tickmarkr 2.6.5 → 2.6.7

package/dist/drivers/orca.js

@@ -44,7 +44,7 @@ export const ORCA_RESPONSE_FAMILIES = [
     "status", "create", "list", "read", "send", "wait", "show", "close",
     "worktree-current", "worktree-set", "hooks-status", "split",
 ];
-export const ORCA_FIXTURE_VERSION = "1.4.195";
+export const ORCA_FIXTURE_VERSION = "1.4.218";
 export const ORCA_CLI_COMMAND_ENV = "ORCA_CLI_COMMAND";
 export const STALE_HANDLE_CODE = "terminal_handle_stale";
 export const TERMINAL_GONE_CODE = "terminal_gone";
@@ -608,6 +608,31 @@ export function isBlindStreamPage(term) {
         && Array.isArray(term.tail) && term.tail.length === 0
         && (term.returnedLineCount === undefined || term.returnedLineCount === 0);
 }
+/**
+ * F (D-832): what one proof page's OWN metadata says about the scrollback it was read from — the closed
+ * seam checkoutProven decides paging and absence by. `complete`: explicit `limited:false` and
+ * `truncated:false` with cursors that agree — nothing lies past this page. `partial`: explicit booleans,
+ * one of them true, cursors that agree — more scrollback exists. `unread`: everything else — a flag
+ * missing or not a boolean, a cursor that is not a string, `limited:false` with a next cursor short of
+ * the latest one (the contradictory "last" page), a blind stream page
+ * (isBlindStreamPage), or a source that is not the stream (`screen-unavailable`). Missing metadata is
+ * never inferred complete: its page's bytes still count as read evidence, but no absence rests on it.
+ */
+export function classifyProofPage(term) {
+    const { limited, truncated } = term;
+    if (typeof limited !== "boolean" || typeof truncated !== "boolean")
+        return "unread";
+    if (isBlindStreamPage(term) || (term.source !== undefined && term.source !== "stream"))
+        return "unread";
+    const next = str(term.nextCursor), latest = str(term.latestCursor);
+    if ((term.nextCursor !== undefined && next === undefined) || (term.latestCursor !== undefined && latest === undefined))
+        return "unread";
+    // a page that says it is the last while its next cursor stops short of the latest one contradicts itself.
+    // (A limited page whose next cursor IS the latest is not: the read from that cursor settles it.)
+    if (!limited && next !== undefined && latest !== undefined && next !== latest)
+        return "unread";
+    return limited || truncated ? "partial" : "complete";
+}
 export class OrcaDriver {
     id = "orca";
     interactive = true; // a visible terminal the operator can watch and answer
@@ -1021,12 +1046,17 @@ export class OrcaDriver {
      * and none carries a trace of the mark; `unread` — every other exit: PROOF_PAGES reached, a limited
      * read with no (or the same) next cursor or a truncated anchor without one, a read that threw, a read
      * the ceiling cut off or never let start (the anchor included), or a page that landed late (even one
-     * carrying the right proof), a malformed page (its tail, cursors or paging flags), or a blind stream
-     * page (isBlindStreamPage). Unread output is unknown — never an empty page, never absence.
+     * carrying the right proof), a malformed page (its tail or cursors), a blind stream page
+     * (isBlindStreamPage), or — F (D-832) — any page read whose paging metadata classifyProofPage cannot
+     * call complete or partial (flags missing, not boolean or contradicted; even when they were omitted,
+     * that page's bytes stay evidence and its matching proof still proves). Unread output is unknown —
+     * never an empty page, never absence.
      * Without a deadline (reconcile, recovery) only `proven` is consumed.
      */
     async checkoutProven(handle, checkout, from, runtimeId, deadline) {
-        let late = false;
+        // F (D-832): a page read whose own metadata does not say how complete it is (classifyProofPage):
+        // its bytes are evidence, but the scrollback it came from is not known to be read whole.
+        let late = false, unknown = false;
         const page = async (cursor) => {
             const budget = deadline === undefined ? undefined : deadline - this.time.now();
             if (budget !== undefined && budget <= 0)
@@ -1052,23 +1082,24 @@ export class OrcaDriver {
                 throw new OrcaError("read", `proof page names terminal ${str(term.handle) ?? "none"}, not the candidate ${handle}`, env.raw);
             }
             // E1: only a well-formed page is read text. A tail that is missing, not an array or carries a
-            // non-string row (tailText), a cursor that is not a non-empty string, or a paging flag that is not
-            // a boolean is a malformed page: it throws, so it is unread output — never filtered to an empty
-            // page that would read as an absent proof.
+            // non-string row (tailText), or a cursor that is not a non-empty string is a malformed page: it
+            // throws, so it is unread output — never filtered to an empty page that would read as an absent proof.
             for (const key of ["oldestCursor", "nextCursor"]) {
                 if (term[key] !== undefined && str(term[key]) === undefined)
                     throw new OrcaError("read", `proof page ${key} is not a cursor`, env.raw);
             }
