tickmarkr 1.84.0 → 1.86.0

package/skills/tickmarkr-overseer/SKILL.md

@@ -22,12 +22,26 @@ Requires `HERDR_ENV=1`; if unset, say so and stop.
    status, and either ADOPT the
    existing orchestrator (updated brief, re-armed watchers) or, if the old hierarchy is dead, archive the
    stale brief and build fresh.
+0a. **READ THE PROJECT MEMORY BEFORE YOU START — it already contains discipline you are about to re-earn.**
+   `~/.claude/projects/<cwd-slug>/memory/` (slug = the absolute cwd with `/` → `-`). Read `MEMORY.md`, then
+   `ls` the topic entries and open every one whose name concerns METHOD or DISCIPLINE rather than a shipped
+   milestone — names like `*-discipline`, `*-drill`, `*-parity`, `*-least-permission`, `context-reset-*`,
+   `consults-*`, `agent-*`.
+   **Earned 2026-08-04, expensively.** That directory held `…-falsification-drill-discipline.md`, written
+   three weeks earlier: *"a gate or grep-pin is assumed WRONG until a falsification drill proves it bites…
+   run the drill that should redden it and SEE the red before trusting green."* That is Evidence discipline
+   rule 11 below, verbatim in substance. Nothing surfaced it, so an orchestrator and an overseer re-derived
+   it independently, twice, inside one hour — and the overseer then filed it as a NEW rule into a
+   mission-scoped brief. **A memory that exists and is never opened costs more than one that was never
+   written, because everyone assumes the lesson is somewhere.** Entries may predate a project rename; search
+   by concept, not by the current product name.
 1. Load the `herdr` skill. `herdr pane list` to map the workspace — the focused pane is yours. Rename your
    tab OVERSEER; create ONE tab ORCHESTRATOR.
    **Live tab labels (standing operator rule, 2026-07-12):** on every decision or state change (role
    handoff, task done/merged, run end) rename the affected tabs — and keep labels SHORT: the role as the
    main name plus at most ONE hot-state token. Vocabulary: ORCH carries the milestone and progress
-   fraction (`ORCH · v1.19 4/5`, updated on every task-done); WORKERS carries the task token (tickmarkr
+   fraction (`ORCH · v1.19 4/5`, updated on every task-done); tickmarkr opens ONE TAB PER TASK, labelled
+   with the task id and holding that task's worker plus its judge/review/consult panes (tickmarkr
    updates it). Never long context strings or ✓-chains.
 2. **Orchestrator**: Launch the orchestrator with your agent host. Spawning on current herdr is two-step — the one-shot `agent start --cwd` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138): first create the pane with `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` and parse `result.root_pane.pane_id` from its JSON, then start the agent in it. For Claude Code, use `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions` (append `--model <m>` after the `--` if the operator has a policy). For Codex, use `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` (add `--model <m>` to specify the model). The unsandboxed flag is REQUIRED: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation — do not downgrade it. Workers you never spawn — tickmarkr spawns its own visible worker panes. Auxiliary agents you do spawn (consultants, reviewers, scouts) follow the same forms: never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions`, and a read-only codex consultant may use `--sandbox read-only`.
 3. **Standing instructions travel as a brief FILE, never as pane text** — PTY input truncates at ~1024B and a
@@ -35,32 +49,98 @@ Requires `HERDR_ENV=1`; if unset, say so and stop.
    (inside the tickmarkr state dir — already self-gitignored, no exclude step needed), then send one line:
    `herdr pane run <orch> "Read .tickmarkr/overseer/ORCH-BRIEF.md and follow it exactly."` The brief MUST contain: the
    mission, the pane mechanics below, rules 1–2, and require a verbatim one-sentence acknowledgment of the
-   human-checkpoint rule before anything is dispatched. Delete the dir at mission end.
+   human-checkpoint rule before anything is dispatched.
+   **⚠ HARVEST BEFORE YOU DELETE.** At mission end the brief dir goes — but a long mission accumulates
+   *method guards* in that brief (how to know a thing, not what is true of this spec), and deleting them
+   re-earns each one at full price on the next mission. So before removing the dir: lift every durable,
+   mission-independent guard into **this skill** (Evidence discipline, below) or the project's `CLAUDE.md`,
+   and only then delete. A guard's home must outlive the mission that earned it. The project ledger does
+   NOT count as that home — `CLAUDE.md` itself says planning records are read-only archives and current
+   guidance belongs in the memory file or the shipped docs.
 4. Arm the watcher (Supervision). Report the hierarchy map (pane ids + names) to the user.
 
-## Supervising tickmarkr as the executor
+## Supervising tickmarkr as the executor — WHO DOES WHAT
 
-When the mission runs `/tickmarkr-auto` (tickmarkr dispatches the workers), supervision changes shape:
+When the mission runs `/tickmarkr-auto` (tickmarkr dispatches the workers), supervision changes shape —
+and the first thing to get right is that **almost none of it is yours**.
 
