tickmarkr 1.93.0 → 1.96.0

package/dist/run/merge.js

@@ -1,7 +1,7 @@
 import { existsSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { shq } from "../adapters/types.js";
-import { classifyFailureOutput, fingerprint, freshFailures } from "../gates/baseline.js";
+import { ceilingKillResult, classifyFailureOutput, effectiveCeilingMs, fingerprint, freshFailures, } from "../gates/baseline.js";
 import { tickmarkrDir } from "../graph/graph.js";
 import { gitHead, linkNodeModules, resolveIntegrationBranch, sh, shGit, shGitOk, WORKTREES_DIR } from "./git.js";
 export function integrationBranch(cfg, runId) {
@@ -53,21 +53,55 @@ export async function mergeTask(intWt, taskBranch, message, gatedCommit) {
 export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
     const results = [];
     for (const [gate, cmd] of Object.entries(commands)) {
-        const r = await sh(cmd, intWt);
+        const entry = baseline?.commands[gate];
+        // OBS-534: the ceiling is the BATTERY's, derived by effectiveCeilingMs from the same baseline entry
+        // this loop already reads for forgiveness two lines down — never the flat DEFAULT_SHELL_TIMEOUT_MS
+        // `sh` defaults to. A suite whose capture measured 600007ms carries a recorded 1800021ms ceiling;
+        // running it under 600000ms here SIGKILLed a green tip three times while every per-task gate passed.
+        const ceilingMs = effectiveCeilingMs(entry);
+        const r = await sh(cmd, intWt, ceilingMs);
         const raw = r.stdout + "\n" + r.stderr;
         const stripped = raw.split(intWt).join("");
-        const entry = baseline?.commands[gate];
+        const artifact = join(runDir, `tip-verify-${gate}.log`);
+        // Battery parity on the ceiling too (baseline.ts Q24): the kill is read BEFORE the exit code is
+        // interpreted at all. A SIGKILLed battery never returned a verdict, so no line of its partial
+        // output is one — fingerprinting it is what produced the `<unrecognized failure output>` an
+        // operator cannot act on. The kill reader's own text (ceiling + elapsed) and cause replace it.
+        const killed = ceilingKillResult(gate, r, ceilingMs);
+        if (killed) {
+            writeFileSync(artifact, raw);
+            results.push({
+                gate,
+                cmd,
+                pass: false,
+                exitCode: r.code,
+                fingerprints: [],
+                details: killed.details,
+                cause: killed.meta?.classification,
+                artifact,
+            });
+            continue;
+        }
         const { failing, unreadable } = freshFailures(entry, stripped);
+        const cause = r.code === 0 ? undefined : classifyFailureOutput(stripped);
         // `?? 1` is the battery's own default (baseline.ts compareToBaseline): an exitCode-less legacy
         // entry reads as red-at-baseline there, so it must read the same here or old baselines silently
-        // lose forgiveness. Battery parity on the infra rule too (T9): infrastructure-only output means
-        // the runner never completed a suite — nothing was verified, so nothing is forgivable, however
-        // familiar its fingerprints. Stricter-than-battery edge kept: unreadable output never forgives.
-        const forgiven = r.code !== 0 && entry !== undefined && (entry.exitCode ?? 1) !== 0
-            && failing.length === 0 && !unreadable && classifyFailureOutput(stripped) !== "infra";
+        // lose forgiveness. OBS-534 (T2): a capture killed at its ceiling now records a CAUSE and no
+        // verdict, and that default must not launder the missing exit code back into red-at-baseline.
+        // Only a recorded verdict is forgivable, so this reads the same predicate the battery does
+        // (baseline.ts `baselineRed`) — `infra` first, the legacy default only after it. freshFailures
+        // already drops the killed capture's flushed fingerprints, but it cannot close this alone: an
+        // output whose only shape is a diagnostic HEADING (vitest's "Unhandled Errors" banner) is
+        // fingerprintable yet OBS-42-exempt from rejecting, so `failing` comes back empty, `unreadable`
+        // false and the cause reads "regression" — every other guard satisfied, and a real red forgiven
+        // against a capture that never finished asking the question.
+        const baselineRed = entry !== undefined && entry.infra !== true && (entry.exitCode ?? 1) !== 0;
+        // Battery parity on the infra rule too (T9): infrastructure-only output means the runner never
+        // completed a suite — nothing was verified, so nothing is forgivable, however familiar its
+        // fingerprints. Stricter-than-battery edge kept: unreadable output never forgives.
+        const forgiven = r.code !== 0 && baselineRed && failing.length === 0 && !unreadable && cause !== "infra";
         const pass = r.code === 0 || forgiven;
-        const artifact = pass ? undefined : join(runDir, `tip-verify-${gate}.log`);
-        if (artifact)
+        if (!pass)
             writeFileSync(artifact, raw);
         results.push({
             gate,
@@ -79,7 +113,8 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
                 : forgiven ? `exit ${r.code} but only baseline-recorded failures (forgiven vs baseline)`
                     : `exit ${r.code}`,
             ...(forgiven ? { forgiven: true } : {}),
-            ...(artifact ? { artifact } : {}),
+            ...(cause ? { cause } : {}),
+            ...(pass ? {} : { artifact }),
         });
     }
     return results;

package/fixtures/gsd-sample/07-live-check/07-01-PLAN.md

@@ -20,7 +20,7 @@ Implement the first objective sentence. Additional prose that is not the title.
 </objective>
 
