tickmarkr 1.73.0 → 1.75.0

package/dist/adapters/claude-code.d.ts

@@ -1,4 +1,5 @@
-import { type AuthHealth, type WorkerAdapter } from "./types.js";
+import { type AuthHealth, type TrustDialog, type WorkerAdapter } from "./types.js";
+export declare const CLAUDE_TRUST_DIALOG: TrustDialog;
 export declare function claudeSlug(real: string): string;
 export declare function probeVersion(bin: string): AuthHealth;
 export declare const claudeCode: WorkerAdapter;

package/dist/adapters/claude-code.js

@@ -20,6 +20,12 @@ import { channelsFromConfig, shq, TokenUsageSchema } from "./types.js";
 // Phase 18's operator-price × tokens derivation, not a CLI claim.
 const MAX_SESSION_FILES = 20; // newest-first; a long-lived project dir can hold many sessions
 const MAX_SESSION_BYTES = 8_000_000; // per-file cap; a runaway JSONL cannot make the read unbounded
+// v1.75 T2 / OBS-137: current Claude Code workspace-trust prompt (2.1.218). The full question
+// distinguishes this startup gate from routine agent text; Enter accepts the selected trust option.
+export const CLAUDE_TRUST_DIALOG = {
+    fingerprint: "Quick safety check: Is this a project you created or one you trust?",
+    key: "Enter",
+};
 export function claudeSlug(real) {
     return real.replace(/[^A-Za-z0-9]/g, "-");
 }
@@ -54,13 +60,11 @@ export const claudeCode = {
     // and --mcp-config is VARIADIC — a positional after it is eaten as a config-file path, so another
     // flag must always follow the value, never the prompt.
     headlessCommand: (promptFile, model) => `claude -p "$(cat ${shq(promptFile)})" --model ${shq(model)} --permission-mode bypassPermissions --strict-mcp-config --mcp-config '{"mcpServers":{}}' --output-format text`,
-    // HYG-03: the residual first-entry dialog on an interactive TUI is the workspace TRUST dialog (not MCP
-    // config loading) — CLI-imposed, no flag to pre-accept, only store is claude's global last-writer-wins
-    // ~/.claude.json keyed on the exact path. Closed WON'T-FIX (decision B, 2026-07-10): tickmarkr writes nothing
-    // to that file (a seed races claude's own writes, nondeterministically). Amortizes to one operator dismissal
-    // per stable worktree path; blocked-pane paging surfaces it. Do NOT change this command to "fix" the dialog —
-    // see .planning/REQUIREMENTS.md HYG-03 and 21-02-LIVE-CHECK.md. Revisit if upstream ships a --trust flag.
+    // HYG-03 / OBS-137: the residual first-entry dialog is workspace trust, not MCP config loading.
+    // Claude's only store is global last-writer-wins ~/.claude.json, so tickmarkr still does not seed it;
+    // the daemon safely answers only the exact adapter-declared dialog once per slot.
     interactiveCommand: (promptFile, model) => `claude --model ${shq(model)} --strict-mcp-config --mcp-config '{"mcpServers":{}}' --permission-mode bypassPermissions "$(cat ${shq(promptFile)})"`,
+    trustDialog: CLAUDE_TRUST_DIALOG,
     resumeCommand: (sessionId, promptFile, model) => `claude -r ${shq(sessionId)} --model ${shq(model)} --strict-mcp-config --mcp-config '{"mcpServers":{}}' --permission-mode bypassPermissions "$(cat ${shq(promptFile)})"`,
     invoke(task, _cwd, a, ctx) {
         return { command: this.headlessCommand(ctx.promptFile, a.model) };

package/dist/adapters/codex.d.ts

@@ -1,8 +1,9 @@
-import { type TrustVerdict, type WorkerAdapter } from "./types.js";
+import { type TrustDialog, type TrustVerdict, type WorkerAdapter } from "./types.js";
 export declare function readCodexModelsCache(path?: string): {
     models: string[];
     fetchedAt?: string;
 };
+export declare const CODEX_TRUST_DIALOG: TrustDialog;
 export declare function seedCodexTrust(repoRoot: string, configPath?: string): TrustVerdict;
 export declare function hasCodexTrustedProject(text: string, root: string): boolean;
 export declare function codexConfigMcpServerNames(configPath?: string): string[];

package/dist/adapters/codex.js

@@ -89,6 +89,12 @@ const GITDIR_WRITABLE = `-c "sandbox_workspace_write.writable_roots=[\\"$(git re
 // -s/--sandbox workspace-write sandbox (deliberately NOT --dangerously-bypass-approvals-and-sandbox,
 // which would drop the sandbox). Listed by `codex --help` and `codex exec --help` (verified 2026-07-23).
 const CODEX_HOOK_TRUST = "--dangerously-bypass-hook-trust";
+// v1.75 T2 / OBS-137: current Codex workspace-trust prompt (0.144.6). The exact heading
+// is distinct from normal agent output; Enter accepts the selected "Yes, continue" option.
+export const CODEX_TRUST_DIALOG = {
+    fingerprint: "Do you trust the contents of this directory?",
+    key: "Enter",
+};
 // v1.22 T5 / OBS-16: codex keys trust on absolute path under [projects."<root>"] trust_level="trusted"
 // in ~/.codex/config.toml (CODEX_HOME relocates the dir). Worktrees inherit parent-project trust when
 // the REPO ROOT is trusted — seed the root once, cover every future worktree. Idempotent: a second
@@ -196,6 +202,7 @@ export const codex = {
     // v1.22 T5: seed [projects."<repoRoot>"] trust_level="trusted" so fresh worktrees never stall on
     // "Do you trust this directory?" (OBS-16). doctor-only side effect.
     trust: (repoRoot) => seedCodexTrust(repoRoot),
+    trustDialog: CODEX_TRUST_DIALOG,
     // v1.5 MODEL-01: file read only (no `codex models` subcommand exists, verified 2026-07-10).
     // Already fails OPEN to [] internally — advisory detection, unlike gates' fail-closed.
     listModels: async () => readCodexModelsCache().models,

package/dist/adapters/kimi.d.ts

@@ -20,6 +20,7 @@ export interface KimiInteractiveSeedResult {
     seedError?: string;
     sessionId?: string;
 }
+export declare const KIMI_INPUT_BOX: import("./types.js").InputBox;
 export declare function runKimiInteractiveSeed(opts: {
     driver: Pick<ExecutorDriver, "run" | "waitOutput" | "read">;
     slot: Slot;

