tickmarkr 2.8.5 → 2.8.7

package/dist/run/daemon.js

@@ -1,7 +1,7 @@
 import { HOST_PROBE_SAMPLE_MS, HOST_PROBE_SAMPLES, HostDegradedError, hostDegraded, observeHost } from "./host-health.js";
 import { runWithInterruptionSink, VITEST_CACHE_ENV, worktreeVitestCache } from "../gates/test-manifest.js";
 import { COMMAND_LEASE_TOKEN_ENV, commandLeaseEnvironment, CommandLeases, currentCommandLeaseToken, isRunnerCommand, runWithCommandLease, withCommandLease } from "./lease.js";
-import { execFileSync, spawn } from "node:child_process";
+import { execFile, execFileSync, spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { shq } from "../adapters/types.js";
 import { appendFileSync, closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, readlinkSync, readSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
@@ -34,10 +34,10 @@ import { executionSignal, remainingExecutionMs, withExecutionBudget, withoutExec
 import { repairSelectionDecision, repairSelectionEnabled } from "./repair-selection.js";
 import { failureDisposition, reserveInfrastructureRetry } from "./recovery.js";
 import { runEnvironment } from "./environment.js";
-import { addDetachedWorktree, changeRepresented, cleanupRunWorktrees, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER, preserveWorktree, producerFields, reflogWitness, removeWorktree, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shell, shGit, SUITE_PARENT_ENV, verificationProtocol, WORKTREE_LAYOUT_CONTRACT, WORKTREES_DIR, worktreePath } from "./git.js";
+import { addDetachedWorktree, changeRepresented, cleanupRunWorktrees, declaredBaseContainment, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER, preserveWorktree, producerFields, reflogWitness, removeWorktree, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shell, shGit, SUITE_PARENT_ENV, verificationProtocol, WorktreeAdminRaceError, WORKTREE_LAYOUT_CONTRACT, WORKTREES_DIR, worktreePath } from "./git.js";
 import { MASK } from "./redact.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
-import { classifyRepairDisposition, resolveScopeHints } from "./repair-disposition.js";
+import { classifyRepairDisposition, namedPaths, resolveScopeHints } from "./repair-disposition.js";
 import { applyScopeAmendments, activeRetryBan, interruptedAttempt, RESUME_HARVEST_SOURCE, resumeHarvestAuthor, approvalAction, APPROVAL_REFUSED, bindingToken, effectiveEvents, foldDecisions, physicalLine, staleApprovals, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, readableExcerpt, receiptOrigin, outstandingReviewFindings, pendingApprovalActions, pendingRechecks, pendingRepairFindings, phaseForGate, priorJudgments, readPriorRunEvidence, recordedTaskFailureKind, reraisedReviewChains, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, standingRulings, structuredFindings, upheldFeedbackByTask } from "./journal.js";
 import { carriedAuthorVendors, gateReviewerFloor, isDiffCapPark, isGarbageReview, pickReviewer } from "../gates/review.js";
 import { acquireApprovalSerialization, acquireRunLock, isPidLive, releaseRunLock } from "./lock.js";
@@ -855,7 +855,11 @@ export function resetDeadChannelFastKillMsForTests() {
 // monotonic-tracker silence — CONCLUDES the wait. Conclude, never kill: the pane is harvested by
 // the same tail a window expiry uses, and the carried worktree goes straight to gates. Set at the
 // fast-kill's window on purpose (the OBS-264 arithmetic is "a ~36m stall + ~15m redo becomes a
-// ~5m gate pass"); a worker that is merely thinking still burns CPU and is never concluded here.
+// ~5m gate pass"). Queue row 231 (D-2119): a headless worker waiting on its remote provider can be
+// silent with flat CPU. Print mode also requires a fresh reading of no ESTABLISHED TCP connection
+// in its owned process group; connected or unreadable holds the harvest. Interactive workers keep
+// the triad: an idle pane holds connections too. Residual (D-2125): a truly hung headless worker
+// holding a connection rides the stall window instead.
 const HARVEST_SILENT_MS = 5 * 60_000;
 let harvestSilentMs = HARVEST_SILENT_MS;
 /** Test seam — shrink the harvest silence gate without minute-long sleeps. */
@@ -1145,6 +1149,48 @@ export function integrationAnchor(events) {
         return { unreadable: `the newest merge row's from is ${show(merge.data.from)}, not an object id` };
     return { anchor: merge.data.commit };
 }
+/**
+ * Queue row 220 (D-2111): prove the spec's declared base against the commit this run starts from — the
+ * checkout HEAD for a fresh run (recorded as its run-start baseRef), the recorded run-start baseRef for a
+ * resume, never the checkout's current HEAD: a resume never re-bases, and no run rebases onto the declared
+ * ref. Drift and an unresolvable answer throw; runDaemon calls this before it writes anything.
