tickmarkr 1.92.1 → 1.96.0

package/dist/run/merge.js

@@ -1,7 +1,7 @@
 import { existsSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { shq } from "../adapters/types.js";
-import { classifyFailureOutput, fingerprint, freshFailures } from "../gates/baseline.js";
+import { ceilingKillResult, classifyFailureOutput, effectiveCeilingMs, fingerprint, freshFailures, } from "../gates/baseline.js";
 import { tickmarkrDir } from "../graph/graph.js";
 import { gitHead, linkNodeModules, resolveIntegrationBranch, sh, shGit, shGitOk, WORKTREES_DIR } from "./git.js";
 export function integrationBranch(cfg, runId) {
@@ -53,21 +53,55 @@ export async function mergeTask(intWt, taskBranch, message, gatedCommit) {
 export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
     const results = [];
     for (const [gate, cmd] of Object.entries(commands)) {
-        const r = await sh(cmd, intWt);
+        const entry = baseline?.commands[gate];
+        // OBS-534: the ceiling is the BATTERY's, derived by effectiveCeilingMs from the same baseline entry
+        // this loop already reads for forgiveness two lines down — never the flat DEFAULT_SHELL_TIMEOUT_MS
+        // `sh` defaults to. A suite whose capture measured 600007ms carries a recorded 1800021ms ceiling;
+        // running it under 600000ms here SIGKILLed a green tip three times while every per-task gate passed.
+        const ceilingMs = effectiveCeilingMs(entry);
+        const r = await sh(cmd, intWt, ceilingMs);
         const raw = r.stdout + "\n" + r.stderr;
         const stripped = raw.split(intWt).join("");
-        const entry = baseline?.commands[gate];
+        const artifact = join(runDir, `tip-verify-${gate}.log`);
+        // Battery parity on the ceiling too (baseline.ts Q24): the kill is read BEFORE the exit code is
+        // interpreted at all. A SIGKILLed battery never returned a verdict, so no line of its partial
+        // output is one — fingerprinting it is what produced the `<unrecognized failure output>` an
+        // operator cannot act on. The kill reader's own text (ceiling + elapsed) and cause replace it.
+        const killed = ceilingKillResult(gate, r, ceilingMs);
+        if (killed) {
+            writeFileSync(artifact, raw);
+            results.push({
+                gate,
+                cmd,
+                pass: false,
+                exitCode: r.code,
+                fingerprints: [],
+                details: killed.details,
+                cause: killed.meta?.classification,
+                artifact,
+            });
+            continue;
+        }
         const { failing, unreadable } = freshFailures(entry, stripped);
+        const cause = r.code === 0 ? undefined : classifyFailureOutput(stripped);
         // `?? 1` is the battery's own default (baseline.ts compareToBaseline): an exitCode-less legacy
         // entry reads as red-at-baseline there, so it must read the same here or old baselines silently
-        // lose forgiveness. Battery parity on the infra rule too (T9): infrastructure-only output means
-        // the runner never completed a suite — nothing was verified, so nothing is forgivable, however
-        // familiar its fingerprints. Stricter-than-battery edge kept: unreadable output never forgives.
-        const forgiven = r.code !== 0 && entry !== undefined && (entry.exitCode ?? 1) !== 0
-            && failing.length === 0 && !unreadable && classifyFailureOutput(stripped) !== "infra";
+        // lose forgiveness. OBS-534 (T2): a capture killed at its ceiling now records a CAUSE and no
+        // verdict, and that default must not launder the missing exit code back into red-at-baseline.
+        // Only a recorded verdict is forgivable, so this reads the same predicate the battery does
+        // (baseline.ts `baselineRed`) — `infra` first, the legacy default only after it. freshFailures
+        // already drops the killed capture's flushed fingerprints, but it cannot close this alone: an
+        // output whose only shape is a diagnostic HEADING (vitest's "Unhandled Errors" banner) is
+        // fingerprintable yet OBS-42-exempt from rejecting, so `failing` comes back empty, `unreadable`
+        // false and the cause reads "regression" — every other guard satisfied, and a real red forgiven
+        // against a capture that never finished asking the question.
+        const baselineRed = entry !== undefined && entry.infra !== true && (entry.exitCode ?? 1) !== 0;
+        // Battery parity on the infra rule too (T9): infrastructure-only output means the runner never
+        // completed a suite — nothing was verified, so nothing is forgivable, however familiar its
+        // fingerprints. Stricter-than-battery edge kept: unreadable output never forgives.
+        const forgiven = r.code !== 0 && baselineRed && failing.length === 0 && !unreadable && cause !== "infra";
         const pass = r.code === 0 || forgiven;
-        const artifact = pass ? undefined : join(runDir, `tip-verify-${gate}.log`);
-        if (artifact)
+        if (!pass)
             writeFileSync(artifact, raw);
         results.push({
             gate,
@@ -79,7 +113,8 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
                 : forgiven ? `exit ${r.code} but only baseline-recorded failures (forgiven vs baseline)`
                     : `exit ${r.code}`,
             ...(forgiven ? { forgiven: true } : {}),
-            ...(artifact ? { artifact } : {}),
+            ...(cause ? { cause } : {}),
+            ...(pass ? {} : { artifact }),
         });
     }
     return results;

package/fixtures/gsd-sample/07-live-check/07-01-PLAN.md

@@ -20,7 +20,7 @@ Implement the first objective sentence. Additional prose that is not the title.
 </objective>
 
