tickmarkr 1.93.0 → 1.97.0

package/dist/cli/commands/verify.js

@@ -42,6 +42,13 @@ export function parseCriteria(text) {
 // verify models the author as a "human" vendor channel — resolvable, excludes nothing real.
 export const HUMAN_CHANNEL = { adapter: "human", vendor: "human", model: "human", channel: "sub", tier: "frontier" };
 export const HUMAN_AUTHOR = { adapter: "human", model: "human", channel: "sub", tier: "frontier" };
+// The battery's own dirty-worktree refusal, mirrored from run-gates.ts:220-232 — that check lives in
+// a closure this command cannot reach, and verify may not reshape it. run-gates stays the authority:
+// it re-checks at round entry and after every gate command, so a copy that ever drifted could only
+// refuse EARLY with a stale sentence — never let a dirty tree through.
+const DIRTY_WHY = `refusing to gate a dirty worktree: the shell gates run against the working tree while `
+    + `evidence, scope and the merge read commits, so these uncommitted changes would be gated `
+    + `and never merged (and the committed diff would never be run)`;
 // GATE-FIX-4 defect 1 (false-RED on macOS): os.tmpdir() returns /var/folders/…, a symlink into
 // /private/var — so a baseline captured under the repo path and a head battery run under the tmp
 // path disagree on every path-bearing fingerprint, and verify reds a green diff. graph.ts's
@@ -105,6 +112,51 @@ export async function verify(argv, cwd = process.cwd()) {
         evidence: { commits: [], artifacts: [], gateResults: [] },
     };
     const commands = detectGateCommands(cwd, cfg);
+    // PRECONDITIONS (OBS-541) — every check that can refuse this candidate, evaluated together and
+    // BEFORE the baseline capture below. Both read cheap local state (one `git status`, the doctor
+    // cache), and both used to be read AFTER the capture: the dirty tree by runGates' own round-entry
+    // refusal, the review seat by the resolution that sat under it. That cost one full capture per
+    // refusal — measured at 602s and 590s on two refusals of the same candidate — to learn something
+    // knowable in 50ms. Messages, exit taxonomy and fail-closed semantics are unchanged; only the
+    // order is. Anything else that can refuse before a gate runs belongs in this phase, above capture.
+    // `--untracked-files=all` is load-bearing twice over: it overrides a repo/user
+    // `status.showUntrackedFiles=no` (under which untracked work is INVISIBLE and a dirty tree would
+    // capture and gate GREEN), and it enumerates nested files individually instead of collapsing them
+    // to a bare `?? dir/`, so the refusal names every offending path. The `.tickmarkr-*` exemption is
+    // unaffected — the harness's droppings are root-level files, never directories.
+    const status = await shGit("GIT_OPTIONAL_LOCKS=0 git status --porcelain --untracked-files=all", cwd);
+    const dirt = status.code !== 0
+        ? `git status failed (exit ${status.code}) — the worktree cannot be proven clean`
+        : status.stdout.split("\n").map((l) => l.trimEnd())
+            .filter((l) => l.trim() && !/^.. \.tickmarkr-[^/]*$/.test(l)).join("\n");
+    if (dirt)
+        throw new Error(`${DIRTY_WHY}:\n${dirt}`);
+    // LLM seats only when a semantic gate will run.
+    let channels = [];
+    let judgeChannels;
+    let author = HUMAN_AUTHOR;
+    const adapters = allAdapters();
+    if (wantAcceptance || wantReview) {
+        const health = readDoctor(cwd) ?? (await probeAll(adapters));
+        const pools = rolePools(cfg, adapters, health);
+        judgeChannels = pools.judge;
+        channels = pools.review;
+        if (values.author && values.author !== "human") {
+            const [adapter, ...rest] = values.author.split(":");
+            const model = rest.join(":");
+            const c = channels.find((ch) => ch.adapter === adapter && ch.model === model);
+            if (!c) {
+                throw new Error(`--author ${values.author} does not name a discoverable review channel — one of: ${channels.map(channelKey).join(", ") || "(none)"}`);
+            }
+            author = { adapter: c.adapter, model: c.model, channel: c.channel, tier: c.tier };
+        }
+        else {
+            channels = [...channels, HUMAN_CHANNEL];
+        }
+        if (wantReview && !channels.some((c) => c.vendor !== "human")) {
+            throw new Error("review gate needs at least one authed LLM channel (run `tickmarkr doctor`) — or pass --no-review");
+        }
+    }
     // Baseline: --baseline file > cached capture for this merge-base > fresh capture on a detached
     // temp worktree of the merge-base (so pre-existing failures on base are forgiven, exactly as a run).
     // ALL verify state (cache, base worktree, artifacts) lives OUTSIDE the repo: verify gates the repo
@@ -135,32 +187,6 @@ export async function verify(argv, cwd = process.cwd()) {
             await removeWorktree(cwd, baseDir);
         }
     }
-    // LLM seats only when a semantic gate will run.
-    let channels = [];
-    let judgeChannels;
-    let author = HUMAN_AUTHOR;
-    const adapters = allAdapters();
-    if (wantAcceptance || wantReview) {
-        const health = readDoctor(cwd) ?? (await probeAll(adapters));
-        const pools = rolePools(cfg, adapters, health);
-        judgeChannels = pools.judge;
-        channels = pools.review;
-        if (values.author && values.author !== "human") {
-            const [adapter, ...rest] = values.author.split(":");
-            const model = rest.join(":");
-            const c = channels.find((ch) => ch.adapter === adapter && ch.model === model);
-            if (!c) {
-                throw new Error(`--author ${values.author} does not name a discoverable review channel — one of: ${channels.map(channelKey).join(", ") || "(none)"}`);
-            }
-            author = { adapter: c.adapter, model: c.model, channel: c.channel, tier: c.tier };
-        }
-        else {
-            channels = [...channels, HUMAN_CHANNEL];
-        }
-        if (wantReview && !channels.some((c) => c.vendor !== "human")) {
-            throw new Error("review gate needs at least one authed LLM channel (run `tickmarkr doctor`) — or pass --no-review");
-        }
-    }
     const artifactDir = join(stateDir, new Date().toISOString().replace(/[:.]/g, "-"));
     mkdirSync(artifactDir, { recursive: true });
     const { results } = await runGates(task, {

