tickmarkr 2.8.7 → 2.8.9

package/README.md

@@ -441,6 +441,28 @@ The daemon reconciles at every safe point:
 unavailable, a pane vanished mid-sweep) do not replace gate verdicts; unconfirmed board
 cleanup is journaled and reported.
 
+### Worktree lifecycle
+
+Queue row 240 (D-2138): at run end, every journaled task checkout is removed once its
+recovery ref is recorded, including parked and failed tasks. Clean merged checkouts
+are removed silently. Dirty work is preserved under `refs/tickmarkr/preserved/`;
+unmerged clean heads are pinned there too. The journal records the recovery ref and
+removed checkout, and resume rebuilds from that work. Task branches and refs remain.
+
+A crash or SIGTERM leaves checkouts until the next daemon start in the same checkout.
+After its lifecycle row and reconciliation, that start sweeps other runs in this
+checkout's runs directory only when their newest lifecycle row records a proven dead
+pid, regardless of how they ended. Recovery and removal rows go into the owning run's
+journal and name the sweeping run; outstanding checks and measured wall windows stay unchanged.
+Only journaled task checkouts are touched: there is no worktree directory listing or
+in-use check. Live or unrecorded pids, this run's checkouts, verification checkouts,
+hand-made directories and sibling linked checkouts remain untouched; a refused start
+sweeps nothing. `visibility.keepPanes: forever` disables both removal boundaries.
+
+Staged bytes missing from the recovery tree, preservation failures and deletion failures
+keep the checkout and journal a run-level removal failure in the current run. Cleanup
+never changes the run's outcome or adds another run end.
+
 ### Workspace trust
 
 tickmarkr creates fresh git worktrees for change isolation. That is separate from each CLI's own

package/dist/cli/commands/compile.js

@@ -67,7 +67,7 @@ export async function compile(argv, cwd = process.cwd(), harnessFrom = process.a
         // Both modes reach the same pure compiler; --dry-run removes every state write below.
         const g = compileSource(sourcePath, values.type, cwd, // repo root: gsd stores context[0] repo-relative so workers resolve it inside their worktree
         (plan) => plan, { strict: values.strict });
-        const sourceFindings = sourceScopeFindings(g.tasks, cwd);
+        const sourceFindings = sourceScopeFindings(g.tasks, cwd, { failClosed: g.spec.source === "native" });
         const scopeLints = [
             ...collateralLints(g.tasks, cwd),
             ...sourceScopeLints(g.tasks, cwd, sourceFindings),

