tickmarkr 2.8.7 → 2.8.9

package/dist/run/daemon.js

@@ -23,7 +23,7 @@ import { herdrSealShellPrefix, MAX_BUF, SubprocessDriver } from "../drivers/subp
 import { formatOwnedName } from "../drivers/types.js";
 import { captureBaseline, detectGateCommands, detectVacuousOracles } from "../gates/baseline.js";
 import { reobserveTestFiles, runGates } from "../gates/run-gates.js";
-import { getVerdictStore, isInfraResult, resolveStateDir } from "../gates/cache.js";
+import { environmentFingerprint, getVerdictStore, isInfraResult, resolveStateDir } from "../gates/cache.js";
 import { RUNNER_INFRA_DIAGNOSTIC_RE, timeoutShaped } from "../gates/timeout-shaped.js";
 import { filesGlob } from "../graph/files-glob.js";
 import { addEvidence, attributeBlocked, batteryPriority, blockedTasks, getTask, graphDefinitionHash, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus, taskContentDigest, tickmarkrDir } from "../graph/graph.js";
@@ -34,7 +34,7 @@ import { executionSignal, remainingExecutionMs, withExecutionBudget, withoutExec
 import { repairSelectionDecision, repairSelectionEnabled } from "./repair-selection.js";
 import { failureDisposition, reserveInfrastructureRetry } from "./recovery.js";
 import { runEnvironment } from "./environment.js";
-import { addDetachedWorktree, changeRepresented, cleanupRunWorktrees, declaredBaseContainment, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER, preserveWorktree, producerFields, reflogWitness, removeWorktree, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shell, shGit, SUITE_PARENT_ENV, verificationProtocol, WorktreeAdminRaceError, WORKTREE_LAYOUT_CONTRACT, WORKTREES_DIR, worktreePath } from "./git.js";
+import { addDetachedWorktree, changeRepresented, cleanupRunWorktrees, declaredBaseContainment, dependencyLinkRefusal, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER, preserveWorktree, producerFields, reflogWitness, removeWorktree, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shell, shGit, SUITE_PARENT_ENV, verificationProtocol, WorktreeAdminRaceError, WORKTREE_LAYOUT_CONTRACT, WORKTREES_DIR, worktreePath } from "./git.js";
 import { MASK } from "./redact.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
 import { classifyRepairDisposition, namedPaths, resolveScopeHints } from "./repair-disposition.js";
@@ -883,6 +883,32 @@ export const HARVESTED_RESULT_SUMMARY = "harvested: the worktree carries committ
 export function commandsHash(commands) {
     return createHash("sha256").update(JSON.stringify(Object.entries(commands).sort())).digest("hex").slice(0, 12);
 }
+// Queue row 24 (D-2134): refuse links before npm probes; an unreadable identity stays absent for the battery's infra row.
+function measureTipEnvironment(worktree, capacity) {
+    if (dependencyLinkRefusal(worktree))
+        return undefined;
+    try {
+        return environmentFingerprint({ worktree, scope: "tip", capacity });
+    }
+    catch {
+        return undefined;
+    }
+}
+// Queue row 24 (D-2134): validate the parts too; a matching fingerprint alone cannot rescue a malformed stamp.
+function sameTipEnvironment(recorded, current) {
+    if (!current || !recorded || typeof recorded !== "object" || Array.isArray(recorded))
+        return false;
+    const { fingerprint, parts } = recorded;
+    if (fingerprint !== current.fingerprint || !parts || typeof parts !== "object" || Array.isArray(parts))
+        return false;
+    const p = parts;
+    const verification = p.verification;
+    return p.nodeRuntime === current.parts.nodeRuntime && p.runner === current.parts.runner
+        && p.lockfile === current.parts.lockfile && p.selectedSet === undefined
+        && p.capacity !== undefined && sameCapacity(p.capacity, current.parts.capacity)
+        && !!verification && (verification.source === "explicit" || verification.source === "npm-config")
+        && sameVerification(verification, current.parts.verification);
+}
 /**
  * T4 (OBS-266): the journal's LAST verification cycle — the (tip, cmdHash) pair the most recent run
  * of the verify commands spoke for, the gates it got a pass from, and whether anything failed in it.
@@ -904,7 +930,7 @@ function lastVerifyCycle(events) {
         if (e.event === "tip-verify-start") {
             const { tip, cmdHash } = e.data;
             cur = typeof tip === "string" && typeof cmdHash === "string"
-                ? { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [e.data.capacity], evidenceByGate: new Map() }
+                ? { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [e.data.capacity], tipEnvironments: [e.data.tipEnvironment], evidenceByGate: new Map() }
                 : undefined;
             afterRunEnd = false;
             continue;
@@ -927,7 +953,7 @@ function lastVerifyCycle(events) {
             continue;
         }
         if (!cur || afterRunEnd || cur.tip !== tip || cur.cmdHash !== cmdHash) {
-            cur = { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [], evidenceByGate: new Map() };
+            cur = { tip, cmdHash, gates: new Set(), failed: false, forgiven: false, capacities: [], tipEnvironments: [], evidenceByGate: new Map() };
         }
         afterRunEnd = false;
         // T7: EVERY verdict row's own capacity, not just the start row's. The start row is a statement of
@@ -935,6 +961,7 @@ function lastVerifyCycle(events) {
         // these rows, so a row whose capacity differs from the session's — or which is malformed — has to
         // be able to sink the cycle by itself.
