tickmarkr 1.93.0 → 1.97.0

package/dist/run/daemon.js

@@ -117,6 +117,11 @@ export function formatSummary(s) {
         : "";
     return `done: ${s.done.length}, failed: ${s.failed.length}, human: ${s.human.length}, blocked: ${s.blocked.length}, pending: ${s.pending.length}\nintegration branch: ${s.branch}${tip}${outstanding}`;
 }
+/** The narrator's command, bound to THIS run. `status` takes exactly one positional and it is the
+ *  run id (cli/commands/status.ts positionalRunId), so naming it here is what stops the board from
+ *  following the newest journal in a repo that already carries a second, newer run — a board showing
+ *  the wrong run is a recorded incident (skills/tickmarkr-overseer/SKILL.md). */
+export const watchCommand = (runId) => `tickmarkr status --watch ${runId}`;
 const MAX_ATTEMPTS = 10; // ponytail: hard cap so a pathological ladder can never loop forever
 // v1.85 T3 (retry economics): two repairs per engagement, then the fresh ladder. A repair re-uses the
 // findings and the landed diff instead of re-buying onboarding; when two of them have not closed the
@@ -1157,13 +1162,14 @@ export async function runDaemon(repoRoot, opts = {}) {
             // T6: open the narrator AFTER run-start/run-resume is journaled so the watch surface has a run to
             // show. driver.narrator is undefined on subprocess → no-op (subprocess spawns nothing). Swallowed:
             // a failed-to-open or later-dead watch pane never affects the run.
-            // OBS-103: hold the returned slot — narrator() adopts an already-open watch by its owned name
-            // (a prior daemon instance's, after a stop→resume cycle), so the run-end sweep below can retire
-            // it regardless of which instance split the pane.
+            // OBS-103: hold the returned slot — narrator() returns the run's board under its canonical owned
+            // name whichever way it got there (the herdr driver retires a survivor it finds and re-splits, so
+            // the live command is run-bound), and the run-end sweep below retires it by that name regardless
+            // of which daemon instance split the pane.
             const watchName = formatOwnedName({ role: "watch", taskId: "run", attempt: 0, runId });
             let watchSlot;
             try {
-                watchSlot = await driver.narrator?.(repoRoot, "tickmarkr status --watch", runId);
+                watchSlot = await driver.narrator?.(repoRoot, watchCommand(runId), runId);
             }
             catch {
                 /* cosmetic-only — the run proceeds without a live surface */
@@ -1350,6 +1356,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // be able to tell "the suite found a defect" from "the runner never ran", and the merge
                         // predicate's reason for refusing has to be legible in the ledger it refused from.
                         ...(g.meta?.infra === true ? { infra: true } : {}),
+                        // OBS-540: preserve terminal-vs-retryable infra exactly. normalizeGateOutcome deliberately
+                        // defaults a legacy infra row to retryable, so dropping an explicit false here reverses the
+                        // oracle's recorded verdict when any journal-backed reader reconstructs it.
+                        ...(g.meta?.infra === true && typeof g.meta.retryable === "boolean"
+                            ? { retryable: g.meta.retryable }
+                            : {}),
                         // R3 (OBS-186): a declined review is journal truth, not an absence. `skipped: true` alone
                         // says a gate did not run; these say WHICH policy declined it and WHY, so a reader of the
                         // ledger never has to infer participation from a details string. The green-skip branch that
@@ -2941,6 +2953,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                         }
                         break gateLoop;
                     }
+                    // OBS-540: infra is a fail-closed NON-verdict, not quality degradation. Park with the blocker
+                    // already journaled by onGate, before gateFails and before any ladder selection can fund an
+                    // identical retry in the same environment. Parsed judge refusals never carry infra and keep
+                    // flowing through the chargeable quality path below.
+                    const infraFailure = results.find((g) => gateFailed(g) && g.meta?.infra === true);
+                    if (infraFailure) {
+                        await park(t, `${infraFailure.gate}: ${infraFailure.details}`, "infra", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
+                        return;
+                    }
                     gateFails++; // this attempt's gates failed — the one place quality degradation is verified (never inferred from attempts)
                     // v1.53 T3: prefer the CLI's own session id captured from this attempt's output (kimi's resume
                     // trailer) over the harness slot name; absent hook or no capture keeps today's slot-name id.