-            for (const key of ["limited", "truncated"]) {
-                if (term[key] !== undefined && typeof term[key] !== "boolean")
-                    throw new OrcaError("read", `proof page ${key} is not a boolean`, env.raw);
-            }
             // E1: the OBS-1011 add.1 blind stream (exited, empty tail, zero lines returned) is the shape a
             // live terminal's stream answers while its screen still paints — and a dead terminal's too. The
             // stream alone cannot tell them apart, so its empty tail is unread scrollback, never absence.
             if (isBlindStreamPage(term))
                 throw new OrcaError("read", "proof page is a blind stream page (status exited, empty tail): its scrollback is unread", env.raw);
-            return { term, text: this.tailText("read", term, env.raw) };
+            const text = this.tailText("read", term, env.raw);
+            // F: paging flags missing, not boolean or contradicted by the cursors leave the page's bytes read
+            // but its completeness unknown — it ends paging, and the poll can never read as absent.
+            const kind = classifyProofPage(term);
+            if (kind === "unread")
+                unknown = true;
+            return { term, text, kind };
         };
         // Every validated read is evidence, whatever stops the next one: the anchor's tail and the pages
         // read from the oldest cursor are inspected even when paging hits PROOF_PAGES or a read throws.
@@ -1093,12 +1124,13 @@ export class OrcaDriver {
             tail = first.text;
             let cursor = str(anchor.oldestCursor);
             // why paging ended with scrollback still unread. Every exit is one of: complete (an anchor that
-            // is the whole scrollback, or a page that is not limited), whole frames found, or one of these.
+            // is the whole scrollback, or a page whose metadata says it is the last), whole frames found, a
+            // page whose completeness is unknown (`unknown`, classifyProofPage), or one of these.
             let stop;
             if (cursor === undefined) {
                 text = tail;
                 // A cursorless anchor that says it holds less than the scrollback leaves the rest unreadable.
-                if (anchor.truncated === true || anchor.limited === true)
+                if (first.kind === "partial")
                     stop = "stalled";
             }
             for (let n = 0; cursor !== undefined; n++) {
@@ -1116,12 +1148,23 @@ export class OrcaDriver {
                 const frames = checkoutFrames(text);
                 if (frames.complete.length > 0 && !frames.incomplete)
                     break; // whole frames, nothing dangling
-                if (term.limited !== true)
+                if (got.kind === "complete")
                     break; // the last page: the scrollback was read to its end
                 const next = str(term.nextCursor);
-                // A limited page with no next cursor, or the same one, says more scrollback exists that no
-                // read can reach: unread, never absent.
-                if (next === undefined || next === cursor) {
+                const advancing = next !== undefined && next !== cursor;
+                if (got.kind === "unread") {
+                    // F: no absence rests on this page (`unknown`), but a cursor that still advances toward more
+                    // scrollback — the page says limited, or its next cursor is short of the latest one — is
+                    // followed for positive proof, inside PROOF_PAGES and the ceiling.
+                    if (advancing && (term.limited === true || next !== str(term.latestCursor))) {
+                        cursor = next;
+                        continue;
+                    }
+                    break;
+                }
+                // A partial page that is not limited, or a limited one with no next cursor or the same one, says
+                // more scrollback exists that no read can reach: unread, never absent.
+                if (term.limited !== true || !advancing) {
                     stop = "stalled";
                     break;
                 }
@@ -1139,9 +1182,10 @@ export class OrcaDriver {
                 return { proven: true, reason: "" };
             const why = `${late ? "read past the ceiling, " : ""}${stop === "cut" ? "the ceiling cut off paging, "
                 : stop === "exhausted" ? `paging stopped at ${PROOF_PAGES} pages with scrollback unread, `
-                    : stop === "stalled" ? "a limited read gave no next cursor with scrollback unread, " : ""}`;
+                    : stop === "stalled" ? "a limited read gave no next cursor with scrollback unread, " : ""}${unknown ? "a page carried missing, non-boolean or contradictory paging metadata, " : ""}`;
             const read = described(why);
-            return { ...read, seen: read.seen ?? (stop || late ? "unread" : "absent") };
+            // F: absent only when every page read said, explicitly and consistently, how complete it was.
+            return { ...read, seen: read.seen ?? (stop || late || unknown ? "unread" : "absent") };
         }
         catch (error) {
             // A read that failed midway keeps what was already read as evidence; what it could not read is