 <context>
-@.planning/PROJECT.md
+@fixtures/gsd-sample/PROJECT.md
 @$HOME/.claude/get-shit-done/workflows/execute-plan.md
 @~/somewhere/outside.md
 </context>

package/fixtures/gsd-sample/PROJECT.md

@@ -0,0 +1,19 @@
+# Sample project — vendored GSD fixture input
+
+This file exists so the sibling phase's `07-01-PLAN.md` can cite a repo-relative `<context>` path that
+is **part of the fixture itself**. It previously cited `.planning/PROJECT.md`, which resolved only
+inside the private development checkout: the public export strips `.planning/` at any depth, so the
+compiler's context-reachability refusal (v1.96 T3) correctly failed eight tests on the exported tree
+and the release ritual's pre-tag proof caught it. A vendored fixture must carry its own inputs.
+
+Nothing here is read by an assertion — the fixture only needs the path to resolve. The prose stands in
+for the project brief a real GSD plan would point a worker at.
+
+## Objective
+
+Ship a small feature end to end, with each plan in the phase owning one objective sentence.
+
+## Constraints
+
+- One plan, one objective.
+- A plan's `<context>` block promises the worker can read every repo-relative path it lists.

package/fixtures/payload-shape/p99-shaped.spec.md

@@ -0,0 +1,68 @@
+<!-- tickmarkr:spec -->
+<!-- provenance: the shape of .planning/phases/99-arabic-coverage as compiled on 2026-08-18 into
+     run-20260818-185710-0000000000000011 (41 tasks). OBS-535's fix — files[] is write scope, not
+     payload — was measured against that graph (41 unreadable-payload lints to 0; 31 overflow lints
+     when the window is forced to 50k) and against nothing in this repo, because no fixture carried
+     its shape. This one does, at five tasks instead of forty-one.
+
+     The four shape features that made every task on that graph skip its context-window comparison,
+     each present below:
+       1. a brace-glob write scope (`scripts/{a,b}`) — a set, not a document; unmeasurable as one file
+       2. an output declared in files[] (`*-SUMMARY.md`) — absent from the base tree BY CONSTRUCTION
+       3. a wave-1 artifact consumed by a TRANSITIVE dependent (T3 reads what T1 writes, via T2)
+       4. the same artifact cited by a task with NO producer upstream (T4) — the actionable class,
+          which on the real graph was 17 tasks citing a self-gitignored tree (RULING-P99-14)
+     T5 adds the class no commit can ever satisfy: a ref under a gitignored directory.
+
+     Compile this fixture from a NON-REPO directory. compileNative's context reachability check
+     (native.ts:684) fails open when git cannot answer, and T3/T4/T5 deliberately cite paths absent
+     from any base tree — that absence is the fixture's whole subject. -->
+
+## T1: Land the instruments the later waves measure with
+- goal: Write the two audit instruments and this task's own summary, so a later wave has something to read
+- shape: implement
+- files: scripts/{audit-strict.mjs,census.mjs}, .planning/payload-shape/T1-SUMMARY.md
+- context: docs/payload-shape/PLAN.md
+- complexity: 3
+- acceptance:
+  - command: node -e "process.exit(0)"
+  - judge: both instruments exist and the summary records what they measured
+
+## T2: Rewrite the localisation sources the instruments flag
+- goal: Apply the instrument's findings across the localisation sources named in the write scope
+- shape: implement
+- deps: T1
+- files: src/i18n/{ar/common.json,en/common.json,ar/dossier.json,en/dossier.json,ar/intake.json,en/intake.json,ar/tasks.json,en/tasks.json,ar/settings.json,en/settings.json}, .planning/payload-shape/T2-SUMMARY.md
+- context: docs/payload-shape/PLAN.md, scripts/audit-strict.mjs
+- complexity: 5
+- acceptance:
+  - judge: every key src/i18n/ar/common.json shares with its en counterpart carries a non-empty Arabic value, and .planning/payload-shape/T2-SUMMARY.md records the count it rewrote
+
+## T3: Close the census the second instrument opens
+- goal: Read the census instrument written two waves back and close its remaining senses
+- shape: implement
+- deps: T2
+- files: src/i18n/{ar/common.json,en/common.json}, .planning/payload-shape/T3-SUMMARY.md
+- context: docs/payload-shape/PLAN.md, scripts/census.mjs
+- complexity: 4
+- acceptance:
+  - judge: the census reports no unresolved sense for any rewritten key
+
+## T4: Report on the audit without depending on the task that writes it
+- goal: Summarise the audit's findings for the operator record
+- shape: chore
+- files: .planning/payload-shape/T4-SUMMARY.md
+- context: docs/payload-shape/PLAN.md, scripts/audit-strict.mjs
+- complexity: 2
+- acceptance:
+  - judge: .planning/payload-shape/T4-SUMMARY.md states both the flagged-site count and the total key count it was measured against
+
+## T5: Apply the standing ruling to the rewritten sources
+- goal: Enforce the ruling's terminology decisions across the sources T2 rewrote
+- shape: chore
+- deps: T2, T3
+- files: src/i18n/{ar/common.json,en/common.json}
+- context: docs/payload-shape/PLAN.md, .state/RULING-TERMINOLOGY.md
+- complexity: 2
+- acceptance:
+  - judge: no file under src/i18n/ar contains the string "Dossier" or "Engagement" in Latin script