package/dist/run/merge.d.ts

@@ -1,5 +1,5 @@
 import type { TickmarkrConfig } from "../config/config.js";
-import { type Baseline } from "../gates/baseline.js";
+import { type Baseline, type FailureClassification } from "../gates/baseline.js";
 export interface TipVerifyResult {
     gate: string;
     cmd: string;
@@ -10,6 +10,11 @@ export interface TipVerifyResult {
     artifact?: string;
     /** Q121s: nonzero exit whose failures are ALL baseline-recorded — forgiven exactly as the battery forgives. */
     forgiven?: boolean;
+    /**
+     * OBS-534: what a nonzero exit is evidence OF, taken from the battery's own readers — `ceilingKillResult`
+     * for a kill, `classifyFailureOutput` for everything else. `infra` means nothing was verified.
+     */
+    cause?: FailureClassification;
 }
 export declare function integrationBranch(cfg: TickmarkrConfig, runId: string): string;
 export declare function ensureIntegration(repo: string, branch: string, baseRef: string): Promise<string>;

package/dist/run/merge.js

@@ -1,7 +1,7 @@
 import { existsSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { shq } from "../adapters/types.js";
-import { classifyFailureOutput, fingerprint, freshFailures } from "../gates/baseline.js";
+import { ceilingKillResult, classifyFailureOutput, effectiveCeilingMs, fingerprint, freshFailures, } from "../gates/baseline.js";
 import { tickmarkrDir } from "../graph/graph.js";
 import { gitHead, linkNodeModules, resolveIntegrationBranch, sh, shGit, shGitOk, WORKTREES_DIR } from "./git.js";
 export function integrationBranch(cfg, runId) {
@@ -53,21 +53,55 @@ export async function mergeTask(intWt, taskBranch, message, gatedCommit) {
 export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
     const results = [];
     for (const [gate, cmd] of Object.entries(commands)) {
-        const r = await sh(cmd, intWt);
+        const entry = baseline?.commands[gate];
+        // OBS-534: the ceiling is the BATTERY's, derived by effectiveCeilingMs from the same baseline entry
+        // this loop already reads for forgiveness two lines down — never the flat DEFAULT_SHELL_TIMEOUT_MS
+        // `sh` defaults to. A suite whose capture measured 600007ms carries a recorded 1800021ms ceiling;
+        // running it under 600000ms here SIGKILLed a green tip three times while every per-task gate passed.
+        const ceilingMs = effectiveCeilingMs(entry);
+        const r = await sh(cmd, intWt, ceilingMs);
         const raw = r.stdout + "\n" + r.stderr;
         const stripped = raw.split(intWt).join("");
-        const entry = baseline?.commands[gate];
+        const artifact = join(runDir, `tip-verify-${gate}.log`);
+        // Battery parity on the ceiling too (baseline.ts Q24): the kill is read BEFORE the exit code is
+        // interpreted at all. A SIGKILLed battery never returned a verdict, so no line of its partial
+        // output is one — fingerprinting it is what produced the `<unrecognized failure output>` an
+        // operator cannot act on. The kill reader's own text (ceiling + elapsed) and cause replace it.
+        const killed = ceilingKillResult(gate, r, ceilingMs);
+        if (killed) {
+            writeFileSync(artifact, raw);
+            results.push({
+                gate,
+                cmd,
+                pass: false,
+                exitCode: r.code,
+                fingerprints: [],
+                details: killed.details,
+                cause: killed.meta?.classification,
+                artifact,
+            });
+            continue;
+        }
         const { failing, unreadable } = freshFailures(entry, stripped);
+        const cause = r.code === 0 ? undefined : classifyFailureOutput(stripped);
         // `?? 1` is the battery's own default (baseline.ts compareToBaseline): an exitCode-less legacy
         // entry reads as red-at-baseline there, so it must read the same here or old baselines silently
-        // lose forgiveness. Battery parity on the infra rule too (T9): infrastructure-only output means
-        // the runner never completed a suite — nothing was verified, so nothing is forgivable, however
-        // familiar its fingerprints. Stricter-than-battery edge kept: unreadable output never forgives.
-        const forgiven = r.code !== 0 && entry !== undefined && (entry.exitCode ?? 1) !== 0
-            && failing.length === 0 && !unreadable && classifyFailureOutput(stripped) !== "infra";
+        // lose forgiveness. OBS-534 (T2): a capture killed at its ceiling now records a CAUSE and no
+        // verdict, and that default must not launder the missing exit code back into red-at-baseline.
+        // Only a recorded verdict is forgivable, so this reads the same predicate the battery does
+        // (baseline.ts `baselineRed`) — `infra` first, the legacy default only after it. freshFailures
+        // already drops the killed capture's flushed fingerprints, but it cannot close this alone: an
+        // output whose only shape is a diagnostic HEADING (vitest's "Unhandled Errors" banner) is
+        // fingerprintable yet OBS-42-exempt from rejecting, so `failing` comes back empty, `unreadable`
+        // false and the cause reads "regression" — every other guard satisfied, and a real red forgiven
+        // against a capture that never finished asking the question.
+        const baselineRed = entry !== undefined && entry.infra !== true && (entry.exitCode ?? 1) !== 0;
+        // Battery parity on the infra rule too (T9): infrastructure-only output means the runner never
+        // completed a suite — nothing was verified, so nothing is forgivable, however familiar its
+        // fingerprints. Stricter-than-battery edge kept: unreadable output never forgives.
+        const forgiven = r.code !== 0 && baselineRed && failing.length === 0 && !unreadable && cause !== "infra";
         const pass = r.code === 0 || forgiven;
-        const artifact = pass ? undefined : join(runDir, `tip-verify-${gate}.log`);
-        if (artifact)
+        if (!pass)
             writeFileSync(artifact, raw);
         results.push({
             gate,
@@ -79,7 +113,8 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
                 : forgiven ? `exit ${r.code} but only baseline-recorded failures (forgiven vs baseline)`
                     : `exit ${r.code}`,
             ...(forgiven ? { forgiven: true } : {}),
-            ...(artifact ? { artifact } : {}),
+            ...(cause ? { cause } : {}),
+            ...(pass ? {} : { artifact }),
         });
     }
     return results;