         cur.capacities.push(e.data.capacity);
+        cur.tipEnvironments.push(e.data.tipEnvironment);
         if (e.event === "tip-verify-failed")
             cur.failed = true;
         else {
@@ -1204,13 +1231,13 @@ export function identityDetails(leg, state, branch, runId, expected) {
  */
 export function appendIdentityFailure(journal, f) {
     if (!f.started)
-        journal.append("tip-verify-start", undefined, { tip: f.expected, cmdHash: f.cmdHash, capacity: f.capacity, gates: [], cached: false });
+        journal.append("tip-verify-start", undefined, { tip: f.expected, cmdHash: f.cmdHash, capacity: f.capacity, tipEnvironment: f.tipEnvironment, gates: [], cached: false });
     const found = f.state?.kind === "regular" || f.state?.kind === "symbolic" ? f.state.commit : undefined;
     journal.append("tip-verify-failed", undefined, {
         gate: "integration", cmd: "", exitCode: 1, fingerprints: [], details: f.details, ...(f.infra ? { infra: true } : {}),
         integration: { branch: f.branch, expected: f.expected ?? null, found: found ?? null, leg: f.leg,
             ...(f.state?.kind === "symbolic" ? { target: f.state.target } : {}) },
-        tip: f.expected, cmdHash: f.cmdHash, capacity: f.capacity,
+        tip: f.expected, cmdHash: f.cmdHash, capacity: f.capacity, tipEnvironment: f.tipEnvironment,
     });
 }
 /** O: I(expected) — or, with no expected value, the ref must be regular and its commit becomes the expected. */
@@ -1271,16 +1298,12 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
     opts.signal?.throwIfAborted();
     const cmdHash = commandsHash(commands);
     const { identity } = opts;
-    // T7: the capacity this session's verify children WOULD run under — the third thing a carried
-    // green must match, beside the tip and the command set. A cached verdict is the one place a green
-    // crosses a session boundary with nothing re-run, and a session resumed at a different capacity
-    // divides the machine by a different number: that green was established in another world, so it is
-    // not carried forward and the commands run again. A pre-T7 cycle records no capacity and keeps
-    // exactly the behaviour it has today.
+    // Queue row 24 (D-2134): measure once against the repository whose installed packages the verifier receives.
     const capacity = resolvedCapacity();
+    const tipEnvironment = measureTipEnvironment(identity?.repo ?? intWt, capacity);
     const identityFailure = (f) => {
-        appendIdentityFailure(journal, { ...f, branch: identity.branch, cmdHash, capacity });
-        return { failed: true, identityFailed: true, deferred: [] };
+        appendIdentityFailure(journal, { ...f, branch: identity.branch, cmdHash, capacity, tipEnvironment });
+        return { failed: true, identityFailed: true, deferred: [], tipEnvironment };
     };
     let tip;
     let clean = true; // with `identity` the battery runs in a fresh checkout and K checks tracked content
@@ -1299,25 +1322,30 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
     const gates = Object.keys(commands).filter((g) => g !== "tipTest");
     if (!gates.includes("test") && commands.tipTest)
         gates.push("test");
+    // Queue row 24 (D-2134 R2/Q6/Q7): carry requires tip, commands, every gate and capacity AND the stamped runner
+    // and environment identity with a measured lifecycle on every row. An unstamped cycle re-verifies once.
+    // Package content drift under equal lockfile and links is the declared residual, as in per-gate reuse.
     const cached = last !== undefined && !last.failed && !last.forgiven && last.tip === tip && last.cmdHash === cmdHash
         && gates.every((g) => last.gates.has(g))
-        && last.capacities.every((recorded) => sameCapacity(recorded, capacity));
+        && last.capacities.every((recorded) => sameCapacity(recorded, capacity))
+        && last.tipEnvironments.every((recorded) => sameTipEnvironment(recorded, tipEnvironment))
+        && !dependencyLinkRefusal(identity?.repo ?? intWt);
     // A pair can be verified red and then green without either SHA or command hash changing (for
     // example, an external service or ignored fixture recovers). Delimit attempts explicitly so that
     // the earlier red cannot remain latched into the later complete green cycle.