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.92.1",
+  "version": "1.96.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-auto/SKILL.md

@@ -19,12 +19,13 @@ When working in a multi-agent terminal environment, decide your role before star
   - **Claude Code:** `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions`
   - **Codex:** `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` — the unsandboxed flag is REQUIRED, not optional: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation (`git worktree add` cannot lock the ref). Do not downgrade this flag; the herdr pane and repo scope are the containment.
   - **Auxiliary agents you spawn (consultants, reviewers, scouts) follow the same forms.** Never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions` (tickmarkr's own adapter uses exactly this for workers, judges, and consults). A read-only codex consultant may use `--sandbox read-only`; any codex session that must touch git needs the unsandboxed flag above.
+  - **Auxiliary seats run as the CLI's interactive TUI in their visible pane — never headless** (`claude -p` / `codex exec`): headless buffers output until exit so the pane renders idle for the entire run, is blind to SessionStart hook errors (a broken and a fixed hook both return green), and gives a stall watcher no midpoint — silent-time equals lifetime. Headless is for exit-code probes only (a quota check that wants `rc`), never for work anyone must watch.
 
 Outside a multi-agent terminal environment, run the loop directly.
 
 ## Stand-down (mission end and retirement)
 
-On each mission's terminal state, after the record commit and operator notification: the orchestrator stops every monitor and background task it started, prints one final stand-down line, and leaves nothing queued in its input box. A finished session with an armed watcher or pre-filled input is a loaded gun.
+On each mission's terminal state, after the record commit and operator notification: the orchestrator stops every monitor and background task it started, sweeps the heartbeat/beat files its watchers wrote (a stale beat beside a live one reads as coverage to whoever globs the directory), prints one final stand-down line, and leaves nothing queued in its input box. A finished session with an armed watcher or pre-filled input is a loaded gun.
 
 ## Invariants
 

package/skills/tickmarkr-loop/SKILL.md

@@ -18,6 +18,7 @@ When working in a multi-agent terminal environment, decide your role before star
   - **Claude Code:** `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions`
   - **Codex:** `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` — the unsandboxed flag is REQUIRED, not optional: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation (`git worktree add` cannot lock the ref). Do not downgrade this flag; the herdr pane and repo scope are the containment.
   - **Auxiliary agents you spawn (consultants, reviewers, scouts) follow the same forms.** Never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions` (tickmarkr's own adapter uses exactly this for workers, judges, and consults). A read-only codex consultant may use `--sandbox read-only`; any codex session that must touch git needs the unsandboxed flag above.
+  - **Auxiliary seats run as the CLI's interactive TUI in their visible pane — never headless** (`claude -p` / `codex exec`): headless buffers output until exit so the pane renders idle for the entire run, is blind to SessionStart hook errors (a broken and a fixed hook both return green), and gives a stall watcher no midpoint — silent-time equals lifetime. Headless is for exit-code probes only (a quota check that wants `rc`), never for work anyone must watch.
 
 Outside a multi-agent terminal environment, run the loop directly.
 
@@ -60,7 +61,7 @@ When spawning consultants (agents gathering synthesis input for decisions like S
 
 ## Stand-down (mission end and retirement)
 
-- **Orchestrator, on terminal state** (green, failed, or parked), after the record commit and operator notification: stop every monitor and background task you started, print one final stand-down line, and leave NOTHING queued in your input box. A finished session with an armed watcher or pre-filled input is a loaded gun — a retired v1.40 orchestrator sat idle with "merge … tag, publish" unsent in its input; one stray Enter would have shipped a duplicate release.
+- **Orchestrator, on terminal state** (green, failed, or parked), after the record commit and operator notification: stop every monitor and background task you started, sweep the heartbeat/beat files your watchers wrote (a stale beat beside a live one reads as coverage to whoever globs the directory), print one final stand-down line, and leave NOTHING queued in your input box. A finished session with an armed watcher or pre-filled input is a loaded gun — a retired v1.40 orchestrator sat idle with "merge … tag, publish" unsent in its input; one stray Enter would have shipped a duplicate release.
 - **Supervisor, when a mission completes** (and always before spawning the next orchestrator): verify the orchestrator stood down, then close its tab. Seeming input-box text in a retired pane can be the TUI's dim ghost-text suggestion, not queued input — confirm with an ANSI read (dim escape around the text) or type-one-char-and-read-back before treating it as the loaded gun; close the tab either way. The journal, execution record, OBS ledger, and memory hold the story; pane scrollback is disposable. Never leave a retired agent idle with watchers armed.
 