package/dist/cli/commands/report.js

@@ -13,6 +13,7 @@ import { assignmentChannel, buildOperatorRecord, formatChannelMoney, formatChann
 import { cellsOf, cellSummary } from "../../route/profile.js";
 import { effectiveEvents, fatalRunEndCause, foldOwedChecks, Journal, loadRoutingProfile, OWED_DISCHARGE_EVENT, } from "../../run/journal.js";
 import { baselineProvenanceOf, fingerprintsOf, forgivenFingerprints, forgivenGateRow, formatBaselineProvenance, formatFingerprints, formatForgiven, formatTipProof, runEndTipProof, } from "../../run/daemon.js";
+import { normalizeGateOutcome } from "../../run/outcome.js";
 import { formatSpan, WALL_PRIORITY, WALL_PRIORITY_TEXT, wallBudget, wallBudgetFacts } from "../../run/wall-budget.js";
 import { deriveRunCockpitData } from "../../tui/cockpit/derive.js";
 import { cellWidth, wrapCells } from "../../tui/cockpit/width.js";
@@ -382,12 +383,15 @@ const verificationOf = (runId, events) => {
         return "failed";
     if (tip?.state !== "pass")
         return "absent";
-    // A cached green is a verified green of an EARLIER tip (daemon.ts verifyIntegrationTipCached
-    // stamps `cached` on every gate it replays), so the record names it instead of folding it into a
-    // plain pass. Still no second window: the cockpit reports "pass" only when the closed cycle
-    // carried verdicts, so the last `tip-verify` IN THAT CYCLE is the one it passed on.
-    const last = [...cycle].reverse().find((e) => e.event === "tip-verify");
-    return last?.data.cached === true ? "cached" : "passed";
+    // Queue 35 (D-2134 R6): the same per-gate proof names both the lead and verification line.
+    const proof = runEndTipProof(cycle);
+    if (proof.gates?.length) {
+        if (proof.gates.every(({ kind }) => kind === "reused"))
+            return "cached";
+        if (proof.gates.some(({ kind }) => kind === "reused"))
+            return "mixed";
+    }
+    return "passed";
 };
 // Absent is a state to render, never a zero to invent — and no reading here calls a run green.
 // NOTE: every reading below is byte-pinned by tests/fixtures/brand-surfaces/report-md.md — the
@@ -396,6 +400,7 @@ const verificationOf = (runId, events) => {
 const VERIFICATION_READING = {
     passed: "passed — tickmarkr verified this run's integration tip",
     cached: "cached — carried forward from an earlier verified tip, not re-run for this one",
+    mixed: "mixed — some tip gates ran fresh and others were carried forward",
     failed: "FAILED — the run did not verify its own tip",
     absent: "absent — no tip verification recorded: neither passed nor failed",
 };
@@ -406,9 +411,9 @@ function forgivenLines(events) {
 function verificationReading(runId, events) {
     const state = verificationOf(runId, events);
     const proof = runEndTipProof(closedCycle(events));
-    if ((state === "passed" || state === "cached") && proof.gates?.length) {
-        const allCarried = proof.gates.every(({ kind }) => kind === "reused");
-        return `${allCarried ? "cached" : "passed"} — ${formatTipProof(proof)}`;
+    if ((state === "passed" || state === "cached" || state === "mixed") && proof.gates?.length) {
+        // Queue 35 (D-2134 R6): mixed describes the lead's provenance; per-gate details retain it here.
+        return `${state === "mixed" ? "passed" : state} — ${formatTipProof(proof)}`;
     }
     return VERIFICATION_READING[state];
 }
@@ -520,9 +525,13 @@ export function renderMarkdownRecord(runId, events, prices = [], rows = [], suit
         lines.push("- **tickmarks:**");
         if (gates.length) {
             for (const g of gates) {
-                // T11: a declined gate never ran — report it as declined, never as a pass.
-                let pass = gateDeclined(g.data) ? "declined" : g.data.pass === true ? "pass" : g.data.pass === false ? "fail" : EM;
+                // Queue 35 (D-2134 R6): only held changes the existing tickmark vocabulary.
+                let pass = normalizeGateOutcome(g.data).kind === "held" ? "held"
+                    : gateDeclined(g.data) ? "declined" : g.data.pass === true ? "pass" : g.data.pass === false ? "fail" : EM;
                 const gate = typeof g.data.gate === "string" ? g.data.gate : EM;
+                if (gate === "acceptance" && g.data.judgeIndependent === false) {
+                    pass += " (independence not established)";
+                }
                 if (gate === "review" && pass === "pass") {
                     const reviewer = reviewerIdentity(g.data);
                     const before = events.slice(0, events.indexOf(g) + 1).reverse()
@@ -616,7 +625,7 @@ function textReport(runId, events, rows, cwd, suite) {
     // T11: gates that declined never ran — out of both the pass count and the rate base.
     const declinedCount = gateResults.filter((e) => gateDeclined(e.data)).length;
     const gateRan = gateResults.length - declinedCount;
-    const gatePass = gateResults.filter((e) => e.data.pass && !gateDeclined(e.data)).length;
+    const gatePass = gateResults.filter((e) => normalizeGateOutcome(e.data).kind === "passed" && !gateDeclined(e.data)).length;
     const escalations = events.filter((e) => e.event === "escalation").length;
     const consults = events.filter((e) => e.event === "consult-verdict").length;
     const failovers = events.filter((e) => e.event === "quota-failover").length;