-    journal.append("tip-verify-start", undefined, { tip, cmdHash, capacity, gates, cached: clean && cached });
+    journal.append("tip-verify-start", undefined, { tip, cmdHash, capacity, tipEnvironment, gates, cached: clean && cached });
     opts.signal?.throwIfAborted();
     if (clean && cached) {
-        journal.append("tip-verify-cached", undefined, { tip, cmdHash, capacity, gates });
+        journal.append("tip-verify-cached", undefined, { tip, cmdHash, capacity, tipEnvironment, gates });
         // The skip must not read as a red. Every surface derives the tip's verdict from this cycle's
         // `tip-verify` events (cockpit derive.ts tipVerificationPassed: a run-end claiming "passed" with
         // ZERO events is fail-closed to FALSE), so a carried-forward green still journals its per-gate
         // pass — `cached: true` keeps it honest about not having re-run the command.
         for (const gate of gates) {
             const cmd = gate === "test" && commands.tipTest ? commands.tipTest : commands[gate];
-            journal.append("tip-verify", undefined, { ...reusedTipEvidence(last.evidenceByGate.get(gate) ?? {}), gate, cmd, pass: true, exitCode: 0, cached: true, tip, cmdHash, capacity });
+            journal.append("tip-verify", undefined, { ...reusedTipEvidence(last.evidenceByGate.get(gate) ?? {}), gate, cmd, pass: true, exitCode: 0, cached: true, tip, cmdHash, capacity, tipEnvironment });
         }
-        return identity ? { failed: false, expected: tip, identityFailed: false, deferred: [] } : false;
+        return identity ? { failed: false, expected: tip, identityFailed: false, deferred: [], tipEnvironment } : false;
     }
     const battery = async (dir) => {
         let tipFailed = false;
@@ -1340,7 +1368,7 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
             };
             if (r.pass) {
                 // Q121s: a forgiven pass journals its fingerprints — honest about what was carried, never a silent green.
-                journal.append("tip-verify", undefined, { ...evidence, gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.reused ? { cached: true } : {}), ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints, ...(r.baselineProvenance ? { baselineProvenance: r.baselineProvenance } : {}) } : {}), tip, cmdHash, capacity: measuredCapacity });
+                journal.append("tip-verify", undefined, { ...evidence, gate: r.gate, cmd: r.cmd, pass: true, exitCode: r.exitCode, details: r.details, ...(r.reused ? { cached: true } : {}), ...(r.forgiven ? { forgiven: true, fingerprints: r.fingerprints, ...(r.baselineProvenance ? { baselineProvenance: r.baselineProvenance } : {}) } : {}), tip, cmdHash, capacity: measuredCapacity, tipEnvironment });
             }
             else {
                 journal.append("tip-verify-failed", undefined, {
@@ -1355,6 +1383,7 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
                     tip,
                     cmdHash,
                     capacity: measuredCapacity,
+                    tipEnvironment,
                 });
                 tipFailed = true;
             }
@@ -1372,7 +1401,7 @@ export async function verifyIntegrationTipCached(intWt, commands, journal, opts
         const changed = await checkoutChange(opened.dir, tip, opened.h0);
         if (changed)
             return identityFailure({ started: true, expected: tip, leg: "checkout", details: `verification checkout changed during the battery: ${changed}` });
-        return { failed: tipFailed, expected: tip, identityFailed: false, deferred };
+        return { failed: tipFailed, expected: tip, identityFailed: false, deferred, tipEnvironment };
     }
     finally {
         if (checkout)
@@ -2104,6 +2133,54 @@ function endedRunIdsForReconcile(repoRoot) {
     }
     return ended;
 }
+// Queue row 240 (D-2138): ownership comes only from dispatch rows in this checkout's runs directory.
+async function removeJournaledTaskWorktrees(repo, owner, current, activeBranch) {
+    let events;
+    try {
+        events = owner.read();
+    }
+    catch {
+        return;
+    } // Queue row 240 (D-2138): unreadable ownership proves no task checkout.
+    const branch = activeBranch ?? events.find((e) => e.event === "run-start")?.data.branch;
+    if (typeof branch !== "string")
+        return;
+    await cleanupRunWorktrees(repo, branch, {
+        removeTaskIds: events.flatMap((e) => e.event === "task-dispatch" && e.taskId ? [e.taskId] : []),
+        run: owner.runId, by: current.runId,
+        producer: (task) => knownProducer(events, task),
+        append: (event, task, data) => {
+            // Queue row 240 (D-2138): the recovery handle retains its terminal task reason without reopening the decision.
+            const terminal = task && [...events].reverse().find((e) => e.taskId === task
+                && ["task-human", "task-failed", "task-done", "task-dispatch"].includes(e.event));
+            const reason = terminal && terminal.data.reason;
+            owner.append(event, task, { ...data, ...(typeof reason === "string" ? { reason } : {}) });
+        },
+        failed: (data) => current.append("worktree-removal-failed", undefined, data),
+    });
+}
+async function sweepDeadRunWorktrees(repo, current) {
+    let runs;
+    try {
+        runs = readdirSync(join(tickmarkrDir(repo), "runs"));
+    }
+    catch {
+        return;
+    }
+    for (const run of runs) {
+        if (run === current.runId)
+            continue;
+        try {
+            const owner = Journal.open(repo, run);
+            const lifecycle = [...owner.read()].reverse().find((e) => e.event === "run-start" || e.event === "run-resume");
+            const pid = lifecycle?.data.pid;
+            if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0 || isPidLive(pid))
+                continue;
+            await removeJournaledTaskWorktrees(repo, owner, current);
+        }
+        catch { /* Queue row 240 (D-2138): unreadable ownership proves nothing and never refuses a start. */ }
+    }
+}
 export async function runDaemon(repoRoot, opts = {}) {
     // OBS-1045: a daemon launched from inside a leased command (a nested runner, an operator's test
     // shell) inherits its ancestor's lease token through the environment, and every gate it ran would
@@ -3188,6 +3265,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                 // panes too. OBS-777: the one startup snapshot lets it reclaim only older runs proven ended, while
                 // every live or unknown run remains spared.