+ */
+async function proveDeclaredBase(repoRoot, runId, ref, resume) {
+    const action = resume ? `resume ${runId}` : "run";
+    const remedy = `Remedy: check out a branch that contains ${ref}, or correct base: in the spec and recompile.`;
+    const unresolvable = (against, why) => new Error(`refusing to ${action}: declared base ${ref} is unresolvable against ${against} — ${why}. ${remedy}`);
+    let start;
+    let against;
+    if (resume) {
+        const recorded = Journal.open(repoRoot, runId).read().find((e) => e.event === "run-start")?.data.baseRef;
+        if (typeof recorded !== "string" || !recorded)
+            throw unresolvable("the recorded run-start base", "the journal's run-start records no baseRef");
+        start = recorded;
+        against = `the recorded run-start base ${short(start)}`;
+    }
+    else {
+        const head = await shGit("git rev-parse --verify HEAD^{commit}", repoRoot);
+        if (head.code !== 0)
+            throw unresolvable("HEAD", `git said for HEAD: ${(head.stderr || head.stdout).trim()}`);
+        start = head.stdout.trim();
+        against = `HEAD ${short(start)}`;
+    }
+    const probe = await declaredBaseContainment(repoRoot, ref, start);
+    if (probe.result === "contained")
+        return { ref, via: probe.via, start };
+    if (probe.result === "unresolvable")
+        throw unresolvable(against, `git said for ${probe.ref}: ${probe.evidence}`);
+    const lines = await Promise.all(probe.missing.map(async (m) => {
+        const subject = await shGit(`git log -1 --format=%s ${shq(m.commit)}`, repoRoot);
+        // a drift refusal must name the subject: an unreadable one refuses as unresolvable, quoting git
+        if (subject.code !== 0)
+            throw unresolvable(against, `git said for missing commit ${short(m.commit)}: ${(subject.stderr || subject.stdout).trim()}`);
+        return `  ${short(m.commit)} ${subject.stdout.trim()}${m.merge ? " (merge)" : ""}`
+            + ` — ${m.paths.length > 0 ? m.paths.join(", ") : "no paths"}`;
+    }));
+    throw new Error(`refusing to ${action}: declared base ${ref} has drifted from ${against} — `
+        + `${probe.missing.length} declared commit(s) missing:\n${lines.join("\n")}\n${remedy}`);
+}
 /** The ref legs' details: the leg, both commits, the symbolic target and the repair text. */
 export function identityDetails(leg, state, branch, runId, expected) {
     const found = state.kind === "regular" || state.kind === "symbolic" ? state.commit : undefined;
@@ -2105,6 +2151,12 @@ export async function runDaemon(repoRoot, opts = {}) {
     let baselineFailed = false;
     try {
         graph = loadGraph(repoRoot);
+        // Queue row 220 (D-2111): a declared base is proven HERE — before any journal row (lock-reclaimed and
+        // exit-cause included), the resume anchor checks, a worktree, the integration ref or baseline capture —
+        // so a refusal leaves nothing; the finally releases the lock and repository claim. No base: unchanged.
+        const declaredBase = graph.spec.base === undefined ? undefined
+            : await proveDeclaredBase(repoRoot, runId, graph.spec.base, opts.resume === true);
+        const declaredBaseRow = declaredBase ? { declaredBase: { ref: declaredBase.ref, via: declaredBase.via } } : {};
         // One bounded snapshot supplies every dispatch. On resume the current journal still participates
         // in the fold so its task-done/ordinary-approval events can retire older evidence, but findings it
         // produced are suppressed: same-run feedback already replays those bytes and must not deliver them
@@ -2943,6 +2995,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         ...(replayedExclusions.size > 0 ? { excludedChannels: [...replayedExclusions].sort() } : {}),
                         ...(opts.retryFailed ? { retryFailed: true } : {}),
                         ...(opts.graphChanged ? { graphChanged: true } : {}), // OBS-1073: the release is the engagement's
+                        ...declaredBaseRow,
                     });
                     runStarted = true;
                     await placeBoard();
@@ -2993,7 +3046,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     }
                 }
                 else {
-                    baseRef = await gitHead(repoRoot);
+                    baseRef = declaredBase?.start ?? await gitHead(repoRoot); // row 220: the proven commit is the run's base
                     journal.append("baseline-start", undefined, { baseRef, commands, capacity: resolvedCapacity() });
                     await placeBoard();
                     baselinePending = true;
@@ -3034,6 +3087,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         branch, graphDefinitionHash: graphDefinitionHash(graph),
                         integrationAnchor: "journal", // 2.8.1 T2: this run creates its branch at baseRef and journals every publication with `from`
                         ...(prior ? { supersedes: prior.runId } : {}),
+                        ...declaredBaseRow,
                     }); // graphDefinitionHash: T3 engagement identity (status+resume share it); pid: v1.13 (VIS-11) liveness; mode/modeSource: v1.51 T2; supersedes: v1.53 T5
                     runStarted = true;
                     // v1.53 T5: mark the prior run AFTER this run's run-start exists, so the prior journal never
@@ -3185,11 +3239,6 @@ export async function runDaemon(repoRoot, opts = {}) {
                     ];
                     return `${identity} — release with ${commands.map((command) => `\`${command}\``).join(" or ")}`;
                 };
-                // Lexing never starts in the middle of a word. Resolution is separate so missing hints
-                // remain visible evidence without becoming executable approval advice.