package/dist/adapters/kimi.js

@@ -5,7 +5,7 @@ import { probeVersion } from "./claude-code.js";
 import { parseWorkerResult } from "./prompt.js";
 import { runInteractiveSeed } from "../run/interactive-seed.js";
 import { sh } from "../run/git.js";
-import { channelsFromConfig, MODEL_ID_RE, shq, TokenUsageSchema } from "./types.js";
+import { channelsFromConfig, declareInputBox, MODEL_ID_RE, shq, TokenUsageSchema } from "./types.js";
 // KIMI-03 → v1.58 T5: the "no harness-readable counter" block (research F-6, 2026-07-17) is
 // LIFTED for collectUsage — kimi 0.27.0 writes a wire journal per agent at
 // ~/.kimi-code/sessions/<wd>/session_<uuid>/agents/<agent>/wire.jsonl, and ~/.kimi-code/
@@ -118,6 +118,11 @@ export function confirmKimiSeedBanner(banner, assignedModel) {
     }
     return { ok: true, sessionId: kimiBannerSessionId(banner) };
 }
+// v1.75 T1 / OBS-136: this readiness line is rendered inside Kimi Code's bordered steady-state
+// input box. The adapter owns the fingerprint; the driver only consults declarations generically.
+export const KIMI_INPUT_BOX = declareInputBox("kimi", {
+    fingerprint: "Send /help for help information.",
+});
 // Shared launch-then-seed surface (T6) + banner confirm (T7/T2). One definition so the adapter
 // property and the daemon's generic runInteractiveSeed path cannot drift.
 const KIMI_SEED = {
@@ -165,6 +170,7 @@ export const kimi = {
     // prompt as one user turn. Banner model/session confirmation runs on the daemon's generic
     // runInteractiveSeed path via confirmBanner on KIMI_SEED (not a separate dispatch helper).
     interactiveSeed: KIMI_SEED,
+    inputBox: KIMI_INPUT_BOX,
     // v1.53 T3 resume — live-probed 2026-07-18: `-p` + `-S <id>` compose cleanly (no OBS-67-class
     // flag rejection) and the resumed session carries prior conversation state. `-S <id>` is the
     // deterministic form; `-c` rejected as primary — cwd-keyed, nondeterministic under worktree

package/dist/adapters/types.d.ts

@@ -82,6 +82,12 @@ export interface TrustDialog {
     key: string;
 }
 export declare function matchesTrustDialog(paneText: string, dialog: TrustDialog): boolean;
+export interface InputBox {
+    fingerprint: string;
+}
+export declare function declareInputBox(adapterId: string, inputBox: InputBox): InputBox;
+export declare function declaredInputBoxForWorkerName(workerName: string): InputBox | undefined;
+export declare function matchesInputBox(paneText: string, inputBox: InputBox): boolean;
 export interface WorkerAdapter {
     id: string;
     vendor: string;
@@ -105,6 +111,7 @@ export interface WorkerAdapter {
     contextUsage?(session: SessionRef): ContextUsage | null;
     trust?(repoRoot: string): TrustVerdict;
     trustDialog?: TrustDialog;
+    inputBox?: InputBox;
     hardcodedFlags?: {
         binary: string;
         flags: string[];

package/dist/adapters/types.js

@@ -30,6 +30,18 @@ export function modelAuthed(health, model, allowUnverifiedModels = false) {
 export function matchesTrustDialog(paneText, dialog) {
     return paneText.includes(dialog.fingerprint);
 }
+const inputBoxes = new Map();
+export function declareInputBox(adapterId, inputBox) {
+    inputBoxes.set(adapterId, inputBox);
+    return inputBox;
+}
+export function declaredInputBoxForWorkerName(workerName) {
+    const adapterId = /^.+-worker-(.+)-a\d+-.+$/.exec(workerName)?.[1];
+    return adapterId === undefined ? undefined : inputBoxes.get(adapterId);
+}
+export function matchesInputBox(paneText, inputBox) {
+    return paneText.includes(inputBox.fingerprint);
+}
 export function channelsFromConfig(adapterId, cfg) {
     const e = cfg.tiers[adapterId];
     if (!e)

package/dist/cli/commands/fleet.js

@@ -57,6 +57,14 @@ function withModeLine(yaml, mode) {
         return yaml.replace(/^routing:$/m, `routing:\n  mode: ${mode}`);
     return `routing:\n  mode: ${mode}\n${yaml}`;
 }
+function formatFleetSteering(cfg) {
+    const blocks = [];
+    if (cfg.review.prefer?.length)
+        blocks.push(`review:\n  prefer: ${JSON.stringify(cfg.review.prefer)}`);
+    if (cfg.consult.prefer?.length)
+        blocks.push(`consult:\n  prefer: ${JSON.stringify(cfg.consult.prefer)}`);
+    return blocks.length ? `${blocks.join("\n")}\n` : "";
+}
 // v1.51 T4: one gloss per routing mode on the fleet mode screen — mirrors the preset compiler.
 const MODE_GLOSS = {
     "partner-led": "every shape frontier · explore off",
@@ -83,7 +91,9 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
         const rm = resolveRunMode(cwd, { globalDir });
         const body = formatFleetPrint(cwd, { globalDir });
         const nl = body.indexOf("\n");
-        return `${body.slice(0, nl)}\n# mode: ${rm.mode.mode} (${rm.source})${body.slice(nl)}`;
+        // Steering comes from the same resolved config snapshot the editor consumes below,
+        // not from another parse of either raw overlay.
+        return `${body.slice(0, nl)}\n# mode: ${rm.mode.mode} (${rm.source})${body.slice(nl)}${formatFleetSteering(rm.cfg)}`;
     }
     if (!interactive)
         return { out: NON_TTY_MSG, code: 1 };