package/fixtures/gsd-sample/07-live-check/07-01-PLAN.md

@@ -20,7 +20,7 @@ Implement the first objective sentence. Additional prose that is not the title.
 </objective>
 
 <context>
-@.planning/PROJECT.md
+@fixtures/gsd-sample/PROJECT.md
 @$HOME/.claude/get-shit-done/workflows/execute-plan.md
 @~/somewhere/outside.md
 </context>

package/fixtures/gsd-sample/PROJECT.md

@@ -0,0 +1,19 @@
+# Sample project — vendored GSD fixture input
+
+This file exists so the sibling phase's `07-01-PLAN.md` can cite a repo-relative `<context>` path that
+is **part of the fixture itself**. It previously cited `.planning/PROJECT.md`, which resolved only
+inside the private development checkout: the public export strips `.planning/` at any depth, so the
+compiler's context-reachability refusal (v1.96 T3) correctly failed eight tests on the exported tree
+and the release ritual's pre-tag proof caught it. A vendored fixture must carry its own inputs.
+
+Nothing here is read by an assertion — the fixture only needs the path to resolve. The prose stands in
+for the project brief a real GSD plan would point a worker at.
+
+## Objective
+
+Ship a small feature end to end, with each plan in the phase owning one objective sentence.
+
+## Constraints
+
+- One plan, one objective.
+- A plan's `<context>` block promises the worker can read every repo-relative path it lists.