-                const namedPaths = (text) => [...text.matchAll(/(?:^|[\s`'"])((?:[A-Za-z0-9_@.()[\]-]+\/)+[A-Za-z0-9_@.[\]-]+|[A-Za-z0-9_@-]+(?:\.[A-Za-z0-9_-]+)+)(?=$|[\s`'"),:;.!?])/g)]
-                    .map((match) => match[1].replace(/^\.\//, "").replace(/\.$/, ""))
-                    .filter((path) => !path.split("/").includes(".."));
                 const diffPaths = async (base, wt) => {
                     const out = await shGit(`git diff --name-only -z ${shq(base)}..HEAD`, wt);
                     return new Set(out.code === 0 ? out.stdout.split("\0").filter(Boolean) : []);
@@ -3476,7 +3525,20 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const ref = await preserveWorktree(priorWt, producer);
                         if (ref)
                             journal.append("worktree-preserved", t.id, { ref, ...producerFields(producer) });
-                        return driver.worktree(repoRoot, taskBranch, taskBase);
+                        // Queue row 223 (D-2118): only this typed add race buys retries, with three adds total.
+                        const addWorktree = () => {
+                            return driver.worktree(repoRoot, taskBranch, taskBase);
+                        };
+                        for (let attempt = 1;; attempt++) {
+                            try {
+                                return await addWorktree();
+                            }
+                            catch (error) {
+                                if (!(error instanceof WorktreeAdminRaceError) || attempt >= 3)
+                                    throw error;
+                                journal.append("worktree-add-retry", t.id, { attempt, nextAttempt: attempt + 1, evidence: error.evidence });
+                            }
+                        }
                     };
                     // A dead worker with a clean checkout still needs a durable recovery handle: there may be no
                     // pane left to identify even the commit it was dispatched from. preserveWorktree deliberately
@@ -5186,7 +5248,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const icmd = retryMode === "resume"
                             ? adapter.resumeCommand(sessionId, promptFile, assignment.model, assignment.effort)
                             : cfg.visibility.worker === "interactive" && driver.interactive
-                                ? adapter.interactiveCommand(promptFile, assignment.model, assignment.effort)
+                                ? adapter.interactiveCommand(promptFile, assignment.model, assignment.effort, { cwd: wt, branch: taskBranch, repoRoot })
                                 : null;
                         // v1.69 T6: adapters that declare interactiveSeed launch the real TUI and inject the prompt as a
                         // user turn; they do NOT need the argv-seeding surface that interactiveCommand represents.
@@ -5203,7 +5265,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // timing can never interleave a `$(…)` with what follows it (the codex corruption class).
                         const workerCmd = interactive
                             ? (hasSeed ? ":" : icmd)
-                            : adapter.invoke(t, wt, assignment, { promptFile }).command;
+                            : adapter.invoke(t, wt, assignment, { promptFile, branch: taskBranch, repoRoot }).command;
                         const dispatchScript = promptFile.replace(/\.md$/, ".sh");
                         // Approval can reset the attempt counter while the old pane remains retained.
                         // Its ownership claim must survive a new engagement reusing the script path.
@@ -5260,17 +5322,19 @@ export async function runDaemon(repoRoot, opts = {}) {
                         let cpuFlat;
                         let cpuAccountant;
                         let cpuGapCount = 0;
-                        let unmeasurableNoted = false;
-                        // One line per attempt, whichever way the CPU leg turns out to be unmeasurable. A triad that
+                        const unmeasurableNoted = new Set();
+                        // Queue row 231 (D-2119): one line per reading per attempt, including the connection leg.
+                        // One CPU line per attempt, whichever way that leg turns out to be unmeasurable. A triad that
                         // can never conclude is this feature silently ABSENT — on a host whose `ps` the probe cannot
                         // read, every stall would ride its whole window out again with nothing saying why. Named once
                         // per attempt, not per slice: the condition is structural, and a per-slice line would bury it.