package/dist/cli/commands/status.js

@@ -8,7 +8,8 @@ import { Journal, engagementComparable, isQualityFailureParkKind, recordedTaskFa
 import { normalizeStallSnapshot } from "../../run/stall.js";
 // ponytail: fixed 2s refresh; promote to config.visibility.* only when an operator asks.
 const REFRESH_MS = 2000;
-const NOT_COMPARABLE_NOTICE = "graph recompiled since this run — task states not comparable; run `tickmarkr run` to execute";
+const NOT_COMPARABLE_NOTICE = "graph recompiled since this run — task states not comparable; resume with `--graph-changed` to audit this recompile";
+const PRIOR_GRAPH_MARKER = "prior graph";
 // The timer must keep the process ALIVE: an unref'd timer here let the event loop drain after the
 // first frame, so a live `--watch` printed once and exited 0 (OBS-11). Never unref this.
 const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -120,23 +121,28 @@ export const gateBox = (state, unicode) => {
     return state === "pass" ? "[x]" : state === "fail" ? "[!]" : state === "skip" ? "." : "[ ]";
 };
 export const defaultGateStates = (task) => GATE_NAMES.map((gate) => task.gates.includes(gate) ? "open" : "skip");
-export const gateStates = (task, events) => {
+const gateSnapshot = (task, events, rehashAt) => {
     const outcomes = new Map();
     const start = attemptStartIdx(events, task.id);
     if (start >= 0) {
-        for (const e of events.slice(start)) {
+        for (let eventIndex = start; eventIndex < events.length; eventIndex++) {
+            const e = events[eventIndex];
             if (e.taskId !== task.id || e.event !== "gate-result" || typeof e.data.gate !== "string")
                 continue;
             if (e.data.skipped === true)
-                outcomes.set(e.data.gate, "skip");
+                outcomes.set(e.data.gate, { state: "skip", eventIndex });
             else if (e.data.pass === true)
-                outcomes.set(e.data.gate, "pass");
+                outcomes.set(e.data.gate, { state: "pass", eventIndex });
             else if (e.data.pass === false)
-                outcomes.set(e.data.gate, "fail");
+                outcomes.set(e.data.gate, { state: "fail", eventIndex });
         }
     }
-    return GATE_NAMES.map((gate) => task.gates.includes(gate) ? outcomes.get(gate) ?? "open" : "skip");
+    return {
+        states: GATE_NAMES.map((gate) => task.gates.includes(gate) ? outcomes.get(gate)?.state ?? "open" : "skip"),
+        priorGraph: rehashAt !== undefined && [...outcomes.values()].some((outcome) => outcome.eventIndex < rehashAt),
+    };
 };
+export const gateStates = (task, events) => gateSnapshot(task, events).states;
 // verdict semantics only: pass brand green, fail red, skip/open dim chrome — everything else stays quiet
 const GATE_STATE_TOKEN = { pass: ok, fail, skip: dim, open: dim };
 // TTY cells are bare glyphs in fixed GATE_NAMES order — gate identity lives once in the frame
@@ -220,6 +226,24 @@ const liveness = (events, now = Date.now()) => {
     } // EPERM ⇒ alive
     return `last event ${age} ago · daemon pid ${pid} ${state}${cause ? ` · ${cause}` : ""}`;
 };
+// Resume's shared comparator remains the fail-closed baseline. Status may additionally accept the
+// daemon's audited graph-rehash release, but only when its `from` names that baseline identity (or
+// null for an explicitly released legacy journal) and its `to` names the graph loaded now.
+const statusEngagement = (events, loadedHash) => {
+    const baseline = engagementComparable(events, loadedHash);
+    for (let i = events.length - 1; i >= 0; i--) {
+        const event = events[i];
+        if (event.event !== "graph-rehash")
+            continue;
+        const auditsBaseline = baseline.comparable || baseline.reason === "mismatch"
+            ? event.data.from === baseline.recorded
+            : event.data.from === null;
+        return event.data.to === loadedHash && auditsBaseline
+            ? { comparable: true, rehashAt: i }
+            : { comparable: false };
+    }
+    return { comparable: baseline.comparable };
+};
 const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness = new Map()) => {
     const g = loadGraph(cwd);
     const runId = Journal.latestRunId(cwd, { withJournal: true });
@@ -228,16 +252,18 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
     let events = [];
     const contexts = new Map();
     let comparable = false;
+    let rehashAt;
     let supersededBy; // v1.53 T5: this run is dead — a newer run replaced it
     if (runId) {
         const j = Journal.open(cwd, runId);
         events = j.read();
         const sup = [...events].reverse().find((e) => e.event === "superseded" && typeof e.data.by === "string");
         supersededBy = sup?.data.by;
-        // T3 (Sol #2 / Fable F2): the SAME comparator resume uses (engagementComparable) — one decision,
-        // two consumers. graphDefinitionHash (compiled task definitions only) survives status/evidence
-        // mutation but changes when a task definition changes, so a recompiled graph is detected here too.
-        comparable = engagementComparable(events, graphDefinitionHash(g)).comparable;
+        // The resume comparator is the fail-closed baseline; a matching graph-rehash is the daemon's
+        // append-only audit that authorizes this status replay after stop-amend-resume.
+        const engagement = statusEngagement(events, graphDefinitionHash(g));
+        comparable = engagement.comparable;
+        rehashAt = engagement.rehashAt;
         if (comparable) {
             replayed = j.replayStatuses();
             for (const e of events) {
@@ -285,15 +311,18 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
         const channel = assignments.get(t.id) ?? "-";
         const ctx = contexts.get(t.id);
         const assignCol = ctx !== undefined ? `${channel}${divider}ctx ${ctx}` : channel;
-        return { t, st, failureKind, redTier, label, assignCol, isStarved, phrase, channel, ctx, livePhase, states: comparable ? gateStates(t, events) : defaultGateStates(t) };
+        const gates = comparable
+            ? gateSnapshot(t, events, rehashAt)
+            : { states: defaultGateStates(t), priorGraph: false };
+        return { t, st, failureKind, redTier, label, assignCol, isStarved, phrase, channel, ctx, livePhase, ...gates };
     });
     if (!unicode) {
         // machine/CI surface — journals without phase-start stay byte-identical; new phase-aware frames
         // use an ASCII spinner so pipes never receive terminal-only braille/ANSI.
-        const rows = cells.map(({ t, st, label, assignCol, livePhase, states }) => {
+        const rows = cells.map(({ t, st, label, assignCol, livePhase, states, priorGraph }) => {
             const chain = gateChain(states, false);
             const prefix = livePhase ? `  ${ASCII_SPINNER[animationFrame % ASCII_SPINNER.length]} ${t.id} ` : `  ${taskBox(st)} ${t.id} `;
-            const suffix = `  ${chain}  ${livePhase ? "running" : String(st)}${label}  ${assignCol}`;
+            const suffix = `  ${chain}${priorGraph ? ` ${PRIOR_GRAPH_MARKER}` : ""}  ${livePhase ? "running" : String(st)}${label}  ${assignCol}`;
             return `${prefix}${shortGoal(t.goal, Math.max(0, width - prefix.length - suffix.length))}${suffix}`;
         });
         const header = runId
@@ -348,7 +377,7 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
     const goalW = Math.max(8, ...goals.map((s) => s.length));
     const indent = " ".repeat(idW + 5); // line 2 starts under the goal column
     const rows = cells.map((c, i) => {
-        const { t, st, failureKind, redTier, states, isStarved, phrase, channel, ctx, livePhase } = c;
+        const { t, st, failureKind, redTier, states, priorGraph, isStarved, phrase, channel, ctx, livePhase } = c;
         const word = statusWord(c);
         const staleWorker = livePhase?.phase === "worker"
             && workerOutputAge(livePhase, now, workerLiveness.get(t.id)) >= 60_000;
@@ -366,6 +395,7 @@ const renderFrame = (cwd, now = Date.now(), animationFrame = 0, workerLiveness =
             : `  ${statusRow(taskVerdict(c), taskLabel)}`;
         // activity already names its channel for in-flight attempts — never repeat it
         const detail = [
+            ...(priorGraph ? [PRIOR_GRAPH_MARKER] : []),
             ...(phrase ? [phrase, ...(phrase.includes(channel) || channel === "-" ? [] : [channel])] : [channel]),
             ...(failureKind && !phrase?.includes(failureKind) ? [failureKind] : []),
             ...(ctx !== undefined ? [`ctx ${ctx}`] : []),