 <context>
-@.planning/PROJECT.md
+@fixtures/gsd-sample/PROJECT.md
 @$HOME/.claude/get-shit-done/workflows/execute-plan.md
 @~/somewhere/outside.md
 </context>

package/fixtures/gsd-sample/PROJECT.md

@@ -0,0 +1,19 @@
+# Sample project — vendored GSD fixture input
+
+This file exists so the sibling phase's `07-01-PLAN.md` can cite a repo-relative `<context>` path that
+is **part of the fixture itself**. It previously cited `.planning/PROJECT.md`, which resolved only
+inside the private development checkout: the public export strips `.planning/` at any depth, so the
+compiler's context-reachability refusal (v1.96 T3) correctly failed eight tests on the exported tree
+and the release ritual's pre-tag proof caught it. A vendored fixture must carry its own inputs.
+
+Nothing here is read by an assertion — the fixture only needs the path to resolve. The prose stands in
+for the project brief a real GSD plan would point a worker at.
+
+## Objective
+
+Ship a small feature end to end, with each plan in the phase owning one objective sentence.
+
+## Constraints
+
+- One plan, one objective.
+- A plan's `<context>` block promises the worker can read every repo-relative path it lists.

package/fixtures/payload-shape/p99-shaped.spec.md

@@ -0,0 +1,68 @@
+<!-- tickmarkr:spec -->
+<!-- provenance: the shape of .planning/phases/99-arabic-coverage as compiled on 2026-08-18 into
+     run-20260818-185710-0000000000000011 (41 tasks). OBS-535's fix — files[] is write scope, not
+     payload — was measured against that graph (41 unreadable-payload lints to 0; 31 overflow lints
+     when the window is forced to 50k) and against nothing in this repo, because no fixture carried
+     its shape. This one does, at five tasks instead of forty-one.
+
+     The four shape features that made every task on that graph skip its context-window comparison,
+     each present below:
+       1. a brace-glob write scope (`scripts/{a,b}`) — a set, not a document; unmeasurable as one file
+       2. an output declared in files[] (`*-SUMMARY.md`) — absent from the base tree BY CONSTRUCTION
+       3. a wave-1 artifact consumed by a TRANSITIVE dependent (T3 reads what T1 writes, via T2)
+       4. the same artifact cited by a task with NO producer upstream (T4) — the actionable class,
+          which on the real graph was 17 tasks citing a self-gitignored tree (RULING-P99-14)
+     T5 adds the class no commit can ever satisfy: a ref under a gitignored directory.
+
+     Compile this fixture from a NON-REPO directory. compileNative's context reachability check
+     (native.ts:684) fails open when git cannot answer, and T3/T4/T5 deliberately cite paths absent
+     from any base tree — that absence is the fixture's whole subject. -->
+
+## T1: Land the instruments the later waves measure with
+- goal: Write the two audit instruments and this task's own summary, so a later wave has something to read
+- shape: implement
+- files: scripts/{audit-strict.mjs,census.mjs}, .planning/payload-shape/T1-SUMMARY.md
+- context: docs/payload-shape/PLAN.md
+- complexity: 3
+- acceptance:
+  - command: node -e "process.exit(0)"
+  - judge: both instruments exist and the summary records what they measured
+
+## T2: Rewrite the localisation sources the instruments flag
+- goal: Apply the instrument's findings across the localisation sources named in the write scope
+- shape: implement
+- deps: T1
+- files: src/i18n/{ar/common.json,en/common.json,ar/dossier.json,en/dossier.json,ar/intake.json,en/intake.json,ar/tasks.json,en/tasks.json,ar/settings.json,en/settings.json}, .planning/payload-shape/T2-SUMMARY.md
+- context: docs/payload-shape/PLAN.md, scripts/audit-strict.mjs
+- complexity: 5
+- acceptance:
+  - judge: every key src/i18n/ar/common.json shares with its en counterpart carries a non-empty Arabic value, and .planning/payload-shape/T2-SUMMARY.md records the count it rewrote
+
+## T3: Close the census the second instrument opens
+- goal: Read the census instrument written two waves back and close its remaining senses
+- shape: implement
+- deps: T2
+- files: src/i18n/{ar/common.json,en/common.json}, .planning/payload-shape/T3-SUMMARY.md
+- context: docs/payload-shape/PLAN.md, scripts/census.mjs
+- complexity: 4
+- acceptance:
+  - judge: the census reports no unresolved sense for any rewritten key
+
+## T4: Report on the audit without depending on the task that writes it
+- goal: Summarise the audit's findings for the operator record
+- shape: chore
+- files: .planning/payload-shape/T4-SUMMARY.md
+- context: docs/payload-shape/PLAN.md, scripts/audit-strict.mjs
+- complexity: 2
+- acceptance:
+  - judge: .planning/payload-shape/T4-SUMMARY.md states both the flagged-site count and the total key count it was measured against
+
+## T5: Apply the standing ruling to the rewritten sources
+- goal: Enforce the ruling's terminology decisions across the sources T2 rewrote
+- shape: chore
+- deps: T2, T3
+- files: src/i18n/{ar/common.json,en/common.json}
+- context: docs/payload-shape/PLAN.md, .state/RULING-TERMINOLOGY.md
+- complexity: 2
+- acceptance:
+  - judge: no file under src/i18n/ar contains the string "Dossier" or "Engagement" in Latin script