package/dist/cli/commands/status.js

@@ -968,6 +968,16 @@ const recordedTasks = (graph, rows) => graph.tasks.filter((task) => {
         || row.parkKind !== undefined);
 });
 const recordedDone = (tasks, rows) => tasks.filter((task) => graphTaskStatus(rows.get(task.id)?.state, task.status) === "done").length;
+const judgeIndependenceNotes = (events) => {
+    // Queue row 34(a) (D-2134 R5): only the newest acceptance row owns this note.
+    const acceptance = new Map();
+    for (const event of events) {
+        if (event.taskId && event.event === "gate-result" && event.data.gate === "acceptance")
+            acceptance.set(event.taskId, event);
+    }
+    return [...acceptance].filter(([, event]) => event.data.judgeIndependent === false)
+        .map(([id]) => `${sanitizeTaskText(id)} judge not independent`);
+};
 const renderFrame = (cwd, 
 // No default: the version is the binary's, resolved once by its caller, and a frame that had to
 // invent one would be naming a version nobody can check.
@@ -976,6 +986,7 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
     const record = readRunRecord(cwd, g, namedRunId);
     const runId = record?.runId;
     const events = record?.events ?? [];
+    const judgeNotes = judgeIndependenceNotes(events);
     const runLine = runId && record ? runStatusLine(cwd, runId, events) : null;
     // The header and every live-phase consumer share this exact process reading. Proved death retires
     // stale phase markers; unknown identity deliberately does not, preserving pre-identity journals.
@@ -1171,7 +1182,7 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
         // At its machine width and wider the plain print keeps each machine row whole — one row per task and
         // its evidence line after it, which consumers parse. A configured width narrower than that holds for
         // EVERY row: one that overflows wraps beneath its own indent, its identity kept on the first.
-        const body = [header, legendLine, `  ${supervisionText(supervision, divider)}`, ...rows];
+        const body = [header, legendLine, `  ${supervisionText(supervision, divider)}`, ...rows, ...judgeNotes.map((note) => `  ${note}`)];
         const wrapRow = (line) => wrapCells(line, width, { continuationPrefix: `${/^ */u.exec(line)[0]}  ` });
         return {
             content: [
@@ -1383,6 +1394,7 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
             "",
             ...tableRows(),
             ...recoverySection,
+            ...judgeNotes.flatMap((note) => wrapCells(`    ${note}`, boardColumns, { continuationPrefix: "      " })),
             gatesLegend,
             "",
             rule(boardColumns),
@@ -1436,7 +1448,7 @@ const oneLine = (cwd, namedRunId) => {
     // A fatal run-end leads right after the run id: no completion fraction or verify state reads first.
     const crash = fatalRunEndCause(events);
     return sanitizeTaskText([
-        record.runId, ...(crash ? [`run crashed — ${crash}`] : []), ...claims, firstPassText(endToEndFirstPass(events)), wallText(events), needsYouText(events, currentOwed(events, cwd)),
+        record.runId, ...(crash ? [`run crashed — ${crash}`] : []), ...claims, firstPassText(endToEndFirstPass(events)), wallText(events), needsYouText(events, currentOwed(events, cwd)), ...judgeIndependenceNotes(events),
     ].join(" · "));
 };
 export async function status(argv, cwd = process.cwd(), opts = {}) {