package/fixtures/payload-shape/p99-shaped.spec.md

@@ -0,0 +1,68 @@
+<!-- tickmarkr:spec -->
+<!-- provenance: the shape of .planning/phases/99-arabic-coverage as compiled on 2026-08-18 into
+     run-20260818-185710-0000000000000011 (41 tasks). OBS-535's fix — files[] is write scope, not
+     payload — was measured against that graph (41 unreadable-payload lints to 0; 31 overflow lints
+     when the window is forced to 50k) and against nothing in this repo, because no fixture carried
+     its shape. This one does, at five tasks instead of forty-one.
+
+     The four shape features that made every task on that graph skip its context-window comparison,
+     each present below:
+       1. a brace-glob write scope (`scripts/{a,b}`) — a set, not a document; unmeasurable as one file
+       2. an output declared in files[] (`*-SUMMARY.md`) — absent from the base tree BY CONSTRUCTION
+       3. a wave-1 artifact consumed by a TRANSITIVE dependent (T3 reads what T1 writes, via T2)
+       4. the same artifact cited by a task with NO producer upstream (T4) — the actionable class,
+          which on the real graph was 17 tasks citing a self-gitignored tree (RULING-P99-14)
+     T5 adds the class no commit can ever satisfy: a ref under a gitignored directory.
+
+     Compile this fixture from a NON-REPO directory. compileNative's context reachability check
+     (native.ts:684) fails open when git cannot answer, and T3/T4/T5 deliberately cite paths absent
+     from any base tree — that absence is the fixture's whole subject. -->
+
+## T1: Land the instruments the later waves measure with
+- goal: Write the two audit instruments and this task's own summary, so a later wave has something to read
+- shape: implement
+- files: scripts/{audit-strict.mjs,census.mjs}, .planning/payload-shape/T1-SUMMARY.md
+- context: docs/payload-shape/PLAN.md
+- complexity: 3
+- acceptance:
+  - command: node -e "process.exit(0)"
+  - judge: both instruments exist and the summary records what they measured
+
+## T2: Rewrite the localisation sources the instruments flag
+- goal: Apply the instrument's findings across the localisation sources named in the write scope
+- shape: implement
+- deps: T1
+- files: src/i18n/{ar/common.json,en/common.json,ar/dossier.json,en/dossier.json,ar/intake.json,en/intake.json,ar/tasks.json,en/tasks.json,ar/settings.json,en/settings.json}, .planning/payload-shape/T2-SUMMARY.md
+- context: docs/payload-shape/PLAN.md, scripts/audit-strict.mjs
+- complexity: 5
+- acceptance:
+  - judge: every key src/i18n/ar/common.json shares with its en counterpart carries a non-empty Arabic value, and .planning/payload-shape/T2-SUMMARY.md records the count it rewrote
+
+## T3: Close the census the second instrument opens
+- goal: Read the census instrument written two waves back and close its remaining senses
+- shape: implement
+- deps: T2
+- files: src/i18n/{ar/common.json,en/common.json}, .planning/payload-shape/T3-SUMMARY.md
+- context: docs/payload-shape/PLAN.md, scripts/census.mjs
+- complexity: 4
+- acceptance:
+  - judge: the census reports no unresolved sense for any rewritten key
+
+## T4: Report on the audit without depending on the task that writes it
+- goal: Summarise the audit's findings for the operator record
+- shape: chore
+- files: .planning/payload-shape/T4-SUMMARY.md
+- context: docs/payload-shape/PLAN.md, scripts/audit-strict.mjs
+- complexity: 2
+- acceptance:
+  - judge: .planning/payload-shape/T4-SUMMARY.md states both the flagged-site count and the total key count it was measured against
+
+## T5: Apply the standing ruling to the rewritten sources
+- goal: Enforce the ruling's terminology decisions across the sources T2 rewrote
+- shape: chore
+- deps: T2, T3
+- files: src/i18n/{ar/common.json,en/common.json}
+- context: docs/payload-shape/PLAN.md, .state/RULING-TERMINOLOGY.md
+- complexity: 2
+- acceptance:
+  - judge: no file under src/i18n/ar contains the string "Dossier" or "Engagement" in Latin script

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.93.0",
+  "version": "1.97.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-overseer/SKILL.md

