tickmarkr 2.6.5 → 2.6.6

package/dist/gates/run-gates.js

@@ -15,6 +15,7 @@ import { marginalCostRank } from "../route/router.js";
 import { carriedAuthorVendors, gateReviewerFloor, pickReviewer, reviewGate } from "./review.js";
 import { scopeGate } from "./scope.js";
 import { discoverTestManifest, evaluateManifestedTest, isVitestTestCommand, VITEST_CACHE_ENV, worktreeVitestCache } from "./test-manifest.js";
+import { RUNNER_INFRA_DIAGNOSTIC_RE, timeoutShaped } from "./timeout-shaped.js";
 import { executionSignal } from "../run/execution-budget.js";
 import { failureDisposition } from "../run/recovery.js";
 import { dependencyLinkRefusal, FORK_CAP_ENV, preserveWorktree, producerFields, ROUTING_ENV_SEAMS, shGit, resolvedCapacity, SUITE_PARENT_ENV, verificationProtocol } from "../run/git.js";
@@ -253,7 +254,13 @@ async function listFullManifest(cmd, worktree) {
         rmSync(dir, { recursive: true, force: true });
     }
 }
-/** The manifest-report path for a detected vitest test command — never the stdout-count/file-count path. */
+/** The manifest-report path for a detected vitest test command — never the stdout-count/file-count path.
+ * ONE outer latch (`retried`) buys at most one more measurement of the exact same selection: the bounded
+ * infrastructure retry, or — v2.6.6 C (D-873), default-on — a behavioral timeout red carrying runner
+ * infra diagnostics, read by the daemon's own predicate (timeout-shaped.ts). Either waits for calm and
+ * spends the bounded allowance when one is configured; neither follows a receipt-backed recovery
+ * (retryable:false) or a diagnostic re-observation, and the second sample never stacks the stranded
+ * single-fork recovery. The second sample is authoritative; the first keeps its receipts beside it. */
 async function runVitestManifestGate(worktree, cmd, baseline, selected, artifactDir, retry = {}, retried = false) {
     const entry = baseline.commands.test;
     const outcome = await evaluateManifestedTest(cmd, worktree, {
@@ -263,21 +270,28 @@ async function runVitestManifestGate(worktree, cmd, baseline, selected, artifact
         artifactDir,
         evidence: retry.evidence,
         retryBaseCommand: retry.retryBaseCommand, // OBS-1166: the un-narrowed command for a selected screen's stranded retry
+        allowStrandedRecovery: !retried,
     });
     const reportPath = outcome.reportPath;
     const evidence = { evidenceReceipt: outcome.evidenceReceipt, evidenceReceipts: outcome.evidenceReceipts };
-    if (!retried && retry.authorizeRetry && failureDisposition(outcome) === "infrastructure"
-        && outcome.meta?.retryable !== false) {
+    const disposition = failureDisposition(outcome);
+    const shaped = disposition === "behavioral" && timeoutShaped(outcome.details) && RUNNER_INFRA_DIAGNOSTIC_RE.test(outcome.details);
+    if (!retried && outcome.meta?.retryable !== false && retry.retryBaseCommand !== REOBSERVATION_RETRY_BASE
+        && (shaped || (retry.authorizeRetry && disposition === "infrastructure"))) {
         const waitedMs = await waitForCalmWindow(executionSignal());
         if (!calmWindowReady())
             return { ...evidence, gate: "test", pass: false, details: outcome.details,
                 meta: { ...outcome.meta, reportPath, recoveryBlocked: "calm window unavailable within the existing wait ceiling" } };
-        if (!retry.authorizeRetry("infra")) {
+        if (retry.authorizeRetry && !retry.authorizeRetry("infra")) {
             return { ...evidence, gate: "test", pass: false, details: outcome.details,
                 meta: { ...outcome.meta, reportPath, recoveryBlocked: "infrastructure retry allowance exhausted or subject unavailable" } };
         }
         const result = await runVitestManifestGate(worktree, cmd, baseline, selected, artifactDir, retry, true);
-        return { ...result, evidenceReceipts: [...(outcome.evidenceReceipts ?? []), ...(result.evidenceReceipts ?? [])], meta: { ...result.meta, runnerInfraRerun: { count: 1, waitedMs, firstReportPath: reportPath } } };
+        const rerun = { count: 1, waitedMs, firstReportPath: reportPath };
+        return { ...result, evidenceReceipts: [...(outcome.evidenceReceipts ?? []), ...(result.evidenceReceipts ?? [])],
+            meta: { ...result.meta, ...(shaped
+                    ? { remeasured: { ...rerun, first: { pass: outcome.pass, details: outcome.details, meta: outcome.meta } } }
+                    : { runnerInfraRerun: rerun }) } };
     }
     return {
         ...evidence,
@@ -290,7 +304,8 @@ async function runVitestManifestGate(worktree, cmd, baseline, selected, artifact
 /** A retry base no runner invocation parses. evaluateManifestedTest builds its stranded single-fork
  * retry from the base it is handed, and one it cannot parse throws before any spawn — so this base
  * disables that inner recovery: a worker-RPC-stranded re-observation comes back infra (the caller
- * parks it as ambiguous) instead of launching a second execution. */
+ * parks it as ambiguous) instead of launching a second execution. runVitestManifestGate reads it as
+ * the mark of a diagnostic subset, which never buys the outer timeout-shaped remeasurement either. */
 export const REOBSERVATION_RETRY_BASE = "tickmarkr-reobservation-refuses-stranded-retry";
 /** OBS-1106 residual: ONE isolated re-observation of a timeout-shaped red's attributed failing files on
  * the same checkout, narrowed exactly as a screen is. Never cached and never a verdict: the caller

package/dist/gates/test-manifest.d.ts

@@ -208,4 +208,7 @@ export declare function evaluateManifestedTest(cmd: string, cwd: string, opts: {