package/dist/cli/commands/verify.js

@@ -370,8 +370,8 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
     }
     // Baseline: --baseline file > cached capture for this merge-base > fresh capture on a detached
     // temp worktree of the merge-base (so pre-existing failures on base are forgiven, exactly as a run).
-    // ALL verify state (cache, base worktree, artifacts) lives OUTSIDE the repo: verify gates the repo
-    // root itself, so any file it wrote there would trip the battery's own dirty-worktree refusal.
+    // Queue row 31 / D-2134: gate-time state lives outside the repo; a validated discharge's durable
+    // proof is copied into its run only after the battery's final dirty-worktree check.
     // ponytail: tmpdir means the baseline cache dies on reboot/cleanup — worst case is one re-capture.
     const stateDir = verifyStateDir(cwd);
     mkdirSync(stateDir, { recursive: true });
@@ -600,6 +600,7 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
         console.error(`verify: evidence capture failed for ${artifactPath}`);
     }
     const review = reviewRows.at(-1);
+    let recordedArtifactPath = artifactPath;
     // C1: ONE discharge row names what the fold re-reads — the artifact by hash, the range mapping, the
     // criteria and each resolved channel — and it is appended only when the fold, the single decider,
     // already accepts it: verify never writes a proof that would turn known debt into unknown debt.
@@ -624,8 +625,31 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
             dischargeRefusal = "the results artifact is unavailable";
         else if (!candidate.known || !owed.every((o) => candidate.discharged.includes(o.id)))
             dischargeRefusal = candidate.unknown.at(-1)?.reason ?? "the proof does not discharge the check";
-        else
-            recordJournal.append(OWED_DISCHARGE_EVENT, values.task, data);
+        else {
+            // Queue row 31 / D-2134: validate before writing under the run, then retain the exact bytes.
+            // Exclusive creation accepts an identical existing proof, never overwrites different bytes.
+            const relativePath = join("discharges", `${artifactSha256}.json`);
+            const durablePath = join(recordJournal.dir, relativePath);
+            try {
+                mkdirSync(dirname(durablePath), { recursive: true });
+                try {
+                    writeFileSync(durablePath, artifactBytes, { flag: "wx" });
+                }
+                catch (error) {
+                    if (error.code !== "EEXIST")
+                        throw error;
+                    if (!readFileSync(durablePath).equals(artifactBytes))
+                        throw new Error("existing durable proof has different bytes");
+                }
+            }
+            catch {
+                dischargeRefusal = "durable results artifact unavailable or has different bytes";
+            }
+            if (!dischargeRefusal) {
+                recordedArtifactPath = relativePath;
+                recordJournal.append(OWED_DISCHARGE_EVENT, values.task, { ...data, artifactPath: recordedArtifactPath });
+            }
+        }
     }
     const owedAfter = recordJournal ? foldOwedChecks(recordJournal.read(), cwd) : undefined;
     const code = green && !dischargeRefusal ? 0 : 2;
@@ -633,7 +657,7 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
         ? [...(dischargeRefusal ? [`verify --record refused discharge: ${dischargeRefusal}`] : []), debtLine(owedAfter)] : [];
     if (recordJournal && review) {
         recordJournal.append("review-leg2", values.task ?? "VERIFY", {
-            base: baseTip, head, mergeBase, author: channelKey(author), artifactPath, artifactSha256, artifactAvailability,
+            base: baseTip, head, mergeBase, author: channelKey(author), artifactPath: recordedArtifactPath, artifactSha256, artifactAvailability,
             ...review,
         });
     }

package/dist/compile/collateral.d.ts

@@ -55,7 +55,9 @@ export interface SourceScopeFinding {
     paths: string[];
 }
 /** Structured OBS-76 findings shared by human rendering and native compile enforcement. */
-export declare function sourceScopeFindings(tasks: ReadonlyArray<Pick<Task, "id" | "files" | "acceptance">>, repoRoot: string): SourceScopeFinding[];
+export declare function sourceScopeFindings(tasks: ReadonlyArray<Pick<Task, "id" | "files" | "acceptance">>, repoRoot: string, options?: {
+    failClosed?: boolean;
+}): SourceScopeFinding[];
 /** Human display is derived from the structured finding; no enforcement path parses this text. */
 export declare function renderSourceScopeFinding(finding: SourceScopeFinding): string;
 /**