-                        const noteUnmeasurable = (reason) => {
-                            if (unmeasurableNoted)
+                        const noteUnmeasurable = (reason, reading = "cpu") => {
+                            if (unmeasurableNoted.has(reading))
                                 return;
-                            unmeasurableNoted = true;
+                            unmeasurableNoted.add(reading);
                             journal.append("worker-harvest-unmeasurable", t.id, { slot: slot.name, attempt, reason });
                         };
+                        let harvestHeldNoted = false;
                         // The CPU leg needs a marker in the worker's own argv, and every launch path puts this
                         // attempt's dispatch script there EXCEPT interactiveSeed: runInteractiveSeed launches the
                         // TUI directly, by a command the ADAPTER owns (seed.launch(model)) which tickmarkr cannot
@@ -5332,6 +5396,39 @@ export async function runDaemon(repoRoot, opts = {}) {
                             const carried = await commitsAheadOf(taskBase, wt);
                             if (carried.length === 0)
                                 return false; // nothing landed: not this branch's population
+                            if (!interactive) {
+                                // Queue row 231 (D-2119): query afresh only after the other legs hold. lsof ORs selections
+                                // without -a; -g includes connector children in the owned group, not just the CLI root.
+                                // No environment inspection. One async PATH lookup, bounded from invocation like the
+                                // reap census (15 s); SIGKILL also retires a probe that ignores SIGTERM.
+                                const group = readOwnedProcessGroup(groupFile);
+                                const connection = group === undefined ? "unreadable" : await new Promise((resolve) => {
+                                    try {
+                                        execFile("lsof", ["-nP", "-a", "-g", String(group), "-iTCP", "-sTCP:ESTABLISHED", "-Fp"], { encoding: "utf8", timeout: 15_000, killSignal: "SIGKILL", maxBuffer: 4 * 1024 * 1024 }, (error, stdout, stderr) => {
+                                            if (!error && stdout.trim())
+                                                resolve("connected");
+                                            else if (error && error.code === 1 && !stdout && !stderr)
+                                                resolve("none");
+                                            else
+                                                resolve("unreadable");
+                                        });
+                                    }
+                                    catch {
+                                        resolve("unreadable");
+                                    }
+                                });
+                                if (connection === "unreadable") {
+                                    noteUnmeasurable("the worker ESTABLISHED TCP connection reading could not be read", "connection");
+                                    return false;
+                                }
+                                if (connection === "connected") {
+                                    if (!harvestHeldNoted) {
+                                        harvestHeldNoted = true;
+                                        journal.append("worker-harvest-held", t.id, { slot: slot.name, attempt, reason: "established-tcp-connection", processGroup: group });
+                                    }
+                                    return false;
+                                }
+                            }
                             journal.append("worker-harvest", t.id, {
                                 slot: slot.name, attempt, commits: carried.length,
                                 silentMs, cpuMs: leg.cpu.ms, cpuResolutionMs: leg.cpu.resolutionMs,
@@ -5810,13 +5907,17 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             lastStatus = st;
                                             journal.append("worker-status", t.id, { slot: slot.name, status: st, attempt });
                                         }
-                                        if (st === "blocked" || st === "idle") {
+                                        // Queue row 215 (D-2118 add.1): an unhooked CLI can report unknown at its startup modal.
+                                        // Bound that status to worker-launch's startup window, including time spent reading.
+                                        const withinTrustStartup = () => workerLaunchedAt !== undefined
+                                            && Date.now() - workerLaunchedAt <= workerStartupWindowMs;
+                                        if (st === "blocked" || st === "idle" || (st === "unknown" && withinTrustStartup())) {
                                             // T5: once-per-slot auto-answer when the adapter declares a trust dialog and the pane
                                             // text matches. tickmarkr created the worktree from the operator's own repo — safe by construction.
                                             if (!trustAnswered && adapter.trustDialog && driver.sendKey) {
                                                 try {
-                                                    const paneText = await workerTransport.read(slot, 80);
-                                                    if (matchesTrustDialog(paneText, adapter.trustDialog)) {
+                                                    const paneText = await (slot.readScreen ? slot.readScreen() : workerTransport.read(slot, 80));
+                                                    if ((st !== "unknown" || withinTrustStartup()) && matchesTrustDialog(paneText, adapter.trustDialog)) {
                                                         trustAnswered = true;
                                                         trustAnsweredSlots.add(slot.id);
                                                         // v1.25 T1: audit trail for live runs — prove the dialog appeared and was answered.
@@ -6042,9 +6143,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         }
                                         // OBS-548: the FOURTH leg, and the one the daemon already measured. The three legs above
                                         // are all channel-side: they say a pane stopped talking. The tree's CPU says whether
-                                        // anything is still WORKING, and the harvest triad forty lines up refuses exactly this
-                                        // conclusion without it — "a worker that is merely thinking still burns CPU and is never
-                                        // concluded here". A live CPU delta is a live worker, by construction; an UNMEASURABLE
+                                        // anything is still WORKING, and the harvest triad forty lines up refuses this
+                                        // conclusion without it. Queue row 231 (D-2119): print-mode harvest additionally checks
+                                        // connections because a remote model turn can have flat CPU. An UNMEASURABLE
                                         // reading keeps the fail-open contract the probe already states (undefined is never
                                         // evidence a worker stopped), so on a host whose `ps` cannot be read the fast-kill stands
                                         // down and the fixed attempt ceiling bounds the hold.