 ## The loop

package/skills/tickmarkr-overseer/SKILL.md

@@ -12,6 +12,19 @@ to the user with evidence.
 The mission is the skill argument. If empty, ask the user what to run end-to-end before doing anything else.
 Requires `HERDR_ENV=1`; if unset, say so and stop.
 
+**THE ENGINE IS THE DEFAULT EXECUTOR.** A mission that names a milestone, a phase, or a spec runs the
+loop: `tickmarkr compile` → `plan` → `run` → `report`, and the JOURNAL is the record. `compile` ingests
+GSD phase plans (`src/compile/gsd.ts`), so *"this repo uses GSD"* is not a reason to bypass it. The
+supervised GSD flow (below) is the EXCEPTION: it exists only on an explicit operator order, recorded in
+the brief WITH its costs named — no journal (so no per-task adapter/model record), no routing, no
+enforced gate battery, no enforced cross-vendor review; each is re-implemented by hand or silently lost.
+**Measured 2026-08-18 (P98):** the operator triggered this skill expecting the engine; the mission ran
+as GSD legs instead — 12 seats, 11 of them one model checking that same model's work, and *"which model
+ran each task"* was unanswerable from every mission artifact (no ruling, log, or brief named a model;
+the answer took session-file archaeology). The flip from the engine (P89, journaled runs on disk) to
+GSD legs (P92) had been RULED NOWHERE — no ledger entry decides it — and then propagated for six phases
+through brief lineage. **An executor choice nobody made is still an executor choice, and it compounds.**
+
 ## Setup
 
 0. **Adopt before you build.** If this workspace already has a supervision hierarchy — an
@@ -22,11 +35,17 @@ Requires `HERDR_ENV=1`; if unset, say so and stop.
    status, and either ADOPT the
    existing orchestrator (updated brief, re-armed watchers) or, if the old hierarchy is dead, archive the
    stale brief and build fresh.
+   ⚠ **Adopting a hierarchy silently adopts its EXECUTOR CHOICE.** The P92→P98 GSD drift propagated
+   exactly this way: each overseer read the prior brief, reproduced "the same two-leg pattern as the
+   last three phases", and the unruled bypass of the engine became load-bearing through repetition.
+   At every adopt, re-derive the executor question — *"why is this milestone not compiled?"* — and if
+   the answer is not a recorded operator order, route the mission back through the engine.
 0a. **READ THE PROJECT MEMORY BEFORE YOU START — it already contains discipline you are about to re-earn.**
    `~/.claude/projects/<cwd-slug>/memory/` (slug = the absolute cwd with `/` → `-`). Read `MEMORY.md`, then
-   `ls` the topic entries and open every one whose name concerns METHOD or DISCIPLINE rather than a shipped
-   milestone — names like `*-discipline`, `*-drill`, `*-parity`, `*-least-permission`, `context-reset-*`,
-   `consults-*`, `agent-*`.
+   `ls` the topic entries and open every one whose name concerns METHOD, DISCIPLINE, or a STANDING
+   OPERATOR LAYOUT/CONVENTION rather than a shipped milestone — names like `*-discipline`, `*-drill`,
+   `*-parity`, `*-least-permission`, `context-reset-*`, `consults-*`, `agent-*`, `*-tab-layout`,
+   `*-visible-*`, `*-panes*`, `user-tabs-*`.
    **Earned 2026-08-04, expensively.** That directory held `…-falsification-drill-discipline.md`, written
    three weeks earlier: *"a gate or grep-pin is assumed WRONG until a falsification drill proves it bites…
    run the drill that should redden it and SEE the red before trusting green."* That is Evidence discipline
@@ -35,8 +54,32 @@ Requires `HERDR_ENV=1`; if unset, say so and stop.
    mission-scoped brief. **A memory that exists and is never opened costs more than one that was never
    written, because everyone assumes the lesson is somewhere.** Entries may predate a project rename; search
    by concept, not by the current product name.
+   **And the sweep scope is itself a recorded defect: a filter limited to discipline names SKIPS the
+   layout canon, and that skip is paid.** The layout entry records a 2026-08-05 correction it caused —
+   *"widen the start-of-session read to include layout/convention entries, not only discipline ones"* —
+   and on 2026-08-17 the same skip put a planning seat inside the ORCH tab. A standing operator layout is
+   not cosmetic; it is how the operator reads the fleet, and it binds exactly like a discipline rule.
 1. Load the `herdr` skill. `herdr pane list` to map the workspace — the focused pane is yours. Rename your
    tab OVERSEER; create ONE tab ORCHESTRATOR.
+   **FIVE-TAB CANON (standing operator layout — corrected three times on 2026-07-27, layout approved
+   2026-07-29, re-earned 2026-08-17):**
+   - `OVERSEER` — you. Do not add a second live run surface: the daemon self-places the shipped board
+     beside the supervising seat that invokes the run.
+   - `ORCH` — the orchestrator and the daemon-placed, run-id-pinned shipped board beside it. **Look for
+     that `role: "watch"` pane; never hand-place or hand-roll a live run surface. Nothing else, ever: a
+     work seat NEVER splits into the ORCH tab.** Operator verbatim: *"in orch tab should be the orch and
+     the watcher only."* Re-earned 2026-08-17: a planning seat split beside the orchestrator, and the
+     operator caught it, again. The daemon owns the side placement and board-first width allocation;
+     neither the worker-pane halving floor nor an overseer split command places this pane.
+   - Worker/seat tabs — tickmarkr opens ONE TAB PER TASK itself; GSD-leg seats get the same treatment
+     (own tab, or a shared WORKERS tab), never the ORCH tab.
+   - `CONSULT · <topic>` — ONE shared tab for ALL consultants of a round, side-by-side splits; never one
+     tab per consultant; do NOT auto-close after adjudication (operator, 2026-08-09 — keep the round's
+     panes until the thread is confirmed finished or a successor round supersedes them).
+   - `REVIEW <task>` — reviewer panes.
+   Never multiply beyond these without asking. **Tabs you did not create are the OPERATOR'S — provenance
+   decides: never close, rename, reuse, or send input to one, however idle it looks.** An "idle
+   stale-looking" tab an overseer once swept was the operator's in-progress thinking (2026-07-14).
    **Live tab labels (standing operator rule, 2026-07-12):** on every decision or state change (role
    handoff, task done/merged, run end) rename the affected tabs — and keep labels SHORT: the role as the
    main name plus at most ONE hot-state token. Vocabulary: ORCH carries the milestone and progress
@@ -48,8 +91,9 @@ Requires `HERDR_ENV=1`; if unset, say so and stop.
    truncated brief silently drops policy. Write the full brief to `<repo>/.tickmarkr/overseer/ORCH-BRIEF.md`
    (inside the tickmarkr state dir — already self-gitignored, no exclude step needed), then send one line:
    `herdr pane run <orch> "Read .tickmarkr/overseer/ORCH-BRIEF.md and follow it exactly."` The brief MUST contain: the
-   mission, the pane mechanics below, rules 1–2, and require a verbatim one-sentence acknowledgment of the
-   human-checkpoint rule before anything is dispatched.
+   mission, the five-tab canon from step 1, the pane mechanics below, rules 1–2, the GSD-leg rules
+   (below) whenever the mission dispatches `/gsd:*` legs, and require a verbatim one-sentence
+   acknowledgment of the human-checkpoint rule before anything is dispatched.
    **⚠ HARVEST BEFORE YOU DELETE.** At mission end the brief dir goes — but a long mission accumulates
    *method guards* in that brief (how to know a thing, not what is true of this spec), and deleting them
    re-earns each one at full price on the next mission. So before removing the dir: lift every durable,
@@ -57,7 +101,7 @@ Requires `HERDR_ENV=1`; if unset, say so and stop.
    and only then delete. A guard's home must outlive the mission that earned it. The project ledger does
    NOT count as that home — `CLAUDE.md` itself says planning records are read-only archives and current
    guidance belongs in the memory file or the shipped docs.
-4. Arm the watcher (Supervision). Report the hierarchy map (pane ids + names) to the user.
+4. Arm the watcher and your own supervision beat (Supervision). Report the hierarchy map (pane ids + names) to the user.
 
