tickmarkr 2.6.7 → 2.6.8

package/dist/drivers/orca.js

@@ -1,3 +1,4 @@
+import { AsyncLocalStorage } from "node:async_hooks";
 import { existsSync, linkSync, mkdirSync, readdirSync, readFileSync, readlinkSync, realpathSync, renameSync, rmdirSync, rmSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { dirname, join, resolve } from "node:path";
@@ -77,6 +78,8 @@ export class OrcaError extends Error {
     code;
     runtimeId;
     launchCause;
+    /** v2.6.8 T1: the CLI was killed at the timeout it was handed — the one evidence that a deadline interrupted it. */
+    timedOut;
     constructor(family, reason, raw, opts = {}) {
         super(`orca ${family} failed — ${reason}; raw response:\n${raw}`);
         this.family = family;
@@ -86,6 +89,7 @@ export class OrcaError extends Error {
         this.code = opts.code;
         this.runtimeId = opts.runtimeId;
         this.launchCause = opts.launchCause;
+        this.timedOut = opts.timedOut;
     }
 }
 /** The slot cannot be addressed: dead/unknown terminal record, or a handle that cannot be recovered
@@ -209,7 +213,9 @@ export const CHECKOUT_MARK = "TICKMARKR_CHECKOUT";
 // carries no whitespace or quotes, survives renderer wrapping (hex rows re-join losslessly), and is
 // either complete (length matches, terminator present) or nothing. A prefix of another checkout can
 // never decode to this one; `A` versus `A B`, `…--T1` versus `…--T10` are different frames.
-const CHECKOUT_FRAME_RE = /TICKMARKR_CHECKOUT (\d+):([0-9a-f]*)(;?)/g;
+// v2.6.8 T1: the header separator is optional — a terminal that wraps the frame AT it leaves the space
+// at a row edge, where joinWrapped trims it — so where the frame wraps never decides what it is.
+const CHECKOUT_FRAME_RE = /TICKMARKR_CHECKOUT ?(\d+):([0-9a-f]*)(;?)/g;
 const PROOF_PAGES = 16; // pages read from the oldest cursor before the proof is declared absent
 // E1: the ceiling for the wrapper shell's startup proof. A loaded host can print a review seat's proof
 // long after the old 2 s window closed (the window a healthy seat was retired on); a proof first
@@ -228,8 +234,110 @@ const MARK_TRACE = CHECKOUT_MARK.slice(0, CHECKOUT_MARK.indexOf("_") + 2);
 function misplacedProof(text, checkout) {
     const { complete, incomplete } = checkoutFrames(text);
     const joined = joinWrapped(text);
+    const frames = [...joined.matchAll(CHECKOUT_FRAME_RE)];
     return incomplete || complete.some((c) => c !== checkout)
-        || joined.split(MARK_TRACE).length - 1 > [...joined.matchAll(CHECKOUT_FRAME_RE)].length;
+        || joined.split(MARK_TRACE).length - 1 > frames.length || danglingMarkRow(text, joined, frames);
+}
+/** v2.6.8 T1: a row that is only a mark prefix too short to carry MARK_TRACE (`T` … `TICKMARKR_`) — the
+ *  same partial frame ceilingCutFrame types as a cut — is placement evidence unless the rejoined text
+ *  continues it into the mark there, or it lies inside a frame a wrap split (`…CHECKOU` | `T` | ` 40:…;`).
+ *  ponytail: a long line whose last wrapped row is just `T` refuses too; fail-closed costs a relaunch. */
+function danglingMarkRow(text, joined, frames) {
+    let at = 0;
+    for (const row of text.split("\n").map(joinWrapped)) {
+        const start = at;
+        at += row.length;
+        if (row.length === 0 || row.length >= MARK_TRACE.length || !MARK_TRACE.startsWith(row))
+            continue;
+        if (joined.startsWith(MARK_TRACE, start))
+            continue;
+        if (!frames.some((m) => m.index < start && start < m.index + m[0].length))
+            return true;
+    }
+    return false;
+}
+/** v2.6.8 T1: is `fragment` (rows rejoined) a strict prefix of the OWN proof frame `own` — the frame the
+ *  unread rows could still complete into the proof? The separator is optional exactly as in
+ *  CHECKOUT_FRAME_RE. A prefix no continuation can make the own frame (`TICKMARKR_CHECKOUT 1:ff`, a foreign
+ *  length or hex) is placement evidence whatever the unread rows hold — never a cut. */
+function framePrefix(fragment, own) {
+    return fragment.length > 0 && [own, own.replace(" ", "")].some((frame) => fragment.length < frame.length && frame.startsWith(fragment));
+}
+/** v2.6.8 T1: the evidence that paging left a frame unread — the paged text ENDS in a strict prefix of
+ *  the own frame (cutFrameRow), and nothing read before it — the pages' reading of a position or the anchor's —
+ *  nor the anchor's rows past it, is placement evidence. A malformed marker read whole is never a prefix,
+ *  so it stays a placement refusal. A row that merely continues the cut frame (`TICKMARKR_CHECKOU`, then
+ *  `T`) is never taken for a new frame.