-- **Give the run a live surface.** `tickmarkr run` is stdout-silent until run-end by design — split a pane in the
-  ORCHESTRATOR tab running `tickmarkr status --watch`. Narration also arrives as herdr notifications.
-- **Watch the journal, not the panes.** The append-only journal
-  (`.tickmarkr/runs/<runId>/journal.jsonl`) is the
-  source of truth. Arm a background watcher on `run-end` / `task-human` / `task-failed` / `consult-verdict`
-  events; never sleep-poll inside an agent turn.
+**THE ORCHESTRATOR OWNS THE LOOP. You rule and record. You do not drive.**
+
+| | ORCHESTRATOR | OVERSEER |
+|---|---|---|
+| `compile` · `plan` · `run` · `resume` | **owns** | never |
+| journal watchers, live surface, dialog watchers | **owns** | watches the ORCHESTRATOR, not the run |
+| orphan sweeps, worker pane hygiene | **owns** | — |
+| reading a gate failure and assembling its evidence | **owns** | reads the file it writes |
+| **deciding** a gate, spend, or ship | never | **owns** |
+| executing `tickmarkr approve` after a ruling | **owns** | never |
+| git writes, the ledger, records, the operator | never | **owns** |
+
+**Why this is a rule and not a preference — it has a measured cost.** On 2026-08-04 an OVERSEER ran the
+loop itself: compile, plan, run, resume, approve, sweeps, even source fixes. The operator caught it —
+*"you are doing the job of the orchestrator, the orchestrator is the one should be taking care of the
+gates"* — and the receipt was a pair of numbers: **the ORCHESTRATOR sat at 369K tokens while the OVERSEER
+burned 747K.** Collapsing two tiers into one does not just waste a seat; it **burns the context of the
+seat that cannot be replaced cheaply**, because the orchestrator can `/clear` against a brief while the
+overseer holds the mission's judgment. A tier collapse is therefore a context leak with a delay fuse.
+
+**The tell, and you will not notice it from inside:** if you are typing `tickmarkr resume`, or reading a
+journal tail to decide what happens next, or sweeping orphans — you have taken the loop. Hand it back.
+
+### What the ORCHESTRATOR does, and what you require of it
+
+- **A live surface.** `tickmarkr run` is stdout-silent until run-end by design, and the run spawns its own
+  watch board (`role: "watch"`, one per run) — **look for that pane before building anything.** Do NOT use
+  `tickmarkr status --watch` as the surface: `status <runId>` has reported the WRONG run, so a board built
+  on it shows a previous milestone's numbers under the current run's id.
+- **The journal is the source of truth**, not panes. Watchers go on `run-end` / `task-human` /
+  `task-failed` / `consult-verdict`; never sleep-poll inside an agent turn. **Never key a watcher on an
+  agent's `done`** — that is turn end and fires the moment a seat finishes acknowledging you.
 - **Daemon liveness ≠ journal activity.** A dead daemon emits no events, so journal watchers sleep through
-  its death. `tickmarkr status` prints last-event age + daemon pid liveness; check it before diagnosing a stall.
-  Recovery is `tickmarkr resume <runId>` — crash-safe by design (journal replay restores attempt counts and
-  consult channel bans).
-- **Gate quiet ≠ idle.** Between `worker-result` and the batched `gate-result`s tickmarkr runs shell gates plus a
-  headless LLM judge/review with little visible signal — check the journal timestamps before intervening.
-- **Classify gate failures before reacting.** The same fingerprint failing across DIFFERENT workers, or a
-  scope/test catch-22 (attempt N edits a file → scope gate fails; attempt N+1 leaves it → test gate fails),
-  is a PLAN defect: widen `files_modified` in the phase PLAN, recompile the phase dir after the run ends or
-  the task parks, release (`human → pending`), resume. A cross-vendor review rejection with concrete findings
-  is a REAL defect — let the escalation ladder work.
-- **Dialog watchers go stale per attempt.** Every retry/escalation may spawn a new pane; re-arm dialog
-  watchers on each `task-dispatch` journal event.
+  its death. Liveness comes from the lock's OWN pid (`kill -0`), never a command-name grep. Recovery is
+  `tickmarkr resume <runId>` — **the orchestrator's command, not yours** — and note that resume REPLAYS the
+  journal's `baseRef`, so a fix landed on the base branch is unreachable by the running run.
+- **Gate quiet ≠ idle.** Between `worker-result` and the batched `gate-result`s, shell gates plus a
+  headless judge/review run with little visible signal. Clock the CURRENT phase: a worker heartbeat is
+  stale by design once gates start, and clocking the wrong one makes a healthy gate read as a stalled
+  worker — the false alarm that gets a good run killed.
+- **Classify gate failures before reacting.** The same fingerprint across DIFFERENT workers, or a
+  scope/test catch-22 (attempt N edits a file → scope fails; attempt N+1 leaves it → test fails), is a
+  PLAN defect. So is any blocker OUTSIDE the task's `files[]` — no worker can fix it and a retry is
+  knowingly wasted. A cross-vendor review rejection with concrete findings is a REAL defect; let the
+  ladder work.
+- **Dialog watchers go stale per attempt.** Every retry may spawn a new pane; re-arm on each
+  `task-dispatch`.
+
+### What YOU do
+
+Read the evidence file the orchestrator writes, rule on it against your pre-committed release criterion,
+record the ruling with what it set aside, and hand the ruling back for execution. That is the whole job,
+and it is the only work that cannot be delegated — which is exactly why nothing else should occupy you.
+
+**And before you write the ruling: check that YOUR REMEDY is buildable inside the task's `files[]`.** The
+orchestrator is told to classify a blocker outside a task's scope as a plan defect. Nothing tells the
+OVERSEER that *its own instruction* can be that defect — so it arrives carrying your authority and is not
+re-examined.
+
+**Measured 2026-08-06.** A ruling directed a task to make a function parameter required. Verified
+afterwards: two callers pass one argument, in a file **no task in the graph owned**. The worker would have
+been trapped — edit it and fail `scope`, leave it and fail `build` — and the failure would have surfaced
+as a worker defect at the next park. Worse, the unowned file was exactly the relation that task existed to
+detect: **the ruling would have made the worker commit the violation the task was being built to catch.**
+
+> Run the callers before you write the remedy: locate the symbol, **enumerate** every caller and asserting
+> test, classify each against `files[]`, and resolve who owns the out-of-scope ones. A sweep for this class
+> then found **five of six remaining tasks exposed**, so it is a shape, not an accident.
+
+### Context is a supervised resource, for BOTH tiers
+
+Arm a context watcher on the orchestrator at spawn time and treat a threshold wake as a first-class event:
+finish the step, write a handoff, `/clear` **plus a fresh brief — never `/compact`**, because a compaction
+is a lossy summary nobody trusts while a clean session re-oriented from disk-verifiable state is reliable.
+**Do the same for yourself before you are forced to**: write the handoff while your judgment is still
+good, not after. If your own context cannot be read by the watcher, say so to the operator and ask for the
+number — an unmeasured budget is not a small budget.
 