 ## Supervising tickmarkr as the executor — WHO DOES WHAT
 
@@ -69,7 +113,7 @@ and the first thing to get right is that **almost none of it is yours**.
 | | ORCHESTRATOR | OVERSEER |
 |---|---|---|
 | `compile` · `plan` · `run` · `resume` | **owns** | never |
-| journal watchers, live surface, dialog watchers | **owns** | watches the ORCHESTRATOR, not the run |
+| journal and dialog watchers; verifying the daemon's live surface | **owns** | watches the ORCHESTRATOR, not the run |
 | orphan sweeps, worker pane hygiene | **owns** | — |
 | reading a gate failure and assembling its evidence | **owns** | reads the file it writes |
 | **deciding** a gate, spend, or ship | never | **owns** |
@@ -89,10 +133,11 @@ journal tail to decide what happens next, or sweeping orphans — you have taken
 
 ### What the ORCHESTRATOR does, and what you require of it
 
-- **A live surface.** `tickmarkr run` is stdout-silent until run-end by design, and the run spawns its own
-  watch board (`role: "watch"`, one per run) — **look for that pane before building anything.** Do NOT use
-  `tickmarkr status --watch` as the surface: `status <runId>` has reported the WRONG run, so a board built
-  on it shows a previous milestone's numbers under the current run's id.
+- **The live surface arrives with the run.** `tickmarkr run` is stdout-silent until run-end by design;
+  its daemon self-places one shipped `role: "watch"` board beside the supervising seat and pins that
+  board to the daemon's run id. **Look for the matching daemon-placed pane.** If it is absent, treat that
+  as a daemon/run liveness fault and use the normal recovery path; never hand-place, hand-roll, or launch
+  a replacement live surface.
 - **The journal is the source of truth**, not panes. Watchers go on `run-end` / `task-human` /
   `task-failed` / `consult-verdict`; never sleep-poll inside an agent turn. **Never key a watcher on an
   agent's `done`** — that is turn end and fires the moment a seat finishes acknowledging you.
@@ -192,12 +237,68 @@ is a lossy summary nobody trusts while a clean session re-oriented from disk-ver
 good, not after. If your own context cannot be read by the watcher, say so to the operator and ask for the
 number — an unmeasured budget is not a small budget.
 