                 await reconcile();
+                if (!keepForever)
+                    await sweepDeadRunWorktrees(repoRoot, journal);
                 // v1.4 self-reference guard: a random nonce on the worker trailer AND exit marker. Displayed
                 // source/diffs (e.g. a worker editing tickmarkr's own prompt.ts/daemon.ts) can't know it, so an echoed
                 // TICKMARKR_RESULT/TICKMARKR_EXIT literal can never premature-harvest the worker. Quote-split keeps the
@@ -3380,7 +3459,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                     const worker = journal.read().reverse().find((e) => e.taskId === t.id && e.event === "worker-result");
                     const disposition = classifyRepairDisposition({
                         // OBS-1072 add.2: hints are lexed from the readable excerpt, never from terminal control bytes.
-                        results: results.map((g) => ({ ...g, details: readableExcerpt(g.details) })), files: t.files, inventory: changed,
+                        results: results.map((g) => ({ ...g, details: readableExcerpt(g.details),
+                            // Queue row 235 (D-2134): oracle output has the same readable boundary as gate details.
+                            ...(Array.isArray(g.meta?.oracles) ? { meta: { ...g.meta, oracles: g.meta.oracles.map((oracle) => oracle && typeof oracle === "object" && typeof oracle.output === "string"
+                                        ? { ...oracle, output: readableExcerpt(oracle.output) } : oracle) } } : {}),
+                        })), files: t.files, inventory: changed,
                         refusalSummary: worker?.data.ok === false && typeof worker.data.summary === "string" ? worker.data.summary : undefined,
                     });
                     for (const diagnostic of disposition.diagnostics) {
@@ -3520,6 +3603,64 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // row is deliberately written before the later worktree-recreation row so the journal cannot
                     // describe only the commits it carried while omitting uncommitted work the removal destroyed.
                     const producerNow = () => knownProducer(journal.read(), t.id);
+                    const readTaskWork = async (taskBase, priorWt, events = journal.read()) => {
+                        if (existsSync(priorWt))
+                            return { head: await gitHead(priorWt), commits: await commitsAheadOf(taskBase, priorWt) };
+                        const taskBranch = `${branch}--${t.id}`;
+                        try {
+                            const read = async (command) => {
+                                const result = await shGit(command, repoRoot);
+                                if (result.code !== 0)
+                                    throw new Error(result.stderr || result.stdout || `git exited ${result.code}`);
+                                return result.stdout.trim();
+                            };
+                            const ahead = async (head) => (await read(`git log --reverse --format=%H ${shq(taskBase)}..${shq(head)}`)).split("\n").filter(Boolean);
+                            const ancestor = async (base, head) => {
+                                const result = await shGit(`git merge-base --is-ancestor ${shq(base)} ${shq(head)}`, repoRoot);
+                                if (result.code !== 0 && result.code !== 1)
+                                    throw new Error(result.stderr || result.stdout || `ancestry exited ${result.code}`);
+                                return result.code === 0;
+                            };
+                            const branchRef = `refs/heads/${taskBranch}`;
+                            const exists = await shGit(`git show-ref --verify --quiet ${shq(branchRef)}`, repoRoot);
+                            if (exists.code !== 0 && exists.code !== 1)
+                                throw new Error(exists.stderr || exists.stdout || `branch read exited ${exists.code}`);
+                            const tip = exists.code === 0 ? await read(`git rev-parse --verify ${shq(`${branchRef}^{commit}`)}`) : undefined;
+                            const removalAt = events.map((e) => e.event === "worktree-removed" && e.data.task === t.id).lastIndexOf(true);
+                            const removal = events[removalAt];
+                            if (removal && !events.slice(removalAt + 1).some((e) => e.event === "worktree-recreation" && e.taskId === t.id)
+                                && typeof removal.data.head === "string") {
+                                const resolved = await shGit(`git rev-parse --verify ${shq(`${removal.data.head}^{commit}`)}`, repoRoot);
+                                const head = resolved.stdout.trim();
+                                if (resolved.code === 0 && head && (!tip || await ancestor(tip, head))) {
+                                    const commits = await ahead(head);
+                                    let snapshot;
+                                    if (typeof removal.data.ref === "string") {
+                                        const pinned = await read(`git rev-parse --verify ${shq(`${removal.data.ref}^{commit}`)}`);
+                                        if (pinned !== head)
+                                            snapshot = removal.data.ref;
+                                    }
+                                    return { head, commits, snapshot, rebuiltFrom: "removal" };
+                                }
+                            }
+                            if (!tip)
+                                return { commits: [] };
+                            const commits = await ahead(tip);
+                            if (commits.length === 0)
+                                return { commits: [] };
+                            const dispatch = [...events].reverse().find((e) => e.event === "task-dispatch" && e.taskId === t.id);
+                            const base = dispatch?.data.base === undefined ? events.find((e) => e.event === "run-start")?.data.baseRef : dispatch.data.base;
+                            if (typeof base !== "string" || !await ancestor(base, tip))
+                                throw new Error("tip does not descend from its recorded dispatch base");