package/dist/compile/collateral.js

@@ -3,18 +3,15 @@ import { extname, join, posix, relative } from "node:path";
 import { filesGlob } from "../graph/files-glob.js";
 import { criticalPathHits, DEFAULT_CONFIG, DEFAULT_REVIEW_CRITICAL_PATHS, effectiveReviewPolicy, loadConfig, } from "../config/config.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
+import { CompileError } from "./common.js";
 // Advisory scan (OBS-12/13/14/21, OBS-76). NEVER expands files[] or fails compile — a warning the
 // author acts on. Plain-text (no AST), capped + sorted for DISPLAY only.
 // OBS-547: the collateral prediction is no longer plan-time-only. The daemon computes one full
 // (uncapped) map per run and hands each task's slice to its scope gate, which classifies a red
 // against it — the prediction never causes a refusal, it only says whether a red the gate already
 // found was foreseeable (authoring defect) or not (chargeable quality failure).
-/** Max files walked per root (sorted walk; rest ignored). */
-const MAX_WALK_FILES = 400;
 /** Max collateral test paths listed per task. */
 const MAX_HITS_PER_TASK = 20;
-/** Skip giant fixtures / snapshots. */
-const MAX_READ_BYTES = 512 * 1024;
 const EXPORT_MANIFEST_TEST = "tests/repo/export-manifest.test.ts";
 const SRC_EXT = /\.(ts|tsx|js|jsx|mts|cts)$/;
 const CODE_EXT = /\.(ts|tsx|js|jsx|mts|cts)$/;
@@ -33,8 +30,6 @@ function walkCode(repoRoot, subdir) {
     const root = join(repoRoot, subdir);
     const out = [];
     const walk = (dir) => {
-        if (out.length >= MAX_WALK_FILES)
-            return;
         let entries;
         try {
             entries = readdirSync(dir, { withFileTypes: true });
@@ -45,8 +40,6 @@ function walkCode(repoRoot, subdir) {
         // deterministic order
         entries.sort((a, b) => a.name.localeCompare(b.name));
         for (const e of entries) {
-            if (out.length >= MAX_WALK_FILES)
-                return;
             if (e.name === "node_modules" || e.name === ".git" || e.name.startsWith("."))
                 continue;
             const full = join(dir, e.name);
@@ -78,22 +71,21 @@ function mentions(content, needles) {
     return false;
 }
 // cache file bodies (one read per path)
-function makeReader(repoRoot) {
+function makeReader(repoRoot, failClosed = false) {
     const body = new Map();
     return (rel) => {
         if (body.has(rel))
             return body.get(rel);
         try {
-            const st = statSync(join(repoRoot, rel));
-            if (st.size > MAX_READ_BYTES) {
-                body.set(rel, null);
-                return null;
-            }
             const text = readFileSync(join(repoRoot, rel), "utf8");
             body.set(rel, text);
             return text;
         }
         catch {
+            if (failClosed) {
+                throw new CompileError(`${rel} is unreadable, so the source-scope scan is incomplete — restore read access `
+                    + `or remove the path and recompile (queue row 27, D-2134).`);
+            }
             body.set(rel, null);
             return null;
         }
@@ -502,7 +494,7 @@ export function newDirectoryLints(tasks, repoRoot) {
     return lines;
 }
 /** Structured OBS-76 findings shared by human rendering and native compile enforcement. */
-export function sourceScopeFindings(tasks, repoRoot) {
+export function sourceScopeFindings(tasks, repoRoot, options = {}) {
     const perTask = tasks
         .map((t) => ({ t, needles: criteriaSymbols(t.acceptance) }))
         .filter((x) => x.needles.length);
@@ -511,7 +503,7 @@ export function sourceScopeFindings(tasks, repoRoot) {
     const srcFiles = walkCode(repoRoot, "src");
     if (!srcFiles.length)
         return [];
-    const read = makeReader(repoRoot);
+    const read = makeReader(repoRoot, options.failClosed);
     const findings = [];
     for (const { t, needles } of perTask) {
         // OBS-22: scopeGate accepts picomatch globs; advisory warnings must agree.