+ *  ponytail: the typed command's echo cut exactly after its `TICKMARKR` printf argument reads the same,
+ *  and so does a last row that merely reads `T`; either way the proof line is unread at the ceiling. */
+function ceilingCutFrame(pages, tail, checkout) {
+    const k = cutFrameRow(pages.rows, checkoutProofLine(checkout));
+    if (k === undefined)
+        return false;
+    // The anchor's rows past the pages' last position are the cut frame's continuation (`…CHECKOU` | `T` |
+    // ` 40:…;`), read after it; an anchor past a gap, or at an unknown position, stands alone and must read
+    // clean.
+    const beyond = tailBeyond(pages, tail), cut = pages.rows.slice(k);
+    const continued = beyond === undefined ? !misplacedProof(tail.rows.join("\n"), checkout)
+        : beyond.length === 0 || !misplacedProof([...cut, ...beyond].join("\n"), checkout);
+    if (!continued || misplacedProof(pages.rows.slice(0, k).join("\n"), checkout))
+        return false;
+    if (beyond === undefined)
+        return true;
+    // An anchor sharing positions with the pages is a SECOND reading of those rows, read WHOLE before them:
+    // it is classified in place and whole — only the pages' own cut rows past it are dropped — so a foreign,
+    // malformed or unterminated mark the anchor read where a later page read harmless text or the cut frame
+    // is never forgotten, and a trailing prefix in the anchor's own reading never inherits the pages' cut.
+    const from = tail.at - pages.at, ownEnd = Math.max(0, from + tail.rows.length);
+    const anchored = [...pages.rows.slice(0, Math.max(0, from)), ...tail.rows, ...pages.rows.slice(ownEnd, Math.max(k, ownEnd))];
+    return !misplacedProof(anchored.join("\n"), checkout);
+}
+/** v2.6.8 T1: the row a trailing strict prefix of the own frame starts at, or undefined. A frame starts its own row
+ *  and the terminal may wrap it anywhere, so rows are rejoined first and the cut frame is the LONGEST run
+ *  of trailing rows that rejoins into a prefix; only the trailing frame-alphabet run can hold it. */
+function cutFrameRow(rows, own) {
+    const joinedRows = rows.map(joinWrapped), joined = joinedRows.join("");
+    let run = joined.length;
+    while (run > 0 && /[A-Z0-9a-f_ :]/.test(joined[run - 1]))
+        run--;
+    for (let k = 0, at = 0; k < rows.length; at += joinedRows[k].length, k++) {
+        if (joinedRows[k] && at >= run && framePrefix(joined.slice(at), own))
+            return k;
+    }
+    return undefined;
+}
+/** A row the read returned but that is not text: kept in its position so it never joins its neighbours. */
+const UNREADABLE_ROW = "�";
+function linePosition(cursor) {
+    return typeof cursor === "string" && /^\d+$/.test(cursor) ? Number(cursor) : undefined;
+}
+/** v2.6.8 T1: the anchor's rows past the pages, by ROW IDENTITY — scrollback position, never text: none when
+ *  the anchor lies inside the pages (the scrollback may have grown between the reads), the rest when it
+ *  overlaps or abuts their end, undefined when a gap separates them or either position is unknown. */
+function tailBeyond(pages, tail) {
+    if (pages.at === undefined || tail.at === undefined)
+        return undefined;
+    const end = pages.at + pages.rows.length;
+    if (tail.at > end || tail.at + tail.rows.length < pages.at)
+        return undefined;
+    return tail.rows.slice(Math.max(0, end - tail.at));
+}
+/** v2.6.8 T1: the anchor read in place among the paged rows: the pages' rows before its position, every one
+ *  of its own rows, then the pages' rows after it. An anchor sharing or abutting no position with the
+ *  pages, or at an unknown one, stands alone (fail-closed). The pages' own reading is classified too. */
+function tailInContext(pages, tail) {
+    if (tailBeyond(pages, tail) === undefined)
+        return tail.rows.join("\n");
+    const from = tail.at - pages.at;
+    return [...pages.rows.slice(0, Math.max(0, from)), ...tail.rows, ...pages.rows.slice(Math.max(0, from + tail.rows.length))].join("\n");
+}
+/** v2.6.8 T1: the caller's live launch check, consulted by create at its actual submission — after the runtime
+ *  and worktree lookups it awaits, the last moment before a terminal is launched. A throwing guard withdraws
+ *  the launch (nothing is created) and its error is the launch failure. Async-scoped, so it reaches create
+ *  through every driver wrapper that forwards run. */
+const launchGuards = new AsyncLocalStorage();
+export function withLaunchGuard(guard, run) {
+    return launchGuards.run(guard, run);
 }
 /** The exact bytes the create command prints as its first line. */
 export function checkoutProofLine(checkout) {
@@ -257,8 +365,8 @@ export function checkoutFrames(text) {
  *  frame names anything else, and no frame is incomplete. Full-path equality after canonicalization —
  *  never a prefix, a substring, or a whitespace-terminated fragment. */
 export function provesCheckout(text, checkout) {
-    const { complete, incomplete } = checkoutFrames(text);
-    return !incomplete && complete.includes(checkout) && complete.every((c) => c === checkout);
+    // v2.6.8 T1: a malformed mark the frame grammar cannot parse is placement evidence too (misplacedProof).