package/dist/cli/index.d.ts

@@ -5,7 +5,7 @@ export type CommandResult = string | {
 };
 export type CommandMap = Record<string, (argv: string[]) => Promise<CommandResult>>;
 export declare const COMMANDS: CommandMap;
-export declare const USAGE = "tickmarkr \u2014 spec-driven orchestration harness for AI coding agents\nusage: tickmarkr <command>\n  init          guided setup + doctor; init --agent [--force] [--docs] adds agent skills/docs\n  doctor        re-probe adapters, herdr, auth; print capability matrix (--fix writes the test-runner ignore when a safe edit exists)\n  fleet         interactive fleet editor (fleet --print for CI drift checks)\n  compile <src> spec \u2192 .tickmarkr/graph.json (fails without acceptance criteria)\n  scope <intent> draft a compiled native spec beside an answered intent (--force to overwrite)\n  plan          dry-run routing table + cost estimate + floor lints\n  eval          run checked-in fixtures against every channel in isolated temp repos\n  run           execute the graph (--concurrency N --driver herdr|subprocess --route-strict)\n  status        live run state\n  verify        run the gate battery standalone against merge-base(--base, HEAD)..HEAD \u2014 no daemon, one verdict (--base main --criteria <file> | --task <id> [--files <glob>] [--author adapter:model] [--no-review] [--json])\n  resume <id>   continue a run from its journal\n  report <id>   cost/quality report (--md for committable execution record)\n  profile       show learned routing profile (profile reset = forget history via cursor, keeps telemetry)\n  ui            open the Fleet Studio TUI (full-screen tabbed cockpit)\n  unlock        remove a stale/garbage run lock (refuses if the holder is alive)\n  approve <id> <task>  release a park (--uphold sides with the reviewer and funds a fixed attempt; --by <name> --reason <text>); takes effect on resume";
+export declare const USAGE = "tickmarkr \u2014 spec-driven orchestration harness for AI coding agents\nusage: tickmarkr <command>\n  init          guided setup + doctor; init --agent [--force] [--docs] adds agent skills/docs\n  doctor        re-probe adapters, herdr, auth; print capability matrix (--fix writes the test-runner ignore when a safe edit exists)\n  fleet         interactive fleet editor (fleet --print for CI drift checks)\n  compile <src> spec \u2192 .tickmarkr/graph.json (fails without acceptance criteria)\n  scope <intent> draft a compiled native spec beside an answered intent (--force to overwrite)\n  plan          dry-run routing table + cost estimate + floor lints\n  eval          run checked-in fixtures against every channel in isolated temp repos\n  run           execute the graph (--concurrency N --driver herdr|subprocess --route-strict)\n  status        live run state\n  verify        run the gate battery standalone against merge-base(--base, HEAD)..HEAD \u2014 no daemon, one verdict (--base main --criteria <file> | --task <id> [--files <glob>] [--author adapter:model] [--no-review] [--json])\n  resume <id>   continue a run from its journal\n  report <id>   cost/quality report (--md for committable execution record)\n  profile       show learned routing profile (profile reset = forget history via cursor, keeps telemetry)\n  ui            open the Fleet Studio TUI (full-screen tabbed cockpit)\n  unlock        remove a stale/garbage run lock (refuses if the holder is alive)\n  beat <tier>   record one supervision beat for orchestrator|overseer|watch (--stand-down to hand off); a supervising seat's own watcher loop calls it, and status reads the tier STALE once the beats stop\n  approve <id> <task>  release a park (--uphold sides with the reviewer and funds a fixed attempt; --by <name> --reason <text>); takes effect on resume";
 export declare function dispatch(cmd: string | undefined, argv: string[], commands?: CommandMap): Promise<{
     out: string;
     code: number;

package/dist/cli/index.js

@@ -2,6 +2,7 @@
 import { realpathSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 import { approve } from "./commands/approve.js";
+import { beat } from "./commands/beat.js";
 import { compile } from "./commands/compile.js";
 import { doctor } from "./commands/doctor.js";
 import { evalCommand } from "./commands/eval.js";
@@ -20,7 +21,7 @@ import { verify } from "./commands/verify.js";
 import { version } from "./commands/version.js";
 const normalize = (r) => typeof r === "string" ? { out: r, code: 0 } : r;
 export const COMMANDS = {
-    init, doctor, fleet, compile, scope, plan, run, status, resume, report, profile, ui, unlock, approve, version, verify, eval: evalCommand,
+    init, doctor, fleet, compile, scope, plan, run, status, resume, report, profile, ui, unlock, approve, beat, version, verify, eval: evalCommand,
 };
 const VERSION_FLAGS = new Set(["version", "--version", "-v"]);
 const HELP_CMDS = new Set(["help", "-h", "--help"]);
@@ -42,6 +43,7 @@ usage: tickmarkr <command>
   profile       show learned routing profile (profile reset = forget history via cursor, keeps telemetry)
   ui            open the Fleet Studio TUI (full-screen tabbed cockpit)
   unlock        remove a stale/garbage run lock (refuses if the holder is alive)
+  beat <tier>   record one supervision beat for orchestrator|overseer|watch (--stand-down to hand off); a supervising seat's own watcher loop calls it, and status reads the tier STALE once the beats stop
   approve <id> <task>  release a park (--uphold sides with the reviewer and funds a fixed attempt; --by <name> --reason <text>); takes effect on resume`;
 // pure, testable dispatcher: resolves a command, forwards argv, shapes the result — no side effects.
 // unknown/missing cmd → USAGE (exit 1 if a cmd was typed, 0 for bare `tickmarkr`); a handler throw becomes