     /** OBS-1166: the configured command BEFORE a selected screen narrowed it, so a stranded retry's
      * only positional filters are the stranded files. Absent (a full suite), `cmd` is that command. */
     retryBaseCommand?: string;
+    /** v2.6.6 C: false on the manifest gate's one outer re-measurement — the second sample is one
+     * execution and never stacks the stranded single-fork recovery on top of the retry it already is. */
+    allowStrandedRecovery?: boolean;
 }): Promise<ManifestGateOutcome>;

package/dist/gates/test-manifest.js

@@ -594,7 +594,7 @@ export async function evaluateManifestedTest(cmd, cwd, opts) {
             hangActiveMs: invoked.hangActiveMs, hangWallMs: invoked.hangWallMs });
         evidenceReceipts.push(...invoked.evidenceReceipts);
         const interruptions = [...invoked.interruptions];
-        const stranded = strandedSingleForkFiles(files, nonce, invoked);
+        const stranded = opts.allowStrandedRecovery === false ? undefined : strandedSingleForkFiles(files, nonce, invoked);
         if (stranded) {
             const first = invoked.report;
             const retryNonce = randomBytes(16).toString("hex");

package/dist/gates/timeout-shaped.d.ts

@@ -0,0 +1,3 @@
+export declare const TIMEOUT_SHAPED_RE: RegExp;
+export declare const RUNNER_INFRA_DIAGNOSTIC_RE: RegExp;
+export declare const timeoutShaped: (details: string) => boolean;

package/dist/gates/timeout-shaped.js

@@ -0,0 +1,10 @@
+import { readableExcerpt } from "../run/journal.js";
+// OBS-1106 residual: a red whose assertion is a timeout or a wall-clock budget, and the runner-level
+// diagnostics (never-started files, a worker RPC timeout) that make such a red infrastructure-SHAPED.
+// Shape alone never parks anything: it only buys one isolated re-observation before a charge. A
+// fresh-fingerprint section masks digits to `#`, so both spellings of a number are read.
+// v2.6.6 C: the daemon's declarations (src/run/daemon.ts at 75dc3187:492-494), exported verbatim so the
+// manifest gate's one remeasurement and the daemon's isolated adjudication read ONE predicate.
+export const TIMEOUT_SHAPED_RE = /\b(?:Test|Hook) timed out in (?:\d+|#)\s*ms\b|\bexpected (?:\d+|#)(?:\.(?:\d+|#))? to be (?:less than|below)(?: or equal to)? (?:\d+|#)/i;
+export const RUNNER_INFRA_DIAGNOSTIC_RE = /\bnever-started (?:[1-9]\d*|#)(?![\d#])|\[vitest-worker\]: Timeout calling\b/;
+export const timeoutShaped = (details) => TIMEOUT_SHAPED_RE.test(readableExcerpt(details));

package/dist/run/daemon.js

@@ -4,7 +4,7 @@ import { COMMAND_LEASE_TOKEN_ENV, commandLeaseEnvironment, CommandLeases, curren
 import { execFileSync, spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { shq } from "../adapters/types.js";
-import { appendFileSync, closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, readlinkSync, readSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { appendFileSync, closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, readlinkSync, readSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
@@ -23,6 +23,7 @@ import { formatOwnedName } from "../drivers/types.js";
 import { captureBaseline, detectGateCommands, detectVacuousOracles } from "../gates/baseline.js";
 import { reobserveTestFiles, runGates } from "../gates/run-gates.js";
 import { isInfraResult } from "../gates/cache.js";
+import { RUNNER_INFRA_DIAGNOSTIC_RE, timeoutShaped } from "../gates/timeout-shaped.js";
 import { filesGlob } from "../graph/files-glob.js";
 import { addEvidence, attributeBlocked, batteryPriority, blockedTasks, getTask, graphDefinitionHash, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus, taskContentDigest, tickmarkrDir } from "../graph/graph.js";
 import { GATE_NAMES } from "../graph/schema.js";
@@ -32,7 +33,8 @@ import { executionSignal, remainingExecutionMs, withExecutionBudget, withoutExec
 import { repairSelectionDecision, repairSelectionEnabled } from "./repair-selection.js";
 import { failureDisposition, reserveInfrastructureRetry } from "./recovery.js";
 import { runEnvironment } from "./environment.js";
-import { changeRepresented, cleanupRunWorktrees, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER, preserveWorktree, producerFields, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shGit, SUITE_PARENT_ENV, verificationProtocol, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
+import { changeRepresented, cleanupRunWorktrees, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER, preserveWorktree, producerFields, removeWorktree, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shGit, SUITE_PARENT_ENV, verificationProtocol, WORKTREE_LAYOUT_CONTRACT, WORKTREES_DIR, worktreePath } from "./git.js";
+import { MASK } from "./redact.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
 import { classifyRepairDisposition, resolveScopeHints } from "./repair-disposition.js";
 import { applyScopeAmendments, activeRetryBan, interruptedAttempt, RESUME_HARVEST_SOURCE, resumeHarvestAuthor, approvalAction, APPROVAL_REFUSED, bindingToken, effectiveEvents, foldDecisions, physicalLine, staleApprovals, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, readableExcerpt, receiptOrigin, outstandingReviewFindings, pendingApprovalActions, pendingRechecks, pendingRepairFindings, phaseForGate, priorJudgments, readPriorRunEvidence, recordedTaskFailureKind, reraisedReviewChains, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, standingRulings, structuredFindings, upheldFeedbackByTask } from "./journal.js";
@@ -374,9 +376,6 @@ function classifyInfraResult(g) {
 // diagnostics (never-started files, a worker RPC timeout) that make such a red infrastructure-SHAPED.