+    return checkoutFrames(text).complete.includes(checkout) && !misplacedProof(text, checkout);
 }
 /**
  * Everything a terminal on the tracked worktree runs before the payload: enter the checkout (a
@@ -725,7 +833,7 @@ export class OrcaDriver {
                     throw new OrcaError(family, e.reason, raw, { code: e.code, runtimeId: e.runtimeId });
                 }
             }
-            throw new OrcaError(family, `orca CLI exited ${r.code}${r.timedOut ? " after timeout" : ""}`, raw);
+            throw new OrcaError(family, `orca CLI exited ${r.code}${r.timedOut ? " after timeout" : ""}`, raw, r.timedOut === true ? { timedOut: true } : {});
         }
         return parseEnvelope(family, r.stdout, raw);
     }
@@ -859,6 +967,7 @@ export class OrcaDriver {
         // into the checkout, because Orca cannot be asked to place a terminal in a path it does not
         // track (OBS-1004). Shell startup can swallow that prefix; prove it from scrollback below.
         const payload = `export ${FORK_CAP_ENV}=${shq(process.env[FORK_CAP_ENV] ?? resolvedForkCap())}; ${cmd}`;
+        launchGuards.getStore()?.(); // v2.6.8 T1: eligibility is re-read here, after every awaited lookup above
         const env = await this.call("create", [
             "terminal", "create", "--worktree", `path:${tracked}`, "--title", st.title, "--command", inCheckout(st.cwd, payload),
         ], this.cliCwd(st));
@@ -892,7 +1001,9 @@ export class OrcaDriver {
         let misplaced, unread;
         let proof = await this.checkoutProven(handle, st.cwd, this.cliCwd(st), env.runtimeId, deadline);
         for (;;) {
-            if (proof.proven)
+            // v2.6.8 T1: placement evidence is sticky — a later poll whose scrollback no longer shows the
+            // foreign, malformed or partial mark an earlier one read never turns it into proof.
+            if (proof.proven && misplaced === undefined)
                 break;
             if (proof.seen === "misplaced")
                 misplaced = proof;
@@ -906,15 +1017,16 @@ export class OrcaDriver {
                 break;
             proof = await this.checkoutProven(handle, st.cwd, this.cliCwd(st), env.runtimeId, deadline);
         }
-        if (!proof.proven) {
+        if (!proof.proven || misplaced !== undefined) {
             try {
                 await this.closeTerminal({ ...st, handle, runtimeId: env.runtimeId });
             }
             catch { /* best effort under the answering runtime; the latch prevents another launch */ }
             // The typed timeout only when EVERY poll read its whole scrollback inside the ceiling and found no
-            // trace of the mark; one misplaced or unread poll anywhere in the window denies it.
+            // trace of the mark — or the ceiling cut the last one mid-frame; one misplaced or unread poll
+            // anywhere in the window denies it.
             const evidence = misplaced ?? unread ?? proof;
-            throw this.latched("create", st, `terminal ${handle} does not prove checkout ${st.cwd} within ${CHECKOUT_PROOF_TIMEOUT_MS} ms (${evidence.reason})`, env.raw, evidence.seen === "absent" ? "checkout-proof-timeout" : undefined);
+            throw this.latched("create", st, `terminal ${handle} does not prove checkout ${st.cwd} within ${CHECKOUT_PROOF_TIMEOUT_MS} ms (${evidence.reason})`, env.raw, evidence.seen === "absent" || evidence.seen === "cut" ? "checkout-proof-timeout" : undefined);
         }
         st.handle = handle;
         // The handle is bound to the runtime identity that ANSWERED its create.
@@ -1036,12 +1148,14 @@ export class OrcaDriver {
      * the terminal record must name `handle` and `_meta.runtimeId` must be `runtimeId` — the runtime
      * that supplied the ownership listing — else another terminal's or another runtime's bytes were
      * answered and nothing is proven. Proven means provesCheckout: exact canonical full-path equality
-     * of a complete frame, no other checkout named, no incomplete frame.
+     * of a complete frame, no other checkout named, no incomplete frame or unparseable mark — in the pages
+     * or the anchor's tail (v2.6.8 T1).