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.93.0",
+  "version": "1.96.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-overseer/SKILL.md

@@ -63,15 +63,14 @@ through brief lineage. **An executor choice nobody made is still an executor cho
    tab OVERSEER; create ONE tab ORCHESTRATOR.
    **FIVE-TAB CANON (standing operator layout — corrected three times on 2026-07-27, layout approved
    2026-07-29, re-earned 2026-08-17):**
-   - `OVERSEER` — you, plus a visible pipeline watch pane running the SHIPPED surface (`tickmarkr ui`,
-     newest-run default; never a hand-rolled status loop — the operator flagged an ad-hoc shell-loop
-     watcher as "strange watch design"). A supervision watcher buried in an invisible background task
-     reads as "no watcher" to the operator even when armed.
-   - `ORCH` — the orchestrator, the run's watch board (split `--direction right`, ~0.6 to the board —
-     never `down`; the board needs full height for its task matrix), and the raw journal feed. **Nothing
-     else, ever: a work seat NEVER splits into the ORCH tab**, even when width arithmetic allows a second
-     column. Operator verbatim: *"in orch tab should be the orch and the watcher only."* Re-earned
-     2026-08-17: a planning seat split beside the orchestrator, and the operator caught it, again.
+   - `OVERSEER` — you. Do not add a second live run surface: the daemon self-places the shipped board
+     beside the supervising seat that invokes the run.
+   - `ORCH` — the orchestrator and the daemon-placed, run-id-pinned shipped board beside it. **Look for
+     that `role: "watch"` pane; never hand-place or hand-roll a live run surface. Nothing else, ever: a
+     work seat NEVER splits into the ORCH tab.** Operator verbatim: *"in orch tab should be the orch and
+     the watcher only."* Re-earned 2026-08-17: a planning seat split beside the orchestrator, and the
+     operator caught it, again. The daemon owns the side placement and board-first width allocation;
+     neither the worker-pane halving floor nor an overseer split command places this pane.
    - Worker/seat tabs — tickmarkr opens ONE TAB PER TASK itself; GSD-leg seats get the same treatment
      (own tab, or a shared WORKERS tab), never the ORCH tab.
    - `CONSULT · <topic>` — ONE shared tab for ALL consultants of a round, side-by-side splits; never one
@@ -102,7 +101,7 @@ through brief lineage. **An executor choice nobody made is still an executor cho
    and only then delete. A guard's home must outlive the mission that earned it. The project ledger does
    NOT count as that home — `CLAUDE.md` itself says planning records are read-only archives and current
    guidance belongs in the memory file or the shipped docs.
-4. Arm the watcher (Supervision). Report the hierarchy map (pane ids + names) to the user.
+4. Arm the watcher and your own supervision beat (Supervision). Report the hierarchy map (pane ids + names) to the user.
 