 // Shape alone never parks anything: it only buys one isolated re-observation before a charge. A
 // fresh-fingerprint section masks digits to `#`, so both spellings of a number are read.
-const TIMEOUT_SHAPED_RE = /\b(?:Test|Hook) timed out in (?:\d+|#)\s*ms\b|\bexpected (?:\d+|#)(?:\.(?:\d+|#))? to be (?:less than|below)(?: or equal to)? (?:\d+|#)/i;
-const RUNNER_INFRA_DIAGNOSTIC_RE = /\bnever-started (?:[1-9]\d*|#)(?![\d#])|\[vitest-worker\]: Timeout calling\b/;
-const timeoutShaped = (details) => TIMEOUT_SHAPED_RE.test(readableExcerpt(details));
 /** C (E1): the one no-verdict that is the host's slowness, not the seat's — the same predicate run-gates
  * applies to its run-scoped tally, read here for the live task strike and the resume reconstruction. */
 const proofTimeoutNote = (data) => data.cause === "seat-launch-failed" && data.launchCause === "checkout-proof-timeout";
@@ -2690,7 +2689,29 @@ export async function runDaemon(repoRoot, opts = {}) {
                             to: loadedHash,
                         });
                     }
-                    baseline = JSON.parse(readFileSync(join(journal.dir, "baseline.json"), "utf8"));
+                    // B (D-812): a daemon interrupted inside its capture leaves run-start without baseline.json. Only
+                    // that absence recaptures; existing bytes that do not parse fail closed and are never written over.
+                    const baselinePath = join(journal.dir, "baseline.json");
+                    let recapture = false;
+                    try {
+                        baseline = JSON.parse(readFileSync(baselinePath, "utf8"));
+                    }
+                    catch (error) {
+                        if (error.code !== "ENOENT") {
+                            throw new Error(`refusing to resume ${runId}: existing baseline.json is unreadable (${error instanceof Error ? error.message : String(error)}) — it is never recaptured over`);
+                        }
+                        // The recapture measures run-start's commands; current config is no authority for that base.
+                        // Only unmasked bytes prove equality: redaction maps a changed credential onto the same mask, so a
+                        // journaled command carrying the mask cannot be proven unchanged and is refused like a change.
+                        const recorded = (typeof start.data.commands === "object" && start.data.commands !== null ? start.data.commands : {});
+                        const effective = commands;
+                        const changed = [...new Set([...Object.keys(recorded), ...Object.keys(effective)])]
+                            .filter((name) => recorded[name] !== effective[name] || String(recorded[name]).includes(MASK)).sort();
+                        if (changed.length > 0) {
+                            throw new Error(`refusing to resume ${runId}: baseline recapture refused — effective commands differ from (or are masked in) run-start's journaled commands: ${changed.join(", ")}`);
+                        }
+                        recapture = true;
+                    }
                     const replayEvents = journal.read();
                     // journal.replayStatuses predates typed releases and re-pends even inert rows. Keep that
                     // legacy reader intact; scheduling accepts only the fold's recognised authorities.
@@ -2739,8 +2760,47 @@ export async function runDaemon(repoRoot, opts = {}) {
                     });
                     runStarted = true;
                     await placeBoard();
-                    // A terminal resume with no commands has no execution to admit.
-                    if (Object.keys(commands).length > 0 || graph.tasks.some(t => ["pending", "running", "gated"].includes(t.status))) {
+                    if (recapture) {
+                        // Moved HEAD is never baseline authority: measure the journaled base in a detached checkout this
+                        // daemon owns, and publish by rename so any interruption leaves no baseline.json or a whole one.
+                        journal.append("baseline-recapture-start", undefined, { baseRef, commands, capacity: resolvedCapacity() });
+                        baselinePending = true;
+                        baselineCapture = withCommandContext(undefined, async () => {
+                            const parent = join(tickmarkrDir(repoRoot), WORKTREES_DIR);
+                            mkdirSync(parent, { recursive: true });
+                            // A killed daemon never reaches the finally below; sweep checkouts whose owner is dead.