package/dist/drivers/herdr.d.ts

@@ -14,6 +14,7 @@ export declare class HerdrDriver implements ExecutorDriver {
     private deliverySerial;
     private dispatchLeases;
     private deliveredPanes;
+    private inputBoxes;
     private ws;
     private callerPane;
     private watches;
@@ -39,6 +40,7 @@ export declare class HerdrDriver implements ExecutorDriver {
     private joinGroup;
     run(slot: Slot, cmd: string): Promise<void>;
     private deliver;
+    private settleDeliveryLine;
     private deliveryReadMatches;
     private waitOk;
     waitOutput(slot: Slot, pattern: string, timeoutMs: number, opts?: {

package/dist/drivers/herdr.js

@@ -1,4 +1,4 @@
-import { shq } from "../adapters/types.js";
+import { declaredInputBoxForWorkerName, matchesInputBox, shq } from "../adapters/types.js";
 import { PANE_IDENTITY_ENV, paneIdentityLine } from "../brand.js";
 import { createWorktree, sh } from "../run/git.js";
 import { herdrSealShellPrefix } from "./subprocess.js";
@@ -10,6 +10,8 @@ export const TRAILER_WIDTH_MARGIN = 2; // cols below (floor + margin) refuse a r
 export const DELIVERY_ATTEMPTS = 3;
 const DELIVERY_VERIFY_TIMEOUT_MS = 2000; // per attempt — a paste that hasn't rendered in 2s is retyped
 const DELIVERY_READ_LINES = 80;
+const DELIVERY_SETTLE_READ_ATTEMPTS = 6;
+const DELIVERY_SETTLE_POLL_MS = 100;
 /** First-generation join direction from measured trailer-safe floor (43-MEASUREMENT.md). */
 export function workerSplitDirection(paneCols, safeFloor = TRAILER_SAFE_FLOOR_COLS, margin = TRAILER_WIDTH_MARGIN) {
     if (paneCols == null || paneCols <= 0)
@@ -30,6 +32,7 @@ export class HerdrDriver {
     deliverySerial = Promise.resolve();
     dispatchLeases = new WeakMap();
     deliveredPanes = new WeakMap();
+    inputBoxes = new WeakMap();
     // VIS-10: the run's workspace id, captured once at construction (the daemon inherits it from the
     // operator's env before the driver is built). Required at slot() time, never in the constructor —
     // pickDriver and its unit test construct HerdrDriver without env, so slot() is the trust gate.
@@ -140,6 +143,7 @@ export class HerdrDriver {
         }
     }
     async slot(cwd, name, opts) {
+        const inputBox = declaredInputBoxForWorkerName(name);
         // T1 ownership contract: `opts.owned` (T2 call sites) names the pane canonically —
         // tickmarkr:<role>:<taskId>:<attempt>:<runId>. Without it, `name` passes through byte-identical
         // (today's legacy daemon/gates/consult shapes) — canonicalizeLegacyName (types.ts) is what lets
@@ -152,12 +156,13 @@ export class HerdrDriver {
         // Production dispatch names are canonical even when the gate call site supplies the already-
         // formatted name rather than SlotOpts.owned. Hold one lease across slot() → run(); legacy/manual
         // slots retain their existing allocation-only semantics for compatibility.
-        if (parseOwnedName(resolved))
-            return this.reserveDispatch(allocate);
+        const slot = parseOwnedName(resolved) ? await this.reserveDispatch(allocate) : await allocate();
+        if (inputBox)
+            this.inputBoxes.set(slot, inputBox);
         // group wins if both are set (a group tab is already stage-labeled; passing both is a caller bug).
         // label (without group) → dedicated labeled tab via tabSlot's third param: no groups-map entry, no
         // refcount, no groupSerial, no degrade latch — dedicated tabs have no shared state to guard (SUP-01).
-        return allocate(); // label undefined → defaults to name (today's behavior)
+        return slot; // label undefined → defaults to name (today's behavior)
     }
     // today's per-slot tab path, plus the VIS-04 orphan reap
     // label defaults to the slot name; group tabs pass the STAGE name instead — a first-member label
@@ -391,11 +396,23 @@ export class HerdrDriver {
         let transcript = "";
         for (let attempt = 0; attempt < DELIVERY_ATTEMPTS; attempt++) {
             if (attempt > 0) {
-                // clear the corrupted input line before retyping; a failed clear must NOT be retyped onto —
-                // corrupt-prefix + clean-retype would concatenate and false-verify by containment
-                const cleared = await this.herdr(`pane send-keys ${shq(pane)} C-u`, slot.cwd);
-                if (cleared.code !== 0)
+                // A TUI may still be painting while the failed delivery is captured (OBS-135). Judge the
+                // line only after two consecutive pane reads agree; an already-stable frame returns on the
+                // first fresh read without a timer. A changing pane is bounded and preserves OBS-85's
+                // fail-closed error instead of guessing from an adapter fingerprint.
+                const settled = await this.settleDeliveryLine(pane, slot.cwd, transcript, this.inputBoxes.get(slot));
+                transcript = settled.transcript;
+                if (!settled.ok) {
                     throw new Error(`herdr delivery clear failed — refusing to retype onto a corrupted line (OBS-85); pane transcript:\n${transcript}`);
+                }
+                if (!settled.recognizedInputBox) {
+                    // Clear the corrupted shell input line before retyping; a failed clear must NOT be retyped
+                    // onto — corrupt-prefix + clean-retype would concatenate and false-verify by containment.
+                    // A stable adapter-declared input box is already an empty legitimate delivery target.
+                    const cleared = await this.herdr(`pane send-keys ${shq(pane)} C-u`, slot.cwd);
+                    if (cleared.code !== 0)
+                        throw new Error(`herdr delivery clear failed — refusing to retype onto a corrupted line (OBS-85); pane transcript:\n${transcript}`);
+                }
             }
             const typed = await this.herdr(`pane send-text ${shq(pane)} ${shq(cmd)}`, slot.cwd);
             if (typed.code !== 0)
@@ -412,6 +429,26 @@ export class HerdrDriver {
         }
         throw new Error(`herdr delivery corrupted after ${DELIVERY_ATTEMPTS} attempts — enter never pressed (OBS-85); pane transcript:\n${transcript}`);
     }
+    async settleDeliveryLine(pane, cwd, initialTranscript, inputBox) {
+        let transcript = initialTranscript;
+        for (let readAttempt = 0; readAttempt < DELIVERY_SETTLE_READ_ATTEMPTS; readAttempt++) {
+            const read = await this.herdr(`pane read ${shq(pane)} --source recent-unwrapped --lines ${DELIVERY_READ_LINES}`, cwd);
+            if (read.code !== 0)
+                return { ok: false, transcript: read.stdout || transcript, recognizedInputBox: false };
+            if (read.stdout === transcript) {
+                return {
+                    ok: true,
+                    transcript,
+                    recognizedInputBox: inputBox !== undefined && matchesInputBox(transcript, inputBox),
+                };
+            }
+            transcript = read.stdout;
+            if (readAttempt < DELIVERY_SETTLE_READ_ATTEMPTS - 1) {
+                await new Promise((resolve) => setTimeout(resolve, DELIVERY_SETTLE_POLL_MS));
+            }
+        }
+        return { ok: false, transcript, recognizedInputBox: false };
+    }
     async deliveryReadMatches(pane, cmd, cwd) {
         const read = await this.herdr(`pane read ${shq(pane)} --source recent-unwrapped --lines ${DELIVERY_READ_LINES}`, cwd);
         return read.code === 0 && this.deliveryMatches(read.stdout, cmd);