+                            const ref = `refs/tickmarkr/preserved/${tip}`;
+                            await read(`git update-ref ${shq(ref)} ${shq(tip)}`);
+                            journal.append("worktree-preserved", t.id, { ref, ...producerFields(producerNow()) });
+                            return { head: tip, commits, rebuiltFrom: "branch" };
+                        }
+                        catch (error) {
+                            return { commits: [], error: `Queue row 240 (D-2138): cannot rebuild task branch ${taskBranch}: ${error instanceof Error ? error.message : String(error)}` };
+                        }
+                    };
                     const recreateTaskWorktree = async (taskBranch, taskBase, priorWt) => {
                         const producer = producerNow();
                         const ref = await preserveWorktree(priorWt, producer);
@@ -3895,8 +4036,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 ...(typeof g.meta.producerAttempt === "number" ? { producerAttempt: g.meta.producerAttempt } : {}),
                             } : {}),
                             ...((cfg.executionPolicy || repairSelection) && !g.pass ? { disposition: failureDisposition(g) } : {}),
-                            ...Object.fromEntries(["runnerInfraRerun", "hostStarvedRerun", "recoveryBlocked", "failingFiles", "selectionDecision", "failureEvidence",
-                                "forgivenFingerprints", "freshFingerprints", "baselineProvenance", "judgment", "adjudication", "judgeDisagreement", "interruptions"]
+                            ...Object.fromEntries(["runnerInfraRerun", "judgeIndependent", "hostStarvedRerun", "recoveryBlocked", "failingFiles", "selectionDecision", "failureEvidence",
+                                "forgivenFingerprints", "freshFingerprints", "baselineProvenance", "oracles", "judgment", "adjudication", "judgeDisagreement", "interruptions"]
                                 .filter((key) => g.meta?.[key] !== undefined).map((key) => [key, g.meta[key]])),
                             // OBS-540: preserve terminal-vs-retryable infra exactly. normalizeGateOutcome deliberately
                             // defaults a legacy infra row to retryable, so dropping an explicit false here reverses the
@@ -4345,7 +4486,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 if (uncertain)
                                     return decline(uncertain);
                             }
-                            const commits = existsSync(wt) ? await commitsAheadOf(published, wt) : [];
+                            const work = await readTaskWork(published, wt);
+                            if (work.error) {
+                                await park(t, work.error, "infra", found.assignment, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
+                                return "parked";
+                            }
+                            const commits = work.commits;
                             if (!found.result.finished && commits.length === 0)
                                 return decline("unfinished");
                             recordHarvest(commits, found.result.finished, found.result.summary);
@@ -4402,6 +4548,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                         return found.assignment;
                     };
                     const harvestAuthor = rs && !satisfiedGate && !replayedGates && !recheck ? await harvestInterruptedAttempt() : undefined;
+                    if (harvestAuthor === "parked")
+                        return;
                     // OBS-1202: a recheck bound to a stall park that recorded a reapFailure re-verifies the parked
                     // attempt's owned census through the same reapWorker a live harvest uses, BEFORE any gate reads
                     // its tree. Only a complete, empty census releases the harvested commits to the battery; an
@@ -4454,7 +4602,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const preservedRef = recheck
                             ? effectiveEvents(journal.read()).reverse().find((e) => e.taskId === t.id && e.event === "task-approved" && e.data.release === RECHECK_RELEASE)?.data.recheckedRef
                             : undefined;
-                        if (!existsSync(priorWt) && !preservedRef) {
+                        const work = preservedRef ? undefined : await readTaskWork(taskBase, priorWt);
+                        if (work?.error) {
+                            await park(t, work.error, "infra", assignment, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
+                            return;
+                        }
+                        if (!work?.head && !preservedRef) {
                             if (satisfiedGate || recheck)
                                 throw new Error(`${recheck ? "recheck" : `approved gate ${satisfiedGate}`} cannot resume: task worktree is missing`);
                             // Observed passes are an optimization, never authority: without the task worktree there is no
@@ -4469,9 +4622,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 : satisfiedGate
                                     ? `approved gate ${satisfiedGate}`
                                     : `recorded gates on ${replayedGates.commit.slice(0, 10)}`;
-                        const priorTaskTip = preservedRef ? (await shGit(`git rev-parse ${shq(preservedRef)}`, repoRoot)).stdout.trim() : await gitHead(priorWt);
-                        const priorTaskSubject = await gateCommitSubject(taskBase, priorTaskTip, preservedRef ? repoRoot : priorWt);
-                        const commitsToCarry = preservedRef ? await commitsAheadOfRef(taskBase, priorTaskTip, repoRoot) : await commitsAheadOf(taskBase, priorWt);
+                        const priorTaskTip = preservedRef ? (await shGit(`git rev-parse ${shq(preservedRef)}`, repoRoot)).stdout.trim() : work.head;
+                        const priorTaskSubject = await gateCommitSubject(taskBase, priorTaskTip, preservedRef || work?.rebuiltFrom ? repoRoot : priorWt);
+                        const commitsToCarry = preservedRef ? await commitsAheadOfRef(taskBase, priorTaskTip, repoRoot) : [...work.commits];
+                        // Queue row 240 (D-2138): rechecking a dirt refusal gates the committed work as a present checkout did.