@@ -6231,13 +6332,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 }
                                 await noteLaunched();
                                 // OBS-54: headless workers have the same output-inactivity budget as visible panes.
-                                // v1.76: same monotonic-progress measure as the interactive site; harvest stays raw.
+                                // Queue row 233 (D-2130): print progress is the driver's received-byte count, never a row
+                                // high-water over the bounded tail; a driver reporting no count keeps the row measure.
                                 const stallWindowMs = taskTimeoutMinutes * 60_000;
+                                const hardDeadline = attemptStart + (attemptHardTimeoutMs ?? stallWindowMs * 4);
                                 const initialPane = await workerTransport.read(slot, 500);
                                 startupFailure = startupFailureInWindow(initialPane, workerLaunchedAt);
                                 let everHadOutput = initialPane.length > 0;
                                 const stallProgress = new StallProgressTracker();
-                                stallProgress.observe({ paneText: initialPane, seedSubmitted: true, contextTokens });
+                                stallProgress.observe({ paneText: initialPane, receivedBytes: (await workerTransport.transportState?.(slot))?.bytes, seedSubmitted: true, contextTokens });
                                 let lastProgressAt = Date.now();
                                 finished = false;
                                 // T2 review (material): the exit marker proves the PROCESS EXITED, never that the worker
@@ -6247,10 +6350,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // worker-result-harvested row. The interactive site has always kept them apart (`finished`
                                 // there is the trailer regex; the exit marker only sets exitCode), and the cause taxonomy
                                 // already names this shape "clean-exit-no-trailer" — unreachable in print mode until now.
-                                while (!startupFailure && Date.now() - lastProgressAt < stallWindowMs) {
+                                while (!startupFailure && Date.now() - lastProgressAt < stallWindowMs && Date.now() < hardDeadline) {
                                     fatalStop.signal.throwIfAborted();
                                     executionSignal()?.throwIfAborted();
-                                    const remaining = stallWindowMs - (Date.now() - lastProgressAt);
+                                    const remaining = Math.min(stallWindowMs - (Date.now() - lastProgressAt), hardDeadline - Date.now());
                                     let slice = Math.min(BLOCKED_POLL_MS, Math.max(100, Math.min(stallWindowMs / 2, remaining)));
                                     const startupLeft = workerLaunchedAt === undefined
                                         ? 0
@@ -6281,11 +6384,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         break;
                                     }
                                     await sampleContext();
-                                    if (stallProgress.observe({ paneText, contextTokens }))
+                                    if (stallProgress.observe({ paneText, receivedBytes: (await workerTransport.transportState?.(slot))?.bytes, contextTokens }))
                                         lastProgressAt = Date.now();
-                                    // T2 (OBS-264): the same liveness triad the interactive loop runs. A headless worker that
-                                    // committed and went quiet is finished work too, and before this it rode the entire
-                                    // window out before anything looked at its commits.
+                                    // Queue row 231 (D-2119): print mode adds a fresh owned-group connection reading to the
+                                    // silence/commits/CPU triad; a quiet remote model turn can hold a connection with flat CPU.
                                     // No nudge hold here, deliberately: print mode has no nudge surface at all (no pane to
                                     // steer, driver.nudge is never consulted on this path), so there is no pending daemon
                                     // action for the triad to preempt — the asymmetry with the interactive call site above is
@@ -6300,7 +6402,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // without one is finished:false with a non-null exitCode — the harvest synthesis then owns
                                 // it when the worktree carries work, and classifyWorkerResultCause names it otherwise.
                                 finished = new RegExp(trailerPattern(nonce)).test(output);
-                                timedOut = !processExited && !finished && Date.now() - lastProgressAt >= stallWindowMs;
+                                timedOut = !processExited && !finished && (Date.now() - lastProgressAt >= stallWindowMs || Date.now() >= hardDeadline);
                             }
                         }
                         finally {
@@ -7051,7 +7153,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // Budget spent means the FRESH LADDER owns this failure — including a review-only one, whose
                         // same-channel fix retry is exactly the round the budget just declared too expensive to repeat.
                         const repairExhausted = repairable && !repair;
-                        if (repair && !capStep) {
+                        const fundedRepair = repair && !capStep;
+                        if (fundedRepair) {
                             journal.append("repair-attempt", t.id, {
                                 repair: repairHistory.length + 1, charge: repairsDrawn + 1, of: MAX_REPAIRS,
                                 gates: failing.map((g) => g.gate),
@@ -7076,8 +7179,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                             });
                             await driver.notify(`tickmarkr ${runId}: ${t.id} escalation: ${step}`, { tier: "attention" });
                         }
+                        // Queue row 224(b) (D-2118): pinned tasks park on the first unfunded owned deterministic red
+                        // at or after the second, so this climb fires at most once. Unpinned tasks climb on exactly
+                        // the second owned deterministic red, even when it funds a repair.