+                            for (const entry of readdirSync(parent)) {
+                                const owner = /^baseline-recapture-(\d+)-\w{6}$/.exec(entry)?.[1];
+                                if (owner && !isPidLive(Number(owner)))
+                                    await removeWorktree(repoRoot, join(parent, entry));
+                            }
+                            const pristine = mkdtempSync(join(parent, `baseline-recapture-${process.pid}-`));
+                            const staged = `${baselinePath}.${process.pid}.tmp`;
+                            try {
+                                const added = await shGit(`git worktree add --detach ${shq(pristine)} ${shq(baseRef)}`, repoRoot);
+                                if (added.code !== 0)
+                                    throw new Error(`baseline recapture: journaled base ${baseRef} cannot be checked out: ${added.stderr.trim()}`);
+                                if (!linkNodeModules(repoRoot, pristine, { force: true }))
+                                    throw new Error("baseline recapture: pristine node_modules link could not be provisioned");
+                                await initializeHost();
+                                const captured = { ...await captureBaseline(pristine, commands),
+                                    provenance: { baseRef, capturedAt: new Date().toISOString() } };
+                                writeFileSync(staged, JSON.stringify(captured, null, 2));
+                                renameSync(staged, baselinePath);
+                                baseline = captured;
+                                journal.append("baseline-recapture-complete", undefined, { provenance: captured.provenance });
+                                for (const warning of captured.warnings ?? [])
+                                    journal.append("baseline-warning", undefined, { ...warning });
+                            }
+                            finally {
+                                rmSync(staged, { force: true });
+                                await removeWorktree(repoRoot, pristine);
+                            }
+                        }).finally(() => { baselinePending = false; });
+                        void baselineCapture.catch(() => { baselineFailed = true; });
+                    }
+                    else if (Object.keys(commands).length > 0 || graph.tasks.some(t => ["pending", "running", "gated"].includes(t.status))) {
+                        // A terminal resume with no commands has no execution to admit.
                         baselineCapture = initializeHost();
                         void baselineCapture.catch(() => { baselineFailed = true; });
                     }
@@ -3709,6 +3769,81 @@ export async function runDaemon(repoRoot, opts = {}) {
                     let testGateFailed = journal.read().some((e) => e.event === "gate-result" && e.taskId === t.id && e.data.gate === "test" && e.data.pass === false
                         && !(cfg.executionPolicy?.boundedInfrastructure && e.data.disposition === "infrastructure"));
                     let retryMode = "fresh";
+                    // v2.6.6 A: the ONE post-result settlement both gate loops call. Order is the contract:
+                    // satisfied → merge (tip-moved once regates, twice parks; a conflict goes back to the caller), else
+                    // noEligible → infra → diff-cap → adjudication → outside-scope → disposition, and whatever survives
+                    // is the caller's "red". Every declared resume/live difference arrives as a parameter; nothing here
+                    // normalizes one. Preparation, replay, conflict handling, repair funding, feedback and cleanup stay
+                    // in the callers.
+                    const settleResults = async (results, p) => {
+                        const parkAs = (reason, kind) => park(t, reason, kind, p.author, p.attempts, startMs, gateFails, consults, tokens, metered, retryMode);
+                        if (results.every(gateSatisfied)) {
+                            p.beforeMerge?.();
+                            const m = await mergeSerial(p.taskBranch, t, p.gated);
+                            if (m.tipMoved) {
+                                journal.append("tip-moved", t.id, m.tipMoved);
+                                if (tipMoves++ === 0)
+                                    return { kind: "regate" };
+                                await parkAs("task branch tip moved twice after gating", "tip-moved");
+                                return { kind: "parked" };
+                            }
+                            if (!m.ok) {
+                                journal.append("merge-conflict", t.id, { conflict: m.conflict });
+                                return { kind: "conflict", conflict: m.conflict };
+                            }
+                            graph = setStatus(graph, t.id, "done");
+                            saveGraph(repoRoot, graph);
+                            journal.append("task-done", t.id, {
+                                attempts: p.attempts, assignment: p.author, taskContentDigest: contentDigest,
+                                authors: mergedAuthors(await subjectAuthors(journal.read(), t.id, p.wt, p.taskBase)),
+                            });
+                            journal.append("merge", t.id, { branch: p.taskBranch, commit: await integrationHead(intWt) });
+                            await trackedDriver.project?.(t.id, "completed");
+                            // firstAttemptOk/gateFails/consults are recorded FACTS, not policy — a parkKind:"stall" row is
+                            // recorded but NOT quality-negative in v1.6; Phase 12 owns reward policy, so flipping it later needs zero data migration.
+                            journal.telemetry({
+                                taskId: t.id, shape: t.shape, adapter: p.author.adapter, model: p.author.model,
+                                channel: p.author.channel, attempts: p.attempts, outcome: "done",
+                                durationMs: Date.now() - startMs, firstAttemptOk: p.firstAttemptOk, gateFails, consults, ...p.metering, retryMode,
+                            });
+                            return { kind: "merged" };
+                        }
+                        // OBS-540: infra is a fail-closed NON-verdict, not quality degradation. Park with the blocker
+                        // already journaled by onGate, before gateFails and before any ladder selection can fund an
+                        // identical retry in the same environment. Parsed judge refusals never carry infra and keep
+                        // flowing through the chargeable quality path below.