+                        // The refused bytes remain recoverable; an explicitly checked ref still selects its exact tree.
+                        const dirtRecheck = recheck && [...journal.read()].reverse()
+                            .find((e) => e.taskId === t.id && e.event === "gate-result")?.data.dirtyWorktree === true;
+                        if (work?.snapshot && !dirtRecheck)
+                            commitsToCarry.push(work.snapshot);
                         // 2.8.1 T2 (ANL-023 §7.2): a task with a recorded merge whose prior tip is PROVEN in E (`merge-base --is-ancestor`
                         // exit 0 — an empty or failed history read is no proof) keeps that tip as its gated subject — recreated on E it
                         // would be gated AT E, and a sibling's publication since its merge would hide the recorded merge. Nothing is gated
@@ -4505,6 +4664,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             satisfiedGate = journal.replaySatisfiedGates(new Map([[t.id, currentTaskSubject]])).get(t.id);
                         }
                         journal.append("worktree-recreation", t.id, {
+                            ...(work?.rebuiltFrom ? { rebuiltFrom: work.rebuiltFrom } : {}),
                             attempted: commitsToCarry, carried: carriedCommits, ...(accountedCommits.length > 0 ? { accounted: accountedCommits } : {}),
                         });
                         // OBS-212: same fail-closed rule as the dispatch path — but this path is worse, because it runs
@@ -5063,6 +5223,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                             });
                         }
                         lastContextTokens = undefined;
+                        const taskBase = published; // deps are merged → visible to this task (E, never the ref as it stands)
+                        const taskBranch = `${branch}--${t.id}`;
+                        const priorWt = worktreePath(repoRoot, taskBranch);
+                        const recreating = existsSync(priorWt);
+                        const work = await readTaskWork(taskBase, priorWt, journaledSoFar);
+                        if (work.error) {
+                            await park(t, work.error, "infra", assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode);
+                            return;
+                        }
                         graph = setStatus(graph, t.id, "running");
                         saveGraph(repoRoot, graph);
                         await trackedDriver.project?.(t.id, "in-progress");
@@ -5073,6 +5242,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const workerDispatchOrdinal = nextWorkerDispatchOrdinal++;
                         vendorEscalated.delete(channelKey(assignment)); // dispatched now: from here on it IS tried
                         journal.append("task-dispatch", t.id, {
+                            base: taskBase,
                             ...(scopeApproval?.data.release === "scope-request" ? { files: t.files, graphDefinitionHash: graphDefinitionHash(graph) } : {}),
                             assignment, attempt, workerDispatchOrdinal, provenance: dispatchProvenance([
                                 channelKey(assignment) === channelKey(r.assignment) ? r.provenance
@@ -5090,15 +5260,17 @@ export async function runDaemon(repoRoot, opts = {}) {
                             ...(carriedConsultGuidance ? { carriedConsultGuidance } : {}),
                         });
                         journal.phaseStart(t.id, "worker", { attempt, assignment });
-                        const taskBase = published; // deps are merged → visible to this task (E, never the ref as it stands)
                         taskBases.set(t.id, taskBase);
-                        const taskBranch = `${branch}--${t.id}`; // "--": a ref can't nest under the existing integration branch (locked decision 10)
-                        const priorWt = worktreePath(repoRoot, taskBranch);
-                        const recreating = existsSync(priorWt);
-                        // Carry the interrupted worker's snapshot, never incidental files created by later gates.
-                        const preserved = recreating ? reapedWorktreeRef : undefined;
+                        // Queue row 240 (D-2138): read a missing checkout like a present one: its recorded removal first,
+                        // with its preserved snapshot carried as a reaped worker's is; else a task branch proven by its
+                        // journaled dispatch base or the run-start base; else nothing. Never reset a branch holding commits unproven.
+                        // Queue row 240 (D-2138): like recheck, a dispatch after a dirt refusal carries committed work only;
+                        // the refused bytes remain recoverable from their ref, as when the prior checkout was present.