@@ -63,15 +63,14 @@ through brief lineage. **An executor choice nobody made is still an executor cho
    tab OVERSEER; create ONE tab ORCHESTRATOR.
    **FIVE-TAB CANON (standing operator layout — corrected three times on 2026-07-27, layout approved
    2026-07-29, re-earned 2026-08-17):**
-   - `OVERSEER` — you, plus a visible pipeline watch pane running the SHIPPED surface (`tickmarkr ui`,
-     newest-run default; never a hand-rolled status loop — the operator flagged an ad-hoc shell-loop
-     watcher as "strange watch design"). A supervision watcher buried in an invisible background task
-     reads as "no watcher" to the operator even when armed.
-   - `ORCH` — the orchestrator, the run's watch board (split `--direction right`, ~0.6 to the board —
-     never `down`; the board needs full height for its task matrix), and the raw journal feed. **Nothing
-     else, ever: a work seat NEVER splits into the ORCH tab**, even when width arithmetic allows a second
-     column. Operator verbatim: *"in orch tab should be the orch and the watcher only."* Re-earned
-     2026-08-17: a planning seat split beside the orchestrator, and the operator caught it, again.
+   - `OVERSEER` — you. Do not add a second live run surface: the daemon self-places the shipped board
+     beside the supervising seat that invokes the run.
+   - `ORCH` — the orchestrator and the daemon-placed, run-id-pinned shipped board beside it. **Look for
+     that `role: "watch"` pane; never hand-place or hand-roll a live run surface. Nothing else, ever: a
+     work seat NEVER splits into the ORCH tab.** Operator verbatim: *"in orch tab should be the orch and
+     the watcher only."* Re-earned 2026-08-17: a planning seat split beside the orchestrator, and the
+     operator caught it, again. The daemon owns the side placement and board-first width allocation;
+     neither the worker-pane halving floor nor an overseer split command places this pane.
    - Worker/seat tabs — tickmarkr opens ONE TAB PER TASK itself; GSD-leg seats get the same treatment
      (own tab, or a shared WORKERS tab), never the ORCH tab.
    - `CONSULT · <topic>` — ONE shared tab for ALL consultants of a round, side-by-side splits; never one
@@ -102,7 +101,7 @@ through brief lineage. **An executor choice nobody made is still an executor cho
    and only then delete. A guard's home must outlive the mission that earned it. The project ledger does
    NOT count as that home — `CLAUDE.md` itself says planning records are read-only archives and current
    guidance belongs in the memory file or the shipped docs.
-4. Arm the watcher (Supervision). Report the hierarchy map (pane ids + names) to the user.
+4. Arm the watcher and your own supervision beat (Supervision). Report the hierarchy map (pane ids + names) to the user.
 
 ## Supervising tickmarkr as the executor — WHO DOES WHAT
 
@@ -114,7 +113,7 @@ and the first thing to get right is that **almost none of it is yours**.
 | | ORCHESTRATOR | OVERSEER |
 |---|---|---|
 | `compile` · `plan` · `run` · `resume` | **owns** | never |
-| journal watchers, live surface, dialog watchers | **owns** | watches the ORCHESTRATOR, not the run |
+| journal and dialog watchers; verifying the daemon's live surface | **owns** | watches the ORCHESTRATOR, not the run |
 | orphan sweeps, worker pane hygiene | **owns** | — |
 | reading a gate failure and assembling its evidence | **owns** | reads the file it writes |
 | **deciding** a gate, spend, or ship | never | **owns** |
@@ -134,10 +133,11 @@ journal tail to decide what happens next, or sweeping orphans — you have taken
 
 ### What the ORCHESTRATOR does, and what you require of it
 
-- **A live surface.** `tickmarkr run` is stdout-silent until run-end by design, and the run spawns its own
-  watch board (`role: "watch"`, one per run) — **look for that pane before building anything.** Do NOT use
-  `tickmarkr status --watch` as the surface: `status <runId>` has reported the WRONG run, so a board built
-  on it shows a previous milestone's numbers under the current run's id.
+- **The live surface arrives with the run.** `tickmarkr run` is stdout-silent until run-end by design;
+  its daemon self-places one shipped `role: "watch"` board beside the supervising seat and pins that
+  board to the daemon's run id. **Look for the matching daemon-placed pane.** If it is absent, treat that
+  as a daemon/run liveness fault and use the normal recovery path; never hand-place, hand-roll, or launch
+  a replacement live surface.
 - **The journal is the source of truth**, not panes. Watchers go on `run-end` / `task-human` /
   `task-failed` / `consult-verdict`; never sleep-poll inside an agent turn. **Never key a watcher on an
   agent's `done`** — that is turn end and fires the moment a seat finishes acknowledging you.
@@ -377,6 +377,26 @@ they are left implicit:
 