package/dist/gates/baseline.d.ts

@@ -125,6 +125,9 @@ export interface BaselineCommand {
     /** VL-1: every per-file duration the runner named, so a later per-file hang budget (test-manifest.ts)
      * can be derived per file rather than from one slowest-file number; null when unavailable. */
     fileDurations?: BaselineFileDuration[] | null;
+    /** v2.6.7 close: set when fileTiming classified each duration's outcome (`failed` on a red file). A red capture
+     * without it (an older binary, a cached or hand-supplied baseline) never says which files were red. */
+    fileOutcomes?: true;
     /** The ceiling that measurement implies, persisted so every later battery uses the same number. */
     ceilingMs?: number;
     /**
@@ -145,6 +148,8 @@ export interface BaselineCommand {
 export interface BaselineFileDuration {
     file: string;
     durationMs: number;
+    /** The file was RED in this capture (× or ❯): its duration ended early and is no measure of its green runtime. */
+    failed?: true;
 }
 /**
  * OBS-1123: WHICH capture a forgiveness rests on — the commit it measured and when it was published.
@@ -175,6 +180,10 @@ export type FailureClassification = "regression" | "infra";
  * unreadable-runner case the existing fail-closed path already owns.
  */
 export declare function classifyFailureOutput(output: string): FailureClassification | undefined;
+/** The per-file timings a consumer may read as green runtimes. A red capture that never classified its files
+ * (no fileOutcomes) marks every file failed, so each is budgeted and costed as untimed — never as the early-ending
+ * time of a run that may have been red for it. */
+export declare function classifiedFileDurations(entry: BaselineCommand | undefined): BaselineFileDuration[] | null | undefined;
 export declare const UNRECOGNIZED_FAILURE = "<unrecognized failure output>";
 export declare function fingerprint(output: string): string[];
 /**