 ## Pane mechanics that bite
 
@@ -71,8 +151,12 @@ When the mission runs `/tickmarkr-auto` (tickmarkr dispatches the workers), supe
 - **Guard-before-Enter** (race-safe prompt answering): chain with `&&` — pane get shows `blocked` && pane
   read shows the expected option under the cursor && only then send-keys. If no longer `blocked`, someone
   already answered; do nothing.
-- `herdr wait agent-status` exits 1 on timeout, 0 on match — but ALSO 0 (with an error JSON) when the pane is
-  GONE. Never chain `wait && act` without confirming the pane exists.
+- **A dead pane accepts your dispatch and reports success.** `herdr wait agent-status` exits 1 on timeout, 0
+  on match — but ALSO 0 (with an error JSON) when the pane is GONE. So does `pane run`: sending to a vanished
+  pane prints `{"error":{"code":"pane_not_found"}}` and **still exits 0**, so `pane run … >/dev/null && echo
+  sent` reports a delivery that never happened. Never chain `wait && act` or trust a send's exit status —
+  confirm the pane exists and read it back. An orchestrator's pane can vanish mid-mission without any event
+  reaching you; the first symptom is a dispatch into nothing.
 - Stale typed input is unclearable via CLI — supersede it:
   `pane run "<-- disregard everything before this arrow (stale draft). ACTUAL: <message>"`.
 
@@ -90,21 +174,257 @@ orchestrator gets a 90s grace window to handle worker blocks first. For long par
 `herdr wait agent-status <pane> --status <s> --timeout <ms>` beats the watcher. When parking a human
 checkpoint, also fire `herdr notification show "HUMAN CHECKPOINT: <gate>" --sound request`.
 
+**Every seat you spawn gets an ARTIFACT watcher armed in the SAME call that spawns it** — bundled, and
+keyed on the deliverable rather than the seat:
+
+```bash
+.claude/skills/tickmarkr-overseer/scripts/watch-artifacts.sh <MARKER> <cap-s> <poll-s> <file>...
+```
+
+It wakes when every named file exists AND ends with its terminal marker, and on timeout it reports each
+file as READY / PARTIAL / ABSENT so a quiet arm still proves the watcher was alive. Tell each seat, in its
+brief, the exact marker its report must end with — you cannot watch for a marker you never demanded.
+
+**Arm it in the same call as the spawn, not the next one.** A watcher armed "after I finish this step"
+leaves a gap exactly as wide as however long you stay busy, and you will be busy — you just spawned work.
+**Measured 2026-08-06 (OBS-369): two consult verdicts, 30KB and 12.8KB, sat COMPLETE with their markers
+while the overseer hand-polled and reported them as still running. The operator had to ask.** Project
+memory has carried this rule since before that session and the operator had already flagged it twice; it
+was re-earned a third time because nothing in this skill made it a spawn-time step. It is one now.
+
+**Never key a watcher on an agent's `done`.** `done` is TURN end, not mission end — a briefed seat flips to
+`done` the moment it finishes acknowledging you, and a watcher waiting on "not working" wakes instantly and
+reports a deliverable that does not exist. Key it on the artifact instead: the deliverable file existing **and
+containing its terminal marker**, or `blocked`, or the pane being gone. Those are the three states that
+actually require you. The same applies to a run: the journal's `run-end` event is the signal, never an
+orchestrator turn boundary.
+
 ## Specialist pipeline rules
 
