tldr-experts 0.15.0 → 0.16.1

package/CHANGELOG.md

@@ -1,5 +1,167 @@
 # Changelog
 
+## 0.16.1 — 2026-09-12
+
+### Added
+
+- **`tldrx reject --and-continue` — a rejection that means "redo it this way and carry on"
+  (#242).** `run auto --wait-gates` resumed after an approve and STOPPED after a reject, so on a
+  phone the button meaning *there is still work to do* was the one that ended the run: the only
+  way to act on a rejection was to walk to a terminal and relaunch. The stop was deliberate and
+  its reasoning is real — resuming re-spends the stage on a decision the person who rejected it
+  has not been shown the result of — but it is the reasoning for ONE kind of rejection, "stop, I
+  will look", and the issue measured five consecutive live rejections that all meant the other
+  one: *"faltan 4 stories sin arrancar; continuar el build"*, *"Rehacer S2 y las waves 3 y 4"*,
+  *"Una ronda mas"*. Five rejections, five manual relaunches, the assumption holding zero times
+  out of five. So the rejection now SAYS which act it is instead of the loop guessing from the
+  note's words or from what was holding the gate: `--and-continue` records `and_continue: true`
+  on the gate record `tldrx reject` writes — the same object `--wait-gates` already reads the
+  gate's `status` off, in the same read, so there is no second derivation and no second process
+  to ask — and the loop re-runs the stage with the note, exactly as the manual relaunch did. A
+  bare `tldrx reject` is byte-identical to what it wrote before and stops the loop exactly as
+  before; `and_continue` is additive and only ever `true`, so a gate written before this key
+  existed reads as "stop". It is cleared when the stage parks on its gate again, so it never
+  outlives the rejection it describes. The rationale in `runAuto.ts` now names both kinds and
+  says which one is the default. Which BUTTON a notification offers for which effect is
+  deliberately not part of this change.
+
+### Fixed
+
+- **The `merge-wave` "known flake" was a real race, and it was in the guard's own INSTALL
+  (#115).** For months `test/merge-wave.test.ts`'s concurrency cases reddened CI, went green on
+  a same-sha re-run, and were waved through under §4's re-run licence — three separate cases in
+  one night alone. Nobody had read the failure detail. `gh run view 34671878974 --log-failed`
+  (sha `8cd4df2`) says it in two lines: `fatal: cannot exec '.git/hooks/reference-transaction':
+  Text file busy` → `update aborted by the reference-transaction hook`. `merge-wave.sh` installs
+  the ref guard BEFORE it queues for the lock — deliberately, so an unguarded window never
+  exists — so two invocations overlap on exactly one file, and `install_hook` wrote it with
+  `cat > "$hook"`: truncate-and-rewrite THE SAME INODE, while the invocation holding the lock
+  has a `git merge` exec'ing it. On Linux exec of a file open for write is ETXTBSY; on macOS the
+  identical race is benign, which is the whole of why it was green locally and red on CI, and
+  why a same-sha re-run failed 2-for-2 rather than passing. The hook is now written to
+  `reference-transaction.tmp.$$`, made executable there, and `mv -f`'d into place — the exec'd
+  inode is never the written inode, and no reader can catch a zero-length window. It is the
+  answer `$MARKER` in `merge-wave.sh` already used, and the trap AGENTS.md §12 already named.
+  The race is untestable on macOS by design, so the WRITE is what is pinned: a reinstall must
+  land on a new inode and must leave the inode a hard link is holding byte-identical — red on
+  both counts before the fix. And the refusal that hid all this now tells the truth: a merge the
+  ref-transaction hook aborted, with no conflicting path anywhere, says so and exits **11**, its
+  own code, instead of borrowing `2` and telling the agent to go rebase against a conflict that
+  never existed. A mislabelled refusal is how a deterministic defect becomes folklore; §4's
+  re-run licence for this test is withdrawn in the same change.
+- **The views fixture no longer decays: `test/experts.test.ts` was a wall-clock time bomb
+  (#240).** `main` went red at `e1d284d` — the exact sha of published 0.16.0, with no commit in
+  between — because `competencyLevel` weighs every evidence row by its AGE and the fixture dated
+  its rows ABSOLUTELY (`at: 2026-08-20`, …). An in-process test hands the reader `VIEWS_NOW` and
+  is hermetic; a test that spawns the CLI cannot, because the CLI reads `new Date()`. So
+  `dotnet-stack/ef-core` sat 3% above the level-3 threshold on the day the assertion was written
+  and fell through it eleven days later, by the calendar alone. Bumping the expected number would
+  only have re-armed the bomb for a later date, so the FIXTURE moved instead:
+  `makeViewsWorkspace({ now })` re-dates the copied evidence so every row keeps the age the
+  fixture meant, relative to the clock the assertion is evaluated against, and `NOW` in
+  `experts.test.ts` is the real clock rather than a pinned calendar day. Measured with the clock
+  moved a year forward: reverted, five tests red (the one that reds today plus four with longer
+  fuses); fixed, the whole suite is green at +1 year and the fixture's own consumers are green at
+  +5. §8's hermeticity rule now covers the clock as well as `$TMPDIR`.
+- **A parked gate hands over the command that CLEARS it, not `tldrx approve` whatever is
+  holding it (#239).** Measured on an owner's phone, 2026-09-10: a gate held BY five
+  unanswered questions was announced as `Run: tldrx approve --run <id>`, and the
+  `--notify-every` heartbeat repeated that same line seven times in an hour. The sentence
+  named the holding condition correctly — #203 was working — and the ACTION contradicted it,
+  which is the worse half: a notification exists to be obeyed off a lock screen. Two Build
+  gates were approved by mistake that evening, both over unbuilt stories, both revoked with
+  `reject --stage`; the owner said so himself — *"no sé por qué me avisa que ya puedo cerrarlo
+  si aún hay preguntas"*. `command` now follows the holding condition, in ONE mapping shared by
+  `gate.requested` and the parked heartbeat — and over ONE reading of the pending gate,
+  `gateStories`, so the alert and its reminder can never offer two different taps: open blocking questions → the `tldrx answer` line (the gate is downstream of
+  them); unfinished stories → `tldrx run status` (not `reject` — nobody has decided to abandon
+  that work, and a one-tap refusal is the mirror of the mistake being fixed — and not `null`,
+  because what is missing there is knowledge, not a signature); nothing mechanical outstanding
+  → `tldrx approve`, which is what the field always meant. `approve_command` and
+  `reject_command` stay in the `detail` of every payload, so an adapter that renders buttons
+  keeps both. The open question ids are read off disk by the loop through `blockingQuestionIds`
+  — the one predicate `--wait-answers` polls — at the moment the notification is SENT, so a
+  gate whose questions cleared while the send was deferred does not point at an answered
+  question; the heartbeat reads the gate's stories the same way, every tick, instead of the
+  hard-wired "nothing unfinished" that kept it saying `approve` at a Build gate held by unbuilt
+  work — the gate the two mistaken approvals were on.
+- **The Build gate's summary has a verb again (#239).** `deliveredPhrase` is a noun phrase and
+  three callers embed it after a label, so `It 5 of 6 stories delivered, S6 blocked (…)` was
+  reaching lock screens as a typo. The article is fixed at the one call site that needed a
+  sentence — `It has 5 of 6 stories delivered` — and the phrase's contract is unchanged for
+  `run next`, `ship` and the decision card.
+
+- **A red base pre-flight now keeps what the command SAID, so a stage-wide refusal names a
+  cause (#229).** #211 taught a red story DoD to keep its output — the file on disk, an
+  excerpt, the failing line, a failure-shaped `tail` — and the base row, produced a hundred
+  lines away in the same file, was left on `outcome.tail`: the last line of stdout+stderr.
+  The blast radius and the evidence were the wrong way round. A red story DoD blocks ONE
+  story; a red base refuses the WHOLE stage before anything is dispatched or charged.
+  Measured in the field: a `dotnet test` whose 163,702 captured lines named a dead container
+  daemon on line 12 refused all six stories of a stage with `Test run completed with
+  non-success exit code: 2` — the sentence every failing run of that runner prints, whatever
+  broke. Nothing in the run directory contained the word `Docker`, so diagnosing the refusal
+  meant re-running by hand the command the pre-flight exists to have already run. The base
+  row now goes through the SAME seam, not a second reading of it: `tail` is the
+  failure-looking line, `excerpt` the few lines around it, and the whole bounded tail is
+  written to `04-build/log/dod-output/base-<hash>-1.txt`, which the refusal cites by file and
+  line. A GREEN base still writes nothing — #211's argument holds harder here, since a green
+  base is re-used from cache far more often than a story's — and an `unmeasured` row is
+  untouched: nothing ran, it refuses nothing, and its `tail` is already a reason sentence.
+  `04-build/preflight.yml` stays `version: 1`: four optional fields, and every older file
+  still reads.
+
+## 0.16.0 — 2026-09-11
+
+### Added
+
+- **`tldrx run auto --retry-failed <n>` — a bounded retry on a failed stage (#233).** Measured
+  on a real unattended run at 0.15.0: the loop drove itself through what → how → plan and
+  signed all three `auto` gates by itself, and still needed a person four times. Three of the
+  four were content decisions or money, which a loop must not make. The fourth was a plan that
+  failed its `plan` check by five characters over a cap — a person relaunched `run auto`, the
+  next attempt fixed the two files and passed, and nothing else happened. So the loop stopped
+  on the one failure it could have cleared, and it stopped because `run auto` returned on every
+  non-zero exit except `4`. Now `--retry-failed <n>` lets it run that stage again, at most `n`
+  times in a row. It bounds exit `5` and nothing else: a usage error (`1`), a money refusal
+  (`2`) and an awaiting-human park (`4`) are each attempted ONCE however large `n` is, because
+  a phase ceiling means *a human decides about money* and a retry would turn that sentence into
+  a delay. Only CONSECUTIVE failures count — any other outcome puts the count back to zero,
+  since what is bounded is "this run is stuck", not "this run has ever failed". A retry SPENDS:
+  it is a fresh metered stage under the same phase ceiling and the same `--max-usd`, which is
+  what stops it running up a bill. `0` is the default and a default invocation's lines are
+  byte-identical to what they were; anything outside `0..3` is refused by name with exit `1`,
+  from the one constant the loop and the flag parser share. When the bound is spent the loop
+  stops on the failure's own exit `5` and SAYS the count last — `3 consecutive stage failures
+  at 03-plan/plan …` — so the sentence that reaches a phone is what the loop tried, not a bare
+  `5`.
+
+### Fixed
+
+- **An `auto` gate that REFUSES now writes the verdict down, so `run status` says which of the
+  seven conditions is holding it (#230).** The note has always been the designed answer to
+  "which of the seven stopped it" — and it was written only by a gate that CLOSED, so the one
+  record built for that question was `note: ""` in exactly the case it exists for. Measured
+  2026-09-10 on an unattended `run auto`: a gate sat pending ~40 minutes, `run status` and
+  `run status --verbose` named no condition, and the reason (`claim-sources`, one unresolvable
+  source) surfaced only when a person guessed at the `tldrx approve` the status line suggested
+  — the one route nobody unattended is going to take. Each re-measure that refuses now records
+  `auto-gate refused — held by: <ids> · <all seven with their values>` on the gate that is
+  still `pending`, and `run status` names the ids on the gate row and on the `waiting` line
+  (`--verbose` still quotes the whole note). All seven values, not just the failures: a note
+  that dropped `budget=$0.30 of $6.00` would answer "was it the money" with the same silence.
+  It writes only a `pending` gate — a gate a person has since signed keeps THEIR words — and
+  only when the note would change, so a four-hour `--wait-gates` poll writes `run.yml` once per
+  distinct verdict rather than thousands of times. That `pending` test and the write are a
+  **compare-and-set under the workspace lock**, over a `run.yml` read inside it: a check-then-act
+  over a snapshot taken a moment earlier erased a concurrent `approve` outright — `save()` writes
+  the whole snapshot and re-reads only `budget.yml`'s ceilings, so the gate fell back to
+  `pending`, `by`/`at` to null and the person's words were gone. Caught in pre-merge review and
+  reproduced with two real processes, which is now the test: the poll runs every two seconds
+  precisely while a person is deciding, so an audit record that destroys the evidence of a human
+  decision is not a theoretical interleaving. A gate carrying a refusal note is no longer
+  counted among the "signed gates carry a note" rows, because nobody closed it.
+
 ## 0.15.0 — 2026-09-10
 