      * E1: with a `deadline` (create's window) there is ONE absolute deadline: a read is issued only while
      * budget is left and is handed exactly that budget, and a page that still lands past it is late —
      * nothing late proves the checkout. `seen` is what the scrollback showed, for the typed timeout:
      * `misplaced` — a frame naming another checkout, a cut frame or an unparseable mark in anything read
-     * (the anchor's tail and every page included, even when paging stopped or a later read threw);
+     * (the anchor's tail and every page included, even when paging stopped, a later read threw or the page's
+     * own cursors were malformed — v2.6.8 T1; the tail read after the pages it overlaps, tailInContext);
      * `absent` — ONLY when every page down to the start of the scrollback was read before the ceiling
      * and none carries a trace of the mark; `unread` — every other exit: PROOF_PAGES reached, a limited
      * read with no (or the same) next cursor or a truncated anchor without one, a read that threw, a read
@@ -1057,10 +1171,13 @@ export class OrcaDriver {
         // F (D-832): a page read whose own metadata does not say how complete it is (classifyProofPage):
         // its bytes are evidence, but the scrollback it came from is not known to be read whole.
         let late = false, unknown = false;
-        const page = async (cursor) => {
+        // v2.6.8 T1: `keep` takes every row a bound read returned, at its position, the moment it is read —
+        // BEFORE any row type, cursor or overlap validation can discard it: a bound page whose cursor metadata
+        // is malformed, or that carries a non-string row, is still evidence of every row it shows.
+        const page = async (keep, cursor) => {
             const budget = deadline === undefined ? undefined : deadline - this.time.now();
             if (budget !== undefined && budget <= 0)
-                return undefined; // no budget left: the read is never issued
+                return undefined; // no budget left: the read is never issued (the anchor only)
             let env;
             try {
                 env = await this.call("read", [
@@ -1068,7 +1185,10 @@ export class OrcaDriver {
                 ], from, budget);
             }
             catch (error) {
-                if (deadline === undefined || this.time.now() < deadline)
+                // v2.6.8 T1: only a read the ceiling actually INTERRUPTED — killed at the budget it was handed — is
+                // the cut. A read that failed for any other reason (a nonzero exit, unparseable output, an invocation
+                // exception) keeps its own failure at every arrival time, at or past the ceiling included.
+                if (deadline === undefined || !(error instanceof OrcaError && error.timedOut === true))
                     throw error;
                 return undefined; // the read the ceiling cut off: unread
             }
@@ -1084,6 +1204,16 @@ export class OrcaDriver {
             // E1: only a well-formed page is read text. A tail that is missing, not an array or carries a
             // non-string row (tailText), or a cursor that is not a non-empty string is a malformed page: it
             // throws, so it is unread output — never filtered to an empty page that would read as an absent proof.
+            // v2.6.8 T1: the tail's rows are kept first — a non-string row as UNREADABLE_ROW in its place — so
+            // neither a malformed cursor nor a malformed row discards the foreign, malformed or partial mark the
+            // rest show: that evidence stays sticky for the whole create window. A cursor page's rows start at
+            // its cursor; the anchor's end at its nextCursor (an impossible or unknown position stays unknown).
+            if (Array.isArray(term.tail)) {
+                const rows = term.tail.map((row) => typeof row === "string" ? row : UNREADABLE_ROW);
+                const at = cursor === undefined ? (linePosition(term.nextCursor) ?? -1) - rows.length : linePosition(cursor);
+                keep({ rows, ...(at !== undefined && at >= 0 ? { at } : {}) });
+            }
+            this.tailText("read", term, env.raw);
             for (const key of ["oldestCursor", "nextCursor"]) {
                 if (term[key] !== undefined && str(term[key]) === undefined)
                     throw new OrcaError("read", `proof page ${key} is not a cursor`, env.raw);
@@ -1093,42 +1223,51 @@ export class OrcaDriver {
             // stream alone cannot tell them apart, so its empty tail is unread scrollback, never absence.
             if (isBlindStreamPage(term))
                 throw new OrcaError("read", "proof page is a blind stream page (status exited, empty tail): its scrollback is unread", env.raw);
-            const text = this.tailText("read", term, env.raw);
             // F: paging flags missing, not boolean or contradicted by the cursors leave the page's bytes read
             // but its completeness unknown — it ends paging, and the poll can never read as absent.
             const kind = classifyProofPage(term);
             if (kind === "unread")
                 unknown = true;
-            return { term, text, kind };
+            return { term, kind };
         };
         // Every validated read is evidence, whatever stops the next one: the anchor's tail and the pages
         // read from the oldest cursor are inspected even when paging hits PROOF_PAGES or a read throws.
-        let tail = "", text = "";
-        const described = (why) => {
-            const misplaced = checkout !== undefined && [text, tail].some((t) => misplacedProof(t, checkout));
-            const shown = [text, tail].map(checkoutFrames);
+        // v2.6.8 T1: ONE record of everything read — the anchor's rows and the pages' rows, each row once at
+        // its position. `pages` keeps a position only while every page starts where the rows before it end.