 - **Dedicated consultant tab**: Consultants (agents spawned to gather synthesis input for decisions like SCOPER analysis or architectural reviews) must run in a DEDICATED tab separate from the ORCHESTRATOR tab. When the orchestrator stands down, the consultant panes should persist so their assessments remain available for review and reference.
 - **Scoper worktree rule**: The SCOPER (or any worktree-based specialist synthesizing into the spec pipeline) must do ALL git operations in a dedicated worktree (e.g., `git worktree add /private/tmp/tkr-scoper-v155 -b spec/...`), never switching the main checkout's branch. This prevents race conditions between the specialist's branch operations and the orchestrator's shipping logic.
+- **One fresh pane per consult ROUND** (operator rule, 2026-08-04): every consult round spawns a NEW pane in
+  the consult tab rather than re-prompting the seat that answered last round — unless there is a stated
+  reason to reuse. Two payoffs: each round starts with a clean context window instead of inheriting the
+  previous round's, which is what fills a long mission's seats and forces mid-mission `/clear`; and the
+  prior round's pane persists as a readable record of what that seat actually saw and said. Reuse only when
+  continuity of the seat's own reasoning is the point, and say so when you do.
+- **CLOSE WHAT YOU SPAWNED** (operator observation, 2026-08-04: *"orch doesn't auto close the panes that he
+  created when no more needed"*). Panes accumulate silently — one mission reached **15 panes and 10 tabs**,
+  ten of them holding live agent sessions for work that had been on disk and fully consumed for hours.
+  Neither seat cleaned up, because neither had been told to.
+  - **Whoever spawns a pane owns closing it.** The orchestrator closes its workers; the overseer closes the
+    consultants and sweeps it spawned. The overseer sweeps whatever is left at mission end.
+  - **Verify the deliverable is ON DISK before closing** — a pane is the only place an unwritten finding
+    exists, and an agent that rendered "Done" without writing its artifact did not deliver (the
+    trust-disk-over-transcripts rule — cited by NAME, because a renumbered list orphans a "rule N").
+    **Non-empty is the FLOOR, not the test: completeness is the artifact's own TERMINAL MARKER.** One
+    consult verdict was 10KB on disk while its seat still read `working` — size proved it had started, and
+    only the closing `VERDICT:` line proved it had finished. Require the terminal marker a report is
+    supposed to end with, per seat, then close.
+  - **A pane is not an archive; the report is.** Once a worker's findings are written and synthesized, its
+    transcript adds nothing the report does not.
+  - **KEEP: the active seat, and the most recent SETTLED consult round.** That last one earns its place —
+    re-prompting the seat that found a defect to confirm its own fix is cheaper and stricter than briefing
+    a fresh one, which is the stated-reason exception above. Close consult rounds only once a later round
+    has re-derived their findings.
+  - Emptied tabs disappear on their own; do not close tabs by hand.
 