+                        const unavailableReview = results.find((g) => gateFailed(g) && g.meta?.noEligibleReviewer === true);
+                        if (unavailableReview) {
+                            await parkAs(gateFailApprovalReason(t.id, unavailableReview.details, true), "gate-fail");
+                            return { kind: "parked" };
+                        }
+                        // OBS-1106: same predicate as classification — an infra replay is parked, never repaired.
+                        const infra = results.find((g) => gateFailed(g) && isInfraResult(g));
+                        if (infra) {
+                            await parkAs(p.infraReason(infra), "infra");
+                            return { kind: "parked" };
+                        }
+                        // OBS-1007: a cap trip is a typed park of its own — the diff cannot shrink by retrying and the
+                        // only honest verb is a recheck under a raised cap. Decided BEFORE the authoring classifier, which
+                        // used to lift `gates.diffCap` out of the cap prose as a files[] hint.
+                        const capTrip = results.find(isDiffCapPark);
+                        if (capTrip) {
+                            await parkAs(`${capTrip.gate}: ${capTrip.details}`, "diff-cap");
+                            return { kind: "parked" };
+                        }
+                        if (await adjudicateInfraShapedRed(t, results, p.wt, p.commit, p.reobserve.attempt, p.reobserve.replayed, (reason) => parkAs(reason, "infra")))
+                            return { kind: "parked" };
+                        if (p.outsideScopeForced && freshOutsideScopeRed(t, p.commit)) {
+                            await parkAs(outsideScopePark(t), "gate-fail");
+                            return { kind: "parked" };
+                        }
+                        // OBS-547: who pays for this red is decided by the run's collateral prediction (see
+                        // dispositionScopeRed) — an authoring defect parks unchargeable before any accounting below.
+                        const d = p.disposition();
+                        if (await dispositionScopeRed(t, results, d.author, d.attempt, startMs, gateFails, consults, tokens, metered, retryMode, await treeOrDiffPaths(p.taskBase, p.wt)))
+                            return { kind: "parked" };
+                        return { kind: "red" };
+                    };
                     let lastContextTokens; // v1.23 reset signal, including stalled/quota attempts
                     // v1.29: only a gate-failed attempt can seed same-session retry. The next attempt consumes this
                     // once; a changed channel, unknown context, or missing resumeCommand falls back to fresh.
@@ -4306,23 +4441,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                             const approvedCommits = await commitsAheadOf(taskBase, wt);
                             graph = addEvidence(graph, t.id, { commits: approvedCommits, gateResults: results });
                             saveGraph(repoRoot, graph);
-                            if (!results.every(gateSatisfied)) {
-                                const unavailableReview = results.find((g) => gateFailed(g) && g.meta?.noEligibleReviewer === true);
-                                if (unavailableReview) {
-                                    await park(t, gateFailApprovalReason(t.id, unavailableReview.details, true), "gate-fail", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
-                                    return;
-                                }
-                                // OBS-1106: same predicate as classification — an infra replay is parked, never repaired.
-                                const infra = results.find((g) => gateFailed(g) && isInfraResult(g));
-                                if (infra) {
-                                    await park(t, `${infra.gate}: ${infra.details}`, "infra", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
-                                    return;
-                                }
-                                const capTrip = results.find(isDiffCapPark);
-                                if (capTrip) {
-                                    await park(t, `${capTrip.gate}: ${capTrip.details}`, "diff-cap", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
-                                    return;
-                                }
+                            const n = rs?.attempts ?? 0;
+                            const settled = await settleResults(results, {
+                                wt, taskBase, taskBranch, gated, commit: gateSubject.commit, outsideScopeForced,
+                                author: gateAuthor, attempts: n, infraReason: (g) => `${g.gate}: ${g.details}`,
+                                reobserve: { attempt: n, replayed: false }, firstAttemptOk: false, metering: {},
                                 // OBS-547: disposition FIRST, and through the same helper the ordinary attempt path uses. A
                                 // crash between a journaled scope red and its classification must not turn a predicted red
                                 // into a charged one just because a resume is what observed it.
@@ -4334,15 +4457,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // erase an EARLIER chargeable attempt and attribute the park to the assignment the rewind
                                 // restored. Ask the journal which state this is, and take the classified dispatch's own
                                 // assignment back with it.