+        let tail = { rows: [] }, pages = { rows: [] }, pagedEnd;
+        const text = () => pages.rows.join("\n");
+        // `cut`: the ceiling stopped this read. A frame it left incomplete at the end of the paged text is
+        // the cut, not the terminal's misprint — unread, typed as the timeout — unless anything else read
+        // (a complete foreign frame, a malformed marker read whole) is placement evidence (ceilingCutFrame).
+        const described = (why, cut = false) => {
+            const after = tailInContext(pages, tail);
+            const misplaced = checkout !== undefined && [text(), after].some((t) => misplacedProof(t, checkout));
+            const shown = [text(), after].map(checkoutFrames);
             const named = [...new Set(shown.flatMap((f) => f.complete))];
-            const flaw = shown.some((f) => f.incomplete) ? " and carries an incomplete proof frame"
-                : misplaced && named.length === 0 ? " and carries a malformed proof marker" : "";
+            const ceilingCut = cut && checkout !== undefined && ceilingCutFrame(pages, tail, checkout);
+            const flaw = ceilingCut ? " and carries a proof frame the ceiling cut off before it was read whole"
+                : shown.some((f) => f.incomplete) ? " and carries an incomplete proof frame"
+                    : misplaced && named.every((c) => c === checkout) ? " and carries a malformed proof marker" : "";
             return {
                 proven: false,
                 reason: `${why}its scrollback ${named.length ? `names ${named.join(", ")}` : "names no checkout"}${flaw}`,
-                ...(misplaced ? { seen: "misplaced" } : {}),
+                ...(ceilingCut ? { seen: "cut" } : misplaced ? { seen: "misplaced" } : {}),
             };
         };
         try {
-            const first = await page();
+            const first = await page((read) => { tail = read; });
             if (first === undefined)
                 return { proven: false, reason: "the ceiling cut off the proof read before any scrollback was read", seen: "unread" };
             const anchor = first.term;
-            tail = first.text;
             let cursor = str(anchor.oldestCursor);
             // why paging ended with scrollback still unread. Every exit is one of: complete (an anchor that
             // is the whole scrollback, or a page whose metadata says it is the last), whole frames found, a
             // page whose completeness is unknown (`unknown`, classifyProofPage), or one of these.
+            // `spent`: a whole page landed exactly AT the ceiling, so no budget is left for the next read — paging
+            // ended with scrollback unread, but no read was cut.
             let stop;
             if (cursor === undefined) {
-                text = tail;
+                pages = tail; // the anchor is the whole read: the same rows, read once
                 // A cursorless anchor that says it holds less than the scrollback leaves the rest unreadable.
                 if (first.kind === "partial")
                     stop = "stalled";
@@ -1138,14 +1277,31 @@ export class OrcaDriver {
                     stop = "exhausted";
                     break;
                 } // more scrollback than the bound: unread, not absent
-                const got = late ? undefined : await page(cursor);
+                // v2.6.8 T1: lateness ends paging but never CUTS a read — a page returned whole, whether it landed
+                // past the ceiling (`late`) or exactly at it (`spent`: the next read is never issued), keeps its rows
+                // (an unterminated or malformed marker included) as placement evidence; only a read the ceiling
+                // actually INTERRUPTED below is `cut` (described's typed-timeout exemption).
+                if (late)
+                    break;
+                if (deadline !== undefined && this.time.now() >= deadline) {
+                    stop = "spent";
+                    break;
+                }
+                const got = await page((read) => {
+                    // Pages join by POSITION, never by bytes: a page that does not start where the rows before it end — a
+                    // gap, an overlap or an unknown position — is set apart by UNREADABLE_ROW, so no frame bridges rows
+                    // it never read beside.
+                    const contiguous = n === 0 || (pagedEnd !== undefined && read.at === pagedEnd);
+                    pages = { rows: [...pages.rows, ...(contiguous ? [] : [UNREADABLE_ROW]), ...read.rows],
+                        ...(n === 0 ? { at: read.at } : contiguous && pages.at !== undefined ? { at: pages.at } : {}) };
+                    pagedEnd = read.at === undefined ? undefined : read.at + read.rows.length;
+                }, cursor);
                 if (got === undefined) {
                     stop = "cut";
                     break;
-                }
+                } // issued with budget left, interrupted by the ceiling
                 const term = got.term;
-                text += `${got.text}\n`;
-                const frames = checkoutFrames(text);
+                const frames = checkoutFrames(text());
                 if (frames.complete.length > 0 && !frames.incomplete)
                     break; // whole frames, nothing dangling
                 if (got.kind === "complete")
@@ -1170,20 +1326,25 @@ export class OrcaDriver {
                 }
                 cursor = next;
             }
-            const frames = checkoutFrames(text);
             // Reconcile has no task-checkout path after a daemon restart, but the proof itself remains
             // an ownership record: exactly one complete, unambiguous checkout frame can only have been
             // written by tickmarkr's create command.  Slot recovery additionally requires its exact path.