package/dist/gates/baseline.js

@@ -430,7 +430,7 @@ const normalizeLine = (l) => l.replace(/\d+/g, "#").replace(/\s+/g, " ").trim();
 // turbo-prefixed, but a test-name timing has no parenthesized file tally and therefore cannot enter
 // this measurement. These are observations of runner output, not a promise that every runner exposes
 // them — callers record null, never zero, when no line matches.
-const FILE_DURATION_RE = /^\s*(?:(?:[\w@./-]+:\s*)*)[✓✔×❯]\s+(?:\|[^|\r\n]+\|\s+)?(\S+)\s+\([^\r\n)]*\)\s+(\d+(?:\.\d+)?)\s*(ms|s|m)\b/;
+const FILE_DURATION_RE = /^\s*(?:(?:[\w@./-]+:\s*)*)([✓✔×❯])\s+(?:\|[^|\r\n]+\|\s+)?(\S+)\s+\([^\r\n)]*\)\s+(\d+(?:\.\d+)?)\s*(ms|s|m)\b/;
 const durationUnitMs = (unit) => unit === "m" ? 60_000 : unit === "s" ? 1_000 : 1;
 function fileTiming(output, wallClockMs) {
     const files = [];
@@ -438,9 +438,10 @@ function fileTiming(output, wallClockMs) {
         const match = FILE_DURATION_RE.exec(line.replace(ANSI_RE, ""));
         if (!match)
             continue;
-        const durationMs = Number(match[2]) * durationUnitMs(match[3]);
+        const durationMs = Number(match[3]) * durationUnitMs(match[4]);
+        // vitest marks a red file ❯ (suiteFail) and a red test × (taskFail)
         if (Number.isFinite(durationMs))
-            files.push({ file: match[1], durationMs });
+            files.push({ file: match[2], durationMs, ...(match[1] === "×" || match[1] === "❯" ? { failed: true } : {}) });
     }
     if (!files.length)
         return { fileDurationSumMs: null, impliedParallelism: null, longestFile: null, fileDurations: null };
@@ -451,8 +452,18 @@ function fileTiming(output, wallClockMs) {
         impliedParallelism: wallClockMs > 0 ? fileDurationSumMs / wallClockMs : null,
         longestFile,
         fileDurations: files,
+        fileOutcomes: true,
     };
 }
+/** The per-file timings a consumer may read as green runtimes. A red capture that never classified its files
+ * (no fileOutcomes) marks every file failed, so each is budgeted and costed as untimed — never as the early-ending
+ * time of a run that may have been red for it. */
+export function classifiedFileDurations(entry) {
+    const files = entry?.fileDurations;
+    if (!Array.isArray(files) || entry?.fileOutcomes || entry?.exitCode === 0)
+        return files;
+    return files.map((f) => ({ ...f, failed: true }));
+}
 // A failing command whose output holds no shape any runner here names. The marker is content-free and
 // constant: downstream consumers (tip verify journals fingerprint counts) still see that the command
 // failed, while no line of the output — narration, status strip, stack trace — can enter the set. Being

package/dist/gates/cache.js

@@ -53,7 +53,7 @@ export function baselineIdentity(baseline) {
         return "none";
     // Measurements control execution budgets, not which failures the baseline forgives.
     const commands = Object.fromEntries(Object.entries(baseline.commands).map(([gate, entry]) => {
-        const { durationMs: _duration, fileDurationSumMs: _sum, impliedParallelism: _parallelism, longestFile: _longest, fileDurations: _files, ceilingMs: _ceiling, ...evidence } = entry;
+        const { durationMs: _duration, fileDurationSumMs: _sum, impliedParallelism: _parallelism, longestFile: _longest, fileDurations: _files, fileOutcomes: _outcomes, ceilingMs: _ceiling, ...evidence } = entry;
         return [gate, evidence];
     }));
     return createHash("sha256").update(canonicalJson(commands)).digest("hex").slice(0, 16);

package/dist/gates/review.js

@@ -535,6 +535,13 @@ carriedAuthors = [], operatorContext) {
         ? `You may run at most the task's own test files explicitly named in files[]; these are the only suites you may run: ${ownTestFiles.map((file) => `\`${file}\``).join(", ")}.`
         : "No suite may be run: files[] names no explicit test file owned by this task.";
     const responseRequirement = reviewResponseRequirement(nonce);
+    // D-966 (T3 E): a reviewer that stopped at the first example of a class drip-fed it one round at a
+    // time — T5's rounds carried 2→1→1→1→2→1 findings and T10's 3→2→1→1→1, each round's repair fixing
+    // the case it was shown while its same-class siblings waited for the next review. The closed note
+    // tuple asks for every counterexample ACTUALLY FOUND in scope at once, plus the boundary searched and
+    // what stays uncertain, so the repair sees the class and the next round knows what was covered. It
+    // rides the existing note text (details → repair brief unchanged) and never asks for an exhaustive
+    // search the reviewer cannot honestly make; uncertainty alone stays out of the material bar.
     const prompt = `TICKMARKR-REVIEW
 ${responseRequirement}
 