package/dist/gates/acceptance.js

@@ -172,6 +172,22 @@ function compressLines(lines) {
     }
     return parts.join(", ");
 }
+// OBS-134: whole-file deletions are already fully described by their path. Sending every removed line
+// spends the cap and judge context on content that cannot exist after the change. Added and modified
+// sections pass through byte-for-byte, so their anti-flooding budget is unchanged.
+function judgeRelevantDiff(diff) {
+    return diff.split(/(?=^diff --git )/m).map((section) => {
+        if (!/^deleted file mode /m.test(section))
+            return section;
+        const oldPath = /^--- (.+)$/m.exec(section)?.[1]
+            ?? /^Binary files (.+) and \/dev\/null differ$/m.exec(section)?.[1];
+        if (!oldPath || oldPath === "/dev/null")
+            return section;
+        const unquoted = oldPath.startsWith('"') && oldPath.endsWith('"') ? oldPath.slice(1, -1) : oldPath;
+        const path = unquoted.replace(/^a\//, "");
+        return `deleted file: ${path}\n`;
+    }).join("");
+}
 // A citation is valid evidence iff the cited line falls inside a changed hunk of the cited file (OBS-129:
 // changed-hunk span, not exact-added-line). A legacy free-text quote (string) keeps v1.64's substring
 // check — non-empty and present somewhere in the diff.
@@ -225,7 +241,9 @@ export async function acceptanceGate(task, worktree, baseRef, judge, via, opts =
     const warn = onlyJudge
         ? "WARNING: only judge oracles — no deterministic command/test oracle guards this task (deterministic preferred, spec §2).\n"
         : "";
-    const { full: diff, forCap } = await fetchTaskDiff(worktree, baseRef);
+    const fetched = await fetchTaskDiff(worktree, baseRef);
+    const diff = judgeRelevantDiff(fetched.full);
+    const forCap = judgeRelevantDiff(fetched.forCap);
     const diffCap = opts.diffCap ?? DEFAULT_DIFF_CAP;
     const capFail = checkDiffCap("acceptance", forCap.length, diffCap, warn + detBlock);
     if (capFail)

package/dist/gates/llm.d.ts

@@ -26,6 +26,10 @@ export interface GateVia {
     nameFor: (role: "judge" | "review", adapter: string) => string;
     labelFor: (role: "judge" | "review") => string;
 }
+export declare function captureLlmOutput<T>(run: () => Promise<T>): Promise<{
+    value: T;
+    outputs: string[];
+}>;
 export declare function runHeadless(adapter: WorkerAdapter, model: string, prompt: string, cwd: string, timeoutMs?: number): Promise<string>;
 export declare function runViaDriver(adapter: WorkerAdapter, model: string, prompt: string, cwd: string, via: LlmVia, timeoutMs?: number): Promise<string>;
 export declare function runLlm(adapter: WorkerAdapter, model: string, prompt: string, cwd: string, via?: LlmVia, timeoutMs?: number): Promise<string>;