package/dist/compile/gsd.js

@@ -1,8 +1,10 @@
-import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { existsSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative } from "node:path";
 import { parse as parseYaml } from "yaml";
 import { AcceptanceItemSchema, TIERS, validateGraph } from "../graph/schema.js";
 import { CompileError, assertWriteScope, inferShape, sha256 } from "./common.js";
+import { classifyContextPath } from "./native.js";
 // GSD artifact front-end (spec v1.3): one GSD *plan* is one tickmarkr *task* — a plan is
 // worktree-sized; its inner <task> steps stay in the worker prompt via context[0] = the plan file.
 // Artifact-level only: parses .planning/ markdown, never GSD repo/command internals.
@@ -213,6 +215,7 @@ function compileOne(file, storedPath) {
             ...(routingHints ? { routingHints } : {}),
         },
         content,
+        refs,
     };
 }
 export function compileGsd(src, root) {
@@ -280,6 +283,36 @@ export function compileGsd(src, root) {
             throw new CompileError(`${files[i]} depends on "${d}" but no such plan exists in ${src}`);
         });
     }
+    // Match native context reachability against the committed tree. This block only obtains the HEAD
+    // snapshot; classifyContextPath remains the single authority for missing, untracked, and glob refs.
+    const gitDir = dirname(files[0]);
+    const top = spawnSync("git", ["-C", gitDir, "rev-parse", "--show-toplevel"], { encoding: "utf8", maxBuffer: 1 << 28 });
+    const tree = spawnSync("git", ["-C", gitDir, "ls-tree", "--full-tree", "-r", "--name-only", "HEAD"], { encoding: "utf8", maxBuffer: 1 << 28 });
+    const repoRoot = typeof top.stdout === "string" ? top.stdout.trim() : "";
+    // `root` is the repository whose worktrees will consume these refs. A source nested inside some
+    // unrelated repository (as with vendored fixtures) must not be judged against that outer tree.
+    const authoritative = root === undefined
+        || (top.status === 0 && repoRoot !== "" && realpathSync(root) === realpathSync(repoRoot));
+    if (top.status === 0 && tree.status === 0 && repoRoot && typeof tree.stdout === "string" && authoritative) {
+        const tracked = new Set(tree.stdout.split("\n").filter(Boolean));
+        const unreachable = [];
+        for (const [i, t] of tasks.entries()) {
+            for (const entry of compiled[i].refs) {
+                const { kind, suggestion } = classifyContextPath(entry, tracked, repoRoot);
+                if (kind === "untracked") {
+                    console.warn(`tickmarkr: OBS-170: task ${t.id} context ${JSON.stringify(entry)} exists in your checkout but is NOT in a worker's worktree. To make it worker context: git add -f ${entry} && git commit. Staging alone is not enough.`);
+                }
+                else if (kind === "missing") {
+                    unreachable.push(`  ${t.id}: ${JSON.stringify(entry)}${suggestion ? `\n      → did you mean ${suggestion} ?` : "\n      → not found in the repository, and not a path."}`);
+                }
+            }
+        }
+        if (unreachable.length) {
+            throw new CompileError(`context: paths that do not exist in ${src}:\n${unreachable.join("\n")}\n\n` +
+                `A context: entry is a promise the worker can read it. These resolve to nothing in the repository,\n` +
+                `so the worker would be told to read a file that is not there. Fix the paths and recompile.`);
+        }
+    }
     return validateGraph({
         version: 1,
         spec: { source: "gsd", paths: files, hash: sha256(compiled.map((c) => c.content).join("\n")) },

package/dist/compile/native.js

@@ -132,7 +132,15 @@ function strictNegativeCount(text) {
 }
 function namedCriterionPaths(text, tests) {
     const paths = new Set();
-    for (const match of text.matchAll(/(?:^|[\s("'`])((?:src|tests|fixtures|scripts)\/[A-Za-z0-9_@{}*?.,/+-]+\.(?:ts|tsx|js|jsx|mjs|cjs|json|md|txt))/g)) {
+    // Longest extension first, plus a not-a-name-character tail: regex alternation is first-match-wins,
+    // so `js|json` extracted `src/i18n/ar/common.json` as `src/i18n/ar/common.js` and `ts|tsx` turned
+    // `Card.tsx` into `Card.ts`. criterion-scope is a THROWING lint, so a criterion naming a .json,
+    // .tsx or .jsx file that sits squarely inside its own files[] refused to compile, and the refusal
+    // named a path its author never wrote. Order and boundary both: either alone would fix it, and the
+    // pair makes a future extension added in the wrong place harmless (OBS-545).
+    const ext = "tsx|ts|jsx|json|js|mjs|cjs|md|txt";
+    const re = new RegExp(`(?:^|[\\s("'\`])((?:src|tests|fixtures|scripts)/[A-Za-z0-9_@{}*?.,/+-]+\\.(?:${ext}))(?![A-Za-z0-9])`, "g");
+    for (const match of text.matchAll(re)) {
         paths.add(match[1]);
     }
     for (const match of text.matchAll(/\b([A-Za-z0-9_.-]+\.test\.ts)\b/g)) {
@@ -739,6 +747,23 @@ acceptance is required on every task (a nested list of observable outcomes).
       hard value anywhere in the domain, the criterion asserts a universal that may be FALSE ABOUT THE
       WORLD — bound it or say where it stops holding, rather than demanding a value that does not exist.
 