-                                if (await adjudicateInfraShapedRed(t, results, wt, gateSubject.commit, rs?.attempts ?? 0, false, (reason) => park(t, reason, "infra", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode)))
-                                    return;
-                                if (outsideScopeForced && freshOutsideScopeRed(t, gateSubject.commit)) {
-                                    await park(t, outsideScopePark(t), "gate-fail", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
-                                    return;
-                                }
-                                const classified = journal.classifiedDispatch(t.id);
-                                if (await dispositionScopeRed(t, results, classified?.assignment ?? gateAuthor, classified ? (rs?.attempts ?? 0) : Math.max(0, (rs?.attempts ?? 0) - 1), startMs, gateFails, consults, tokens, metered, retryMode, await treeOrDiffPaths(taskBase, wt)))
-                                    return;
+                                disposition: () => {
+                                    const classified = journal.classifiedDispatch(t.id);
+                                    return { author: classified?.assignment ?? gateAuthor, attempt: classified ? n : Math.max(0, n - 1) };
+                                },
+                            });
+                            if (settled.kind === "red") {
                                 gateFails++;
                                 // Observed green gates are only measurements. If the resumed suffix is red, preserve that
                                 // result in the journal and return to the ordinary attempt/consult ladder, which rebuilds
@@ -4385,32 +4505,14 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 await park(t, gateFailApprovalReason(t.id, "post-approval gate failed", results.some((g) => g.gate === "review" && gateFailed(g))), "gate-fail", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
                                 return;
                             }
-                            const m = await mergeSerial(taskBranch, t, gated);
-                            if (m.tipMoved) {
-                                journal.append("tip-moved", t.id, m.tipMoved);
-                                if (tipMoves++ === 0)
-                                    continue gateLoop;
-                                await park(t, "task branch tip moved twice after gating", "tip-moved", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
+                            if (settled.kind === "regate")
+                                continue gateLoop;
+                            if (settled.kind === "parked")
                                 return;
-                            }
-                            if (!m.ok) {
-                                journal.append("merge-conflict", t.id, { conflict: m.conflict });
-                                await park(t, `merge conflict after ${resumeReason}: ${m.conflict ?? "unknown conflict"}`, "merge-conflict", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
+                            if (settled.kind === "conflict") {
+                                await park(t, `merge conflict after ${resumeReason}: ${settled.conflict ?? "unknown conflict"}`, "merge-conflict", gateAuthor, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
                                 return;
                             }
-                            graph = setStatus(graph, t.id, "done");
-                            saveGraph(repoRoot, graph);
-                            journal.append("task-done", t.id, {
-                                attempts: rs?.attempts ?? 0, assignment: gateAuthor, taskContentDigest: contentDigest,
-                                authors: mergedAuthors(await subjectAuthors(journal.read(), t.id, wt, taskBase)),
-                            });
-                            journal.append("merge", t.id, { branch: taskBranch, commit: await integrationHead(intWt) });
-                            await trackedDriver.project?.(t.id, "completed");
-                            journal.telemetry({
-                                taskId: t.id, shape: t.shape, adapter: gateAuthor.adapter, model: gateAuthor.model,
-                                channel: gateAuthor.channel, attempts: rs?.attempts ?? 0, outcome: "done",
-                                durationMs: Date.now() - startMs, firstAttemptOk: false, gateFails, consults, retryMode,
-                            });
                             await reconcile({ spareLiveLlm: true });
                             return;
                         }
@@ -6455,7 +6557,14 @@ export async function runDaemon(repoRoot, opts = {}) {
                             if (results.some((g) => g.gate === "test" && !g.pass
                                 && !(cfg.executionPolicy?.boundedInfrastructure && failureDisposition(g) === "infrastructure")))
                                 testGateFailed = true;
-                            if (results.every(gateSatisfied)) {
+                            const live = assignment;
+                            const settled = await settleResults(results, {
+                                wt, taskBase, taskBranch, gated, commit: gateSubject.commit, outsideScopeForced,
+                                author: live, attempts: attempt + 1,
+                                infraReason: (g) => `${g.gate}: ${g.details}${g.meta?.recoveryBlocked ? ` — ${g.meta.recoveryBlocked}` : ""}`,
+                                reobserve: { attempt, replayed: gateSubject.replayedFromAttempt !== undefined },
+                                disposition: () => ({ author: live, attempt }),
+                                firstAttemptOk: attempt === 0, metering: { tokens, meteredAttempts: tokens ? metered : undefined },
                                 // T6: every gate — the review included — is satisfied on this commit, so the failure brief
                                 // this loop is still holding describes nothing outstanding. It is dropped HERE, before the
                                 // merge, because a conflict below sends the task around the attempt loop again: a brief kept
@@ -6464,35 +6573,23 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // leaving that dispatch's row indistinguishable from an amnesiac one. Rebuilt exactly as the
                                 // gate-fail brief is, so prior-RUN evidence (retired by its own rule, not by this reviewer)
                                 // survives and only this run's settled findings go.
-                                feedback = withCarriedEvidence("");
-                                fatalStop.signal.throwIfAborted();
-                                executionSignal()?.throwIfAborted();
-                                const m = await mergeSerial(taskBranch, t, gated);
-                                if (m.tipMoved) {
-                                    journal.append("tip-moved", t.id, m.tipMoved);
-                                    if (tipMoves++ === 0)
-                                        continue gateLoop;
-                                    await park(t, "task branch tip moved twice after gating", "tip-moved", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
-                                    return;
-                                }
-                                if (!m.ok) {
-                                    journal.append("merge-conflict", t.id, { conflict: m.conflict });
-                                    const v = await runConsult("merge-conflict", output, m.conflict ?? "", results);
-                                    if (await applyVerdict(v, attempt + 1, "merge-conflict"))
-                                        continue attempts;
-                                    return;
-                                }
-                                graph = setStatus(graph, t.id, "done");
-                                saveGraph(repoRoot, graph);
-                                journal.append("task-done", t.id, {
-                                    attempts: attempt + 1, assignment, taskContentDigest: contentDigest,
-                                    authors: mergedAuthors(await subjectAuthors(journal.read(), t.id, wt, taskBase)),
-                                });
-                                journal.append("merge", t.id, { branch: taskBranch, commit: await integrationHead(intWt) });
-                                await trackedDriver.project?.(t.id, "completed");
-                                // firstAttemptOk/gateFails/consults are recorded FACTS, not policy — a parkKind:"stall" row is
-                                // recorded but NOT quality-negative in v1.6; Phase 12 owns reward policy, so flipping it later needs zero data migration.