                         const climbCause = repairExhausted ? "repair-exhausted"
-                            : deterministic && ownedGateFailures === 2 ? "gate-fail" : undefined;
+                            : deterministic && (t.routingHints?.pin
+                                ? ownedGateFailures >= 2 && !fundedRepair
+                                : ownedGateFailures === 2) ? "gate-fail" : undefined;
                         if (climbCause) {
                             const climbed = await climb(climbCause, deterministic ?? failing[0], attempt + 1);
                             if (climbed === "parked")
@@ -7190,6 +7298,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 if (fatalStop.signal.aborted)
                                     return;
                                 const cleanupEvidence = cleanupErrors.length ? { cleanupErrors } : {};
+                                if (err instanceof WorktreeAdminRaceError) {
+                                    await park(t, err.message, "infra", null, 0, Date.now(), 0, 0, undefined, 0, "fresh", { evidence: err.evidence, ...cleanupEvidence });
+                                    return;
+                                }
                                 if (err instanceof HostDegradedError) {
                                     await park(t, err.message, "infra", null, 0, Date.now(), 0, 0, undefined, 0, "fresh", { disposition: "host-degraded", ...cleanupEvidence });
                                     return;

package/dist/run/git-trust.d.ts

@@ -4,11 +4,21 @@ export declare class GitTrustRefusal extends Error {
     readonly detail: string;
     constructor(path: string, detail: string, options?: ErrorOptions);
 }
+interface Authority {
+    gitdir: string;
+    common: string;
+    linked: boolean;
+}
 /**
  * The canonical, independently expected common git directory for the checkout enclosing `cwd` — never what
  * a mutable commondir says. Throws GitTrustRefusal naming the authority path when it cannot be established.
  */
 export declare function trustedCommonDir(cwd: string): string;
+/** The checked authority for `cwd` (see assertGitTrust), with the canonical worktree root the gitfile sits in. */
+export declare function checkedAuthority(cwd: string): (Authority & {
+    worktree: string;
+    stamp?: string;
+}) | undefined;
 /**
  * The uncached pre-spawn check for a covered git invocation at `cwd`. Outside any checkout it is a no-op
  * (unrelated shell commands stay compatible). Inside one it refuses, naming the file, when the commondir git
@@ -119,3 +129,4 @@ export declare const INERT_HOOKS_PATH = "/dev/null";
  * children (shGit/shGitOk) receive it; payload shells (gate commands, suites) keep the operator's git config.
  */
 export declare function protectedGitEnv(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export {};

package/dist/run/git-trust.js

@@ -151,7 +151,7 @@ catch {
     return false;
 } };
 /** The checked authority for `cwd` (see assertGitTrust), with the canonical worktree root the gitfile sits in. */
-function checkedAuthority(cwd) {
+export function checkedAuthority(cwd) {
     const dotGit = dotGitOf(cwd);
     if (!dotGit)
         return undefined;

package/dist/run/git.d.ts

@@ -1,5 +1,5 @@
 import type { CommandReceiptAttribution, ShellReceipt } from "./protocol.js";
-import { spawn } from "node:child_process";
+import { spawn, type SpawnSyncReturns } from "node:child_process";
 import { ROUTING_ENV_SEAMS } from "../route/router.js";
 import { type OwnGitCapability } from "./git-trust.js";
 export { ROUTING_ENV_SEAMS };
@@ -187,6 +187,23 @@ export declare function sh(cmd: string, cwd: string, timeoutMs?: number, options
 export declare function shGit(cmd: string, cwd: string, timeoutMs?: number, own?: OwnGitOptions, options?: Pick<ShellOptions, "bytes">): Promise<ShResult>;
 export declare function shOk(cmd: string, cwd: string): Promise<string>;
 export declare function shGitOk(cmd: string, cwd: string, own?: OwnGitOptions): Promise<string>;
+/**
+ * Queue row 2 item b (D-1042, D-2112, D-2114): the SYNCHRONOUS own-git entry for operator commands — argv, no shell.
+ * It applies what shGit's own-git entry applies, from the same sources: the uncached trust check and, in a linked
+ * checkout, ownGitPin's pin, post-exit recheck and ref-view release, each derived from `dir` — the directory git
+ * targets (a site's -C directory), never the caller's cwd — and protectedGitEnv's forced core.fsmonitor=false and
+ * inert core.hooksPath appended last. A trust refusal throws GitTrustRefusal naming the path (before the spawn, or
+ * after it for a commondir changed while the child ran); every other outcome is spawnSync's own result, so a caller's
+ * fail-open answer for an ordinary git failure is unchanged.