package/dist/compile/native.js

@@ -272,6 +272,11 @@ function testsAtHead(root) {
     if (cached)
         return cached;
     const grep = gitSync(root, ["grep", "-I", "-n", "-e", "", "HEAD", "--", "tests/*.test.ts", "tests/**/*.test.ts"]);
+    if (grep.error || grep.signal || grep.status === null) {
+        const reason = grep.error?.message ?? (grep.signal ? `signal ${grep.signal}` : "no exit status");
+        throw new CompileError(`cannot complete the test corpus read (git grep HEAD tests) in ${root}: ${reason} — `
+            + `restore the corpus read and recompile (queue row 27, D-2134).`);
+    }
     if (grep.status !== 0 || typeof grep.stdout !== "string") {
         headTestCache.set(root, []);
         return [];
@@ -387,8 +392,8 @@ function criterionScopeFinding(task, text, criterion, id, tests) {
 // OBS-898: the fence lint's corpus is listed ONCE per compile by git (tracked plus untracked-not-ignored,
 // the same set a checkout walk sees minus the ignored trees) and filtered per task. The walk it replaces
 // descended every dot-directory (.tickmarkr/runs alone held 3 799 files here) once PER TASK, so a
-// 20-task spec compiled in seconds and the committed-spec corpus test timed out. Fail-open like
-// testsAtHead: no git answer means no corpus, and the lint stays quiet rather than wrong.
+// 20-task spec compiled in seconds and the committed-spec corpus test timed out.
+// Queue row 27 (D-2134): this advisory listing keeps its empty answer on git failure.
 function repoFileList(root) {
     const ls = gitSync(root, ["ls-files", "-z", "--cached", "--others", "--exclude-standard"]);
     if (ls.status !== 0 || typeof ls.stdout !== "string")

package/dist/gates/acceptance.d.ts

@@ -21,6 +21,14 @@ export interface JudgeVerdict {
     }>;
 }
 export declare function judgeCriterionId(index: number): string;
+export interface OracleFailure {
+    index: number;
+    kind: "command" | "test";
+    criterion: string;
+    landing?: string;
+    failure: "absent" | "elsewhere" | "untitled" | "red" | "unverified" | "no-runner";
+    output: string;
+}
 export declare function testFilterPattern(name: string): string;
 export declare function testFiltered(testCmd: string, name: string): string;
 export interface VitestListedTest {