-                                journal.telemetry({ taskId: t.id, shape: t.shape, adapter: assignment.adapter, model: assignment.model, channel: assignment.channel, attempts: attempt + 1, outcome: "done", durationMs: Date.now() - startMs, firstAttemptOk: attempt === 0, gateFails, consults, tokens, meteredAttempts: tokens ? metered : undefined, retryMode });
+                                beforeMerge: () => {
+                                    feedback = withCarriedEvidence("");
+                                    fatalStop.signal.throwIfAborted();
+                                    executionSignal()?.throwIfAborted();
+                                },
+                            });
+                            if (settled.kind === "regate")
+                                continue gateLoop;
+                            if (settled.kind === "parked")
+                                return;
+                            if (settled.kind === "conflict") {
+                                const v = await runConsult("merge-conflict", output, settled.conflict ?? "", results);
+                                if (await applyVerdict(v, attempt + 1, "merge-conflict"))
+                                    continue attempts;
+                                return;
+                            }
+                            if (settled.kind === "merged") {
                                 // D-07 done means gone (merged-P42-01-worker incident): a merged task's worker pane closes on
                                 // the task-done path, not at run end. Only THIS successful attempt's `slot` is in scope — prior
                                 // failed attempts' slots stay in keptSlots governed by keepPanes (they hold failure context the
@@ -6511,38 +6608,6 @@ export async function runDaemon(repoRoot, opts = {}) {
                             }
                             break gateLoop;
                         }
-                        // OBS-540: infra is a fail-closed NON-verdict, not quality degradation. Park with the blocker
-                        // already journaled by onGate, before gateFails and before any ladder selection can fund an
-                        // identical retry in the same environment. Parsed judge refusals never carry infra and keep
-                        // flowing through the chargeable quality path below.
-                        const unavailableReview = results.find((g) => gateFailed(g) && g.meta?.noEligibleReviewer === true);
-                        if (unavailableReview) {
-                            await park(t, gateFailApprovalReason(t.id, unavailableReview.details, true), "gate-fail", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
-                            return;
-                        }
-                        const infraFailure = results.find((g) => gateFailed(g) && isInfraResult(g));
-                        if (infraFailure) {
-                            await park(t, `${infraFailure.gate}: ${infraFailure.details}${infraFailure.meta?.recoveryBlocked ? ` — ${infraFailure.meta.recoveryBlocked}` : ""}`, "infra", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
-                            return;
-                        }
-                        // OBS-1007: a cap trip is a typed park of its own — the diff cannot shrink by retrying and the
-                        // only honest verb is a recheck under a raised cap. Decided BEFORE the authoring classifier, which
-                        // used to lift `gates.diffCap` out of the cap prose as a files[] hint.
-                        const capTrip = results.find(isDiffCapPark);
-                        if (capTrip) {
-                            await park(t, `${capTrip.gate}: ${capTrip.details}`, "diff-cap", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
-                            return;
-                        }
-                        if (await adjudicateInfraShapedRed(t, results, wt, gateSubject.commit, attempt, gateSubject.replayedFromAttempt !== undefined, (reason) => park(t, reason, "infra", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode)))
-                            return;
-                        if (outsideScopeForced && freshOutsideScopeRed(t, gateSubject.commit)) {
-                            await park(t, outsideScopePark(t), "gate-fail", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
-                            return;
-                        }
-                        // OBS-547: who pays for this red is decided by the run's collateral prediction (see
-                        // dispositionScopeRed) — an authoring defect parks unchargeable before any accounting below.
-                        if (await dispositionScopeRed(t, results, assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode, await treeOrDiffPaths(taskBase, wt)))
-                            return;
                         gateFails++; // this attempt's gates failed — the one place quality degradation is verified (never inferred from attempts)
                         // v1.53 T3: prefer the CLI's own session id captured from this attempt's output (kimi's resume
                         // trailer) over the harness slot name; absent hook or no capture keeps today's slot-name id.

package/dist/tui/ink/fleet-app.d.ts

@@ -2,9 +2,21 @@ import { type AuthHealth, type WorkerAdapter } from "../../adapters/types.js";
 import { type DenyScopeKey, type InitialDenyProps, type MapEntry, type RoutingMode, type StagedDenyKey, type Tier, type TickmarkrConfig } from "../../config/config.js";
 import { type Effort, type Shape } from "../../graph/schema.js";
 export type FleetSteeringKey = "review" | "consult";
+/** T10 (D-939): the routing.allow entry a classification staged this session excluded — the row's own
+ * entry in its ownAllow spelling, added to the staged complement so Space can admit it in-session.