@@ -580,6 +587,14 @@ acceptance criterion it violates (or to the regression this diff introduces), st
 and marks its evidence executed (you ran the reproducer), static (you traced it by reading) or blocked (it
 could not run here). Blocked evidence never turns a finding into a pass, and a worker's own case table or
 enumeration never resolves a finding: judge the diff itself.
+Report the whole class in this one review, never only its first example. Each material finding's "note" is one
+line carrying the closed tuple "rule: <the goal clause, criterion or regressed behaviour violated> | found:
+<every counterexample you ACTUALLY FOUND inside the declared scope, each as path:line input → consequence,
+joined by "; "> | searched: <the boundary you actually searched: files, symbols, call sites> | uncertain:
+<what lies outside that boundary or could not be established inside it>". Found one counterexample, list one;
+found several, list every one in the same finding. Never list a case you did not find. Your search is bounded:
+never claim it covered every input, caller or path beyond the boundary you name, and remaining uncertainty
+alone is never a material finding — record it under uncertain, or as a deferred minor with its rationale.
 
 Respond with ONLY this JSON:
 {"nonce": "${nonce}", "approve": true|false, "resolved": [], "reraised": [], "findings": [{"note": "...", "severity": "material"|"minor", "defer": false, "rationale": ""}], "comments": [{"path": "path/to/file", "line": 42, "body": "actionable feedback", "finding": 1}]}

package/dist/gates/run-gates.d.ts

@@ -98,18 +98,31 @@ export interface GateContext {
  * a command that already has `--` takes them directly. Every path is quoted — config flows into a shell.
  */
 export declare function testCommandForFiles(testCmd: string, files: string[]): string;
-/** OBS-635: a screen costing at least this share of the full suite runs the full suite instead. */
-export declare const SCREEN_PROMOTION_RATIO = 0.75;
+/** v2.6.7 T1 (closed order table): an attributed test-red diagnostic is admitted only when BOTH hold. */
+export declare const DIAGNOSTIC_MAX_RATIO = 0.15;
+export declare const DIAGNOSTIC_MAX_ESTIMATE_MS = 60000;
+export interface DiagnosticAdmission {
+    admitted: boolean;
+    reason: "diagnostic-admitted" | "diagnostic-unknown-cost" | "diagnostic-capacity-mismatch" | "diagnostic-cost-ratio" | "diagnostic-cost-estimate";
+    costRatio?: number;
+    estimatedMs?: number;
+}
 /**
- * The screen's share of the full suite's cost, from the per-file durations the harness measured at
- * baseline capture — never a worker's timing. Undefined (unknown) unless every selected file has a
- * measured duration and the measured total is positive; unknown keeps the conservative screen path.
+ * The diagnostic's admission evidence, from the per-file durations the harness measured at baseline
+ * capture — never a worker's timing. Unknown (any selected file unmeasured, any measurement that is not a
+ * finite number > 0 ms, an infra baseline, or no positive total) skips: an expensive or unknown screen must
+ * never become a full suite before semantics.
+ * So does timing recorded under a malformed or different capacity (git.ts sameCapacity): it divided the
+ * machine by another number, so it is not comparable evidence about this one.
+ * `estimatedMs` is the serial sum of those files: admission evidence, not a kill ceiling and not a
+ * claim about the parallel-plus-serial wall time the runner will actually take.
  */
-export declare function screenCostRatio(baseline: Baseline, selected: readonly string[]): number | undefined;
+export declare function diagnosticAdmission(baseline: Baseline, selected: readonly string[]): DiagnosticAdmission;
 /** A retry base no runner invocation parses. evaluateManifestedTest builds its stranded single-fork
  * retry from the base it is handed, and one it cannot parse throws before any spawn — so this base
  * disables that inner recovery: a worker-RPC-stranded re-observation comes back infra (the caller
- * parks it as ambiguous) instead of launching a second execution. */
+ * parks it as ambiguous) instead of launching a second execution. runVitestManifestGate reads it as
+ * the mark of a diagnostic subset, which never buys the outer timeout-shaped remeasurement either. */
 export declare const REOBSERVATION_RETRY_BASE = "tickmarkr-reobservation-refuses-stranded-retry";
 /** OBS-1106 residual: ONE isolated re-observation of a timeout-shaped red's attributed failing files on
  * the same checkout, narrowed exactly as a screen is. Never cached and never a verdict: the caller