 ## Supervision watcher
 
+**Arm your OWN tier first, in the same call chain that arms everything else.** `status` derives each
+tier's state from a beat file the tier itself writes, so a seat that never beats reads `ABSENT` — and
+`ABSENT` means *never armed*, which is a lie about a seat that is working the run. Measured on the P99
+run: `orchestrator ARMED / overseer ABSENT / watch ABSENT` for the whole milestone, with a live overseer
+watching it. Two thirds of that line were constants, not measurements.
+
+The beat is one shipped command and the loop is yours, run from the repo root as its own
+`run_in_background` Bash call:
+
+```bash
+cd <repo> && while :; do tickmarkr beat overseer; sleep 10; done   # 10s = SUPERVISION_BEAT_MS
+tickmarkr beat overseer --stand-down                               # at stand-down, in the same act
+```
+
+One beat per invocation, deliberately: the loop is what proves the seat is alive, so a command that
+kept beating on its own would keep reporting a dead seat as healthy. Stop the loop — or die — and the
+tier ages to `STALE` (never `ABSENT`) within six beats, which is the state that says *armed, then lost*.
+Stand down explicitly when you hand off, or a deliberate exit reads as a death. Same rule as rule 29
+below, now with a conventional path the other tier already reads: `tickmarkr status` shows it.
+
 Arm the bundled watcher as its OWN Bash call with `run_in_background` — chaining it after other commands
 with `&` orphans it from the wake chain. It prints one wake reason and exits; re-arm after every wake.
 
@@ -448,9 +468,9 @@ herdr agent wait <name> --until blocked --timeout <ms>    # run_in_background
 ⚠ **Its exit status is not evidence.** That command exits **0 on timeout** and **0 when the pane is gone**,
 exactly as it does on a real block — so confirm every wake by READING the pane before acting on it.
 
-**And note what no watcher can cover:** the adopted supervision design gives this seat zero watchers and
-wakes it on *product-owned signals* that do not exist until the `supervision-heartbeat` work ships. Until
-then the seat improvises, and an improvised set is where a whole failure class hides. A **host** permission
+**And note what no watcher can cover:** the supervision beat above proves this seat is ARMED and nothing
+more — it is a liveness claim, not a wake signal, so the seat still improvises the wakes, and an improvised
+set is where a whole failure class hides. A **host** permission
 modal is invisible to tickmarkr entirely, so no `src/**` change closes that one — it is covered here or
 nowhere.
 
@@ -531,6 +551,10 @@ orchestrator turn boundary.
     safe 53 → floor 108"*), and it splits right only while `paneWidth/2 ≥ 108 + 2` (`herdr.ts:494`),
     otherwise **down**. Apply the same test by hand: `herdr pane layout --pane <id>`, halve the width,
     and if the halves fall under the floor, split `--direction down`.
+  - **The daemon-placed ORCH board is outside this manual split rule.** The halving bound protects
+    worker-pane trailers; the daemon, not the overseer, places the run-id-pinned shipped board beside
+    the supervising seat and owns its board-first width allocation. Look for that pane and do not split,
+    place, or recreate it.
   - **Binary splits cannot produce an even 3-column row at any width.** 220 goes to 110/55/55 whichever
     pane you split. **At a 220-col terminal the width-derived cap is TWO side-by-side panes**; a third
     seat goes below one of them, or into its own tab. "Three panes" is a *height* heuristic

package/skills/tickmarkr-overseer/scripts/seat-send.sh

@@ -25,7 +25,10 @@
 #
 # First output line is the machine-greppable verdict:
 #   DELIVERED_SUBMITTED | QUEUED_BEHIND_TURN | SEND_UNSUBMITTED | INTERRUPT_FAILED | TARGET_GONE
-#   | REFUSED_SIZE | REFUSED_BOX_OCCUPIED
+#   | REFUSED_SIZE | REFUSED_BOX_OCCUPIED | SEND_UNVERIFIED | SEND_REFUSED | SEND_FAILED
+#
+# A success verdict names the surface that delivered when it was not the default one, so a fallback
+# is visible in the transcript rather than inferred (OBS-552).
 #
 # This verifies SUBMISSION — the text left the input box — never that the seat understood or acted.
 # Read the seat's ARTIFACT for that; a send receipt is not a response.
@@ -46,6 +49,14 @@ status_of() {
     | sed -n 's/.*"agent_status":"\([a-z_]*\)".*/\1/p' | head -1
 }
 