package/dist/gates/acceptance.js

@@ -249,18 +249,18 @@ function oracleExecutionFailure(label, code, stdout, stderr) {
     const zeroRun = testsRan(output) === 0 && classification !== "regression";
     const zeroRunEvidence = zeroRun ? "the runner reported zero tests run and no failure identity; " : "";
     if (classification === "infra" || signalKilled || zeroRun) {
-        return {
+        return { failure: "unverified", output, result: {
+                gate: "acceptance",
+                pass: false,
+                details: `oracle failed: ${label} (exit ${code}) — ${signalEvidence || zeroRunEvidence}infrastructure blocked execution before a verdict; this oracle verified nothing${tail(output)}`,
+                meta: { cause: "oracle-execution", classification: "infra", infra: true, retryable: false },
+            } };
+    }
+    return { failure: "red", output, result: {
             gate: "acceptance",
             pass: false,
-            details: `oracle failed: ${label} (exit ${code}) — ${signalEvidence || zeroRunEvidence}infrastructure blocked execution before a verdict; this oracle verified nothing${tail(output)}`,
-            meta: { cause: "oracle-execution", classification: "infra", infra: true, retryable: false },
-        };
-    }
-    return {
-        gate: "acceptance",
-        pass: false,
-        details: `oracle failed: ${label} (exit ${code})${tail(stderr || stdout)}`,
-    };
+            details: `oracle failed: ${label} (exit ${code})${tail(stderr || stdout)}`,
+        } };
 }
 // today's rule for a test oracle's run: exit 0 AND a positive printed run count (OBS-55: a zero-match run is vacuous).
 function countedTestRun(label, filter, r) {
@@ -269,8 +269,8 @@ function countedTestRun(label, filter, r) {
     const out = (r.stderr || "") + "\n" + (r.stdout || "");
     const ran = testsRan(out);
     if (ran === null || ran < 1) {
-        return { gate: "acceptance", pass: false,
-            details: `oracle failed: ${label} — name filter matched zero tests (filter: ${filter})${tail(out)}` };
+        return { failure: "untitled", output: out, result: { gate: "acceptance", pass: false,
+                details: `oracle failed: ${label} — name filter matched zero tests (filter: ${filter})${tail(out)}` } };
     }
     return undefined;
 }
@@ -290,11 +290,11 @@ function countedTestRun(label, filter, r) {
  */
 async function landedTestOracle(testCmd, title, landing, worktree) {
     const label = `test "${title}" in ${landing}`;
-    const passed = { gate: "acceptance", pass: true, details: `✓ test: ${title} (exit 0) in ${landing}` };
-    const work = (why) => ({ gate: "acceptance", pass: false, details: `oracle failed: ${label} — ${why}` });
-    const unverified = (why) => ({ gate: "acceptance", pass: false,
-        details: `oracle failed: ${label} — ${why}; unverified, failing closed`,
-        meta: { cause: "oracle-execution", classification: "infra", infra: true, retryable: false } });
+    const passed = { output: "", result: { gate: "acceptance", pass: true, details: `✓ test: ${title} (exit 0) in ${landing}` } };
+    const work = (failure, why, output = "") => ({ failure, output, result: { gate: "acceptance", pass: false, details: `oracle failed: ${label} — ${why}` } });
+    const unverified = (why, output = "") => ({ failure: "unverified", output, result: { gate: "acceptance", pass: false,
+            details: `oracle failed: ${label} — ${why}; unverified, failing closed`,
+            meta: { cause: "oracle-execution", classification: "infra", infra: true, retryable: false } } });
     const path = resolve(worktree, landing);
     const within = relative(worktree, path);
     let regular = false;
@@ -303,7 +303,7 @@ async function landedTestOracle(testCmd, title, landing, worktree) {
     }
     catch { /* absent */ }
     if (!regular)
-        return work(`suite file ${landing} is absent from the worktree or is not a regular file; the test command never started`);
+        return work("absent", `suite file ${landing} is absent from the worktree or is not a regular file; the test command never started`);
     if (!isVitestTestCommand(testCmd, worktree)) {
         return countedTestRun(label, title, await sh(fileFiltered(npmForwarded(testCmd), landing, title), worktree)) ?? passed;
     }
@@ -326,17 +326,18 @@ async function landedTestOracle(testCmd, title, landing, worktree) {
         const r = await shell(`${cmd} --reporter=${shq(reporterPath)} --outputFile=${shq(reportPath)}`, worktree, DEFAULT_SHELL_TIMEOUT_MS, false, { env: { ...manifestChildEnv(worktree), TICKMARKR_TEST_REPORT: reportPath, TICKMARKR_TEST_NONCE: nonce } });
         const raw = readTestReport(reportPath);
         const report = raw?.nonce === nonce ? raw : undefined;
+        const output = [r.stderr, r.stdout].filter(Boolean).join("\n");
         if (r.code !== 0) {
             // the reporter replaces the runner's own output: its failure identities are the evidence of a red.
             const named = report ? [...Object.values(report.completed).flatMap((c) => c.failures ?? []), ...(report.certificate?.diagnostics ?? [])] : [];
             return oracleExecutionFailure(label, r.code, r.stdout, [r.stderr, ...named].filter(Boolean).join("\n"));
         }
         if (!raw)
-            return unverified("the runner exited 0 but wrote no per-file report");
+            return unverified("the runner exited 0 but wrote no per-file report", output);
         if (!report)