+ */
+export declare function gitSync(dir: string, args: readonly string[], { env }?: {
+    env?: NodeJS.ProcessEnv;
+}): SpawnSyncReturns<string>;
+/** Queue row 223 (D-2118): git could not read a sibling's partially written admin file during add. */
+export declare class WorktreeAdminRaceError extends Error {
+    readonly evidence: string;
+    constructor(evidence: string);
+}
 /**
  * v2.6.8 T2: the DETACHED worktree capability, declared by calling it (the daemon's baseline recapture and standalone
  * verify's base worktree). Under the ref-store pin git stubs a detached add's new HEAD as `ref: refs/heads/.invalid`

package/dist/run/git.js

@@ -2,7 +2,7 @@ import { observeVerificationReceipt, observeVerificationSpawn, verificationJobEn
 import { executionSignal, withoutExecutionBudget } from "./execution-budget.js";
 import { commandLeaseEnvironment, repositoryLeaseEnvironment, registerRepositoryChild, withCommandLease } from "./lease.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { execFile, execFileSync, spawn } from "node:child_process";
+import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
 import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, readlinkSync, realpathSync, rmdirSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import { availableParallelism, homedir, tmpdir } from "node:os";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
@@ -600,6 +600,62 @@ export async function shGitOk(cmd, cwd, own = {}) {
         throw new Error(`command failed (${r.code}): ${cmd}\n${r.stderr || r.stdout}`);
     return r.stdout;
 }
+/**
+ * Queue row 2 item b (D-1042, D-2112, D-2114): the SYNCHRONOUS own-git entry for operator commands — argv, no shell.
+ * It applies what shGit's own-git entry applies, from the same sources: the uncached trust check and, in a linked
+ * checkout, ownGitPin's pin, post-exit recheck and ref-view release, each derived from `dir` — the directory git
+ * targets (a site's -C directory), never the caller's cwd — and protectedGitEnv's forced core.fsmonitor=false and
+ * inert core.hooksPath appended last. A trust refusal throws GitTrustRefusal naming the path (before the spawn, or
+ * after it for a commondir changed while the child ran); every other outcome is spawnSync's own result, so a caller's
+ * fail-open answer for an ordinary git failure is unchanged.
+ */
+export function gitSync(dir, args, { env = process.env } = {}) {
+    const forced = protectedGitEnv(env);
+    const pin = ownGitPin(dir, forced);
+    try {
+        const r = spawnSync("git", args, { cwd: dir, env: pin?.env ?? forced, encoding: "utf8", maxBuffer: 1 << 28, stdio: ["ignore", "pipe", "pipe"] });
+        pin?.recheck();
+        return pin && typeof r.stdout === "string" ? { ...r, stdout: pin.unview(r.stdout), stderr: pin.unview(r.stderr) } : r;
+    }
+    finally {
+        pin?.release();
+    }
+}
+// Queue row 223 (D-2118): one process-wide administration queue; recreation and rollback retain
+// their caller's hold, including trust rechecks and branch restoration, without queuing behind it.
+let worktreeAdminTail = Promise.resolve();
+const worktreeAdminHold = new AsyncLocalStorage();
+async function withWorktreeAdmin(operation) {
+    if (worktreeAdminHold.getStore())
+        return operation();
+    const prior = worktreeAdminTail;
+    let release;
+    worktreeAdminTail = new Promise((done) => { release = done; });
+    await prior;
+    try {
+        return await worktreeAdminHold.run(true, operation);
+    }
+    finally {
+        release();
+    }
+}
+/** Queue row 223 (D-2118): git could not read a sibling's partially written admin file during add. */
+export class WorktreeAdminRaceError extends Error {
+    evidence;
+    constructor(evidence) {
+        super(`worktree add encountered a sibling admin read race (queue row 223, D-2118): ${evidence}`);
+        this.evidence = evidence;
+        this.name = "WorktreeAdminRaceError";
+    }
+}
+const siblingAdminReadFailed = (stderr) => {
+    for (const line of stderr.split("\n")) {
+        const read = /^(?:fatal: |error: )?failed to read (?:'([^'\r\n]+)'|"([^"\r\n]+)"|([^:\r\n]+))(?::|$)/.exec(line);
+        if (read && /(?:^|\/)worktrees\/[^/\r\n]+\/(?:commondir|gitdir|HEAD)$/.test(read[1] ?? read[2] ?? read[3]))
+            return true;
+    }
+    return false;
+};
 /**
  * v2.6.8 T2: the DETACHED worktree capability, declared by calling it (the daemon's baseline recapture and standalone
  * verify's base worktree). Under the ref-store pin git stubs a detached add's new HEAD as `ref: refs/heads/.invalid`
@@ -612,6 +668,9 @@ export async function shGitOk(cmd, cwd, own = {}) {
  * back through the trusted common directory derived here once (dropWorktree), even while that commondir stays hostile.