+# The submit-fallback needs a PANE id, and $TARGET may be an agent NAME. `agent get` answers for a
+# detected-but-undrivable seat — it is only `agent prompt` that refuses one (OBS-552) — so this
+# resolves either target form. The first `pane_id` in the response is the agent's own.
+pane_of() {
+  herdr agent get "$TARGET" 2>/dev/null \
+    | sed -n 's/.*"pane_id":"\([^"]*\)".*/\1/p' | head -1
+}
+
 # The rendered `❯` line — the only state that discriminates submitted from sitting. head -1 returns
 # the first rendered line, i.e. a PREFIX of a wrapped draft, so callers compare prefixes, never
 # whole sentences (OBS-396: a full-sentence match returns false on a message that arrived intact).
@@ -54,6 +65,24 @@ prompt_line() {
     | sed -n 's/^[[:space:]]*❯[[:space:]]*//p' | head -1 | sed 's/[[:space:]]*$//'
 }
 
+# STAGED-QUEUE DISCRIMINATOR (OBS-552 addendum, captured 2026-08-19 on a live kimi seat). After its
+# first turn ends, kimi stages every later message into a SECOND `❯` region —
+# `❯ <text> ↑ to edit · ctrl-s to steer immediately` — and EMPTIES the ordinary box when it does. So
+# `prompt_line`'s emptiness is not submission on a kimi seat: it is the queue swallowing the
+# directive. Six consecutive paths were tried against that state and the pane revision never moved
+# off 3; `seat-send.sh` called the first one DELIVERED_SUBMITTED. This reads the staging AFFORDANCE
+# rather than the vendor name, so any TUI that grows the same queue is covered without a matcher list.
+# Returns the staged TEXT only: the `❯` marker and the trailing affordance are chrome, and leaving the
+# affordance on would break `is_ours`, whose contract is that the rendered text is a PREFIX of $MSG
+# (OBS-396). A wrapped staged entry still yields a prefix, which is all the comparison needs.
+staged_line() {
+  herdr agent read "$TARGET" --source visible --lines 14 2>/dev/null \
+    | sed -n '/↑ to edit/{/steer/p;}' | head -1 \
+    | sed 's/^[[:space:]]*❯[[:space:]]*//' \
+    | sed 's/[[:space:]]*↑ to edit.*$//' \
+    | sed 's/[[:space:]]*$//'
+}
+
 # Is $1 a rendered prefix of our message? (first line of a wrapped draft = prefix of MSG)
 is_ours() {
   case "$MSG" in "$1"*) return 0 ;; *) return 1 ;; esac
@@ -107,9 +136,73 @@ fi
 
 # Atomic text+Enter honouring the pane's live bracketed-paste mode — never send-text + separate
 # Enter, which is the "sitting unsubmitted" failure by construction.
-herdr agent prompt "$TARGET" "$MSG" >/dev/null 2>&1
+#
+# OBS-552: the outcome of this verb was thrown away — `>/dev/null 2>&1` discarded BOTH the exit code
+# and the reason. A refusal that wrote NOTHING then fell through to the prompt-line checks below with
+# an empty line, which is byte-identical to a clean submit, and this script exited 0 announcing
+# DELIVERED_SUBMITTED — or QUEUED_BEHIND_TURN when the seat read `working`, which also EXPLAINS AWAY
+# the silence that follows. Measured 2026-08-19 against a live seat: `herdr agent prompt` refuses a
+# detected-but-undrivable occupant with `agent_not_ready` and never touches the input box, while
+# `pane run` delivers to that same pane. A send receipt that cannot fail is not a receipt.
+PROMPT_ERR=$(herdr agent prompt "$TARGET" "$MSG" 2>&1 >/dev/null)
+PROMPT_RC=$?
+VIA=""
+if [ "$PROMPT_RC" -ne 0 ]; then
+  case "$PROMPT_ERR" in
+    *agent_not_ready*)
+      # UNEQUIVOCALLY PRE-WRITE: herdr rejected the target before typing anything, so a second
+      # delivery cannot duplicate. This is the ONLY class that earns a fallback.
+      PANE=$(pane_of)
+      if [ -z "$PANE" ]; then
+        echo "SEND_REFUSED $TARGET — agent prompt refused pre-write and no pane id resolved: $PROMPT_ERR"
+        exit 1
+      fi
+      PANE_ERR=$(herdr pane run "$PANE" "$MSG" 2>&1 >/dev/null)
+      PANE_RC=$?
+      if [ "$PANE_RC" -ne 0 ]; then
+        echo "SEND_FAILED $TARGET — both delivery surfaces refused; nothing was typed."
+        echo "  agent prompt: $PROMPT_ERR"
+        echo "  pane run ($PANE): $PANE_ERR"
+        exit 1
+      fi
+      VIA=" (via pane run $PANE — agent prompt refused pre-write: $PROMPT_ERR)"
+      ;;
+    *)
+      # AMBIGUOUS: this class cannot prove the write did not land, and a second delivery APPENDS to
+      # whatever did. So it never retries — it surfaces the cause and stops, which is the one outcome
+      # the discarded stderr made impossible.
+      echo "SEND_UNVERIFIED $TARGET — agent prompt exited $PROMPT_RC with an ambiguous outcome: $PROMPT_ERR"
+      echo "  NOT retrying (a second send appends to anything that landed). Read the pane, then decide."
+      exit 1
+      ;;
+  esac
+fi
 