+  WHICH SIDE OF A RUN INHERITS ENVIRONMENT — AND IT DEPENDS ON THE DRIVER (OBS-542):
+    - Gate commands and "command:"/"test:" oracles INHERIT THE DAEMON'S ENVIRONMENT. They are children of
+      the daemon, so launching it as \`bash -c 'set -a; . .env.test; set +a; exec tickmarkr run'\` reaches
+      every one of them.
+    - Under the HERDR driver, a WORKER PANE runs with a FRESH AMBIENT ENVIRONMENT: none of the daemon's
+      exports reach it. It carries only what tickmarkr seeds explicitly — the run's workspace id, the
+      pane's identity, and VITEST_MAX_FORKS (the one daemon value that crosses, so a worker's suites and
+      the gate shells divide the machine the same way). A herdr worker cannot see a secret, a token, or
+      an exported PATH edit, by deliberate design.
+    - Under the SUBPROCESS driver, a worker inherits the daemon's environment wholesale (minus tickmarkr's
+      own control vars).
+    - The driver is resolved at RUN START, never at compile time, so a spec cannot know which one it gets.
+    CONSEQUENCE FOR CRITERIA: anything needing credentials, a bound port, or the network belongs in a
+    "command:"/"test:" oracle — NEVER in a worker's prose report. As prose it is satisfiable under the
+    subprocess driver and impossible under herdr, while the byte-identical command inside an oracle passes
+    under both. Measured: two burned attempts and three gate reds on one task, to learn one sentence.
+
   ORDERING AND OWNERSHIP:
     - Every path has exactly ONE owning task. Two tasks writing one file must be ORDERED by deps, or the
       loser's work is silently dropped when the integration tip advances.

package/dist/drivers/herdr.d.ts

@@ -22,7 +22,32 @@ export declare class DeliveryCorruptedError extends Error {
 export type DriverJournal = (event: string, slotName: string, data: Record<string, unknown>) => void;
 /** First-generation join direction from measured trailer-safe floor (43-MEASUREMENT.md). */
 export declare function workerSplitDirection(paneCols: number | null, safeFloor?: number, margin?: number): "right" | "down";
+export declare const BOARD_TARGET_COLS = 110;
+export declare const BOARD_SEAT_FLOOR_COLS = 40;
+export interface BoardSplitPlan {
+    direction: "right" | "down";
+    /** herdr's split ratio is the FIRST child's share and a right split's first child is the caller,
+     *  so this is what the SEAT keeps. Absent on `down` — the board then takes the full width. */
+    ratio?: number;
+    /** Columns the board gets under this plan; null when it takes the caller's whole width. */
+    boardCols: number | null;
+}
+/** Board-first placement beside the supervising seat: right only while the caller can fund the board
+ *  its target AND leave the seat its floor; otherwise down at full width, never a squeezed board.
+ *  An unmeasurable caller falls back to down like every other placement here (fail closed). */
+export declare function boardSplitPlan(callerCols: number | null, boardCols?: number, seatFloor?: number): BoardSplitPlan;
 export declare function taskGroupOf(name: string): string | undefined;
+/** The operator-facing TITLE for a tab this driver creates when no stage label is supplied: a task
+ *  token for a worker (`T5`, `T5↻2` on a retry) and ROLE + task for a gate pane (`REVIEW T5`) — the
+ *  same vocabulary `renameGroupTab` and the gate call sites already speak. Any name with no task
+ *  identity keeps today's behaviour and titles the tab after the slot itself.
+ *
+ *  Load-bearing because this fallback IS reached in production: once a group's join degrades (D-09,
+ *  `groupSlot`), every later member takes the per-slot path, and the durable PANE name went onto the
+ *  tab — `tickmarkr:worker:T5:1:run-20260819-022723-0000000000001591`, 58 chars, four of them across
+ *  one tab bar (OBS-45's class, live again 2026-08-19 on run …1591). A durable identity and a human
+ *  title are different strings; `pane rename` still gets the identity, unchanged. */
+export declare function tabLabelFor(name: string): string;
 export declare class HerdrDriver implements ExecutorDriver {
     private bin;
     private workersPerTab;
@@ -89,7 +114,7 @@ export declare class HerdrDriver implements ExecutorDriver {
     notify(msg: string, opts?: NotifyOpts): Promise<void>;
     close(slot: Slot): Promise<void>;
     private closeGrouped;
-    private priorWatch;
+    private ownedWatchPanes;
     private watchSlot;
     narrator(cwd: string, command: string, runId?: string): Promise<Slot>;
     reconcile(desired: Set<string>, runId: string, opts?: {