package/dist/gates/llm.js

@@ -1,3 +1,4 @@
+import { AsyncLocalStorage } from "node:async_hooks";
 import { randomBytes } from "node:crypto";
 import { mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -82,6 +83,16 @@ export function rolePaneNameFromPrompt(prompt, fallback) {
         return gatePaneName("review", id, retry ? "-r1" : "");
     return fallback;
 }
+const llmOutputCapture = new AsyncLocalStorage();
+// OBS-132: acceptance.ts owns verdict parsing and is deliberately byte-untouched. This async-scoped
+// recorder lets run-gates observe the exact output that acceptance parsed without changing runLlm's
+// return value or leaking concurrent tasks into one another. Callers retain output only when the
+// resulting verdict is a production failure; healthy output is discarded in memory.
+export async function captureLlmOutput(run) {
+    const outputs = [];
+    const value = await llmOutputCapture.run(outputs, run);
+    return { value, outputs };
+}
 export async function runHeadless(adapter, model, prompt, cwd, timeoutMs = 300000) {
     const pf = join(mkdtempSync(join(tmpdir(), "tickmarkr-llm-")), "prompt.md");
     writeFileSync(pf, prompt);
@@ -119,10 +130,12 @@ export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs =
     out = augmentFakeVerdictOutput(adapter, out, nonce, prompt);
     return out;
 }
-export function runLlm(adapter, model, prompt, cwd, via, timeoutMs = 300000) {
-    return via
+export async function runLlm(adapter, model, prompt, cwd, via, timeoutMs = 300000) {
+    const out = await (via
         ? runViaDriver(adapter, model, prompt, cwd, via, timeoutMs)
-        : runHeadless(adapter, model, prompt, cwd, timeoutMs);
+        : runHeadless(adapter, model, prompt, cwd, timeoutMs));
+    llmOutputCapture.getStore()?.push(out);
+    return out;
 }
 export function extractJson(raw) {
     const fenced = [...raw.matchAll(/```json\s*\n([\s\S]*?)```/g)].at(-1);

package/dist/gates/run-gates.d.ts

@@ -2,7 +2,7 @@ import { type Assignment, type BillingChannel, type WorkerAdapter, type WorkerRe
 import { type TickmarkrConfig } from "../config/config.js";
 import { type GateName, type Task } from "../graph/schema.js";
 import { type Baseline } from "./baseline.js";
-import type { GateVia } from "./llm.js";
+import { type GateVia } from "./llm.js";
 import type { GateResult } from "./types.js";
 export type GateEvent = {
     phase: "start";

package/dist/gates/run-gates.js

@@ -5,9 +5,11 @@ import { GATE_NAMES } from "../graph/schema.js";
 import { acceptanceGate } from "./acceptance.js";
 import { compareToBaseline } from "./baseline.js";
 import { evidenceGate } from "./evidence.js";
+import { captureLlmOutput } from "./llm.js";
 import { marginalCostRank } from "../route/router.js";
 import { reviewGate } from "./review.js";
 import { scopeGate } from "./scope.js";
+import { withJudgeInvocationEvidence } from "../run/journal.js";
 export async function runGates(task, ctx) {
     const results = [];
     let commits = [];
@@ -63,7 +65,27 @@ export async function runGates(task, ctx) {
             : undefined;
         // v1.19 (T2): testCmd threads the detected test runner to the gate so named-test oracles run
         // deterministically (filtered via -t) before any LLM judge dispatch.
-        let a = await acceptanceGate(task, ctx.worktree, ctx.baseRef, { adapter: judgeAdapter, model: ctx.cfg.judge.model }, jvia, { testCmd: ctx.commands.test, diffCap: ctx.cfg.gates.diffCap });
+        const invocations = [];
+        const invokeJudge = async (adapter, model, via) => {
+            const started = Date.now();
+            const captured = await captureLlmOutput(() => acceptanceGate(task, ctx.worktree, ctx.baseRef, { adapter, model }, via, { testCmd: ctx.commands.test, diffCap: ctx.cfg.gates.diffCap }));
+            const channel = channelKey({ adapter: adapter.id, model });
+            const unparseable = captured.value.meta?.unparseable === true;
+            // acceptanceGate has exactly one runLlm call. Keep the map shape so a future deterministic early
+            // return (zero outputs) stays telemetry-free instead of manufacturing a judge invocation.
+            for (const output of captured.outputs) {
+                invocations.push({
+                    taskId: task.id,
+                    channel,
+                    outcome: unparseable ? "failed" : "done",
+                    judgeOutcome: unparseable ? "unparseable" : "parseable",
+                    durationMs: Date.now() - started,
+                    ...(unparseable ? { transcript: output } : {}),
+                });
+            }
+            return captured.value;
+        };
+        let a = await invokeJudge(judgeAdapter, ctx.cfg.judge.model, jvia);
         // GATE-09: an unparseable judge verdict retries the JUDGE exactly once on a failover channel — never
         // the worker (run-20260711-185020 P43-03 L70-72 billed a judge flake as a worker attempt). The flaked
         // first verdict NEVER enters results (no false gate-result journal event, no operator notify, no stale
@@ -96,10 +118,10 @@ export async function runGates(task, ctx) {
                 ? { driver: ctx.via.driver, keep: ctx.via.keep, onSlot: ctx.via.onSlot, name: ctx.via.nameFor("judge", retryAdapter.id) + "-r1", label: ctx.via.labelFor("judge") }
                 : undefined;
             // the retry IS a second acceptanceGate call: one code path, one parser, zero new parse leniency.
-            a = await acceptanceGate(task, ctx.worktree, ctx.baseRef, { adapter: retryAdapter, model: retry.model }, retryJvia, { testCmd: ctx.commands.test, diffCap: ctx.cfg.gates.diffCap });
+            a = await invokeJudge(retryAdapter, retry.model, retryJvia);
             a = { ...a, meta: { ...a.meta, judgeRetry: { flaked: flakedKey, retried: channelKey({ adapter: retry.adapter, model: retry.model }) } } };
         }
-        await record(a);
+        await withJudgeInvocationEvidence(invocations, () => record(a));
         if (failed())
             return { results, commits };
     }

package/dist/run/journal.d.ts

@@ -92,8 +92,22 @@ export declare const TelemetryRowSchema: z.ZodObject<{
         vacuous: "vacuous";
         skipped: "skipped";
     }>>;
+    kind: z.ZodOptional<z.ZodLiteral<"judge">>;
+    judgeOutcome: z.ZodOptional<z.ZodEnum<{
+        parseable: "parseable";
+        unparseable: "unparseable";
+    }>>;
 }, z.core.$strip>;
 export type TelemetryRow = z.infer<typeof TelemetryRowSchema>;
+export interface JudgeInvocationEvidence {
+    taskId: string;
+    channel: string;
+    outcome: "done" | "failed";
+    judgeOutcome: "parseable" | "unparseable";
+    durationMs: number;
+    transcript?: string;
+}
+export declare function withJudgeInvocationEvidence<T>(invocations: JudgeInvocationEvidence[], persist: () => Promise<T>): Promise<T>;
 export declare const SIGNAL_BASIS: readonly ["proved", "review-agree", "judge-only", "legacy", "vacuous", "skipped"];
 export type SignalBasis = (typeof SIGNAL_BASIS)[number];
 export declare const SIGNAL_QUALITY: Record<SignalBasis, 0 | 0.25 | 0.5 | 0.75 | 1>;
@@ -154,4 +168,5 @@ export declare class Journal {
     replayExcludedChannels(): Set<string>;
     telemetry(row: TelemetryRow): void;
     readTelemetry(): TelemetryRow[];
+    readJudgeTelemetry(): TelemetryRow[];
 }