+## Supervising GSD legs — when the mission dispatches `/gsd:*` instead of `tickmarkr run`
+
+Milestones that alternate GSD legs (`/gsd:plan-phase N`, `/gsd:execute-phase N`) under this hierarchy get
+none of the engine's dispatcher, routing, or gates — every guarantee `tickmarkr run` provides has to be
+demanded in the brief instead. **This path is the EXCEPTION and requires the recorded operator order
+named in the default-executor rule at the top of this skill.** Five guarantees get dropped every time
+they are left implicit:
+
+0. **A seats ledger stands in for the journal's assignment records.** Every seat spawn — orchestrator,
+   planner, checker, executor, verifier, consult — appends ONE JSON line to
+   `<state-dir>/overseer/seats.jsonl` in the same act as the spawn:
+   `{"ts":"<iso>","seat":"<name>","pane":"<id>","tab":"<label>","adapter":"<cli>","model":"<model>","role":"<role>","brief":"<path>"}`.
+   The journal answers *"which model ran each task"* in one line; without this file the answer is
+   session-file archaeology, and the model monoculture it would have exposed stays invisible (measured
+   2026-08-18: 12 seats, no artifact naming any seat's model). ⚠ Interim per rule 27 — removal
+   condition: the engine runs the milestone and the journal is the record.
+
+1. **GSD's Agent-tool default is OVERRIDDEN — name the trap in every seat brief.** `/gsd:plan-phase` and
+   `/gsd:execute-phase` fan their work out to in-process Task subagents: invisible to every watcher tier,
+   billed to the seat's own context, visible only in the seat's status footer. Measured 2026-08-17 (P98
+   leg 1): one planning seat ran FIVE in-process subagents to ≈855k tokens — two of them an unexplained
+   duplicate respawn pair — and the operator caught it from the footer, not from any tier of supervision.
+   The violation was first recorded 2026-07-10, and that record already states the fix: *"generic
+   'visible panes' wording is not enough — name the GSD trap."* The concrete mechanism is claude-code
+   TEAMMATES (the seat's footer roster; `Teammate @<name> finished` notices): they run INSIDE the
+   parent seat's turn, so the seat cannot drain its message queue until every teammate returns —
+   **unwatchable and unsteerable are the same defect** (the queued-message law, Pane mechanics).
+   Measured 2026-08-18: two freeze-class directives sat queued behind a planner's teammate fan-out
+   while the plan set they froze was still editable from that queue, and THE OPERATOR ended the turn
+   by hand (Esc, twice) because no seat owned the interrupt. Every GSD seat brief states: subagents
+   run as visible herdr panes in per-task tabs (`herdr agent start …`), and a seat report whose work
+   was produced by invisible subagents is rejected on read.
+2. **Seats are interactive TUI, never headless `-p`.** The P92–P96 exec lane —
+   `cat brief | claude -p … ` in a visible pane — satisfied visibility in the letter only: `claude -p`
+   buffers output until exit, so the pane renders idle for the entire run; it is blind to SessionStart
+   hook errors (a broken and a fixed hook both return green); and its silence has no midpoint for a
+   stall watcher to catch — silent-time equals lifetime. Standing operator rule since 2026-07-13:
+   consults and one-off LLM calls run as the CLI's real interactive TUI in a visible named pane.
+   Headless is for exit-code probes — a quota check that wants `rc`, never work anyone must watch.
+3. **Buy seat diversity from the live capability matrix, at every dispatch.** When one vendor's model
+   quota collapses, the reflex is to collapse every seat onto the surviving model and hold the
+   cross-vendor CLI back for a late probe — P97 ran planner, checker and verifier as one family that
+   way, and three same-family passes confirmed one wrong anchored conclusion with the refuting fact in
+   the room. `<state-dir>/doctor.json` already lists every installed+authed adapter and its models (nine
+   were authed on 2026-08-17 while every seat ran claude). Priority when independence is scarce:
+   **verifier > checker > planner > executors** — the independent seat goes cross-vendor
+   (`herdr agent start … --kind codex`), ruled at dispatch, never debated under time pressure.
+4. **Gate every exec lane with the shipped battery, not hand-rolled greps.**
+   `tickmarkr verify --base <ref> --criteria <file>` is the standalone form of the engine's own gates —
+   build/test/lint diffed against a recorded baseline, evidence, scope, plus the semantic judges — one
+   fail-closed verdict, no daemon, no retries. A per-lane grep gate re-implements a weaker version of
+   this and passes on source text the screen never renders, which is exactly the class the acceptance
+   judge exists to reject. One command per lane, named in the lane's own brief.
+
 ## Pane mechanics that bite
 