 ## Non-negotiable rules
 
-1. **Takeover rule**: only act on a worker if it needs input AND the orchestrator is not `working`.
-2. **Human checkpoints (absolute)**: any gate marked `autonomous: false` or asking for product/visual
-   sign-off is NEVER auto-answered — regardless of how obviously correct the highlighted option looks. Leave
-   it blocked and bring the user the decision WITH evidence. If the mission explicitly delegates authority,
-   routine-class gates may be overseer-decided after polling the operator first — but spend and ship gates
-   NEVER self-decide.
-3. **Trust disk over transcripts**: verify artifacts on disk before building on them; a subagent killed
+1. **Do not drive the run.** The ORCHESTRATOR owns `compile`/`plan`/`run`/`resume`, the watchers, the
+   sweeps, and assembling gate evidence. You rule, record, and talk to the operator. Measured cost of
+   ignoring this: one OVERSEER at 747K tokens beside an idle ORCHESTRATOR at 369K, doing one tier's work
+   in the seat that cannot cheaply `/clear`. **The tell is your own hands** — typing `tickmarkr resume`,
+   tailing a journal to decide the next move, sweeping orphans. Hand it back.
+2. **Takeover rule**: only act on a worker if it needs input AND the orchestrator is not `working`.
+3. **Human checkpoints**: any gate marked `autonomous: false` or asking for product/visual sign-off is
+   NEVER auto-answered — regardless of how obviously correct the highlighted option looks. Leave it
+   blocked and bring the user the decision WITH evidence.
+   **When the mission delegates authority, the carve-out is the IRREVERSIBLE CREDENTIAL-BEARING ACT
+   ITSELF — not every decision upstream of it.** `npm publish`, `git tag`, a push to a public remote run
+   under the operator's name and account, and *"in charge" is not an npm token*. **Everything upstream is
+   yours**: whether a fix warrants a patch release, what rides which milestone, what to spend, what order
+   to ship in. Announce it with its cost basis and ACT.
+   **Earned 2026-08-06, at a measured price.** An OVERSEER holding a written delegation asked the operator
+   *"patch release ahead of the milestone, or fold it in?"* — a SCHEDULING question, no credential
+   anywhere near it, about a fix that did not yet exist. The operator was away **8.5 hours**. The run
+   ended, parked seven tasks and went unwatched; the context watcher fired and exited unread. Operator,
+   verbatim: *"why did you wait for me to decide earlier? you should have taken the decision your self ..
+   I delegated this to you, remember?"*
+   **The tell: if no credential, tag or public remote is touched by the ACTION you are about to take, it
+   is not the carve-out — decide it.** And a blocking ask is never the only option: route it through a
+   cross-vendor consult and rule, which is what a pre-committed release criterion already prescribes.
+   **A supervising seat that blocks is not neutral — it is unwatched.** Waiting has a running cost the
+   question never displays, and that cost lands on the run, not on the seat that waited.
+4. **Trust disk over transcripts**: verify artifacts on disk before building on them; a subagent killed
    mid-flight still renders "Done" without writing its artifact.
-4. **Report concisely on every state change**: what happened, who handled it, what's next. Lead with the
-   outcome. Surface product decisions; never make them.
-5. **Log every abnormality** to `.planning/OBSERVATIONS.md` (or the project's ledger), even mid-run.
+5. **Report concisely on every state change**: what happened, who handled it, what's next. Lead with the
+   outcome. **Surface product decisions — and under a standing delegation, MAKE them and say you did.**
+   Without a delegation, surface and wait. With one, deciding IS the job; report the ruling and its basis
+   rather than the question. Say *"I decided"*, never *"you approved"* — a record implying a signature it
+   never received is this rule's own defect class running in the opposite direction.
+6. **Log every abnormality** to `.planning/OBSERVATIONS.md` (or the project's ledger), even mid-run.
+7. **Every fix is evaluated for shipping.** The tarball is `files: [dist, schema, skills, fixtures]` — so
+   `src/**` and `skills/**` reach users while `.overseer/**` and `.tickmarkr/**` reach nobody. Before
+   calling a fix done, ask where it lands: a local overlay or a scaffold script standing in for a source
+   fix helps ONE operator and leaves every other user with the defect. If an overlay is the interim, it
+   says so in writing and names its removal condition.
+
+---
+
+## Briefing a seat to audit a security-shaped check — phrasing matters
+
+**Earned 2026-08-04.** A consult seat was asked to *"hunt one more forged pass"* on an authorization gate.
+Its provider cut the session off mid-work — *"We take extra caution with cybersecurity requests"* — and the
+report was never written. The seat had already found the real defect (a timezone-dependent clock) and that
+finding was recovered only by reading its pane before closing it.
+
+**The work is legitimate; the framing is what trips the filter.** Ask for completeness, not exploitation:
+
+- ✗ "find a forged pass", "bypass this", "attack the gate", "how would you defeat it"
+- ✓ **"enumerate every input this check depends on, and confirm each one is bound"**
+- ✓ "which of these inputs can a caller still control?"
+- ✓ "state what this check does NOT establish"
+
+That phrasing produces the same findings — the timezone hole IS an unbound input — without asking a model to
+generate an attack. **And read the pane before closing a seat that ended without its artifact:** a refusal
+mid-work leaves real findings in the transcript and nowhere else, which is the one case where the pane, not