+                        const dirtRefusal = [...journaledSoFar].reverse()
+                            .find((e) => e.taskId === t.id && (e.event === "gate-result" || e.event === "task-dispatch"))?.data.dirtyWorktree === true;
+                        const preserved = recreating ? reapedWorktreeRef : dirtRefusal ? undefined : work.snapshot;
                         reapedWorktreeRef = undefined;
-                        const commitsToCarry = recreating ? await commitsAheadOf(taskBase, priorWt) : [];
+                        const commitsToCarry = [...work.commits];
                         if (preserved)
                             commitsToCarry.push(preserved);
                         const wt = await recreateTaskWorktree(taskBranch, taskBase, priorWt);
@@ -5107,8 +5279,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // orphan work a consult already verified as landed.
                         const { carried: carriedCommits, accounted: accountedCommits } = commitsToCarry.length > 0
                             ? await cherryPickCommits(wt, commitsToCarry) : { carried: [], accounted: [] };
-                        if (recreating) {
+                        if (recreating || work.rebuiltFrom) {
                             journal.append("worktree-recreation", t.id, {
+                                ...(work.rebuiltFrom ? { rebuiltFrom: work.rebuiltFrom } : {}),
                                 attempted: commitsToCarry, carried: carriedCommits, ...(accountedCommits.length > 0 ? { accounted: accountedCommits } : {}),
                             });
                         }
@@ -7478,8 +7651,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                             summary.tipProof = { kind: "incomplete" };
                         }
                         else {
-                            appendIdentityFailure(journal, { started: false, branch, ...opened, cmdHash: commandsHash(commands), capacity: resolvedCapacity() });
-                            tipClose = { failed: true, identityFailed: true, deferred: [] };
+                            const capacity = resolvedCapacity();
+                            const tipEnvironment = measureTipEnvironment(repoRoot, capacity);
+                            appendIdentityFailure(journal, { started: false, branch, ...opened, cmdHash: commandsHash(commands), capacity, tipEnvironment });
+                            tipClose = { failed: true, identityFailed: true, deferred: [], tipEnvironment };
                             summary.tipVerify = "failed";
                             summary.tipProof = runEndTipProof(journal.read());
                         }
@@ -7514,8 +7689,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                     if (!tipClose.identityFailed && tipClose.expected !== undefined) {
                         const closing = await checkIntegrationIdentity(repoRoot, branch, tipClose.expected);
                         if (!closing.ok) {
+                            const capacity = resolvedCapacity();
+                            const tipEnvironment = tipStarted ? tipClose.tipEnvironment : measureTipEnvironment(repoRoot, capacity);
                             appendIdentityFailure(journal, { started: tipStarted, branch, expected: tipClose.expected, leg: closing.leg, state: closing.state,
-                                details: identityDetails(closing.leg, closing.state, branch, runId, tipClose.expected), cmdHash: commandsHash(commands), capacity: resolvedCapacity() });
+                                details: identityDetails(closing.leg, closing.state, branch, runId, tipClose.expected), cmdHash: commandsHash(commands), capacity, tipEnvironment });
                             summary.tipVerify = "failed";
                             summary.tipProof = runEndTipProof(journal.read());
                         }
@@ -7527,9 +7704,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                     }
                     journal.append("run-end", undefined, { ...summary });
                     await reconcile(); // run-end boundary: nothing in flight — full sweep (empty desired set)
-                    // OBS-28: lingering worktrees starve CLI probes; keepPanes:forever is the debug override.
+                    // Queue row 240 (D-2138): every task checkout of this run is removed once its recovery ref is recorded,
+                    // unless keepPanes is forever. A dead run's leftovers go at the next daemon start in the same checkout.
+                    // Only journaled task checkouts are touched; no directory listing or in-use check exists.
                     if (!keepForever)
-                        await cleanupRunWorktrees(repoRoot, branch, { removeTaskIds: summary.done });
+                        await removeJournaledTaskWorktrees(repoRoot, journal, journal, branch);
                     // VIS-02: name each blocked subtree by its nearest parked/failed root, e.g. "3 blocked behind P40-02".
                     const attribution = [...attributeBlocked(graph).entries()]
                         .sort(([a], [b]) => a.localeCompare(b))

package/dist/run/git.d.ts

@@ -234,11 +234,16 @@ export declare const sanitizeBranch: (branch: string) => string;
 export declare const WORKTREES_DIR = "worktrees.noindex";
 export declare const worktreePath: (repo: string, branch: string) => string;
 /**
- * OBS-28: remove this run's recorded task worktrees; tolerates already-gone paths. 2.8.1 T2: a run keeps no
- * integration checkout, and a 2.8.0 run's legacy one is never removed here (it may hold the only view of a merge).
+ * Queue row 240 (D-2138): remove only journaled task checkouts, after preserving their recovery tree.
+ * There is no in-use check. Branches and recovery refs remain; a failed operation keeps the checkout.
  */
 export declare function cleanupRunWorktrees(repo: string, branch: string, opts: {
     removeTaskIds: string[];
+    run: string;
+    by: string;
+    producer: (task: string) => PreserveProducer;
+    append: (event: string, task: string | undefined, data: Record<string, unknown>) => void;
+    failed: (data: Record<string, unknown>) => void;
 }): Promise<void>;
 export declare function resolveIntegrationBranch(_repo: string, branch: string): Promise<string>;
 /**

package/dist/run/git.js

@@ -817,12 +817,45 @@ const sanitize = sanitizeBranch;
 export const WORKTREES_DIR = "worktrees.noindex";
 export const worktreePath = (repo, branch) => join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));
 /**
- * OBS-28: remove this run's recorded task worktrees; tolerates already-gone paths. 2.8.1 T2: a run keeps no
- * integration checkout, and a 2.8.0 run's legacy one is never removed here (it may hold the only view of a merge).