package/dist/drivers/herdr.js

@@ -67,6 +67,22 @@ export function workerSplitDirection(paneCols, safeFloor = TRAILER_SAFE_FLOOR_CO
         return "down";
     return paneCols / 2 >= safeFloor + margin ? "right" : "down";
 }
+// The watch board's geometry, deliberately NOT the trailer floor above. `workerSplitDirection`
+// halves the caller and refuses a right split under 108+2 — that bound protects WORKER panes, which
+// print a trailer; the supervising seat + board pair does not. Applied to that pair on 2026-08-18 it
+// sent a 189-column tab's board BELOW the seat and the operator corrected it (QUEUE-v194 criterion 1;
+// skills/tickmarkr-overseer/SKILL.md: "the side placement outranks the halving floor"). So the board
+// is allocated its measured width FIRST and the seat keeps the remainder.
+export const BOARD_TARGET_COLS = 110; // §14a measured clean-render bound for the board
+export const BOARD_SEAT_FLOOR_COLS = 40; // the seat beside it still has to be usable
+/** Board-first placement beside the supervising seat: right only while the caller can fund the board
+ *  its target AND leave the seat its floor; otherwise down at full width, never a squeezed board.
+ *  An unmeasurable caller falls back to down like every other placement here (fail closed). */
+export function boardSplitPlan(callerCols, boardCols = BOARD_TARGET_COLS, seatFloor = BOARD_SEAT_FLOOR_COLS) {
+    if (callerCols == null || callerCols < boardCols + seatFloor)
+        return { direction: "down", boardCols: null };
+    return { direction: "right", ratio: Math.round(((callerCols - boardCols) / callerCols) * 1e4) / 1e4, boardCols };
+}
 /** The tab a slot belongs to: its TASK — worker, judge, review and consult panes for one task share it.
  *  Returns undefined for everything else, which keeps those on the dedicated-tab path.
  *
@@ -81,6 +97,24 @@ export function taskGroupOf(name) {
         return undefined;
     return taskId && taskId.trim() ? taskId : undefined;
 }
+/** The operator-facing TITLE for a tab this driver creates when no stage label is supplied: a task
+ *  token for a worker (`T5`, `T5↻2` on a retry) and ROLE + task for a gate pane (`REVIEW T5`) — the
+ *  same vocabulary `renameGroupTab` and the gate call sites already speak. Any name with no task
+ *  identity keeps today's behaviour and titles the tab after the slot itself.
+ *
+ *  Load-bearing because this fallback IS reached in production: once a group's join degrades (D-09,
+ *  `groupSlot`), every later member takes the per-slot path, and the durable PANE name went onto the
+ *  tab — `tickmarkr:worker:T5:1:run-20260819-022723-0000000000001591`, 58 chars, four of them across
+ *  one tab bar (OBS-45's class, live again 2026-08-19 on run …1591). A durable identity and a human
+ *  title are different strings; `pane rename` still gets the identity, unchanged. */
+export function tabLabelFor(name) {
+    const { role, taskId, attempt } = canonicalizeLegacyName(name, "");
+    if (!TASK_TAB_ROLES.has(role) || !taskId.trim())
+        return name;
+    if (role !== "worker")
+        return `${role.toUpperCase()} ${taskId}`;
+    return attempt > 0 ? `${taskId}↻${attempt}` : taskId;
+}
 /** Gate panes ride with the task they belong to and never consume the tab cap; everything else does.
  *  Scoped to the three GATE roles deliberately — an earlier cut of this said "not a worker", which let
  *  role:"other" members (any unrecognised name) bypass the cap and silently disabled overflow for
@@ -303,7 +337,7 @@ export class HerdrDriver {
     // label defaults to the slot name; group tabs pass the STAGE name instead — a first-member label
     // outlives its member once keepPanes reaps it (run-20260709-104447: the codex pane sat in a tab
     // named after a dead cursor worker and the operator read it as a mislabeled agent)
-    async tabSlot(cwd, name, label = name) {
+    async tabSlot(cwd, name, label = tabLabelFor(name)) {
         // tab-per-slot: concurrent agents in one tab split it into sliver columns — TUIs exit or
         // hard-wrap at COLUMNS≈2, shredding even the TICKMARKR_RESULT marker (v1.4 phase-1 incident).
         // A dedicated named tab gives every agent a full-width pane; tab close() reaps it.
@@ -400,7 +434,17 @@ export class HerdrDriver {
                 const joined = await this.joinGroup(cwd, name, group, latest);
                 if (joined)
                     return joined;
-                state.splitUnsupported = true; // D-09 fail-safe: this and future members degrade to per-slot tabs
+                // D-09 fail-safe: this and future members degrade to per-slot tabs. Best-effort notify, on
+                // the relabel-failure precedent below: the latch is PERMANENT for the group and was the one
+                // layout decision this driver made with no record anywhere — an operator reading a scattered
+                // tab bar had no way to learn a split had failed once, hours earlier.
+                state.splitUnsupported = true;
+                try {
+                    await this.notify(`tickmarkr tab grouping degraded: ${group} can no longer join by split — every later member opens its own tab`);
+                }
+                catch {
+                    /* cosmetic only — never blocks membership or teardown (v1.18 invariant) */
+                }
                 return this.tabSlot(cwd, name);
             }
             return this.newGeneration(cwd, name, group, state); // cap full → overflow to a new generation tab
@@ -991,7 +1035,11 @@ export class HerdrDriver {
                 this.groups.delete(slot.group); // group dies when all generations gone
         }
     }
-    async priorWatch(runId) {
+    // Every surviving tickmarkr-owned board in this workspace — a PRIOR run's and one already wearing