+the report, is the deliverable.
+
+## Evidence discipline — the durable core
+
+Distilled from a v1.86 spec-repair mission that produced 31 numbered rules, ~90 audit findings and nine
+errors authored by the supervising seat itself. **Every line below was earned by a defect, most of them
+twice.** They are mission-independent on purpose: nothing here names a task, a line number or a figure.
+
+**Rot**
+
+1. **A quotation is exact bytes.** `grep` it before attributing it; if it does not hit, it is not a
+   quotation. A fabricated quotation is the only error that presents itself as primary evidence, so the
+   natural check is already answered on its face.
+2. **A verified quotation ROTS** — the source moves underneath it. Pin it (`as written at <sha/time>`) or
+   re-verify. Documenting a repair is the highest-risk case: the edit you describe is the edit that
+   falsifies your description.
+3. **A FINDING rots exactly like a quotation, and carries more authority while doing it** — a quotation
+   invites checking; *"the consultant found X"* invites action. Re-derive the premise before acting. A
+   *dissolved* finding gets marked SUPERSEDED, never silently dropped.
+4. **Before editing a line, sweep for the records that QUOTE it** — rule 2 used prospectively, which is the
+   only time it is cheap. **And the dual, from the mutating end: any repair to a CONDITION a document
+   DESCRIBES must sweep the descriptions in the same edit.** Fixing the world falsifies the prose about the
+   world, and that prose is nobody's assigned target — it is collateral. Four occurrences in one phase; twice
+   the fix was right and only the record was wrong, which is the version that survives review because the
+   change itself is defensible. **Keep the defect's record when you resolve it** — a passage that flagged a
+   risk which was then relied upon anyway is more instructive than a clean line saying "resolved".
+5. **Never freeze a moving number.** A figure describing anything under active edit is a quotation on a
+   timer; record the derivation command, not the value. A count over a population your own work adds to is
+   self-invalidating — state a floor.
+
+**Scope of a result**
+
+6. **Every gate, tool and verdict states what it does NOT establish.** A green gate is a claim about form
+   until its negative scope says otherwise. This applies to a *seat's own verdict* as much as to a tool:
+   an unchecked cite in a task with no finding is unchecked, not confirmed.
+7. **Never aggregate per-axis PASSes into "it is clean."** Carrying the PASS and dropping the scope
+   manufactures a clean bill nobody issued.
+8. **Never exclude a path from a search whose purpose is to find a counterexample there** — and an
+   INCLUSION list excludes just as effectively, while being harder to see because every entry is
+   individually justified. Cite the line you actually verified.
+9. **A name-keyed sweep answers "is the name absent", not "is the concept absent."** Sweep the mechanism's
+   vocabulary, and one level further: sweep for what the mechanism *does to* its consumers, not who calls
+   it — a thing the harness *applies* to consumers is named by them in no vocabulary at all. Expect
+   over-return; discriminating hits is the cost of the method.
+10. **A hit proves BYTES, not attribution** — and N hits can be ONE origin copied N times.
+
+**Instruments**
+
+11. **For any guard whose failure is SILENCE — detector, lint, watcher, gate, alarm branch — the acceptance
+    test is a POSITIVE CONTROL, not a clean run.** A zero cannot distinguish *nothing is broken* from *the
+    instrument is blind* from *the check does not exist*. Remove the condition it should catch and confirm
+    it FIRES; only then trust its quiet. **A comment asserting the check is enough to make its own author
+    believe it ran.**
+    **This rule is the oldest one here and the most re-earned.** Project memory has carried it since
+    2026-07-14 as the *falsification drill* — *"eleven gate/pin defects in v1.7 alone, every one caught by a
+    drill rather than by a passing test"*, including a `grep -c` gate that exits 0 whether tests pass or
+    fail. Prefer a **compile-time guarantee** (a required parameter → a type error) over a grep-pin whenever
+    the choice exists: a grep-pin guarding a silent default is a hope. Read step 0a — this is what happens
+    when nobody opens the memory.
+    **Turn this rule on your own WATCHERS, because they are the guard you are least likely to aim it at.**
+    A journal watcher armed on `run-end`/`task-human`/`task-failed` is *supposed* to stay silent through a
+    clean merge — so a dead watcher and a correctly-quiet one emit byte-identical evidence from inside the
+    seat that owns it, and they diverge only at the first event the wake was actually for. **Watcher
+    liveness is proved by the PROCESS TABLE, never by its silence, and never by the report of the seat that
+    owns it** — "watchers alive" is the one claim a seat cannot verify about itself. Measured 2026-08-06:
+    an orchestrator sat `idle` through three merges and two dispatches with no journal watcher in the
+    process table, while its own last report read *"daemon, board, sweeper, watcher all alive"* (OBS-366).
+    Two corollaries: **re-arm a wake-and-exit watcher as the same turn's LAST act**, not the next turn's
+    first — the gap between them is unwatched and its width is however long the seat stays busy; and **a
+    handoff that re-arms one tier's watchers must say which tier's it did NOT re-arm.**
+    **A watcher has TWO failure modes, and the second is invisible from inside: never armed, and
+    OUTLIVING ITS TRIGGER.** A watcher aimed at an event that can no longer occur **reads as coverage and