-            // A stalled read proves only what it read, as before; a cut or exhausted one proves nothing.
-            const proven = stop !== "cut" && stop !== "exhausted" && (checkout === undefined
-                ? !frames.incomplete && frames.complete.length > 0 && new Set(frames.complete).size === 1
-                : provesCheckout(text, checkout));
+            // A stalled read proves only what it read, as before; a cut, spent or exhausted one proves nothing.
+            // v2.6.8 T1: proof is classified over EVERYTHING read — the pages and the anchor's tail, which
+            // may hold rows paging stopped short of. A foreign, incomplete or malformed mark in either
+            // (misplacedProof) contradicts the proof: refused, never accepted beside a matching frame.
+            const own = checkout ?? checkoutFrames(text()).complete[0];
+            const proven = (stop === undefined || stop === "stalled") && own !== undefined
+                && provesCheckout(text(), own) && !misplacedProof(tailInContext(pages, tail), own);
             if (proven && !late)
                 return { proven: true, reason: "" };
             const why = `${late ? "read past the ceiling, " : ""}${stop === "cut" ? "the ceiling cut off paging, "
-                : stop === "exhausted" ? `paging stopped at ${PROOF_PAGES} pages with scrollback unread, `
-                    : stop === "stalled" ? "a limited read gave no next cursor with scrollback unread, " : ""}${unknown ? "a page carried missing, non-boolean or contradictory paging metadata, " : ""}`;
-            const read = described(why);
+                : stop === "spent" ? "a page landed at the ceiling with scrollback unread, "
+                    : stop === "exhausted" ? `paging stopped at ${PROOF_PAGES} pages with scrollback unread, `
+                        : stop === "stalled" ? "a limited read gave no next cursor with scrollback unread, " : ""}${unknown ? "a page carried missing, non-boolean or contradictory paging metadata, " : ""}`;
+            // Only a read the ceiling actually cut short leaves a frame unread; a page that landed late or at the
+            // ceiling was still returned whole, so a prefix it ends in is a misprint read whole, never the typed timeout.
+            const read = described(why, stop === "cut");
             // F: absent only when every page read said, explicitly and consistently, how complete it was.
             return { ...read, seen: read.seen ?? (stop || late || unknown ? "unread" : "absent") };
         }
@@ -1191,7 +1352,7 @@ export class OrcaDriver {
             // A read that failed midway keeps what was already read as evidence; what it could not read is
             // unread output — never an absent proof.
             const read = described(""), failed = error instanceof Error ? error.message : String(error);
-            return { ...read, reason: tail || text ? `${read.reason}; then a read failed — ${failed}` : failed, seen: read.seen ?? "unread" };
+            return { ...read, reason: tail.rows.length + pages.rows.length > 0 ? `${read.reason}; then a read failed — ${failed}` : failed, seen: read.seen ?? "unread" };
         }
     }
     async recover(family, st, newRuntimeId, raw, opts) {

package/dist/gates/evidence.js

@@ -1,10 +1,10 @@
-import { shOk } from "../run/git.js";
+import { shGitOk } from "../run/git.js";
 export async function evidenceGate(worktree, baseRef) {
-    const commits = (await shOk(`git rev-list '${baseRef}..HEAD'`, worktree)).trim().split("\n").filter(Boolean);
+    const commits = (await shGitOk(`git rev-list '${baseRef}..HEAD'`, worktree)).trim().split("\n").filter(Boolean);
     if (!commits.length) {
         return { gate: "evidence", pass: false, details: "no commits — worker claimed work but committed nothing", commits: [] };
     }
-    const stat = (await shOk(`git diff --stat '${baseRef}..HEAD'`, worktree)).trim();
+    const stat = (await shGitOk(`git diff --stat '${baseRef}..HEAD'`, worktree)).trim();
     if (!stat) {
         return { gate: "evidence", pass: false, details: "commits exist but the cumulative diff is empty", commits };
     }

package/dist/gates/review.d.ts

@@ -148,4 +148,4 @@ export declare function renderPriorMaterials(priorMaterials: readonly Structured
  */
 export declare function reviewResponseExample(nonce: string): string;
 export declare function reviewResponseRequirement(nonce: string): string;
-export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[], artifactDir?: string, reviewHistory?: string[], demotedReviewers?: ReadonlySet<string>, carriedFindings?: readonly StructuredFinding[], priorReviewers?: readonly PriorReviewer[], carriedAuthors?: readonly string[], operatorContext?: string): Promise<GateResult>;
+export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[], artifactDir?: string, reviewHistory?: string[], demotedReviewers?: ReadonlySet<string>, carriedFindings?: readonly StructuredFinding[], priorReviewers?: readonly PriorReviewer[], carriedAuthors?: readonly string[], _operatorContext?: string): Promise<GateResult>;

package/dist/gates/review.js

@@ -5,7 +5,7 @@ import { criticalPathHits, DEFAULT_DIFF_CAP, DEFAULT_REVIEW_CRITICAL_PATHS, decl
 import { filesGlob } from "../graph/files-glob.js";
 import { renderAcceptanceItem, TIERS } from "../graph/schema.js";
 import { getAdapter } from "../adapters/registry.js";
-import { shOk } from "../run/git.js";
+import { shGitOk } from "../run/git.js";
 import { carryReviewFindings, isDeferredFinding, observedReviewFingerprints, reviewFingerprintMatches, structuredFindings, UNIDENTIFIED } from "../run/journal.js";
 import { redactSecrets } from "../run/redact.js";
 import { rankPreferredChannels, reviewPreferenceTieBreak } from "../route/role-pick.js";
@@ -81,7 +81,7 @@ const DIFF_CAP_REMEDY = "split the task, or raise gates.diffCap";
  * the leaf class must be visible to the promotion test, and rename detection would hide the old side.