+    // this run's own name alike. Both are retired before a new board opens (narrator): what a pane this
+    // process did not create is actually RUNNING cannot be read back, and the pre-v1.94 implementation
+    // launched a bare `tickmarkr status --watch`, which follows the newest journal.
+    async ownedWatchPanes() {
         if (!this.ws)
             throw new Error("herdr watch placement requires HERDR_WORKSPACE_ID — refusing unseeded pane");
         const list = await this.herdr("pane list");
@@ -1006,20 +1054,24 @@ export class HerdrDriver {
         }
         if (!Array.isArray(panes))
             throw new Error(`herdr pane list returned no panes: ${list.stdout}`);
-        const prior = panes.find((p) => {
+        return panes.filter((p) => {
             const owned = typeof p.label === "string" ? parseOwnedName(p.label) : null;
-            return p.workspace_id === this.ws && typeof p.pane_id === "string" && owned?.role === "watch" && owned.taskId === "run" && owned.runId !== runId;
-        });
-        return prior?.pane_id ?? null;
+            return p.workspace_id === this.ws && typeof p.pane_id === "string" && owned?.role === "watch" && owned.taskId === "run";
+        }).map((p) => p.pane_id);
     }
-    // T2: the watch is a rightward sibling of the daemon's own pane, never a separate tab. Its durable
-    // owned name lets a resumed daemon find an already-running watch instead of stacking another one.
+    // T2: the watch is a sibling of the daemon's own pane, never a separate tab — beside it when the
+    // tab can fund the board its width, below it at full width when it cannot. Its durable owned name
+    // is how a later daemon RECOGNIZES the board it must retire, so a run never stacks a second one.
     async watchSlot(cwd, name) {
         if (!this.ws)
             throw new Error("herdr watch placement requires HERDR_WORKSPACE_ID — refusing unseeded pane");
         if (!this.callerPane)
             throw new Error("herdr watch placement requires HERDR_PANE_ID — refusing untargeted split");
-        const sp = await this.herdr(`pane split ${shq(this.callerPane)} --direction right --no-focus`);
+        // Board width first (boardSplitPlan), measured off the caller through the driver's own layout
+        // read — never an unconditional right split, and never the worker halving rule.
+        const plan = boardSplitPlan(await this.paneWidth(this.callerPane));
+        const ratio = plan.ratio == null ? "" : ` --ratio ${plan.ratio}`;
+        const sp = await this.herdr(`pane split ${shq(this.callerPane)} --direction ${plan.direction}${ratio} --no-focus`);
         if (sp.code !== 0)
             throw new Error(`herdr watch split failed: ${sp.stderr || sp.stdout}`);
         let pane;
@@ -1043,31 +1095,27 @@ export class HerdrDriver {
         }
         return { id: pane, name, cwd };
     }
-    // T6 narrator: the run's single live status surface. Reuse a local or already-running owned watch;
-    // a new run reowns its prior watch, and only a newly split pane receives the watch command. The
-    // status command reads the latest run every frame, so the renamed pane follows the new run without
-    // interrupting the operator's watch loop. Failures propagate — the daemon swallows.
+    // T6 narrator: the run's single live status surface, RUNNING THE COMMAND THIS CALL SUPPLIED. Only
+    // a board this driver instance itself opened is reused (this.watches); any other surviving board —
+    // a prior run's, or one already carrying this run's canonical name after a resume — is retired and
+    // re-split, because adoption cannot restart or even read the process inside it and a pre-v1.94 pane
+    // is running the bare `tickmarkr status --watch`, which narrates the newest journal instead of this
+    // run. The retirement is VERIFIED gone before the replacement splits: reconcile is no backstop here
+    // (panesToClose skips role "watch" by design, types.ts:92), so an unverified close would leave two
+    // boards bound to different runs. Failures propagate — the daemon swallows.
     async narrator(cwd, command, runId) {
         const name = runId ? formatOwnedName({ role: "watch", taskId: "run", attempt: 0, runId }) : `narrator-watch-${process.pid}`;
         return this.serial(async () => {
             const cached = this.watches.get(name);
             if (cached)
                 return cached;
-            const existing = await this.namedPaneId(name);
-            if (existing) {
-                const s = { id: existing, name, cwd };
-                this.watches.set(name, s);
-                return s;
-            }
-            const prior = runId ? await this.priorWatch(runId) : null;
-            if (prior) {
-                const renamed = await this.herdr(`pane rename ${shq(prior)} ${shq(name)}`);
-                if (renamed.code !== 0 || await this.namedPaneId(name) !== prior) {
-                    throw new Error(`herdr watch reclaim failed: ${renamed.stderr || renamed.stdout}`);
-                }
-                const s = { id: prior, name, cwd };
-                this.watches.set(name, s);
-                return s;
+            const stale = await this.ownedWatchPanes();
+            for (const pane of stale)
+                await this.herdr(`pane close ${shq(pane)}`);
+            if (stale.length) {
+                const survived = (await this.ownedWatchPanes()).filter((p) => stale.includes(p));
+                if (survived.length)
+                    throw new Error(`herdr watch retire failed: ${survived.join(", ")} survived close — refusing a second board`);
             }
             const s = await this.watchSlot(cwd, name);
             this.watches.set(name, s);