 - **Verified send protocol**: `herdr agent send` writes WITHOUT Enter, and `pane run`'s Enter can be swallowed
   by bracketed-paste on long payloads. Robust sequence: read the pane (bare prompt required) → send-text →
   sleep 2–3s → send-keys Enter → read back (input empty / agent `working`). Never report "briefed" without
-  the read-back. Long content goes in a brief file, never pane text.
+  the read-back. Long content goes in a brief file, never pane text. `scripts/seat-send.sh` encodes
+  this whole path — size guard, atomic prompt, prompt-line read-back, optional interrupt — and never
+  auto-resends.
   **PROBE THE READ-BACK WITH THE SHORTEST DISTINCTIVE TOKEN — a commit hash, a pid, an OBS id — NEVER a
   sentence.** A long phrase crosses the pane's render wrap boundary, so grepping for it returns zero on a
   message that arrived intact, and **a badly-probed successful send is byte-identical to a truncated one.**
@@ -206,6 +307,35 @@ number — an unmeasured budget is not a small budget.
   (OBS-396): a grep for the full sentence returned 0 while a grep for one word of the same sentence
   returned 1. This trap lives *inside* the verification step above, which is why it survives — the rule
   that is supposed to catch dropped sends is the rule that manufactures the phantom.
+  **AND A CONTENT PROBE — TOKEN, TAIL, FULL TEXT — CANNOT VERIFY DELIVERY AT ALL, only presence.**
+  Measured 2026-08-18: `herdr pane read` includes the INPUT BOX, so an unsubmitted message renders
+  identically to a submitted one and every content-based probe returns the same answer in both
+  states. A freeze hold was "verified delivered" by three independent content methods and had never
+  been submitted; the receiving seat stopped 19 minutes later without ever reading it — the frozen
+  set was protected by nothing but the operator's manual Esc. **The prompt line is the only state
+  that discriminates** — text sitting on `❯` is exactly what will not run — and a delivery report
+  is prompt-line state alone, or nothing: a decorative check beside a real one reads as
+  corroboration (two greens, one of which was never capable of disagreeing).
+- **A MESSAGE TO A WORKING SEAT IS A QUEUED MESSAGE, AND THE QUEUE DRAINS ONLY AT TURN BOUNDARIES.**
+  Delivery is not arrival: `agent prompt` to a `working` claude seat lands in its queue (`Press up to
+  edit queued messages` on the seat's prompt line is the tell) and is READ only when the current turn
+  ends — and with in-process teammates a turn runs 20–40 minutes, so steering latency equals subagent
+  runtime. Measured 2026-08-17/18 (P98 leg 1): a FREEZE HOLD and a checker-release directive stacked
+  behind a planner's teammate fan-out — the freeze forbade edits its own queue could still trigger —
+  and the OPERATOR ended the turn by hand. Three consequences:
+  - **A queued hold is not a hold.** A freeze-class or superseding directive to a `working` seat is
+    delivered by INTERRUPT, and the interrupt is the SUPERVISING tier's move, never left to the
+    operator: `send-keys esc` → re-read status → esc once more if still working (two, bounded) →
+    verify idle → prompt → verify. The interrupt loses the seat's in-flight step; for a
+    correctness-class directive that is the price, and it is cheaper than a voided verdict.
+  - **Never stack a correction behind a stale directive.** A queued message executes in a context that
+    no longer matches the one it was written in. When conditions change, do not append another
+    message — interrupt, then send ONE directive that NAMES the queue and overrides it (*"your queue
+    holds X and Y; act on neither; current state is Z"*), and require the seat to report what its
+    queue held before acting. The receiving seat re-validates every queued item against CURRENT state.
+  - Five distinct send failures in one leg — front-truncation, sitting unsubmitted, two silent losses,
+    a probe that mistook its own echo for a reply — is what a prose send protocol costs under load:
+    run `scripts/seat-send.sh` instead.
 - **Guard-before-Enter** (race-safe prompt answering): chain with `&&` — pane get shows `blocked` && pane
   read shows the expected option under the cursor && only then send-keys. If no longer `blocked`, someone
   already answered; do nothing.
@@ -235,9 +365,38 @@ number — an unmeasured budget is not a small budget.
   unaffected (one more reason to prefer them).
 - Stale typed input is unclearable via CLI — supersede it:
   `pane run "<-- disregard everything before this arrow (stale draft). ACTUAL: <message>"`.
+  **But DISCRIMINATE before you supersede or file it: text on an idle seat's prompt line has FOUR
+  authors** — the seat's own draft, an operator, another agent's `agent send` (writes WITHOUT Enter),
+  and claude-code's AUTOSUGGEST, which renders context-plausible ghost text BYTE-IDENTICAL to a typed
+  draft in text-format reads (OBS-482). The check is mechanical and only works at observation time:
+  `agent read --format ansi` — dim/grey SGR around the text = autosuggest ghost, NOT input. Measured
+  2026-08-17 (D-206): an unattributed instruction was found in an orchestrator's box, superseded
+  defensively, and its origin stayed UNRESOLVED — the one probe that discriminates was not taken while
+  the text still sat there. An origin question you can close in ten seconds at the pane becomes
+  permanently open the moment anyone clears the box.
 