+ * `model` is the classified id (the tiers key), `displayModel` the browser row it was staged from. */
+export type FleetSeededAllow = {
+    adapter: string;
+    model: string;
+    displayModel: string;
+    identity?: string;
+    entry: string;
+};
 export type FleetEditorState = Record<DenyScopeKey, string[]> & {
     /** OBS-1046: the staged routing.allow complement, distinct from the authored deny lists above */
     allowOut?: string[];
+    /** T10: one seed per staged classification the current allow form left out */
+    seededAllowOut?: FleetSeededAllow[];
     classifications: FleetClassification[];
     /** OBS-1182: staged launch effort per adapter → model; absent = the CLI's own default */
     efforts?: Record<string, Record<string, Effort>>;
@@ -18,12 +30,17 @@ export type FleetEditorState = Record<DenyScopeKey, string[]> & {
 };
 /** T8: the staged classifications and efforts every preview folds — the same metadata a review stages,
  * so a preview ranks what w would write before the first review and after an escaped one. */
-export type FleetStagedMetadata = Pick<FleetEditorState, "classifications" | "efforts">;
+export type FleetStagedMetadata = Pick<FleetEditorState, "classifications" | "efforts" | "seededAllowOut">;
 /** OBS-525: auto reverts the shape's WHOLE routing declaration — pool included, not just the pin.
  * prefer survives: it biases auto routing and is valid without pin/pool. */
 export declare function autoMapEntry(entry: MapEntry | undefined): MapEntry;
 export type FleetOverlayReview = {
     kind: "empty";
+}
+/** T10: a staged batch the one-destination review cannot write (mixed destinations, a stray seed) */
+ | {
+    kind: "refused";
+    reason: string;
 } | {
     kind: "diff";
     before: string;
@@ -131,7 +148,7 @@ export type FleetStagedRouting = {
     ok: false;
     error: string;
 };
-export declare function FleetApp({ ageMs, agents, initialAllowOut, initialEfforts, modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewAdvisories, reviewOverlay, reloadGuard, stagedRouting, entry, initialJudge, judgeSeats, viewRows, frameColumns, frameRows, ...initialDenyProps }: InitialDenyProps & {
+export declare function FleetApp({ ageMs, agents, initialAllowOut, initialEfforts, modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewAdvisories, reviewOverlay, reloadGuard, stagedRouting, holderOf, entry, initialJudge, judgeSeats, viewRows, frameColumns, frameRows, ...initialDenyProps }: InitialDenyProps & {
     ageMs: number | null;
     agents: AgentCli[];
     /** OBS-1046: adapter ids and adapter:model keys routing.allow leaves out of the fleet */
@@ -158,7 +175,9 @@ export declare function FleetApp({ ageMs, agents, initialAllowOut, initialEffort
     reloadGuard: (bytes: string) => string | null;
     /** the routing policy the staged deny sets load as (fleet: the config loader over the candidate
      * bytes); absent ⇒ the four staged sets alone, with no allowlist */
-    stagedRouting?: (deny: FleetStagedDeny) => FleetStagedRouting;
+    stagedRouting?: (deny: FleetStagedDeny, stage?: FleetStagedMetadata) => FleetStagedRouting;
+    /** T10: the overlay `path:line` holding a dotted config scope in this repository, undefined = defaults */
+    holderOf?: (dotted: string) => string | undefined;
     entry?: "presets" | "probe";
     /** resolved config judge as "adapter:model" — shown on the (keep default) picker row */
     initialJudge?: string;
@@ -171,7 +190,7 @@ export declare function FleetApp({ ageMs, agents, initialAllowOut, initialEffort
     /** terminal height — set only on a real TTY so the footer sticks to the bottom */
     frameRows?: number;
 }): import("react").JSX.Element;
-export declare function runFleetInkEditor({ ageMs, adapters, health, initialAllowOut, initialEfforts, modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewAdvisories, reviewOverlay, reloadGuard, stagedRouting, entry, initialJudge, judgeSeats, initialInput, input, output, debug, ...initialDenyProps }: InitialDenyProps & {
+export declare function runFleetInkEditor({ ageMs, adapters, health, initialAllowOut, initialEfforts, modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewAdvisories, reviewOverlay, reloadGuard, stagedRouting, holderOf, entry, initialJudge, judgeSeats, initialInput, input, output, debug, ...initialDenyProps }: InitialDenyProps & {
     ageMs: number | null;
     adapters: WorkerAdapter[];
     health: Record<string, AuthHealth>;
@@ -199,7 +218,9 @@ export declare function runFleetInkEditor({ ageMs, adapters, health, initialAllo
     reloadGuard: (bytes: string) => string | null;
     /** the routing policy the staged deny sets load as (fleet: the config loader over the candidate
      * bytes); absent ⇒ the four staged sets alone, with no allowlist */
-    stagedRouting?: (deny: FleetStagedDeny) => FleetStagedRouting;
+    stagedRouting?: (deny: FleetStagedDeny, stage?: FleetStagedMetadata) => FleetStagedRouting;
+    /** T10: the overlay `path:line` holding a dotted config scope in this repository, undefined = defaults */
+    holderOf?: (dotted: string) => string | undefined;
     /** "presets" = init's entry: Esc in the browser is HOME to the preset overlay, not quit */
     entry?: "presets" | "probe";
     initialJudge?: string;