 sleep 2
+
+# BEFORE any emptiness verdict: a non-empty staged queue means this seat has accepted text and is not
+# running it, so an empty ordinary box proves nothing. Fail closed — there is no delivery remedy to
+# offer, and every one was tried against the captured instance: bare `enter` on the empty box no-ops,
+# `up`+`enter` moves the entry to the box and puts it straight BACK in the queue, `herdr agent
+# send-keys` cannot type kimi's own `ctrl-s` affordance (no ctrl chords), and `pane run` is a
+# shell-pane path with no effect on a TUI. Recovery is the operator's: capture provenance
+# (pid/ppid/pgid/lstart), TERM the CLI, then `herdr agent start … -- --auto -c` in the SAME pane —
+# session continuation preserved 136k of context and the queue drained on restart. NEVER retry here:
+# the entry may drain at any moment and a second send would then run twice.
+STAGED=$(staged_line)
+if [ -n "$STAGED" ]; then
+  if is_ours "$STAGED"; then
+    echo "SEND_UNVERIFIED $TARGET — the directive is STAGED in the seat's queue, not running: $STAGED"
+  else
+    echo "SEND_UNVERIFIED $TARGET — this seat's queue holds an entry that is not draining, so nothing sent now is running: $STAGED"
+  fi
+  echo "  An empty prompt line does NOT mean submitted on a staging TUI — the box is empty BECAUSE the"
+  echo "  text went to the queue. Do NOT re-send: the queue may drain at any moment and run it twice."
+  echo "  No input path drains it (enter no-ops, up+enter re-queues, send-keys has no ctrl chords,"
+  echo "  pane run is shell-only). Capture provenance, TERM the CLI, restart it in the SAME pane with"
+  echo "  session continuation, then verify the pane REVISION moves before trusting any receipt."
+  exit 1
+fi
 PL=$(prompt_line)
 if [ -n "$PL" ] && is_ours "$PL"; then
   # The text is SITTING, not sent — the swallowed-Enter shape. Submitting the existing draft is not a
@@ -127,14 +220,14 @@ fi
 
 if [ -n "$PL" ]; then
   # Not ours: either autosuggest ghost (dim SGR — benign) or a draft that appeared under us.
-  echo "DELIVERED_SUBMITTED $TARGET — prompt line clear of our text; NOTE it now holds: $PL"
+  echo "DELIVERED_SUBMITTED $TARGET$VIA — prompt line clear of our text; NOTE it now holds: $PL"
   echo "  ANSI-verify (dim = ghost). If typed, treat per D-206: discriminate before anyone clears it."
   exit 0
 fi
 
 if [ -n "$QUEUED" ]; then
-  echo "QUEUED_BEHIND_TURN $TARGET — submitted into a working seat's queue; it is READ at turn end. A freeze-class or superseding directive belongs behind TKR_INTERRUPT=1."
+  echo "QUEUED_BEHIND_TURN $TARGET$VIA — submitted into a working seat's queue; it is READ at turn end. A freeze-class or superseding directive belongs behind TKR_INTERRUPT=1."
 else
-  echo "DELIVERED_SUBMITTED $TARGET"
+  echo "DELIVERED_SUBMITTED $TARGET$VIA"
 fi
 exit 0