  */
 export async function changedPaths(worktree, baseRef) {
-    const out = await shOk(`git diff --name-only --no-renames -z '${baseRef}..HEAD'`, worktree);
+    const out = await shGitOk(`git diff --name-only --no-renames -z '${baseRef}..HEAD'`, worktree);
     return [...new Set(out.split("\0").map((p) => p.trim()).filter(Boolean))].sort();
 }
 /**
@@ -95,7 +95,7 @@ const VERSION_FIELD_LINE_RE = /^[+-]\s*"version":\s*"[^"]*",?\s*$/;
 export async function mirrorsVersionOnly(worktree, baseRef, path) {
     let diff;
     try {
-        diff = await shOk(`git diff --full-index -U0 '${baseRef}..HEAD' -- ${shq(path)}`, worktree);
+        diff = await shGitOk(`git diff --full-index -U0 '${baseRef}..HEAD' -- ${shq(path)}`, worktree);
     }
     catch {
         return false;
@@ -109,8 +109,8 @@ export async function fetchTaskDiff(worktree, baseRef, files = []) {
     const matched = files.length ? (await changedPaths(worktree, baseRef)).filter(filesGlob([...files])) : [];
     const pathspec = matched.length ? ` -- ${matched.map(shq).join(" ")}` : "";
     const [rawFull, rawForCap] = files.length && matched.length === 0 ? ["", ""] : await Promise.all([
-        shOk(`git diff --full-index '${baseRef}..HEAD'${pathspec}`, worktree),
-        shOk(`git diff --full-index -U0 '${baseRef}..HEAD'${pathspec}`, worktree),
+        shGitOk(`git diff --full-index '${baseRef}..HEAD'${pathspec}`, worktree),
+        shGitOk(`git diff --full-index -U0 '${baseRef}..HEAD'${pathspec}`, worktree),
     ]);
     const fullMeasurement = measureArtifactDiff(rawFull);
     const capMeasurement = measureArtifactDiff(rawForCap);
@@ -324,6 +324,52 @@ export function renderDeclaredWriteScope(files) {
 The task DECLARED these write-scope patterns:
 ${files.map((path) => `- ${path}`).join("\n")}`;
 }
+// v2.6.8 T7: syntax only, never a filesystem glob. Explicit alternatives are finite at any count.
+// ponytail: no expansion ceiling; the operator authors files[], so its product of alternatives is theirs to size.
+const TEST_FILE_RE = /(?:^|\/)[^/]*\.(?:test|spec)\.[cm]?[jt]sx?$/;
+/** Every finite, explicit `{a,b}` alternative of one entry, deduplicated; null when any part is not finite. */
+function expandFiniteBraces(pattern) {
+    const open = pattern.indexOf("{");
+    if (open < 0)
+        return pattern.includes("}") ? null : [pattern];
+    if (pattern.slice(0, open).includes("}"))
+        return null;
+    const cuts = [open];
+    let depth = 0;
+    for (let i = open; i < pattern.length; i++) {
+        const c = pattern[i];
+        if (c === "{")
+            depth++;
+        else if (c === "," && depth === 1)
+            cuts.push(i);
+        else if (c === "}" && --depth === 0) {
+            if (cuts.length < 2)
+                return null; // `{}`, `{a}`, `{1..3}`: no finite alternation
+            cuts.push(i);
+            const out = new Set();
+            for (let k = 0; k + 1 < cuts.length; k++) {
+                const alt = pattern.slice(cuts[k] + 1, cuts[k + 1]);
+                const sub = alt ? expandFiniteBraces(pattern.slice(0, open) + alt + pattern.slice(i + 1)) : null;
+                if (!sub)
+                    return null;
+                for (const path of sub)
+                    out.add(path);
+            }
+            return [...out];
+        }
+    }
+    return null; // unclosed brace
+}
+/**
+ * The test files one files[] entry names explicitly. A wildcard, escape, malformed or empty brace, or
+ * a path leaving the repository anywhere in the expansion grants nothing for the whole entry.