package/dist/gates/acceptance.js

@@ -10,6 +10,7 @@ import { checkTaskDiffCaps, fetchTaskDiff, isProtectedEvidence, setAsideReceiptP
 import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
 import { classifyVerdictCause } from "./verdict-cause.js";
 import { reviewableLogicDiff } from "./artifact-manifest.js";
+import { classifyFailureOutput } from "./baseline.js";
 // Fable F4: acceptance judge shares review's 900s timeout — 300s default killed frontier judges on cap-sized diffs.
 const JUDGE_TIMEOUT_MS = 900_000;
 const CitationSchema = z.object({ path: z.string(), line: z.number().int() });
@@ -177,6 +178,29 @@ function tail(out, n = 8) {
         return "";
     return "\n" + t.split("\n").slice(-n).join("\n");
 }
+/**
+ * OBS-540: classify only bytes produced by the deterministic oracle process. A nonzero command with
+ * an infra-only output shape returned no product verdict, so it remains fail-closed but cannot be
+ * billed as a diff failure. Judge reasons never reach this helper: the judge path starts after the
+ * deterministic loop and a parsed refusal is an evaluated quality verdict whatever its prose says.
+ */
+function oracleExecutionFailure(label, code, stdout, stderr) {
+    const output = [stderr, stdout].filter((part) => part.length > 0).join("\n");
+    const classification = classifyFailureOutput(output);
+    if (classification === "infra") {
+        return {
+            gate: "acceptance",
+            pass: false,
+            details: `oracle failed: ${label} (exit ${code}) — infrastructure blocked execution before a verdict; this oracle verified nothing${tail(output)}`,
+            meta: { cause: "oracle-execution", classification, infra: true, retryable: false },
+        };
+    }
+    return {
+        gate: "acceptance",
+        pass: false,
+        details: `oracle failed: ${label} (exit ${code})${tail(stderr || stdout)}`,
+    };
+}
 // v1.70 / OBS-129: the new-file line numbers each changed HUNK spans, per path — parsed from the
 // unified-diff so a citation is validated against real changed regions, not a substring of the whole
 // diff text (which also matches the diff's own +++/@@ headers). A hunk's span is every new-file line it
@@ -289,8 +313,7 @@ export async function acceptanceGate(task, worktree, baseRef, judge, via, opts =
         if (isCommand(a)) {
             const r = await sh(a.command, worktree);
             if (r.code !== 0) {
-                return { gate: "acceptance", pass: false,
-                    details: `oracle failed: $ ${a.command} (exit ${r.code})${tail(r.stderr || r.stdout)}` };
+                return oracleExecutionFailure(`$ ${a.command}`, r.code, r.stdout, r.stderr);
             }
             passedDet.push(`✓ $ ${a.command} (exit 0)`);
         }
@@ -302,8 +325,7 @@ export async function acceptanceGate(task, worktree, baseRef, judge, via, opts =
             const r = await sh(testFiltered(opts.testCmd, a.test), worktree);
             const out = (r.stderr || "") + "\n" + (r.stdout || "");
             if (r.code !== 0) {
-                return { gate: "acceptance", pass: false,
-                    details: `oracle failed: test "${a.test}" (exit ${r.code})${tail(r.stderr || r.stdout)}` };
+                return oracleExecutionFailure(`test "${a.test}"`, r.code, r.stdout, r.stderr);
             }
             // OBS-55: exit 0 alone is vacuous when the name filter matched zero tests — fail closed.
             const ran = testsRan(out);

package/dist/gates/baseline.d.ts

@@ -3,13 +3,22 @@ import type { AcceptanceItem } from "../graph/schema.js";
 import { type ShResult } from "../run/git.js";
 import type { GateResult } from "./types.js";
 export interface BaselineCommand {
-    exitCode: number;
+    /**
+     * Absent when the capture returned no verdict — see `infra`. A pre-v1.90 baseline can also lack it
+     * (legacy entries read as red-at-baseline, the `?? 1` default both readers share).
+     */
+    exitCode?: number;
     fingerprints: string[];
     missingCommand?: boolean;
     /** What this command actually took at capture, on a pristine tree. Absent in pre-v1.90 baselines. */
     durationMs?: number;
     /** The ceiling that measurement implies, persisted so every later battery uses the same number. */
     ceilingMs?: number;
+    /**
+     * OBS-534 (T2): the capture was SIGKILLed at its ceiling. It never finished asking the question, so
+     * the entry carries a CAUSE and no verdict: no exit code, no fingerprints, nothing forgivable.
+     */
+    infra?: true;
 }
 export interface Baseline {
     commands: Record<string, BaselineCommand>;