 ## Supervision watcher
 
+**Arm your OWN tier first, in the same call chain that arms everything else.** `status` derives each
+tier's state from a beat file the tier itself writes, so a seat that never beats reads `ABSENT` — and
+`ABSENT` means *never armed*, which is a lie about a seat that is working the run. Measured on the P99
+run: `orchestrator ARMED / overseer ABSENT / watch ABSENT` for the whole milestone, with a live overseer
+watching it. Two thirds of that line were constants, not measurements.
+
+The beat is one shipped command and the loop is yours, run from the repo root as its own
+`run_in_background` Bash call:
+
+```bash
+cd <repo> && while :; do tickmarkr beat overseer; sleep 10; done   # 10s = SUPERVISION_BEAT_MS
+tickmarkr beat overseer --stand-down                               # at stand-down, in the same act
+```
+
+One beat per invocation, deliberately: the loop is what proves the seat is alive, so a command that
+kept beating on its own would keep reporting a dead seat as healthy. Stop the loop — or die — and the
+tier ages to `STALE` (never `ABSENT`) within six beats, which is the state that says *armed, then lost*.
+Stand down explicitly when you hand off, or a deliberate exit reads as a death. Same rule as rule 29
+below, now with a conventional path the other tier already reads: `tickmarkr status` shows it.
+
 Arm the bundled watcher as its OWN Bash call with `run_in_background` — chaining it after other commands
 with `&` orphans it from the wake chain. It prints one wake reason and exits; re-arm after every wake.
 
@@ -309,9 +468,9 @@ herdr agent wait <name> --until blocked --timeout <ms>    # run_in_background
 ⚠ **Its exit status is not evidence.** That command exits **0 on timeout** and **0 when the pane is gone**,
 exactly as it does on a real block — so confirm every wake by READING the pane before acting on it.
 
-**And note what no watcher can cover:** the adopted supervision design gives this seat zero watchers and
-wakes it on *product-owned signals* that do not exist until the `supervision-heartbeat` work ships. Until
-then the seat improvises, and an improvised set is where a whole failure class hides. A **host** permission
+**And note what no watcher can cover:** the supervision beat above proves this seat is ARMED and nothing
+more — it is a liveness claim, not a wake signal, so the seat still improvises the wakes, and an improvised
+set is where a whole failure class hides. A **host** permission
 modal is invisible to tickmarkr entirely, so no `src/**` change closes that one — it is covered here or
 nowhere.
 
@@ -324,6 +483,12 @@ nowhere.
 It wakes when every named file exists AND ends with its terminal marker, and on timeout it reports each
 file as READY / PARTIAL / ABSENT so a quiet arm still proves the watcher was alive. Tell each seat, in its
 brief, the exact marker its report must end with — you cannot watch for a marker you never demanded.
+**Arm on the marker YOU demanded, verified against the FILE — never on the seat's report of its own
+marker.** Measured 2026-08-17: a seat reported its sweep "ends `SWEEP-END`"; the file on disk ended
+`ORDER4-END`. A watcher armed on the reported marker never fires while the artifact sits COMPLETE, and
+that hang is byte-identical to a seat still working. The script prints each unfinished file's actual
+last line on every timeout heartbeat — read it there, and when in doubt `tail -1` the artifact, never
+the transcript's claim about it.
 
 **Arm it in the same call as the spawn, not the next one.** A watcher armed "after I finish this step"
 leaves a gap exactly as wide as however long you stay busy, and you will be busy — you just spawned work.
@@ -386,6 +551,10 @@ orchestrator turn boundary.
     safe 53 → floor 108"*), and it splits right only while `paneWidth/2 ≥ 108 + 2` (`herdr.ts:494`),
     otherwise **down**. Apply the same test by hand: `herdr pane layout --pane <id>`, halve the width,
     and if the halves fall under the floor, split `--direction down`.
+  - **The daemon-placed ORCH board is outside this manual split rule.** The halving bound protects
+    worker-pane trailers; the daemon, not the overseer, places the run-id-pinned shipped board beside
+    the supervising seat and owns its board-first width allocation. Look for that pane and do not split,
+    place, or recreate it.
   - **Binary splits cannot produce an even 3-column row at any width.** 220 goes to 110/55/55 whichever
     pane you split. **At a 220-col terminal the width-derived cap is TWO side-by-side panes**; a third
     seat goes below one of them, or into its own tab. "Three panes" is a *height* heuristic
@@ -713,6 +882,11 @@ twice.** They are mission-independent on purpose: nothing here names a task, a l
     **Write beats to a conventional path inside the repository the other tier already reads**, one file per
     tier, and state the path when you report. Then have the reader name the tiers that are ABSENT, never
     the ones present: a list of what IS armed is producible by a seat whose watchers are all dead.
+    **And a beat OUTLIVES its mission unless something sweeps it.** Namespace beats per phase/leg and
+    sweep them at stand-down: measured 2026-08-17, a beats directory held SEVEN stale beats from prior
+    phases beside four live tiers, and a stale beat beside live ones reads as coverage to anyone globbing
+    the directory — the outliving-its-trigger failure (rule 11) in file form. Only age distinguishes a
+    frozen beat from a live one, so the reader states ages, and the writer removes what it retires.
 30. **A JOURNAL WATCHER ON A RESUMABLE RUN MUST SCOPE TO THE CURRENT ENGAGEMENT.** A resumed run's journal
     still contains the PREVIOUS `run-end`. A watcher that greps the whole file for its terminal event finds
     that old one immediately, concludes the run is over, and exits — on every resume, which is exactly when