+    is worse than none** — the process table shows it alive and the seat that armed it remembers arming
+    it. When a decision cancels the event a watcher waits on, stand it down **in the same act**. (Earned
+    2026-08-06: an orchestrator did exactly this, unprompted, the moment a ruling cancelled the recompile
+    its standby watcher was waiting for.)
+    **And ASK the negative, explicitly — it is the question that produces gaps.** *"Which tier's watchers
+    did you NOT re-arm?"* A handoff reporting what IS armed produces a list; a handoff required to name
+    what is not armed produced, in one answer: a run's live surface that had **died mid-run** and was
+    found only in the post-run audit, and a worker-liveness tier that had **never been armed**, leaving
+    the daemon both the supervised thing and the sole watcher of its own workers.
+12. **Check which QUANTIFIER the claim uses before quoting a derivation for it.** "The path is N" needs a
+    maximum; *"both chains"*, *"the only consumer"*, *"exactly one owner"* need an ENUMERATION — and a
+    max-with-tie-break silently answers the first question when you asked the second.
+13. **Derive mechanically; hand-derived sets are wrong.** Prefer the real parser's output over a
+    re-implementation, and a property over an enumeration. State what the mechanism cannot establish.
+    **And make every instrument PRINT WHAT IT ACTED ON.** A tool that does not name its target cannot be
+    caught answering about the wrong thing: a dry-compile helper that silently ignored its path argument
+    returned the same verdict for two different files, and a seat read one answer as two results and
+    concluded both forms were valid. The tell is unavailable unless the tool volunteers it. Corollary —
+    an instrument that takes an input must be handed a DELIBERATELY BAD one before its clean runs are
+    worth anything (rule 11 applied to tools, not just to gates).
+14. **A unit is not a measurement.** A configured timeout is a KILL CEILING, not a duration — never compare
+    it to a wall clock or quote it to an operator as an estimate.
+15. **Verify through the path that LOADS, not the path you edited.** Mirrored trees and symlinks mean your
+    check can confirm a shadow copy; `sed -i` on a tracked symlink silently replaces it with a regular file.
+16. **Never edit a script with a live instance** — bash reads by byte offset, so even a comment-only
+    insertion corrupts the running process. Cancel, edit, syntax-check, re-arm, in that order.
+
+**Propagation**
+
+17. **A confirmed single-site or single-axis miss is a CLASS, not an instance.** Re-run the same sweep shape
+    on every sibling; ask what other dimension the fixtures hold constant. **A ruling that fixes one
+    instance of a class it just defined is incomplete by construction** — the sweep is part of the ruling.
+18. **When a boundary moves, every clause referencing the old boundary moves with it.** Neither clause ever
+    looks wrong alone, so single-clause review cannot catch this class. Disambiguate any term used at two
+    levels.
+19. **A METHOD GUARD found by one seat must be promoted to where every seat reads it, in the same pass that
+    reads it.** Otherwise it is re-earned at full price — and the second earning is worse, because by then
+    the wrong answer carries a citation.
+
+**Authority**
+
+20. **Open the file the instruction is about, even when the instruction comes from above.** A ruling reads
+    as settled, and that is exactly when it goes unchecked. Overseer rulings are wrong at roughly the rate
+    of everyone else's.
+21. **State the verification standard alongside the instruction**, or the defect appears at the seam.
+22. **An overclaimed self-criticism is the least-audited sentence you will write** — a harsh line invites no
+    check, so it ships unverified. Including in a section like this one.
+23. **A pre-commitment needs a TRIGGER and a SUBJECT SET. Naming only the trigger is a live hazard.**
+    A bound was rewritten mid-mission to make its CONDITION mechanically checkable — and that rewrite was
+    already the product of one near-miss. It was **still** incomplete: a third task later parked with
+    **both halves of the condition present**, and the bound did not apply, because that task was not in
+    its subject set. A seat reading only the trigger would have closed the milestone on a task the
+    pre-commitment was never about. **State both: what fires it, and what it is ABOUT.** A correct trigger
+    with an unstated subject executes on the first thing matching its shape, carrying the authority of the
+    decision it was written for.
+24. **A REMEDIATION is believed where a guard would be drilled.** Rule 11 says a guard whose failure is
+    silence needs a positive control. **Nobody applies that to a FIX**, because a fix is not an
+    instrument — so a shipped remediation is remembered as coverage and never re-read. One was recalled as
+    *"the reaper shipped in v1.78"*; its own changelog said it reaps only what a helper **tracks**,
+    *"without a broad migration"*, and measurement found the untracked majority behaving exactly as it had
+    been left. **Ask of any remembered fix: what did it actually cover, in its own words, at the time?**
+25. **The fabrication lives in the INDEX line, not the body — and the index is what everyone loads.**
+    In that same case the memory body said *"expect regrowth until the product fix ships."* The one-line
+    summary said *"reaper shipped."* **The accurate body was never opened, because the index had already
+    answered the question.** Audit index and summary lines against the bodies they point at; a compression
+    that drops a qualifier is indistinguishable from a fact.