 ### Added

package/README.md

@@ -316,6 +316,8 @@ back on the registry is 0.3.0.
 
 | Version | Date | Status | Contains |
 |---|---|---|---|
+| 0.16.1 | 2026-09-12 | `beta` | five things the framework knew and did not say, or said wrong — four of them found by using it rather than by reading it: a red base pre-flight now KEEPS its output, so a refusal that blocks every story in a Build names the failing test and cites the file, where it used to record only the last line of stdout — measured 2026-09-10, a stage refused with `tail: "Test run completed with non-success exit code: 2"` while the cause, `DockerUnavailableException`, sat on line 12 of 163,702 lines the run had already captured and thrown away, so diagnosing a refusal the framework had itself measured meant re-running the workspace's test command by hand; it now routes through the same seam #211 built for a story's DoD, which had been naming its failing test correctly all along on the same command, the same day, in the same repo — the path with the SMALLER blast radius was the legible one; a gate notification now offers the command that CLEARS it rather than always `tldrx approve` — questions open give `tldrx answer <id>`, unfinished stories give `tldrx run status`, and `approve` is offered only when nothing mechanical is outstanding, after an owner approved a Build gate by mistake twice in one evening over unbuilt stories, each time from a phone, each time needing a revoke, while a ten-minute heartbeat repeated `Run: tldrx approve` seven times under a sentence that correctly named the five open questions holding it; `tldrx reject --and-continue` lets a rejection mean "redo it this way and carry on" instead of ending the run — the loop resumed after an approve and stopped after a reject, so the button meaning "there is still work to do" was the one that stopped the work and only a terminal could revive it; five real rejections that night all meant continue, five cost a manual relaunch, and a bare `tldrx reject` still writes a byte-identical `run.yml` and stops exactly as before; the expert-recompute fixture anchors its evidence dates to a `now` it can move, so `bun test` stops going red by the calendar — pristine `main` was red at the exact sha of the published 0.16.0 with no commit in between, and a clock moved one year forward reddened FIVE cases, not the one that had already fired; and `test/merge-wave.test.ts`'s concurrency failure, documented as a known flake since #115 and carrying a written licence to re-run it, was never one: `merge-guard.sh` rewrote `.git/hooks/reference-transaction` IN PLACE while a sibling wave's `git merge` was exec'ing it — ETXTBSY on Linux at 31% under contention, benign on macOS, which is why it was green locally and red in CI, and why a same-sha re-run failed 2 for 2 rather than passing; the hook is now written to a temp file and RENAMED into place, the refusal that used to borrow `2`/`merge conflict` for a hook abort now says what it was and exits 11, and AGENTS.md §4 withdraws the re-run licence for those two cases while naming the interrupted-merge case (#237) as still open and undiagnosed — because "all real" for a whole file costs the same as "all flake", in the other direction |
+| 0.16.0 | 2026-09-11 | `beta` | an unattended run can now clear the one kind of failure it was stopping on, and a gate that refuses says why it refused: measured 2026-09-10 on a real unattended `run auto`, the loop drove itself through what → how → plan and signed all three `auto` gates by itself, and still needed a person four times — three of those were content or money decisions a loop must not make, and the fourth was a plan that failed its own check by five characters over a cap, where a person relaunched the same command and the next attempt fixed the two files and passed, so the loop stopped on the one failure it could have cleared; `tldrx run auto --retry-failed <n>` now runs a failed stage again at most `n` times in a row, bounding exit `5` and nothing else — a usage error (`1`), a money refusal (`2`) and an awaiting-human park (`4`) are each attempted ONCE however large `n` is, because a phase ceiling means a human decides about money and a retry would turn that sentence into a delay — only CONSECUTIVE failures count since what is bounded is "this run is stuck" and not "this run has ever failed", a retry SPENDS as a fresh metered stage under the same phase ceiling and the same `--max-usd`, `0` is the default and a default invocation's lines are byte-identical to what they were, and when the bound is spent the loop stops on the failure's own exit `5` and says the count LAST, so the sentence that reaches a phone is what the loop tried and not a bare number; and an `auto` gate that REFUSES now writes down the verdict its note was always designed to carry — a gate sat pending ~40 minutes while `run status` and `--verbose` named no condition at all, and the reason surfaced only when a person guessed at the `tldrx approve` the status line suggested, which is the one route nobody unattended is going to take — recording all seven conditions WITH THEIR VALUES on the still-`pending` gate, since a note that dropped the passing ones would answer "was it the money" with the same silence, and naming the holding ids on the gate row and on the `waiting` line; it writes only over a `pending` gate, so a gate a person has since signed keeps THEIR words, and only when the verdict would change, so a four-hour `--wait-gates` poll writes once per distinct verdict rather than thousands of times — and that test and that write are a compare-and-set under the workspace lock, because pre-merge review reproduced, with two real processes, a check-then-act over an earlier snapshot erasing a concurrent `approve` outright, and the poll runs every two seconds precisely while a person is deciding |
 | 0.15.0 | 2026-09-10 | `beta` | defaults for the models actually running today, and records that name what happened: measured 2026-09-07/09 across three real workspaces, the first engine-driven run of each was ended by a calibration rather than by the work — a `how` turn and two Build developer turns killed at a 900 s per-turn clock while Opus turns on real repositories run 15-50 minutes, a 202 KB prompt refused by a ceiling whose own message called it "29% of a 200k window", and a 169 KB `facts.yml` sliced to 96 KB on its way into a design turn that then died. So a turn gets two hours (`timeout_s` 900 → 7200), a prompt 400 KB and inputs 256 KB, a phase ceiling holds every attempt its stages may take so the first retry of a stage that spent anything is no longer refused by arithmetic — `warn_at_pct` still measured against one attempt's share, so the warning still arrives before the money — and the four numbers that were calibrations rather than invariants (`attempts`, `fixlist_rounds`, `reviewer_share`, `gate_signer_share`) became optional `stage.yml` keys, refused by name out of range instead of clamped, absent meaning today's constant byte for byte, with `tldrx run auto --prompt-max-bytes` and `--max-reads` for the unattended run that would otherwise need a file edit to get past one refusal; a story's Definition of Done now runs with its dependencies installed — the `install:` slot has sat unread in `templates/workspace.yml` since the beginning and now runs in every fresh story worktree through the same allowlist-and-argv runner, recorded with its own exit code and duration, blocking the story rather than paying a turn to discover it — an exit 127 is reported as a named absent binary and not as a red test, a declared command may be run WITH ARGUMENTS (the exact `Bash(npm run test)` grant matched nothing the developer actually typed, so its own 127 was first seen by the gate, after the turn was paid for), and every DoD check says which tree it ran in; the Build gate now names story outcomes on every policy and not only `auto` — two runs approved from a phone printed `run is done` over zero stories delivered — `run.yml` records an additive `outcome:` written once by all three commands that close a run and rendered by six surfaces, and `tldrx ship` refuses with exit 1 instead of opening a PR over nothing; a red DoD keeps its real failure — the last 200 lines on disk (gitignored, since a tail can carry a secret), up to five failure-looking lines as the detail rather than the last `DeprecationWarning` on stderr, the failing line cited at the line it starts on, and the next attempt told it was the check and not a reviewer; a watcher card may honestly say `Query: none — <reason> [src: …]`, earned only over a card whose own `## Signal` cites `absent:` and refused like any unsourced item otherwise, after a stage spent real money writing the honest answer and was refused for it; a truncated input is told to the OWNER at spawn and not only to the sub-agent, a turn killed on timeout keeps the usage it had already streamed and never a price; and the maintain skill says which sha a review record must cite — the code head — a rule that cost a wave and was written down nowhere an agent reads |
 | 0.14.3 | 2026-09-10 | `beta` | foreign uncommitted work no longer stops a Build, and the dashboard flake that blocked four merges in two days has a root cause: the dirty-tree guard used to count every `git status --porcelain` entry and refuse, offering only "commit it" or "stash it" — neither of which an agent may take with another person's files — and measured across three real workspaces on 0.14.2, every first engine-driven run reaching Build stopped at `04-build`, over seed docs, a data export and one untracked note; the dirt is now classified, `own` and `overlapping` refusing or passing exactly as before while everything `foreign` is set aside with a pathspec-limited `git stash push` as the LAST step before the epic branch is cut, recorded as `worktree.foreign_work_aside` and given back with `--index` on every exit path, success or failure, nothing ever deleted and nothing force-popped, a repo mid-merge, rebase, cherry-pick or bisect refused outright because that state has no clean undo, and a pop git refuses said as the stage's last line and carried into the handoff and the notification; the refusal's printed remedy is now the SAME string the engine runs, limited to the paths it listed and relaunching by mode, after an owner ran the pathspec-less line exactly as printed and it swept the run's own records under `tldrx-work/<run>/` into the stash until `tldrx next` answered `no run`; every path handed to git for a write is `:(literal)` and `git status` is read with `-z`, since a glob pathspec moved the neighbouring `x.txt` for a file called `[x].txt`; and the dashboard's live tests stop racing a typed millisecond — five consecutive runs of the two files went red 3 times, at 5084.27 / 5108.01 / 5256.49 ms against a hard-coded 5000 under load averages 65–107 on 14 cores — every deadline now deriving from one `eventWaitMs()` helper that scales like every other budget, with `test/machine-load.test.ts` refusing a hard-coded deadline in either file so it cannot come back at somebody's merge, while that measurement surfaced the product half: `watchWorkspace` armed its mtime sweep only in `poll` mode, so a dropped FSEvents notification left a live dashboard silently stale for the life of the process — measured with `fseventsd` at 98–115% CPU, directory events that never arrived AT ALL at 82,556 ms and 113,942 ms — and the sweep now runs in watch mode too, at 2 s, so a dropped notification is bounded rather than fatal |
 | 0.14.2 | 2026-09-09 | `beta` | every citation check starts from a fresh view of `questions.md` and `facts.yml`: `srcToken.ts` memoised both indexes at module scope and nothing outside `test/` ever dropped them, so in `tldrx run auto` — one Node process for a whole run — the FIRST citation resolved anywhere froze the view every later stage was then judged against; measured on three real unattended workspaces at 0.14.1, a `how` stage refused with `no such question Q2 … declared: Q1` over questions it had itself written minutes earlier, and another refused over `145 live fact(s)` when `facts.yml` held 148, the three extra written by the owner's answers two seconds before the stage started — roughly $11 of paid turns thrown away for ids that were real the whole time; the indexes are now refreshed inside `toSrcContext`, the one place a citation context is built and a place every caller reaches exactly once per check, gate or hook, so a document's forty citations still read `facts.yml` once while nothing survives the check that read it |

package/dist/hooks/{chunk-zccma7kt.js → chunk-gv3sj8gv.js}

@@ -99,7 +99,8 @@ function gate(g) {
   const evidence = g.evidence === undefined ? "" : `, evidence: ${gateEvidence(g.evidence)}`;
   const executor = g.executed_by === undefined ? "" : `, executed_by: ${gateExecutor(g.executed_by)}`;
   const authority = g.authority === undefined ? "" : `, authority: ${gateAuthority(g.authority)}`;
-  return `{type: ${yamlScalar(g.type)}, status: ${yamlScalar(g.status)}, by: ${yamlScalar(g.by)}, ` + `at: ${yamlScalar(g.at)}, note: ${yamlScalar(g.note)}${evidence}${executor}${authority}}`;
+  const andContinue = g.and_continue === undefined ? "" : ", and_continue: true";
+  return `{type: ${yamlScalar(g.type)}, status: ${yamlScalar(g.status)}, by: ${yamlScalar(g.by)}, ` + `at: ${yamlScalar(g.at)}, note: ${yamlScalar(g.note)}${evidence}${executor}${authority}${andContinue}}`;
 }
 function task(t, indent) {
   const inner = `${indent}   `;
@@ -507,6 +508,16 @@ function statusWithOutcome(status, outcome) {
 
 // src/core/run/autoGate.ts
 var AUTO_GATE_ACTOR = "auto";
+var AUTO_GATE_REFUSED_PREFIX = "auto-gate refused — held by: ";
+var HELD_SEPARATOR = " · ";
+function heldByNote(note) {
+  if (!note.startsWith(AUTO_GATE_REFUSED_PREFIX))
+    return [];
+  const rest = note.slice(AUTO_GATE_REFUSED_PREFIX.length);
+  const end = rest.indexOf(HELD_SEPARATOR);
+  const ids = (end === -1 ? rest : rest.slice(0, end)).split(", ").map((id) => id.trim());
+  return ids.filter((id) => id !== "");
+}
 
