the same environment. Parsed judge refusals never carry infra and keep
-                        // flowing through the chargeable quality path below.
-                        const unavailableReview = results.find((g) => gateFailed(g) && g.meta?.noEligibleReviewer === true);
-                        if (unavailableReview) {
-                            await park(t, gateFailApprovalReason(t.id, unavailableReview.details, true), "gate-fail", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
-                            return;
-                        }
-                        const infraFailure = results.find((g) => gateFailed(g) && isInfraResult(g));
-                        if (infraFailure) {
-                            await park(t, `${infraFailure.gate}: ${infraFailure.details}${infraFailure.meta?.recoveryBlocked ? ` — ${infraFailure.meta.recoveryBlocked}` : ""}`, "infra", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
-                            return;
-                        }
-                        // OBS-1007: a cap trip is a typed park of its own — the diff cannot shrink by retrying and the
-                        // only honest verb is a recheck under a raised cap. Decided BEFORE the authoring classifier, which
-                        // used to lift `gates.diffCap` out of the cap prose as a files[] hint.
-                        const capTrip = results.find(isDiffCapPark);
-                        if (capTrip) {
-                            await park(t, `${capTrip.gate}: ${capTrip.details}`, "diff-cap", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
-                            return;
-                        }
-                        if (await adjudicateInfraShapedRed(t, results, wt, gateSubject.commit, attempt, gateSubject.replayedFromAttempt !== undefined, (reason) => park(t, reason, "infra", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode)))
-                            return;
-                        // OBS-547: who pays for this red is decided by the run's collateral prediction (see
-                        // dispositionScopeRed) — an authoring defect parks unchargeable before any accounting below.
-                        if (await dispositionScopeRed(t, results, assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode, await treeOrDiffPaths(taskBase, wt)))
-                            return;
                         gateFails++; // this attempt's gates failed — the one place quality degradation is verified (never inferred from attempts)
                         // v1.53 T3: prefer the CLI's own session id captured from this attempt's output (kimi's resume
                         // trailer) over the harness slot name; absent hook or no capture keeps today's slot-name id.