  */
 export async function addDetachedWorktree(cwd, dir, commitish, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS, { logHead = false } = {}) {
+    return withWorktreeAdmin(() => addDetachedWorktreeHeld(cwd, dir, commitish, timeoutMs, logHead));
+}
+async function addDetachedWorktreeHeld(cwd, dir, commitish, timeoutMs, logHead) {
     // 2.8.1 T1 (ANL-023 §7.1): `logHead` writes the new checkout's HEAD reflog whatever the repository's
     // core.logAllRefUpdates says, so a later HEAD move by any command is appended to an established witness.
     const git = logHead ? "git -c core.logAllRefUpdates=always" : "git";
@@ -661,6 +720,9 @@ function rollbackFailed(error, failure) {
  * step bounded by `timeoutMs`; every step is tried, and any that failed is thrown, never swallowed.
  */
 async function dropWorktree(store, { dir, branch }, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS) {
+    return withWorktreeAdmin(() => dropWorktreeHeld(store, { dir, branch }, timeoutMs));
+}
+async function dropWorktreeHeld(store, { dir, branch }, timeoutMs) {
     const failed = await withoutExecutionBudget(async () => {
         const run = async (cmd) => {
             try {
@@ -838,6 +900,9 @@ export function checkoutIncarnation(worktree) {
     }
 }
 export async function createWorktree(repo, branch, baseRef) {
+    return withWorktreeAdmin(() => createWorktreeHeld(repo, branch, baseRef));
+}
+async function createWorktreeHeld(repo, branch, baseRef) {
     branch = await resolveTaskBranch(repo, branch);
     const dir = join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));
     if (existsSync(dir))
@@ -845,7 +910,13 @@ export async function createWorktree(repo, branch, baseRef) {
     // the worktree capability: a branch add, whose symbolic HEAD keeps the ref-store pin (see OwnGitCapability); a raced
     // add is rolled back, its branch restored to the value read here or deleted when it is new
     const prior = (await shGit(`git rev-parse --verify -q ${shq(`refs/heads/${branch}`)}`, repo)).stdout.trim() || undefined;
-    await shGitOk(`git worktree add -B ${shq(branch)} ${shq(dir)} ${shq(baseRef)}`, repo, { createsWorktree: "branch", rollback: { dir, branch: { name: branch, prior } } });
+    const cmd = `git worktree add -B ${shq(branch)} ${shq(dir)} ${shq(baseRef)}`;
+    const added = await shGit(cmd, repo, DEFAULT_SHELL_TIMEOUT_MS, { createsWorktree: "branch", rollback: { dir, branch: { name: branch, prior } } });
+    if (added.code !== 0) {
+        if (siblingAdminReadFailed(added.stderr))
+            throw new WorktreeAdminRaceError(added.stderr.trim());
+        throw new Error(`command failed (${added.code}): ${cmd}\n${added.stderr || added.stdout}`);
+    }
     linkNodeModules(repo, dir);
     return dir;
 }

package/dist/run/journal.d.ts

@@ -42,7 +42,14 @@ export declare const bindingToken: (binding: DecisionBinding) => string;
 export declare function parseBindingToken(token: string): DecisionBinding | undefined;
 /** The binding a task-approved row recorded under `park` or `failure`, when well formed. */
 export declare function recordedBinding(value: unknown): DecisionBinding | undefined;
-/** The newest failed gate before a park row — the gate a waive of that park would satisfy. */
+/**
+ * The newest failed gate before a park row — the gate a waive of that park would satisfy.
+ * Queue row 225 (D-2111): a gate-fail park with no task-dispatch, gate-result (passing or failing) or
+ * unvoided task-approved row of its task since its previous task-human — a resume's re-park at the same
+ * review round cap — inherits that park's failed gate, the walk continuing past it. A task-approved row
+ * an approval-refused row of the task voids before the newer park (its lines name it, or it names none)
+ * does not end the walk; refusals are read here directly, never through foldDecisions (which calls this).
+ */
 export declare function failedGateBeforePark(events: readonly JournalEvent[], taskId: string, parkIndex: number): GateName | undefined;
 /** The physical journal line of `events[i]` (see SOURCE_LINE). */
 export declare const physicalLine: (events: readonly JournalEvent[], i: number) => number;
@@ -96,6 +103,13 @@ export interface PreservedRef {
 export declare function preservedRefsByTask(events: JournalEvent[]): Map<string, PreservedRef[]>;
 export declare function reviewRoundsSinceApproval(events: JournalEvent[], taskId: string, rounds?: (decided: JournalEvent[]) => JournalEvent[]): number;
 export declare function upheldFeedbackByTask(events: JournalEvent[]): Map<string, string>;
+/**
+ * Queue row 225 (D-2111): a restore names upheld feedback only when it is FUNDED — the task carries an
+ * active uphold brief AND an effective task-approved row newer than its newest task-human. A restore
+ * that only re-parks at the same cap announces nothing, so a spent uphold is never re-announced.
+ * `decided` is already read through the decision fold (effectiveEvents).
+ */
+export declare function restoresUpheldFeedback(decided: JournalEvent[], taskId: string): boolean;
 export interface StructuredFinding {
     class: string;
     path: string;