+ * Queue row 240 (D-2138): remove only journaled task checkouts, after preserving their recovery tree.
+ * There is no in-use check. Branches and recovery refs remain; a failed operation keeps the checkout.
  */
 export async function cleanupRunWorktrees(repo, branch, opts) {
-    for (const id of opts.removeTaskIds)
-        await removeWorktree(repo, worktreePath(repo, `${branch}--${id}`));
+    for (const task of new Set(opts.removeTaskIds)) {
+        const dir = worktreePath(repo, `${branch}--${task}`);
+        if (!existsSync(dir))
+            continue;
+        try {
+            const head = await gitHead(dir);
+            const producer = opts.producer(task);
+            let ref = await preserveWorktree(dir, producer);
+            if (!ref) {
+                const merged = await shGit(`git merge-base --is-ancestor ${shq(head)} ${shq(`refs/heads/${branch}`)}`, repo);
+                if (merged.code !== 0 && merged.code !== 1)
+                    throw new Error(merged.stderr || merged.stdout || "ancestry comparison failed");
+                if (merged.code === 1) {
+                    ref = `refs/tickmarkr/preserved/${head}`;
+                    await shGitOk(`git update-ref ${shq(ref)} ${shq(head)}`, repo);
+                }
+            }
+            // Queue row 240 (D-2138 add.4): a disposable preservation index never sees staged-only bytes.
+            const staged = await shGit(`git diff-index --cached --name-only --diff-filter=ACMRT -z ${shq(ref ?? head)} --`, dir);
+            if (staged.code !== 0 || staged.stdout.length)
+                throw new Error(staged.stderr || "staged bytes are absent from the recovery tree");
+            if (ref)
+                opts.append("worktree-preserved", task, { ref, ...producerFields(producer), by: opts.by });
+            if (ref)
+                opts.append("worktree-removed", undefined, { task, dir, head, ref, by: opts.by });
+            // Queue row 240 (D-2138): unlike rollback, a refused deletion must never fall through to rm -rf.
+            await withWorktreeAdmin(() => shGitOk(`git worktree remove --force ${shq(dir)}`, repo));
+        }
+        catch (error) {
+            try {
+                opts.failed({ run: opts.run, task, dir, error: error instanceof Error ? error.message : String(error) });
+            }
+            catch { /* Queue row 240 (D-2138): cleanup never replaces the run's outcome, even with an unwritable journal. */ }
+        }
+    }
 }
 export async function resolveIntegrationBranch(_repo, branch) {
     return branch;

package/dist/run/journal.js

@@ -2,7 +2,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmdirSync } from "node:fs";
-import { join } from "node:path";
+import { dirname, isAbsolute, join } from "node:path";
 import { z } from "zod";
 import { channelKey, shq, TokenUsageSchema } from "../adapters/types.js";
 import { graphDefinitionHash, stateDirName, taskContentDigest, taskDefinitionFingerprint, tickmarkrDir } from "../graph/graph.js";
@@ -2744,7 +2744,16 @@ function dischargeProblem(row, o, events, cwd, memo) {
         return "discharge range does not bind the obligation";
     let artifact;
     try {
-        const bytes = readFileSync(String(d.artifactPath));
+        let artifactPath = String(d.artifactPath);
+        if (!isAbsolute(artifactPath)) {
+            // Queue row 31 / D-2134: resolve within the obligation's own run, with common-root fallback
+            // only when that run is absent locally; legacy absolute paths keep their original meaning.
+            const id = parseRunId(o.runId);
+            const localRun = join(runsDir(cwd), id);
+            const runDir = existsSync(localRun) ? localRun : join(runsDir(dirname(trustedCommonDir(cwd))), id);
+            artifactPath = join(runDir, artifactPath);
+        }
+        const bytes = readFileSync(artifactPath);
         if (createHash("sha256").update(bytes).digest("hex") !== d.artifactSha256)
             return "artifact hash mismatch";
         artifact = JSON.parse(bytes.toString("utf8")) ?? {};

package/dist/run/repair-disposition.d.ts

@@ -4,7 +4,7 @@ import type { GateResult } from "../gates/types.js";
 export type RepairDispositionKind = "fund-repair" | "scope-request" | "authoring" | "none";
 export interface RepairDisposition {
     kind: RepairDispositionKind;
-    /** validated inventory paths only — the sole paths a caller may put in an executable command */
+    /** Queue row 235 (D-2134): validated inventory paths or explicitly declared oracle landings. */
     paths: string[];
     reason: string;
     /** which evidence decided: a gate name, "worker" for a refusal, absent for the ordinary disposition */