 // src/core/run/gateAuthority.ts
 var UNRECORDED_AUTHORIZER = "unrecorded";
@@ -729,12 +740,14 @@ function waitingFor(run, runDir) {
   }
   const open = blockingQuestionIds(join6(runDir, cursor.phase, "questions.md"));
   switch (entry.stage.status) {
-    case "awaiting_gate":
+    case "awaiting_gate": {
+      const held = heldByNote(entry.stage.gate?.note ?? "");
       return {
         kind: "gate",
-        message: `gate on ${entry.phase.id}/${entry.stage.id} — \`tldrx approve\` or \`tldrx reject --note "…"\``,
+        message: `gate on ${entry.phase.id}/${entry.stage.id}` + (held.length === 0 ? "" : ` — held by ${held.join(", ")}`) + ` — \`tldrx approve\` or \`tldrx reject --note "…"\``,
         questions: open
       };
+    }
     case "awaiting_answer":
       return {
         kind: "answer",

package/dist/hooks/session-start.js

@@ -20,7 +20,7 @@ import {
   runSnapshot,
   statusWithOutcome,
   whatIsWaiting
-} from "./chunk-zccma7kt.js";
+} from "./chunk-gv3sj8gv.js";
 import {
   expertsDir,
   loadExperts,

package/dist/hooks/statusline.js

@@ -2,7 +2,7 @@
 import {
   bar,
   runSnapshot
-} from "./chunk-zccma7kt.js";
+} from "./chunk-gv3sj8gv.js";
 import"./chunk-3kmx3dmz.js";
 import"./chunk-rz0qr006.js";
 import"./chunk-d0rp8c68.js";

package/dist/tldrx.js

@@ -11902,7 +11902,8 @@ function gate(g) {
   const evidence = g.evidence === undefined ? "" : `, evidence: ${gateEvidence(g.evidence)}`;
   const executor = g.executed_by === undefined ? "" : `, executed_by: ${gateExecutor(g.executed_by)}`;
   const authority = g.authority === undefined ? "" : `, authority: ${gateAuthority(g.authority)}`;
-  return `{type: ${yamlScalar(g.type)}, status: ${yamlScalar(g.status)}, by: ${yamlScalar(g.by)}, ` + `at: ${yamlScalar(g.at)}, note: ${yamlScalar(g.note)}${evidence}${executor}${authority}}`;
+  const andContinue = g.and_continue === undefined ? "" : ", and_continue: true";
+  return `{type: ${yamlScalar(g.type)}, status: ${yamlScalar(g.status)}, by: ${yamlScalar(g.by)}, ` + `at: ${yamlScalar(g.at)}, note: ${yamlScalar(g.note)}${evidence}${executor}${authority}${andContinue}}`;
 }
 function task(t, indent) {
   const inner = `${indent}   `;
@@ -15643,10 +15644,16 @@ var ENTRIES = [
         meaning: "Send the workspace's declared notify hook a `status` payload this often while the loop runs — `30s`, `10m`, `2h`, or a bare number of seconds. Off by default, and it does nothing at all unless `.tldrx/workspace.yml` declares a `notify:` command (§2.18). A `status` payload carries what `tldrx run status` prints. It asks for nothing while the run is moving — and when the run is PARKED on an open question it says so and repeats the literal answer command, because a heartbeat that keeps saying nothing is waiting on you while a run waits on you is worse than silence.",
         sub: "auto"
       },
+      {
+        name: "retry-failed",
+        arg: "<n>",
+        meaning: 'How many times in a row the loop may run a FAILED stage again before it stops. 0 — the default, and what every invocation before this got — means one attempt and then exit 5. A retry is the same `tldrx next` a person would have typed: the stage is on disk as `failed` with its reason recorded, and the next attempt is told what the last one did. It bounds EXIT 5 AND NOTHING ELSE — a usage error (1), a money refusal (2) and an awaiting-human park (4) are attempted once however large the bound, because each is a decision a person owns; a phase ceiling especially, which means "a human decides about money" and would otherwise become a delay. Only CONSECUTIVE failures count: a stage that succeeds puts the count back to zero. A retry SPENDS — it is a fresh metered stage under the same phase ceiling and the same --max-usd — and when the bound is spent the loop stops on the failure\'s own exit 5, with the count in the last line.',
+        sub: "auto"
+      },
       {
         name: "wait-gates",
         arg: "<duration>",
-        meaning: "Instead of exiting 4 the moment a stage parks on a pending GATE, poll the run for this long and resume if somebody signs it. `--wait-answers`' sibling for the other half of exit 4: a gate is closed by `tldrx approve` / `tldrx reject`, not by an answer. Approved → the loop carries on; rejected → it stops and prints the note; lapsed → exit 4 with the same lines it always had, after one `gate.timeout` notification. It WAITS FOR a signature and never produces one. A stage on `gates_policy: agent` has already had the engine's own gate signer run on it before this flag ever sees the gate (see the `gates_policy: agent` note below), so what is left to wait for here is a PERSON — the same wait a `human` gate gets. Nothing is spent while it waits. Both wait flags may be given together.",
+        meaning: "Instead of exiting 4 the moment a stage parks on a pending GATE, poll the run for this long and resume if somebody signs it. `--wait-answers`' sibling for the other half of exit 4: a gate is closed by `tldrx approve` / `tldrx reject`, not by an answer. Approved → the loop carries on; rejected → it stops and prints the note, unless the rejection was `tldrx reject --and-continue`, which re-runs the stage with the note instead (#242); lapsed → exit 4 with the same lines it always had, after one `gate.timeout` notification. It WAITS FOR a signature and never produces one. A stage on `gates_policy: agent` has already had the engine's own gate signer run on it before this flag ever sees the gate (see the `gates_policy: agent` note below), so what is left to wait for here is a PERSON — the same wait a `human` gate gets. Nothing is spent while it waits. Both wait flags may be given together.",
         sub: "auto"
       },
       {
@@ -15695,6 +15702,7 @@ var ENTRIES = [
       "tldrx run auto --parallel 3",
       "tldrx run auto --prompt-max-bytes 500000 --max-reads 300",
       "tldrx run auto --notify-every 10m",
+      "tldrx run auto --retry-failed 2",
       "tldrx run auto --wait-answers 30m",
       "tldrx run auto --wait-answers 4h --wait-gates 4h",
       "tldrx run unlock 260101-checkout --force",
@@ -15703,7 +15711,7 @@ var ENTRIES = [
     exits: [EXIT_OK, EXIT_USAGE, EXIT_GATE_REFUSED, EXIT_NOT_FOUND, EXIT_AWAITING_HUMAN, EXIT_AGENT_FAILED],
     notes: [
       "`run attend host` is a LOCK, not an engine. It sets one field, spends nothing, runs no stage and touches no branch — and from then on THE FRAMEWORK WILL NOT SPAWN on that run: every turn is a `tldrx next --prepare` / `tldrx next --commit` handshake with the session driving it, the Build reviewer included. `run attend --none` hands it back.",
-      "`run auto` is an ENGINE, not a lock. It calls `next` HEADLESS over and over, so THE FRAMEWORK spawns a metered sub-agent stage after stage, and it stops at the first thing it may not decide: a human gate or an open question (4), a stage failure (5), a phase ceiling or this loop's own --max-usd (2). It is REFUSED ON AN ATTENDED RUN (exit 1, before the event log is opened) — a lock and an engine are alternatives, never layers.",
+      "`run auto` is an ENGINE, not a lock. It calls `next` HEADLESS over and over, so THE FRAMEWORK spawns a metered sub-agent stage after stage, and it stops at the first thing it may not decide: a human gate or an open question (4), a stage failure (5) — unless `--retry-failed <n>` lets it run that stage again, bounded, up to n times in a row — a phase ceiling or this loop's own --max-usd (2). It is REFUSED ON AN ATTENDED RUN (exit 1, before the event log is opened) — a lock and an engine are alternatives, never layers.",
       "`run auto` can also TELL SOMEBODY. When `.tldrx/workspace.yml` declares a `notify:` command (§2.18), the loop hands that command one `version: 1` JSON object on stdin at every moment a person is needed — an open question with its options and the literal `tldrx answer` line, a gate with the literal approve line, a finished or failed run with its exit code and family — plus a periodic `status` under `--notify-every`. The framework names no chat tool: the command is the owner's own, run as argv with no shell, and its exit code is recorded as `notify.sent` / `notify.failed` and NEVER changes the run's outcome.",
       "Under `run auto`, a stage whose `gates_policy` is `agent` gets one bounded GATE-SIGNER turn of its own. When the stage's checks have passed, the engine spawns a single sub-agent at the stage's model and effort, on a quarter of the stage's per-agent ceiling, allowed to read and to write exactly one file: `.agent/<stage>/evidence.md`. The note then goes through the UNCHANGED `approve --as-agent` path — the same validator a person's note goes through — so `verdict: sign` plus every condition holding closes the gate under the note's own `by:`, and anything else leaves it pending for a person with the reasons named. The turn is recorded like any other (`agent.spawned` / `agent.result`, `role: gate-signer`) and shows up in `tldrx cost`. There is no flag for it: `gates_policy: agent` is already the owner's recorded decision that an agent may close this gate, and `human` gates are never touched.",
       "`run status` with several runs open LISTS them and exits 0 — it is the screen you read to find the id every other command wants.",
@@ -15981,6 +15989,11 @@ var ENTRIES = [
     args: [],
     flags: [
       { name: "note", arg: "<text>", meaning: "What has to change. Required — a rejection with no reason is not actionable." },
+      {
+        name: "and-continue",
+        arg: null,
+        meaning: "This rejection means “redo it this way and carry on”, not “stop, I will look”. The stage goes back to `ready` with the note exactly as a bare rejection leaves it — what changes is that an unattended `tldrx run auto --wait-gates` re-runs the stage instead of exiting 4, so a rejection sent from a phone does not need a walk to a terminal to take effect. Recorded on the gate, so the waiting loop reads it rather than guessing from the note’s words. Without it a rejection stops the loop, which is the default and always was. Refused with exit 1 beside `--stage`: a revoke leaves that gate pending for a decision nobody has made yet, so there is no rejection for it to describe."
+      },
       {
         name: "stage",
         arg: "<phase>/<stage>",
@@ -15991,6 +16004,7 @@ var ENTRIES = [
     ],
     examples: [
       'tldrx reject --note "contracts.md does not name the events"',
+      'tldrx reject --and-continue --note "S2 fell over on a missing binary — redo S2 and waves 3 and 4"',
       'tldrx reject --stage 02-how/design --note "the auto gate signed over four open questions"'
     ],
     exits: [EXIT_OK, EXIT_USAGE, EXIT_GATE_REFUSED, EXIT_NOT_FOUND]
@@ -28956,6 +28970,9 @@ function blockedReasons(runDir) {
   }
   return out;
 }
+function gateStories(runDir, phaseId) {
+  return phaseId === BUILD_PHASE2 ? storiesView(runDir) : null;
+}
 function gateStoriesPayload(view) {
   const blocked = view.firstBlocked;
   return {
@@ -29357,6 +29374,22 @@ async function evaluateAutoGate(input) {
 function heldBy(verdict) {
   return verdict.conditions.filter((condition) => !condition.ok).map((condition) => condition.id);
 }
+var AUTO_GATE_REFUSED_PREFIX = "auto-gate refused — held by: ";
+var HELD_SEPARATOR = " · ";
+function refusalNote(verdict) {
+  const held2 = heldBy(verdict);
+  if (held2.length === 0)
+    return "";
+  return `${AUTO_GATE_REFUSED_PREFIX}${held2.join(", ")}${HELD_SEPARATOR}` + verdict.conditions.map(render2).join("; ");
+}
+function heldByNote(note) {
+  if (!note.startsWith(AUTO_GATE_REFUSED_PREFIX))
+    return [];
+  const rest = note.slice(AUTO_GATE_REFUSED_PREFIX.length);
+  const end = rest.indexOf(HELD_SEPARATOR);
+  const ids = (end === -1 ? rest : rest.slice(0, end)).split(", ").map((id) => id.trim());
+  return ids.filter((id) => id !== "");
+}
 async function reevaluateAutoGate(input) {
   const phase = input.run.phases.find((entry) => entry.stages.some((stage3) => stage3.id === input.stageId));
   const stage2 = phase?.stages.find((entry) => entry.id === input.stageId);
@@ -29377,7 +29410,7 @@ async function reevaluateAutoGate(input) {
     runDir: input.runDir,
     stage: planned
   });
-  return await evaluateAutoGate({
+  const verdict = await evaluateAutoGate({
     root: input.root,
     runDir: input.runDir,
     phaseId: phase.id,
@@ -29386,6 +29419,30 @@ async function reevaluateAutoGate(input) {
     budget: input.budget,
     checks
   });
+  if (!verdict.ok)
+    recordRefusal(input.runDir, input.stageId, verdict);
+  return verdict;
+}
+function recordRefusal(runDir, stageId, verdict) {
+  const note = refusalNote(verdict);
+  if (note === "")
+    return;
+  try {
+    withWorkspaceLock(workspaceRootOfRunDir(runDir), () => {
+      const store = RunStore.open(runDir);
+      const current = store.run.phases.flatMap((phase) => phase.stages).find((stage2) => stage2.id === stageId);
+      if (current === undefined || current.gate.status !== "pending" || current.gate.note === note)
+        return;
+      store.mutate((run) => ({
+        ...run,
+        phases: run.phases.map((phase) => ({
+          ...phase,
+          stages: phase.stages.map((stage2) => stage2.id === stageId && stage2.gate.status === "pending" ? { ...stage2, gate: { ...stage2.gate, note } } : stage2)
+        }))
+      }));
+      store.save();
+    });
+  } catch {}
 }
 function render2(condition) {
   return `${condition.id}=${condition.detail}`;
@@ -29708,12 +29765,14 @@ function waitingFor(run, runDir) {
   }
   const open = blockingQuestionIds(join66(runDir, cursor.phase, "questions.md"));
   switch (entry.stage.status) {
-    case "awaiting_gate":
+    case "awaiting_gate": {
+      const held2 = heldByNote(entry.stage.gate?.note ?? "");
       return {
         kind: "gate",
-        message: `gate on ${entry.phase.id}/${entry.stage.id} — \`tldrx approve\` or \`tldrx reject --note "…"\``,
+        message: `gate on ${entry.phase.id}/${entry.stage.id}` + (held2.length === 0 ? "" : ` — held by ${held2.join(", ")}`) + ` — \`tldrx approve\` or \`tldrx reject --note "…"\``,
         questions: open
       };
+    }
     case "awaiting_answer":
       return {
         kind: "answer",
@@ -30020,7 +30079,7 @@ function renderGates(rows, verbose = false) {
   const auto = rows.filter((row2) => row2.policy === "auto").length;
   const agent = rows.filter((row2) => row2.policy === "agent").length;
   const human = rows.length - auto - agent;
-  const noted2 = rows.filter((row2) => row2.note !== null).length;
+  const noted2 = rows.filter((row2) => isSigned(row2) && row2.note !== null).length;
   const lines = [
     `gates   ${String(human)} human, ${String(auto)} auto` + (agent === 0 ? "" : `, ${String(agent)} agent`)
   ];
@@ -30043,10 +30102,13 @@ function renderGates(rows, verbose = false) {
 var NOTE_MARK = "✎";
 function gateTail(row2) {
   const parts = [briefDuration(row2.started_at, row2.ended_at)];
-  if (row2.note !== null)
+  if (isSigned(row2) && row2.note !== null)
     parts.push(NOTE_MARK);
   return parts.filter((part) => part !== "").join("  ");
 }
+function isSigned(row2) {
+  return row2.status === "approved" || row2.status === "rejected";
+}
 function briefDuration(startedAt, endedAt) {
   const measured = dashDuration(startedAt, endedAt);
   if (measured !== "")
@@ -30076,7 +30138,8 @@ function describeGate(row2) {
     return `rejected by ${describeGateSignature(row2)}`;
   if (row2.status === "n-a")
     return `${row2.type}: n-a`;
-  return `${row2.type}: ${row2.status}`;
+  const held2 = heldByNote(row2.note ?? "");
+  return `${row2.type}: ${row2.status}` + (held2.length === 0 ? "" : ` — held by ${held2.join(", ")}`);
 }
 var NOTES_SHOWN = 3;
 function renderOperatorNotes(notes) {
@@ -30611,14 +30674,22 @@ function gatePhrase(policy) {
       return "gate";
   }
 }
-function gateNotification(ctx, costUsd, policy = null, held2 = [], stories = null) {
+function clearingCommand(runId, openQuestions2, unfinishedStories) {
+  const first2 = openQuestions2[0];
+  if (first2 !== undefined)
+    return answerCommand(first2, runId);
+  if (unfinishedStories > 0)
+    return `tldrx run status ${runId}`;
+  return approveCommand(runId);
+}
+function gateNotification(ctx, costUsd, policy = null, held2 = [], stories = null, openQuestions2 = []) {
   const approve = approveCommand(ctx.runId);
   const why = held2.length === 0 ? "" : policy === "auto" ? ` It is held by: ${held2.join("; ")}.` : ` The engine's signer held it: ${held2.join("; ")}.`;
-  const delivered = stories === null ? "" : ` It ${deliveredPhrase(stories)}.`;
+  const delivered = stories === null ? "" : ` It has ${deliveredPhrase(stories)}.`;
   return {
     ...base(ctx, "gate.requested"),
     summary: `${ctx.runId} finished ${ctx.stage ?? "a stage"} for $${costUsd.toFixed(2)} and is waiting ` + `at ${gateArticle(policy)} ${gatePhrase(policy)}.${delivered}${why} Nothing runs after it until the gate is ` + "approved or rejected.",
-    command: approve,
+    command: clearingCommand(ctx.runId, openQuestions2, stories?.unfinished.length ?? 0),
     detail: {
       cost_usd: costUsd,
       approve_command: approve,
@@ -30684,7 +30755,7 @@ function runEndNotification(ctx, exitCode, spentUsd, lastLine2, tally = { usd: s
     }
   };
 }
-function statusNotification(ctx, statusText, waitingOn = [], waitingOnGate = null, truncation = null) {
+function statusNotification(ctx, statusText, waitingOn = [], waitingOnGate = null, truncation = null, stories = null) {
   const ids = [...waitingOn];
   const parked = ids.length > 0;
   const gateSummary = waitingOnGate === null ? "" : `${ctx.runId} is parked at ${waitingOnGate.stage} waiting for a person to SIGN it: ` + `${gatePhrase(waitingOnGate.policy)}. Nothing runs after it and nothing is being spent ` + "while it waits." + (parked ? ` It also has ${String(ids.length)} open question(s): ${ids.join(", ")}.` : "");
@@ -30692,7 +30763,7 @@ function statusNotification(ctx, statusText, waitingOn = [], waitingOnGate = nul
   return {
     ...base(ctx, "status"),
     summary: (waitingOnGate !== null ? gateSummary : parked ? `${ctx.runId} is parked at ${ctx.stage ?? "an unnamed stage"} waiting on YOU: ` + `${String(ids.length)} open question(s), ${ids.join(", ")}. Nothing is being spent ` + "while it waits, and it resumes the moment one is answered." : `${ctx.runId} is still running at ${ctx.stage ?? "an unnamed stage"}. ` + "Nothing is waiting on you — this is the periodic heartbeat `--notify-every` asked for.") + tail2,
-    command: waitingOnGate !== null ? approveCommand(ctx.runId) : parked ? answerCommand(ids[0] ?? "Q1", ctx.runId) : `tldrx run status ${ctx.runId}`,
+    command: waitingOnGate !== null || parked ? clearingCommand(ctx.runId, ids, stories?.unfinished.length ?? 0) : `tldrx run status ${ctx.runId}`,
     detail: {
       status_text: statusText,
       waiting_on: ids,
@@ -31002,15 +31073,23 @@ function reject(store, ctx) {
     ...stage2,
     status: "ready",
     ended_at: null,
-    gate: { ...stage2.gate, status: "rejected", by: ctx.actor, at: ctx.at, note: ctx.note }
+    gate: {
+      ...stage2.gate,
+      status: "rejected",
+      by: ctx.actor,
+      at: ctx.at,
+      note: ctx.note,
+      and_continue: ctx.andContinue === true ? true : undefined
+    }
   })));
   store.append(event2(ctx.at, store.runId, entry.stage.id, "gate.rejected", ctx.actor, {
     phase: entry.phase.id,
     note: ctx.note,
-    from
+    from,
+    ...ctx.andContinue === true ? { and_continue: true } : {}
   }));
   store.save();
-  return { stage: entry.stage.id, phase: entry.phase.id, note: ctx.note, from };
+  return { stage: entry.stage.id, phase: entry.phase.id, note: ctx.note, from, andContinue: ctx.andContinue === true };
 }
 function revoke(store, ctx, target) {
   if (ctx.note.trim() === "") {
@@ -33583,6 +33662,14 @@ function emitPreflightYaml(preflight) {
       lines.push(`  - repo: ${yamlScalar(row2.repo)}`, `    command: ${yamlScalar(row2.command)}`, `    base_ref: ${yamlScalar(row2.baseRef)}`, `    base_sha: ${yamlScalar(row2.baseSha)}`, ...typeof row2.exitCode === "number" ? [`    exit_code: ${String(row2.exitCode)}`] : [], `    timed_out: ${row2.timedOut ? "true" : "false"}`, `    status: ${yamlScalar(row2.status)}`, `    tail: ${yamlScalar(row2.tail)}`);
       if (row2.refusedBecause !== undefined)
         lines.push(`    refused_because: ${yamlScalar(row2.refusedBecause)}`);
+      if (row2.excerpt !== undefined)
+        lines.push(`    excerpt: ${yamlScalar(row2.excerpt)}`);
+      if (row2.outputPath !== undefined)
+        lines.push(`    output_path: ${yamlScalar(row2.outputPath)}`);
+      if (row2.outputBytes !== undefined)
+        lines.push(`    output_bytes: ${String(row2.outputBytes)}`);
+      if (row2.outputLine !== undefined)
+        lines.push(`    output_line: ${String(row2.outputLine)}`);
       if (row2.commandHash !== undefined)
         lines.push(`    command_hash: ${yamlScalar(row2.commandHash)}`);
       if (row2.checkedAt !== undefined)
@@ -33625,6 +33712,8 @@ function parsePreflight(text3) {
         return null;
     }
     const hash = asText(row2.command_hash);
+    const excerpt = asText(row2.excerpt);
+    const outputPath = asText(row2.output_path);
     const rowCheckedAt = asText(row2.checked_at);
     results.push({
       repo,
@@ -33637,6 +33726,10 @@ function parsePreflight(text3) {
       ...refusedBecause === "" ? {} : { refusedBecause },
       status: row2.status === "ok" || row2.status === "failed" ? row2.status : "unmeasured",
       ...hash === "" ? {} : { commandHash: hash },
+      ...excerpt === "" ? {} : { excerpt },
+      ...outputPath === "" ? {} : { outputPath },
+      ...Number.isInteger(row2.output_bytes) ? { outputBytes: row2.output_bytes } : {},
+      ...Number.isInteger(row2.output_line) ? { outputLine: row2.output_line } : {},
       ...rowCheckedAt === "" ? {} : { checkedAt: rowCheckedAt }
     });
   }
@@ -33704,7 +33797,8 @@ function baseFailureLine(result2) {
   const at = result2.baseSha === "" ? "" : ` (${result2.baseSha})`;
   const why = result2.tail === "" ? "" : ` — ${result2.tail}`;
   const ran = result2.exitCode === undefined ? "was refused and never ran" : `exited ${String(result2.exitCode)}`;
-  return `  · \`${result2.command}\` ${ran}` + `${result2.timedOut ? " (timed out)" : ""} in repo ${result2.repo}` + ` on \`${result2.baseRef}\`${at}${why}`;
+  const cite2 = result2.outputPath === undefined ? "" : ` [src: ${result2.outputPath}:${String(result2.outputLine ?? 1)}]`;
+  return `  · \`${result2.command}\` ${ran}` + `${result2.timedOut ? " (timed out)" : ""} in repo ${result2.repo}` + ` on \`${result2.baseRef}\`${at}${why}${cite2}`;
 }
 function baseRefusalLines(failures, workspace) {
   const failed3 = [];
@@ -33835,6 +33929,9 @@ var FAILURE_RE = /FAIL|Failed|failed|\bfail\b|Error|error:|assert|✗|✖|not ok
 function dodOutputRel(storyId, index) {
   return `${BUILD_PHASE}/${LOG_DIR}/${DOD_OUTPUT_DIR}/${storyId}-${String(index + 1)}.txt`;
 }
+function baseOutputId(repo, command2) {
+  return `base-${hashText(JSON.stringify([repo, command2]))}`;
+}
 function meaningfulLines(output) {
   return output.split(`
 `).map((line) => line.trimEnd()).filter((line) => line.trim() !== "");
@@ -33941,6 +34038,8 @@ async function baseResultOf(parts, repo, command2) {
   try {
     const outcome = await runDodCommand(command2, repoDir, timeoutMs, parts.workspace.commands);
     const exitCode = outcome.timedOut ? 124 : outcome.exitCode;
+    const output = outcome.output ?? "";
+    const kept = exitCode === 0 && !outcome.timedOut ? null : writeDodOutput(parts.runDir, baseOutputId(repo, command2), 0, output);
     measured = {
       repo,
       command: command2,
@@ -33948,7 +34047,13 @@ async function baseResultOf(parts, repo, command2) {
       baseSha,
       exitCode,
       timedOut: outcome.timedOut,
-      tail: outcome.tail,
+      tail: kept === null ? outcome.tail : failureSummaryLine(output),
+      ...kept === null ? {} : {
+        excerpt: failureExcerpt(output),
+        outputPath: kept.rel,
+        outputBytes: kept.bytes,
+        outputLine: kept.line
+      },
       status: exitCode === 0 && !outcome.timedOut ? "ok" : "failed",
       commandHash: hash
     };
@@ -38140,6 +38245,7 @@ class BuildSession {
       at: this.ctx.at,
       preparing: this.ctx.mode === "prepare",
       timeoutMs: this.ctx.spec.planned.timeout_s * 1000,
+      runDir: this.ctx.runDir,
       write: (work) => this.writes.run(work),
       advisories: this.advisories
     };
@@ -39562,7 +39668,7 @@ async function finishStage(store, options, phaseId, stageId, spec, notes, gateOv
       ...s,
       status: "awaiting_gate",
       ended_at: nowish(options),
-      gate: { ...s.gate, type: "approve", status: "pending" }
+      gate: { ...s.gate, type: "approve", status: "pending", and_continue: undefined }
     }));
     const autoVerdict = policy === "auto" ? await evaluateAutoGate({
       root: options.root,
@@ -40210,6 +40316,8 @@ var EXIT_USAGE4 = 1;
 var EXIT_REFUSED3 = 2;
 var EXIT_NOT_FOUND4 = 3;
 var EXIT_AWAITING_HUMAN3 = 4;
+var EXIT_AGENT_FAILED3 = 5;
+var MAX_RETRY_FAILED = 3;
 var MAX_ITERATIONS = 96;
 async function runAuto(options) {
   const lines = [];
@@ -40271,7 +40379,8 @@ async function runAuto(options) {
       } catch {
         return;
       }
-      await notifier.send(statusNotification(notifyCtx(), text3, stillBlocking(runDir2), pendingGate(runDir2), cutInputs(stageIdOf())), stageIdOf());
+      const gate2 = pendingGate(runDir2);
+      await notifier.send(statusNotification(notifyCtx(), text3, stillBlocking(runDir2), gate2, cutInputs(stageIdOf()), gate2 === null ? null : gateStories(runDir2, gate2.phase)), stageIdOf());
     })();
   }, options.notifyEveryMs);
   const finish = async (code, spentUsd) => {
@@ -40329,11 +40438,11 @@ async function runAuto(options) {
     if (requested !== null && !autoApproved) {
       const cost = requested;
       const policy = gatePolicyNow(runDir2);
-      const stories = requestedPhase === BUILD_PHASE2 ? storiesView(runDir2) : null;
+      const stories = gateStories(runDir2, requestedPhase);
       const send = async () => {
         if (notifier === null)
           return;
-        await notifier.send(gateNotification(notifyCtx(), cost, policy, gateHeld(fresh), stories), stageIdOf());
+        await notifier.send(gateNotification(notifyCtx(), cost, policy, gateHeld(fresh), stories, stillBlocking(runDir2)), stageIdOf());
       };
       if (onlyHeldByQuestions(fresh))
         return { costUsd: cost, deferredGate: send };
@@ -40349,6 +40458,7 @@ async function runAuto(options) {
     }
     return { costUsd: null, deferredGate: null };
   };
+  let consecutiveFailures = 0;
   try {
     for (let iteration = 0;iteration < MAX_ITERATIONS; iteration++) {
       const store = RunStore.open(runDir2);
@@ -40400,7 +40510,19 @@ async function runAuto(options) {
         if (send !== null)
           await send();
       };
+      if (outcome.code !== EXIT_AGENT_FAILED3)
+        consecutiveFailures = 0;
       if (outcome.code !== EXIT_OK5) {
+        const retryBound = options.retryFailedStages ?? 0;
+        if (outcome.code === EXIT_AGENT_FAILED3) {
+          consecutiveFailures += 1;
+          if (consecutiveFailures <= retryBound) {
+            for (const line of outcome.lines)
+              say(`  ${line}`);
+            say(`retrying ${cursorBefore} — failure ${String(consecutiveFailures)} of ` + `${String(retryBound)} retries allowed (--retry-failed ${String(retryBound)})`);
+            continue;
+          }
+        }
         let rejection = null;
         if (outcome.code === EXIT_AWAITING_HUMAN3) {
           const card = openQuestions2();
@@ -40432,6 +40554,10 @@ async function runAuto(options) {
                 continue;
               }
               if (waited.resolution === "rejected") {
+                if (waited.andContinue) {
+                  say(`waited ${String(Math.round(waited.ms / 1000))}s at ${cursorBefore} — ` + `the gate on ${gate2.stage} was REJECTED with --and-continue` + (waited.note === null ? "" : `: ${waited.note}`) + " — re-running the stage with the note, resuming");
+                  continue;
+                }
                 rejection = `waited ${String(Math.round(waited.ms / 1000))}s at ${cursorBefore} — ` + `the gate on ${gate2.stage} was REJECTED` + (waited.note === null ? "" : `: ${waited.note}`);
               } else {
                 await flushGate();
@@ -40447,6 +40573,9 @@ async function runAuto(options) {
           say(line);
         if (rejection !== null)
           say(rejection);
+        if (outcome.code === EXIT_AGENT_FAILED3 && retryBound > 0) {
+          say(`stopped: ${String(consecutiveFailures)} consecutive stage failures at ${cursorBefore} ` + `— the --retry-failed ${String(retryBound)} bound is spent, and the exit code is still ` + "5, the failure's own");
+        }
         return await finish(outcome.code, spentByLoop);
       }
       const after = RunStore.open(runDir2);
@@ -40490,6 +40619,7 @@ function pendingGate(runDir2) {
     return {
       stage: `${cursor.phase}/${cursor.stage}`,
       stageId: cursor.stage,
+      phase: cursor.phase,
       policy: gatePolicyFor(store.run.gates_policy, cursor.stage)
     };
   } catch {
@@ -40509,16 +40639,22 @@ async function waitForGate(runDir2, stageId, limitMs, gate2) {
   for (;; ) {
     const elapsed = Date.now() - started;
     const found = gateOf(runDir2, stageId);
-    if (found !== null && found.status === "approved")
-      return { resolution: "approved", ms: elapsed, note: null };
+    if (found !== null && found.status === "approved") {
+      return { resolution: "approved", ms: elapsed, note: null, andContinue: false };
+    }
     if (found !== null && found.status === "rejected") {
-      return { resolution: "rejected", ms: elapsed, note: found.note.trim() === "" ? null : found.note.trim() };
+      return {
+        resolution: "rejected",
+        ms: elapsed,
+        note: found.note.trim() === "" ? null : found.note.trim(),
+        andContinue: found.andContinue
+      };
     }
     if (found !== null && await selfCloseAutoGate(runDir2, stageId, gate2)) {
-      return { resolution: "approved", ms: Date.now() - started, note: null };
+      return { resolution: "approved", ms: Date.now() - started, note: null, andContinue: false };
     }
     if (elapsed >= limitMs)
-      return { resolution: "lapsed", ms: elapsed, note: null };
+      return { resolution: "lapsed", ms: elapsed, note: null, andContinue: false };
     const pollMs = pollInterval(limitMs);
     await new Promise((resolve11) => setTimeout(resolve11, Math.min(pollMs, limitMs - elapsed)));
   }
@@ -40551,7 +40687,11 @@ async function selfCloseAutoGate(runDir2, stageId, gate2) {
 function gateOf(runDir2, stageId) {
   try {
     const found = flatten(RunStore.open(runDir2).run).find((entry) => entry.stage.id === stageId);
-    return found === undefined ? null : { status: found.stage.gate.status, note: found.stage.gate.note };
+    return found === undefined ? null : {
+      status: found.stage.gate.status,
+      note: found.stage.gate.note,
+      andContinue: found.stage.gate.and_continue === true
+    };
   } catch {
     return null;
   }
@@ -42691,7 +42831,8 @@ var VALUE_FLAGS = [
   "wait-answers",
   "wait-gates",
   "prompt-max-bytes",
-  "max-reads"
+  "max-reads",
+  "retry-failed"
 ];
 function durationFlag(args, name) {
   const raw = stringFlag(args, name);
@@ -42703,6 +42844,15 @@ function durationFlag(args, name) {
   }
   return ms;
 }
+function retryFailedFlag(args) {
+  const value = numberFlag(args, "retry-failed");
+  if (value === undefined)
+    return;
+  if (!Number.isInteger(value) || value < 0 || value > MAX_RETRY_FAILED) {
+    throw new UsageError(`--retry-failed must be a whole number between 0 and ${String(MAX_RETRY_FAILED)} ` + "(0 is the default: a failed stage stops the loop). A stage that has failed that many " + "times in a row is failing for a reason another spawn will not discover, and every " + "attempt is real money.");
+  }
+  return value;
+}
 var runCommand = {
   name: "run",
   summary: "Create, inspect or auto-run a piece of work",
@@ -42715,6 +42865,7 @@ var runCommand = {
 ` + `       tldrx run auto [<run>] [--max-usd <n>] [--until <stage>] [--model <m>] [--effort <level>]
 ` + `                      [--notify-every <duration>] [--wait-answers <duration>]
 ` + `                      [--wait-gates <duration>] [--prompt-max-bytes <n>] [--max-reads <n>]
+` + `                      [--retry-failed <n>]
 ` + `                  [--yolo] [--parallel <n>] [--gate-agent] [--ui scene|compact|plain|off]
 ` + `                  [--run <id>] [--root <path>]
 ` + `       tldrx run gates set <stage>:<human|auto|agent> --note <text> [--run <id>] [--root <path>]
@@ -42877,6 +43028,7 @@ async function runAutoLoop(argv) {
         notifyEveryMs: durationFlag(args, "notify-every"),
         waitAnswersMs: durationFlag(args, "wait-answers"),
         waitGatesMs: durationFlag(args, "wait-gates"),
+        retryFailedStages: retryFailedFlag(args),
         actor: currentActor(),
         at: nowRfc3339(),
         onLine: (line) => ui2.log(() => process.stdout.write(`${line}
@@ -43294,7 +43446,7 @@ var PROPOSE_STAGE = "propose";
 var EXIT_OK9 = 0;
 var EXIT_USAGE6 = 1;
 var EXIT_REFUSED7 = 2;
-var EXIT_AGENT_FAILED3 = 5;
+var EXIT_AGENT_FAILED4 = 5;
 var DEFAULT_TRIAGE_EFFORT = "low";
 var DEFAULT_TRIAGE_USD = 1;
 var MIN_TRIAGE_USD = 0.25;
@@ -43428,7 +43580,7 @@ async function propose(options, workspaceCommands, inventory, seed, outDir) {
     metered = outcome.metered;
     if (!outcome.ok) {
       return {
-        code: EXIT_AGENT_FAILED3,
+        code: EXIT_AGENT_FAILED4,
         costUsd,
         outDir,
         inventory,
@@ -43449,7 +43601,7 @@ async function propose(options, workspaceCommands, inventory, seed, outDir) {
     if (mode === "commit")
       writeRaw(outDir, PROPOSE_STAGE, JSON.stringify(raw ?? null, null, 2));
     return {
-      code: EXIT_AGENT_FAILED3,
+      code: EXIT_AGENT_FAILED4,
       costUsd,
       outDir,
       inventory,
@@ -45051,11 +45203,12 @@ function costReport(argv) {
 var rejectCommand2 = {
   name: "reject",
   summary: "Request changes at the current gate, or revoke an approval already given",
-  usage: "tldrx reject --note <text> [--stage <phase>/<stage>] [--run <id>] [--root <path>]",
+  usage: "tldrx reject --note <text> [--and-continue] [--stage <phase>/<stage>] [--run <id>] [--root <path>]",
   implemented: true,
   async run(argv) {
     try {
       const args = parseArgs(argv, ["run", "note", "root", "stage"]);
+      const andContinue = boolFlag(args, "and-continue");
       const note = stringFlag(args, "note") ?? args.positionals.join(" ");
       if (note.trim() === "") {
         throw new UsageError('reject needs --note: `tldrx reject --note "what to change"`');
@@ -45063,11 +45216,14 @@ var rejectCommand2 = {
       const root2 = workspaceRootFrom(args);
       const wanted = stringFlag(args, "run");
       const target = stringFlag(args, "stage");
+      if (andContinue && target !== undefined && target !== "") {
+        throw new UsageError("--and-continue is about a rejection at the CURRENT gate; --stage revokes an approval " + "already given, which leaves that gate pending for a decision nobody has made yet");
+      }
       const resolved = target === undefined || target === "" ? resolveRunOrExplain("tldrx reject", root2, wanted) : resolveIncludingFinished(root2, wanted);
       if (!isResolved(resolved))
         return resolved.exit;
       const store = resolved.store;
-      const ctx = { root: root2, actor: currentActor(), at: nowRfc3339(), note };
+      const ctx = { root: root2, actor: currentActor(), at: nowRfc3339(), note, andContinue };
       if (target !== undefined && target !== "") {
         const outcome2 = revoke(store, ctx, target);
         const signed = outcome2.signedBy === "auto" ? "it had been auto-approved by the facilitator" : `it had been approved by ${outcome2.signedBy}`;
@@ -45088,9 +45244,11 @@ var rejectCommand2 = {
       }
       const outcome = reject(store, ctx);
       const came = outcome.from === "failed" ? " (it had failed)" : "";
+      const loop = outcome.andContinue ? "an unattended `tldrx run auto --wait-gates` re-runs the stage instead of stopping (--and-continue)" : "an unattended `tldrx run auto --wait-gates` STOPS here — pass --and-continue to have it carry on instead";
       process.stdout.write(`rejected ${outcome.phase}/${outcome.stage}${came} — back to \`ready\`
 ` + `note: ${outcome.note}
 the note goes into the next prompt — \`tldrx next\` to re-run the stage
+` + `${loop}
 `);
       return EXIT_OK;
     } catch (error) {
@@ -48535,7 +48693,7 @@ var EXIT_OK14 = 0;
 var EXIT_USAGE9 = 1;
 var EXIT_GATE_REFUSED2 = 2;
 var EXIT_NOT_FOUND12 = 3;
-var EXIT_AGENT_FAILED4 = 5;
+var EXIT_AGENT_FAILED5 = 5;
 var TRAIN_TIMEOUT_MS = 30 * 60 * 1000;
 async function runTraining(options) {
   const said2 = [];
@@ -48775,7 +48933,7 @@ async function trainWithPreflight(options, said2) {
     }));
     if (!outcome.ok) {
       rollback(previous);
-      return fail3(EXIT_AGENT_FAILED4, [
+      return fail3(EXIT_AGENT_FAILED5, [
         `${options.expert}/${area.id}: the ${task2.key} sub-agent failed — ${outcome.error ?? "no result"}`,
         outcome.metered ? `  $${round29(outcome.costUsd).toFixed(2)} spent and recorded; nothing was written to competencies.yml` : `  ${providerWarning ?? "the provider turn was unmetered in dollars"}; nothing was written to competencies.yml`
       ], sum(tasks));
@@ -49114,7 +49272,7 @@ function reject2(log, options, area, costUsd, lines, detail) {
       ...fitProblems(detail.problems)
     }
   }));
-  return { code: EXIT_AGENT_FAILED4, lines, costUsd };
+  return { code: EXIT_AGENT_FAILED5, lines, costUsd };
 }
 function fitProblems(problems) {
   const budget = MAX_PAYLOAD_BYTES2 - 1024;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tldr-experts",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "description": "tldr-experts: an evidence-first, file-based AI development framework - five stages, a gate on every one, and every claim cited or refused. Installs the `tldrx` (and `tldr-experts`) command. Beta.",
   "license": "MIT",
   "author": "Alan Martinez",

package/plugin/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$doc": "Shape verified from https://code.claude.com/docs/en/plugins.md (Quickstart > Create the plugin manifest). Fields used here: name, description, version, author.name. Only plugin.json goes inside .claude-plugin/; skills/, agents/ and hooks/ live at the plugin root.",
   "name": "tldrx",
   "description": "tldr-experts: an evidence-first, file-based AI development framework. Five stages, a gate on every one, every claim cited or refused. Beta.",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "author": {
     "name": "Alan Martinez"
   }