 ## Supervising tickmarkr as the executor — WHO DOES WHAT
 
@@ -114,7 +113,7 @@ and the first thing to get right is that **almost none of it is yours**.
 | | ORCHESTRATOR | OVERSEER |
 |---|---|---|
 | `compile` · `plan` · `run` · `resume` | **owns** | never |
-| journal watchers, live surface, dialog watchers | **owns** | watches the ORCHESTRATOR, not the run |
+| journal and dialog watchers; verifying the daemon's live surface | **owns** | watches the ORCHESTRATOR, not the run |
 | orphan sweeps, worker pane hygiene | **owns** | — |
 | reading a gate failure and assembling its evidence | **owns** | reads the file it writes |
 | **deciding** a gate, spend, or ship | never | **owns** |
@@ -134,10 +133,11 @@ journal tail to decide what happens next, or sweeping orphans — you have taken
 
 ### What the ORCHESTRATOR does, and what you require of it
 
-- **A live surface.** `tickmarkr run` is stdout-silent until run-end by design, and the run spawns its own
-  watch board (`role: "watch"`, one per run) — **look for that pane before building anything.** Do NOT use
-  `tickmarkr status --watch` as the surface: `status <runId>` has reported the WRONG run, so a board built
-  on it shows a previous milestone's numbers under the current run's id.
+- **The live surface arrives with the run.** `tickmarkr run` is stdout-silent until run-end by design;
+  its daemon self-places one shipped `role: "watch"` board beside the supervising seat and pins that
+  board to the daemon's run id. **Look for the matching daemon-placed pane.** If it is absent, treat that
+  as a daemon/run liveness fault and use the normal recovery path; never hand-place, hand-roll, or launch
+  a replacement live surface.
 - **The journal is the source of truth**, not panes. Watchers go on `run-end` / `task-human` /
   `task-failed` / `consult-verdict`; never sleep-poll inside an agent turn. **Never key a watcher on an
   agent's `done`** — that is turn end and fires the moment a seat finishes acknowledging you.
@@ -377,6 +377,26 @@ they are left implicit:
 
 ## Supervision watcher
 
+**Arm your OWN tier first, in the same call chain that arms everything else.** `status` derives each
+tier's state from a beat file the tier itself writes, so a seat that never beats reads `ABSENT` — and
+`ABSENT` means *never armed*, which is a lie about a seat that is working the run. Measured on the P99
+run: `orchestrator ARMED / overseer ABSENT / watch ABSENT` for the whole milestone, with a live overseer
+watching it. Two thirds of that line were constants, not measurements.
+
+The beat is one shipped command and the loop is yours, run from the repo root as its own
+`run_in_background` Bash call:
+
+```bash
+cd <repo> && while :; do tickmarkr beat overseer; sleep 10; done   # 10s = SUPERVISION_BEAT_MS
+tickmarkr beat overseer --stand-down                               # at stand-down, in the same act
+```
+
+One beat per invocation, deliberately: the loop is what proves the seat is alive, so a command that
+kept beating on its own would keep reporting a dead seat as healthy. Stop the loop — or die — and the
+tier ages to `STALE` (never `ABSENT`) within six beats, which is the state that says *armed, then lost*.
+Stand down explicitly when you hand off, or a deliberate exit reads as a death. Same rule as rule 29
+below, now with a conventional path the other tier already reads: `tickmarkr status` shows it.
+
 Arm the bundled watcher as its OWN Bash call with `run_in_background` — chaining it after other commands
 with `&` orphans it from the wake chain. It prints one wake reason and exits; re-arm after every wake.
 
@@ -448,9 +468,9 @@ herdr agent wait <name> --until blocked --timeout <ms>    # run_in_background
 ⚠ **Its exit status is not evidence.** That command exits **0 on timeout** and **0 when the pane is gone**,
 exactly as it does on a real block — so confirm every wake by READING the pane before acting on it.
 
-**And note what no watcher can cover:** the adopted supervision design gives this seat zero watchers and
-wakes it on *product-owned signals* that do not exist until the `supervision-heartbeat` work ships. Until
-then the seat improvises, and an improvised set is where a whole failure class hides. A **host** permission
+**And note what no watcher can cover:** the supervision beat above proves this seat is ARMED and nothing
+more — it is a liveness claim, not a wake signal, so the seat still improvises the wakes, and an improvised
+set is where a whole failure class hides. A **host** permission
 modal is invisible to tickmarkr entirely, so no `src/**` change closes that one — it is covered here or
 nowhere.
 
@@ -531,6 +551,10 @@ orchestrator turn boundary.
     safe 53 → floor 108"*), and it splits right only while `paneWidth/2 ≥ 108 + 2` (`herdr.ts:494`),
     otherwise **down**. Apply the same test by hand: `herdr pane layout --pane <id>`, halve the width,
     and if the halves fall under the floor, split `--direction down`.
+  - **The daemon-placed ORCH board is outside this manual split rule.** The halving bound protects
+    worker-pane trailers; the daemon, not the overseer, places the run-id-pinned shipped board beside
+    the supervising seat and owns its board-first width allocation. Look for that pane and do not split,
+    place, or recreate it.
   - **Binary splits cannot produce an even 3-column row at any width.** 220 goes to 110/55/55 whichever
     pane you split. **At a 220-col terminal the width-derived cap is TWO side-by-side panes**; a third
     seat goes below one of them, or into its own tab. "Three panes" is a *height* heuristic