package/skills/tickmarkr-overseer/scripts/watch-artifacts.sh

@@ -0,0 +1,70 @@
+#!/bin/bash
+# Wake the overseer when spawned seats have actually DELIVERED.
+#
+#   watch-artifacts.sh <marker> <cap-seconds> <poll-seconds> <file>...
+#
+# Completion is the ARTIFACT plus its TERMINAL MARKER — never an agent's `done`, which is turn end and
+# fires the moment a seat finishes acknowledging you. Never file existence alone either: a seat killed
+# mid-write leaves a large, plausible, truncated file. Size proves it started; the marker proves it
+# finished. Measured 2026-08-06: one 10KB verdict was on disk while its seat still read `working`, and two
+# 30KB/12.8KB verdicts sat COMPLETE for minutes with nothing watching, found only because the operator
+# asked (OBS-369).
+#
+# ARM THIS IN THE SAME CALL THAT SPAWNS THE SEAT. A watcher armed later leaves an unwatched gap exactly as
+# wide as however long you stay busy — and you will be busy, because you just spawned work.
+#
+# Prints one wake reason and EXITS. Re-arm after every wake.
+set -u
+# macOS ships bash 3.2, where `set -u` makes "${arr[@]}" on an EMPTY array a fatal unbound-variable
+# error. Every expansion below therefore uses the ${arr[@]+"${arr[@]}"} guard. Caught by the timeout
+# control, not by the completion one: the happy path was green while the path that runs on almost every
+# arm crashed before printing its reason — a watcher that dies without a wake reason is the exact failure
+# this script exists to prevent.
+
+MARKER="${1:?usage: watch-artifacts.sh <marker> <cap-seconds> <poll-seconds> <file>...}"
+CAP="${2:?}"
+POLL="${3:?}"
+shift 3
+[ "$#" -gt 0 ] || { echo "watch-artifacts: no files given" >&2; exit 2; }
+
+# Cap BELOW the host's background-job kill so every arm ends by PRINTING something. A job killed at the
+# limit carries no wake reason and is indistinguishable from a real wake until you read the output —
+# OBS-325, re-earned by a third watcher that had not been capped because the fix was applied only to the
+# two that happened to be in view at the time. Class, not instance.
+END=$((SECONDS + CAP))
+
+# A file is DONE when the marker appears in its last few lines. Anchored to the tail on purpose: a report
+# that merely *mentions* its own marker mid-body has not finished, and grepping the whole file would call
+# that done. This brief tells seats to end the file with the marker, so the tail is where it must be.
+done_file() {
+  [ -s "$1" ] || return 1
+  tail -5 "$1" 2>/dev/null | grep -qF -- "$MARKER"
+}
+
+while :; do
+  pending=()
+  ready=()
+  for f in "$@"; do
+    if done_file "$f"; then ready+=("$f"); else pending+=("$f"); fi
+  done
+
+  if [ "${#pending[@]}" -eq 0 ]; then
+    echo "WAKE: all ${#ready[@]} artifact(s) complete with marker '$MARKER'"
+    for f in ${ready[@]+"${ready[@]}"}; do echo "  READY  $(wc -c <"$f" | tr -d ' ') bytes  $f"; done
+    exit 0
+  fi
+
+  if [ "$SECONDS" -ge "$END" ]; then
+    # Timing out is NOT failure and must not read as one: it is the heartbeat that proves the watcher was
+    # alive and still watching. Report both sides so the state is unambiguous on arrival.
+    echo "WAKE: cap ${CAP}s reached — ${#ready[@]} of $# complete, re-arm"
+    for f in ${ready[@]+"${ready[@]}"};   do echo "  READY    $(wc -c <"$f" | tr -d ' ') bytes  $f"; done
+    for f in ${pending[@]+"${pending[@]}"}; do
+      if [ -s "$f" ]; then echo "  PARTIAL  $(wc -c <"$f" | tr -d ' ') bytes, no '$MARKER' yet  $f"
+      else echo "  ABSENT   $f"; fi
+    done
+    exit 0
+  fi
+
+  sleep "$POLL"
+done

package/skills/tickmarkr-overseer/scripts/watch-panes.sh

@@ -28,7 +28,7 @@ WORKER="${1:?worker pane id required}"
 ORCH="${2:?orchestrator pane id required}"
 shift 2
 FAST_BLOCKED=false
-CAP=14400
+CAP=240   # a backgrounded Bash job is killed at 300s; a longer cap can never be reached (OBS-325)
 SETTLE=60
 while [ $# -gt 0 ]; do
   case "$1" in

package/dist/tui/ink/studio-app.d.ts

@@ -1,59 +0,0 @@
-import { type RunGraph } from "../../graph/schema.js";
-import { type JournalEvent } from "../../run/journal.js";
-import { FleetStaging } from "../staging.js";
-export type StudioInkView = {
-    id: string;
-    label: string;
-    render(props: {
-        cols: number;
-        rows: number;
-    }): string[];
-    key?(name: string): void;
-};
-export type StudioInkIO = {
-    input: NodeJS.ReadStream;
-    output: NodeJS.WriteStream;
-    views?: StudioInkView[];
-    repoRoot?: string;
-    globalDir?: string;
-    staging?: FleetStaging;
-    runsData?: RunsCockpitData;
-    clock?: () => number;
-    debug?: boolean;
-};
-export type RunsCockpitData = {
-    runId?: string;
-    events: JournalEvent[];
-    graph: RunGraph;
-    prompts?: Record<string, string[]>;
-};
-type DossierVerdict = {
-    action: "retry" | "reroute" | "decompose" | "human";
-    reason?: string;
-    prompt?: string;
-};
-type ConsultDossierData = {
-    taskId: string;
-    verdicts: DossierVerdict[];
-};
-type RunsCockpitTask = {
-    id: string;
-    status: string;
-    phase?: string;
-    elapsed?: string;
-    consultCount: number;
-};
-export declare function foldConsultDossier(data: RunsCockpitData, taskId: string): ConsultDossierData;
-export declare function buildRunsCockpitTasks(data: RunsCockpitData, nowMs: number): RunsCockpitTask[];
-export declare function StudioApp({ views: suppliedViews, repoRoot, globalDir, staging: suppliedStaging, runsData: suppliedRunsData, clock, columns, rows, }: {
-    views?: StudioInkView[];
-    repoRoot?: string;
-    globalDir?: string;
-    staging?: FleetStaging;
-    runsData?: RunsCockpitData;
-    clock?: () => number;
-    columns?: number;
-    rows?: number;
-}): import("react").JSX.Element;
-export declare function runStudioInk({ input, output, views, repoRoot, globalDir, staging, runsData, clock, debug, }: StudioInkIO): Promise<void>;
-export {};