package/dist/gates/baseline.js

@@ -107,7 +107,11 @@ const VOCAB_RE = /\b(?:error|fail(?:ed|ure|ing)?)\b/i;
 // test-level failure — "AssertionError after spawn EAGAIN" names one and is a regression; "spawn
 // EAGAIN" and "Error: spawn EAGAIN" name none and are infra. One regression line anywhere in the
 // output makes the whole output a regression, whatever else the runner printed.
-const INFRA_RE = /\bE(?:AGAIN|MFILE|NFILE|NOMEM|NOSPC)\b|JavaScript heap out of memory|Cannot allocate memory|Resource temporarily unavailable/;
+// OBS-540: command-oracle startup failures are execution evidence too. These two Playwright/keyring
+// shapes are emitted by the process that was asked to run the oracle; they are deliberately kept in
+// this runner-output classifier rather than applied to any judge-authored reason text. A real test
+// failure still dominates below because one regression-shaped line makes the whole output regression.
+const INFRA_RE = /\bE(?:AGAIN|MFILE|NFILE|NOMEM|NOSPC)\b|JavaScript heap out of memory|Cannot allocate memory|Resource temporarily unavailable|Token not found in system keyring|Process from config\.webServer was not able to start/i;
 // A named error CLASS ("AssertionError", "TypeError", "MyDomainError") — never bare "Error", which
 // is what an errno report itself is headed with (`Error: spawn EAGAIN`). The prefix is required.
 const ERROR_CLASS_RE = /\b[A-Za-z][A-Za-z0-9]*Error\b/;
@@ -170,7 +174,11 @@ const renormalize = (fp) => normalizeLine(fp.replace(ANSI_RE, ""));
  * whether the output carried no recognizable failure shape at all.
  */
 export function freshFailures(entry, raw) {
-    const known = new Set((entry?.fingerprints ?? []).map(renormalize));
+    // OBS-534 (T2): an infra-recorded entry is a KILL, not a verdict — whatever fingerprints it carries
+    // came from output flushed before the kill, over a suite that never finished. Nothing there is
+    // "pre-existing", so it forgives nothing. The rule lives here rather than in either caller, so the
+    // battery and tip verify inherit it from the one helper they already share.
+    const known = new Set(entry?.infra === true ? [] : (entry?.fingerprints ?? []).map(renormalize));
     // OBS-42: diagnostic headings enrich fingerprints but cannot invalidate legacy baselines.
     const current = fingerprint(raw);
     const fresh = current.filter((f) => !known.has(f) && (!FAIL_ANCHOR_RE.test(f) || f.startsWith("FAIL ")));
@@ -318,6 +326,19 @@ export async function captureBaseline(cwd, commands) {
         // ponytail: a capture that was itself killed records the ceiling as its "measurement", which
         // scales the next ceiling up — the right direction for a suite that never finished once.
         const durationMs = r.durationMs ?? 0;
+        // OBS-534 (T2): a capture SIGKILLed at its ceiling never returned a verdict, so `r.code` is the
+        // kill and not evidence about the command. Run 1501 recorded `test: {durationMs: 600007,
+        // exitCode: 1}` for exactly this — a kill written down as a red baseline. There the accident
+        // helped (the inflated ceiling is why every task gate passed); the same accident can mark a
+        // GREEN command permanently red-at-baseline and hand every later gate free forgiveness for
+        // failures the diff really did cause. So record the cause and nothing forgivable: no exit code,
+        // and none of the partial output the runner had flushed before the kill. The measurement stays —
+        // it is the one thing the kill did establish — and still scales the next ceiling up.
+        // `timedOut` is set in exactly one place (git.ts's kill timer), so no ordinary exit reaches here.
+        if (r.timedOut === true) {
+            base.commands[name] = { infra: true, fingerprints: [], durationMs, ceilingMs: effectiveCeilingMs({ durationMs }) };
+            continue;
+        }
         base.commands[name] = {
             exitCode: r.code,
             // a command that exits 0 has no failures to fingerprint — recording any would be a lie the
@@ -393,7 +414,8 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
             results.push({ gate: name, pass: true, details: `no ${name} command detected — skipped`, meta: { skipped: true } });
             continue;
         }
-        const ceilingMs = effectiveCeilingMs(baseline.commands[name]);
+        const entry = baseline.commands[name];
+        const ceilingMs = effectiveCeilingMs(entry);
         const r = await sh(cmd, cwd, ceilingMs);
         // Q24: the kill is read BEFORE the exit code is interpreted at all. A SIGKILLed battery has
         // whatever partial output it had flushed — typically no failure shape — so every path below
@@ -431,9 +453,16 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
         // below rather than reading as a verified green. Raise the ceiling by teaching isFailureShaped
         // that runner's position rule (leading verdict + identifier, or identifier + separator + trailing
         // verdict); loosening back to vocabulary re-opens OBS-278.
-        const { failing, unreadable } = freshFailures(baseline.commands[name], raw);
-        if (!failing.length && (baseline.commands[name]?.exitCode ?? 1) === 0) {
-            const closed = `command was green at baseline but now exits ${r.code} with no recognizable failure lines — failing closed`;
+        const { failing, unreadable } = freshFailures(entry, raw);
+        // OBS-534 (T2): only a recorded VERDICT can be forgiven. A green baseline has no red to forgive,
+        // and neither has a capture that was killed at its ceiling — it recorded a cause instead, so it
+        // fails closed on the same branch rather than reading as "only pre-existing failures". Legacy
+        // entries with no exitCode keep the `?? 1` red default both readers share (merge.ts:131).
+        const baselineRed = entry?.infra !== true && (entry?.exitCode ?? 1) !== 0;
+        if (!failing.length && !baselineRed) {
+            const closed = entry?.infra === true
+                ? `the baseline capture for this command was killed at its ceiling and recorded no verdict, so nothing here is forgivable — it now exits ${r.code} with no recognizable failure lines — failing closed`
+                : `command was green at baseline but now exits ${r.code} with no recognizable failure lines — failing closed`;
             const evidence = unrecognizedEvidence(raw);
             results.push({
                 gate: name,

package/dist/run/daemon.d.ts

@@ -58,6 +58,11 @@ export interface RunSummary {
  */
 export declare function outstandingApprovals(events: JournalEvent[]): string[];
 export declare function formatSummary(s: RunSummary): string;
+/** The narrator's command, bound to THIS run. `status` takes exactly one positional and it is the
+ *  run id (cli/commands/status.ts positionalRunId), so naming it here is what stops the board from
+ *  following the newest journal in a repo that already carries a second, newer run — a board showing
+ *  the wrong run is a recorded incident (skills/tickmarkr-overseer/SKILL.md). */
+export declare const watchCommand: (runId: string) => string;
 /**
  * R3 (OBS-186): a gate that DECLINED to run is not a gate that failed. The review gate's skip branch
  * no longer forges `pass: true` to buy passage, so the merge decision has to read the same predicate