package/dist/run/journal.js

@@ -1,3 +1,4 @@
+import { AsyncLocalStorage } from "node:async_hooks";
 import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
@@ -141,7 +142,19 @@ export const TelemetryRowSchema = z.object({
     // v1.46 additive (T5): gate-signal quality for routing hygiene — OPTIONAL, absent = legacy (0.25 at fold).
     signalQuality: z.union([z.literal(0), z.literal(0.25), z.literal(0.5), z.literal(0.75), z.literal(1)]).optional(),
     signalBasis: z.enum(["proved", "review-agree", "judge-only", "legacy", "vacuous", "skipped"]).optional(),
+    // OBS-132 additive judge invocation rows. Absent means the legacy per-task row. Judge rows reuse the
+    // required v1.5 envelope so per-run raw readers stay source-compatible, while readAllTelemetry filters
+    // them before profile derivation: verdict production must be observable without becoming worker reward.
+    kind: z.literal("judge").optional(),
+    judgeOutcome: z.enum(["parseable", "unparseable"]).optional(),
 });
+const judgePersistence = new AsyncLocalStorage();
+// run-gates scopes this context around the existing daemon onGate callback. Journal.append therefore
+// remains the sole persistence boundary: it can enrich the existing judge-retry row and write invocation
+// telemetry without requiring a parallel daemon callback or changing healthy gate-result payloads.
+export function withJudgeInvocationEvidence(invocations, persist) {
+    return judgePersistence.run({ invocations, written: false }, persist);
+}
 // v1.46 T5 (Sol signal telemetry): gate-result rows carry explicit signalQuality so future defect windows
 // are identifiable without forensics. Basis is the provenance claim; quality is the dyadic h-fold weight.
 export const SIGNAL_BASIS = ["proved", "review-agree", "judge-only", "legacy", "vacuous", "skipped"];
@@ -259,7 +272,7 @@ export function readAllTelemetry(repoRoot, lastK, opts = {}) {
     for (const runId of runIds) {
         for (const raw of readJsonl(join(dir, runId, "telemetry.jsonl"))) {
             const r = TelemetryRowSchema.safeParse(raw);
-            if (r.success)
+            if (r.success && r.data.kind !== "judge")
                 out.push({ ...r.data, runId });
         }
     }
@@ -358,7 +371,18 @@ export class Journal {
         return join(this.dir, "journal.jsonl");
     }
     append(event, taskId, data = {}) {
-        const row = { ts: new Date().toISOString(), event, ...(taskId ? { taskId } : {}), data };
+        const evidence = judgePersistence.getStore();
+        const failed = evidence?.invocations.filter((invocation) => invocation.transcript !== undefined) ?? [];
+        const persistedData = event === "judge-retry" && failed.length > 0
+            ? {
+                ...data,
+                transcript: failed[0].transcript,
+                ...(failed[1] ? { retryTranscript: failed[1].transcript } : {}),
+            }
+            : data;
+        const row = {
+            ts: new Date().toISOString(), event, ...(taskId ? { taskId } : {}), data: persistedData,
+        };
         // T3 secret redaction: only the persisted bytes are masked — the caller's data stays untouched in
         // memory. The narrator receives the persisted (masked) row so a pane sink never shows a credential.
         const line = redactSecrets(JSON.stringify(row));
@@ -369,6 +393,26 @@ export class Journal {
         catch {
             // narration is observational; a broken sink must not affect the journal or run
         }
+        if (evidence && !evidence.written && (event === "judge-retry" || event === "gate-result")) {
+            evidence.written = true;
+            for (const invocation of evidence.invocations) {
+                const colon = invocation.channel.indexOf(":");
+                const adapter = colon === -1 ? invocation.channel : invocation.channel.slice(0, colon);
+                const model = colon === -1 ? "" : invocation.channel.slice(colon + 1);
+                this.telemetry({
+                    kind: "judge",
+                    taskId: invocation.taskId,
+                    shape: "judge",
+                    adapter,
+                    model,
+                    channel: invocation.channel,
+                    attempts: 1,
+                    outcome: invocation.outcome,
+                    durationMs: invocation.durationMs,
+                    judgeOutcome: invocation.judgeOutcome,
+                });
+            }
+        }
     }
     phaseStart(taskId, phase, data = {}) {
         this.append("phase-start", taskId, { ...data, phase });
@@ -506,8 +550,15 @@ export class Journal {
         // T3 secret redaction: same persistence seam as append — credential-free rows are byte-identical.
         appendFileSync(join(this.dir, "telemetry.jsonl"), redactSecrets(JSON.stringify(row)) + "\n");
     }
-    // Per-run, raw (NOT schema-validated) — report.ts reads v1.5 core fields; stays byte-compatible.
+    // Per-run task rows stay byte-compatible for legacy readers (report and task-level test helpers).
+    // Judge rows share telemetry.jsonl but have a dedicated reader so their earlier gate-time ordering
+    // cannot make a find(taskId) caller mistake invocation evidence for the later terminal task row.
     readTelemetry() {
-        return readJsonl(join(this.dir, "telemetry.jsonl"));
+        return readJsonl(join(this.dir, "telemetry.jsonl"))
+            .filter((row) => !(row && typeof row === "object" && "kind" in row && row.kind === "judge"));
+    }
+    readJudgeTelemetry() {
+        return readJsonl(join(this.dir, "telemetry.jsonl"))
+            .filter((row) => row && typeof row === "object" && "kind" in row && row.kind === "judge");
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.73.0",
+  "version": "1.75.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-auto/SKILL.md