+ */
+function explicitSuitePaths(entry) {
+    const paths = expandFiniteBraces(entry);
+    const explicit = paths?.every((path) => !/[*?[\]{}()!\\]/.test(path)
+        && path.split("/").every((segment) => segment !== "" && segment !== "." && segment !== ".."));
+    return explicit ? paths.filter((path) => TEST_FILE_RE.test(path)) : [];
+}
 /**
  * OBS-1033: the vendors of the seats that authored commits inside the accumulated diff. A seat is
  * never handed its own earlier work to approve. Unresolved channels are refused by reviewGate.
@@ -433,7 +479,10 @@ artifactDir, reviewHistory, demotedReviewers, carriedFindings = [],
 // never the run-wide rotation history nor excludeReviewers; the seat holds the highest of their tiers.
 priorReviewers = [], 
 // Closed list of actual subject authors; empty preserves legacy callers' single-author contract.
-carriedAuthors = [], operatorContext) {
+carriedAuthors = [], 
+// v2.6.8 T7: kept for compatible callers and read as empty. An approve reason is the repair worker's
+// standing instruction; a reviewer handed "the previous finding is resolved" graded the reason, not the diff.
+_operatorContext) {
     // R3 (OBS-186): participation is keyed on PATHS. The compiler's assignment comes from the DECLARED
     // files[]; the operator's floor may RAISE it to full and can never lower it. `complexityThreshold` is
     // retired — the branch that returned a green skip on a complexity comparison is gone, and with it the
@@ -529,8 +578,9 @@ carriedAuthors = [], operatorContext) {
         return capFail;
     const nonce = generateVerdictNonce();
     const repoRoot = daemonRepoRoot(worktree, artifactDir);
-    // OBS-880 add.1: guidance only. Do not expand scope globs into permission to run suites.
-    const ownTestFiles = [...new Set(task.files.filter((file) => !/[*?[\]{}()!]/.test(file) && /(?:^|\/)[^/]*\.(?:test|spec)\.[cm]?[jt]sx?$/.test(file)))];
+    // OBS-880 add.1: guidance only. Do not expand scope globs into permission to run suites; v2.6.8 T7:
+    // finite explicit brace alternatives are explicit files and each one is named.
+    const ownTestFiles = [...new Set(task.files.flatMap(explicitSuitePaths))];
     const suiteBudget = ownTestFiles.length
         ? `You may run at most the task's own test files explicitly named in files[]; these are the only suites you may run: ${ownTestFiles.map((file) => `\`${file}\``).join(", ")}.`
         : "No suite may be run: files[] names no explicit test file owned by this task.";
@@ -562,10 +612,6 @@ ${suiteBudget} Never run the whole suite (including an unfiltered npm test or vi
 
 ${priorMaterials.length ? `${renderPriorMaterials(priorMaterials)}
 
-` : ""}${operatorContext?.trim() ? `## Operator context
-Context only: this never substitutes for an acceptance criterion or closes a prior material.
-${operatorContext.trim()}
-
 ` : ""}${task.outOfScope?.length ? `## Out of scope
 The task declares these items out of scope. A finding inside these declared bounds is not material and must not block approval.
 ${task.outOfScope.map((item) => `- ${item}`).join("\n")}
@@ -683,7 +729,10 @@ ${responseRequirement}
     // a genuinely wrapped verdict behind it is reconstructed here, exactly as llm.ts would have.
     const echoFree = withoutExampleEcho(raw, nonce);
     const seat = via ? dewrapPaneVerdict(echoFree, nonce) : echoFree;
-    const v = extractVerdictJson(seat, nonce);
+    const parsed = extractVerdictJson(seat, nonce);
+    // v2.6.8 T7: with zero carried ids nothing was asked to close, so volunteered closure ids are ignored —
+    // a material red stays red, never no-verdict. With carried ids the closure protocol binds unchanged.
+    const v = parsed && !priorMaterials.length ? { ...parsed, resolved: undefined, reraised: undefined } : parsed;
     const findings = v && Array.isArray(v.findings) ? v.findings : null;
     const priorIds = priorMaterials;
     const closureInvalid = isReviewClosureInvalid(v, priorIds);

package/dist/gates/run-gates.d.ts

@@ -73,6 +73,9 @@ export interface GateContext {
     excludeReviewers?: string[];
     demotedReviewers?: Set<string>;
     reviewNoVerdicts?: Map<string, string[]>;
+    /** v2.6.8 T1: review seats whose one same-seat launch retry this candidate already spent (the daemon
+     * replays them from the journal), so a resume or recheck never re-grants it by forgetting. */
+    launchRetried?: readonly string[];
     recheck?: boolean;
     /** Explicit worker funding requires fresh red measurements, never a gate waiver. OBS-1106: so does
      * a retry that landed nothing on a timeout-class red — its one fresh re-observation. C: and one whose