-            return unverified(`the per-file report carries nonce "${raw.nonce}", not this invocation's`);
+            return unverified(`the per-file report carries nonce "${raw.nonce}", not this invocation's`, output);
         if (report.certificate?.exitCode !== 0)
-            return unverified("the per-file report never reached its run-end certificate with exit 0");
+            return unverified("the per-file report never reached its run-end certificate with exit 0", output);
         const key = toManifestPath(within, worktree);
         // a module completed more than once (one path in several projects) keeps only its LAST counters, so its record
         // cannot show that no earlier completion ran a body: it counts as run.
@@ -346,9 +347,9 @@ async function landedTestOracle(testCmd, title, landing, worktree) {
             return file !== key && (repeated.has(file) || !t || t.passed + t.failed > 0);
         }).sort();
         if (elsewhere.length)
-            return work(`the runner's per-file report shows a test body run outside ${landing}, in ${elsewhere.join(", ")} — only ${landing} can satisfy this criterion`);
+            return work("elsewhere", `the runner's per-file report shows a test body run outside ${landing}, in ${elsewhere.join(", ")} — only ${landing} can satisfy this criterion`, output);
         if (!((report.completed[key]?.tests?.passed ?? 0) > 0))
-            return work(`the runner's per-file report shows no passing test of that title in ${landing}`);
+            return work("untitled", `the runner's per-file report shows no passing test of that title in ${landing}`, output);
         return passed;
     }
     finally {
@@ -456,38 +457,54 @@ function citesChangedLocation(evidence, changed) {
 export async function acceptanceGate(task, worktree, baseRef, 
 // OBS-1182: the judge seat's OWN effort (absent = CLI default) — never the worker's.
 judge, via, opts = {}) {
-    // 1. deterministic oracles — exit code decides, fail-closed, zero LLM calls (spec §2, T2).
-    //    A failure returns here, before any runLlm() call: a judge can never override it.
+    // Queue row 234(b) (D-2134): measure every deterministic oracle in declaration order before judging.
     const passedDet = [];
-    for (const a of task.acceptance) {
+    const failures = [];
+    const record = (index, a, run) => {
+        if (run.result.pass)
+            passedDet.push(run.result.details);
+        else
+            failures.push({ run, oracle: {
+                    index, kind: a.oracle, criterion: isCommand(a) ? a.command : a.test,
+                    ...(isTest(a) && a.landing !== undefined ? { landing: a.landing } : {}),
+                    failure: run.failure, output: run.output,
+                } });
+    };
+    for (const [index, a] of task.acceptance.entries()) {
         if (isCommand(a)) {
             const r = await sh(a.command, worktree);
             if (r.code !== 0) {
-                return oracleExecutionFailure(`$ ${a.command}`, r.code, r.stdout, r.stderr);
+                record(index, a, oracleExecutionFailure(`$ ${a.command}`, r.code, r.stdout, r.stderr));
             }
-            passedDet.push(`✓ $ ${a.command} (exit 0)`);
+            else
+                passedDet.push(`✓ $ ${a.command} (exit 0)`);
         }
         else if (isTest(a)) {
             if (!opts.testCmd) {
-                return { gate: "acceptance", pass: false,
-                    details: `oracle failed: test "${a.test}" — no test command configured to run it (failing closed)` };
+                record(index, a, { failure: "no-runner", output: "", result: { gate: "acceptance", pass: false,
+                        details: `oracle failed: test "${a.test}" — no test command configured to run it (failing closed)` } });
+                continue;
             }
             // queue row 179: a declared suite file is the only file that can satisfy its criterion.
             if (a.landing !== undefined) {
-                const landed = await landedTestOracle(opts.testCmd, a.test, a.landing, worktree);
-                if (!landed.pass)
-                    return landed;
-                passedDet.push(landed.details);
+                record(index, a, await landedTestOracle(opts.testCmd, a.test, a.landing, worktree));
                 continue;
             }
             // OBS-55: exit 0 alone is vacuous when the name filter matched zero tests — fail closed.
             const red = countedTestRun(`test "${a.test}"`, a.test, await sh(testFiltered(opts.testCmd, a.test), worktree));
             if (red)
-                return red;
-            passedDet.push(`✓ test: ${a.test} (exit 0)`);
+                record(index, a, red);
+            else
+                passedDet.push(`✓ test: ${a.test} (exit 0)`);
         }
     }
-    // 2. judge items — only after every deterministic oracle passed (a failed one returned above).
+    if (failures.length) {
+        const first = failures[0].run.result;
+        const infra = failures.find(({ run }) => run.result.meta?.infra === true)?.run.result.meta;
+        return { ...first, details: failures.map(({ run }) => run.result.details).join("\n"),
+            meta: { ...first.meta, ...infra, oracles: failures.map(({ oracle }) => oracle) } };
+    }
+    // Queue row 234(b) (D-2134): only an entirely green deterministic round reaches the judge.
     const judgeItems = task.acceptance.filter(isJudge);
     const detBlock = passedDet.length ? passedDet.join("\n") + "\n" : "";
     if (!judgeItems.length) {