@@ -15,8 +15,9 @@ When working in a multi-agent terminal environment, decide your role before star
 - **Orchestrator:** your session was started to execute the mission. Rename your own tab/pane `ORCH · <version>` (short labels: ≤20 chars, `ROLE · token`) and run the loop below.
 - **Supervisor with a live orchestrator:** do not start a second run. Relay the mission to the existing orchestrator with a [verified handoff](#verified-handoffs-agent-to-agent-messaging), then supervise it as OVERSEER.
 - **Primary session without an orchestrator:** rename your own tab `OVERSEER · <version>` and your agent `overseer`, spawn one child orchestration session with your host's launch form, label its tab `ORCH · <version>` and name its agent, give it the mission and these rules verbatim, then supervise it. Do not drive a duplicate single-tier run yourself. Before spawning, confirm any PREVIOUS orchestrator has stood down (monitors stopped, input box empty — dim ghost-text suggestions are UI, not queued input; ANSI-verify before alarming) and close its tab — the journal, records, and ledger hold the story; scrollback is disposable.
-  - **Claude Code:** `herdr agent start orchestrator --cwd <repo> --no-focus -- claude --permission-mode bypassPermissions`
-  - **Codex:** `herdr agent start orchestrator --cwd <repo> --no-focus -- codex --dangerously-bypass-approvals-and-sandbox` — the unsandboxed flag is REQUIRED, not optional: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation (`git worktree add` cannot lock the ref). Do not downgrade this flag; the herdr pane and repo scope are the containment.
+  - **Spawning on current herdr is two-step** — the one-shot `agent start --cwd/--tab/--no-focus` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138). First create the pane: `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` (tab create does not steal focus unless `--focus` is passed; parse `result.root_pane.pane_id` from its JSON), then start the agent in it:
+  - **Claude Code:** `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions`
+  - **Codex:** `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` — the unsandboxed flag is REQUIRED, not optional: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation (`git worktree add` cannot lock the ref). Do not downgrade this flag; the herdr pane and repo scope are the containment.
   - **Auxiliary agents you spawn (consultants, reviewers, scouts) follow the same forms.** Never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions` (tickmarkr's own adapter uses exactly this for workers, judges, and consults). A read-only codex consultant may use `--sandbox read-only`; any codex session that must touch git needs the unsandboxed flag above.
 
 Outside a multi-agent terminal environment, run the loop directly.

package/skills/tickmarkr-loop/SKILL.md

@@ -14,8 +14,9 @@ When working in a multi-agent terminal environment, decide your role before star
 - **Orchestrator:** your session was started to execute the mission. Rename your own tab/pane `ORCH · <version>` (short labels: ≤20 chars, `ROLE · token`) and run the loop below.
 - **Supervisor with a live orchestrator:** do not start a second run. Relay the mission to the existing orchestrator with a [verified handoff](#verified-handoffs-agent-to-agent-messaging), then supervise it as OVERSEER.
 - **Primary session without an orchestrator:** rename your own tab `OVERSEER · <version>` and your agent `overseer`, spawn one child orchestration session with your host's launch form, label its tab `ORCH · <version>` and name its agent, give it the mission and these rules verbatim, then supervise it. Do not drive a duplicate single-tier run yourself. Before spawning, confirm any PREVIOUS orchestrator has [stood down](#stand-down-mission-end-and-retirement) and close its tab.
-  - **Claude Code:** `herdr agent start orchestrator --cwd <repo> --no-focus -- claude --permission-mode bypassPermissions`
-  - **Codex:** `herdr agent start orchestrator --cwd <repo> --no-focus -- codex --dangerously-bypass-approvals-and-sandbox` — the unsandboxed flag is REQUIRED, not optional: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation (`git worktree add` cannot lock the ref). Do not downgrade this flag; the herdr pane and repo scope are the containment.
+  - **Spawning on current herdr is two-step** — the one-shot `agent start --cwd/--tab/--no-focus` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138). First create the pane: `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` (tab create does not steal focus unless `--focus` is passed; parse `result.root_pane.pane_id` from its JSON), then start the agent in it:
+  - **Claude Code:** `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions`
+  - **Codex:** `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` — the unsandboxed flag is REQUIRED, not optional: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation (`git worktree add` cannot lock the ref). Do not downgrade this flag; the herdr pane and repo scope are the containment.
   - **Auxiliary agents you spawn (consultants, reviewers, scouts) follow the same forms.** Never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions` (tickmarkr's own adapter uses exactly this for workers, judges, and consults). A read-only codex consultant may use `--sandbox read-only`; any codex session that must touch git needs the unsandboxed flag above.
 
 Outside a multi-agent terminal environment, run the loop directly.

package/skills/tickmarkr-overseer/SKILL.md

@@ -29,7 +29,7 @@ Requires `HERDR_ENV=1`; if unset, say so and stop.
    main name plus at most ONE hot-state token. Vocabulary: ORCH carries the milestone and progress
    fraction (`ORCH · v1.19 4/5`, updated on every task-done); WORKERS carries the task token (tickmarkr
    updates it). Never long context strings or ✓-chains.
-2. **Orchestrator**: Launch the orchestrator with your agent host. For Claude Code, use `herdr agent start orchestrator --cwd <repo> --no-focus -- claude --permission-mode bypassPermissions` (pin a strong model with `--model <m>` if the operator has a policy). For Codex, use `herdr agent start orchestrator --cwd <repo> --no-focus -- codex --dangerously-bypass-approvals-and-sandbox` (add `--model <m>` to specify the model). The unsandboxed flag is REQUIRED: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation — do not downgrade it. Workers you never spawn — tickmarkr spawns its own visible worker panes. Auxiliary agents you do spawn (consultants, reviewers, scouts) follow the same forms: never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions`, and a read-only codex consultant may use `--sandbox read-only`.
+2. **Orchestrator**: Launch the orchestrator with your agent host. Spawning on current herdr is two-step — the one-shot `agent start --cwd` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138): first create the pane with `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` and parse `result.root_pane.pane_id` from its JSON, then start the agent in it. For Claude Code, use `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions` (append `--model <m>` after the `--` if the operator has a policy). For Codex, use `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` (add `--model <m>` to specify the model). The unsandboxed flag is REQUIRED: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation — do not downgrade it. Workers you never spawn — tickmarkr spawns its own visible worker panes. Auxiliary agents you do spawn (consultants, reviewers, scouts) follow the same forms: never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions`, and a read-only codex consultant may use `--sandbox read-only`.
 3. **Standing instructions travel as a brief FILE, never as pane text** — PTY input truncates at ~1024B and a
    truncated brief silently drops policy. Write the full brief to `<repo>/.tickmarkr/overseer/ORCH-BRIEF.md`
    (inside the tickmarkr state dir — already self-gitignored, no exclude step needed), then send one line: