tickmarkr 1.96.0 → 2.0.0

package/dist/run/stall.js

@@ -1,3 +1,5 @@
+import { existsSync, readFileSync } from "node:fs";
+import { shGit } from "./git.js";
 // OBS-82: normalize known presentation tokens before measuring transcript extent or filtering an
 // LLM-bound transcript. This remains a closed allowlist — ANSI/VT escapes, braille-range spinner
 // glyphs, and elapsed-time tokens bound to time-unit suffixes. Every other byte passes through
@@ -18,6 +20,177 @@ const ELAPSED_RE = /(?<![\w.])\d+(?:\.\d+)?(?:ms|[hms])(?!\w)/g;
 export function normalizeStallSnapshot(text) {
     return text.replace(ANSI_RE, "").replace(SPINNER_RE, "").replace(ELAPSED_RE, "");
 }
+// T2 (OBS-264): a CPU delta needs two samples separated in WALL CLOCK, and the CPU clock is
+// QUANTIZED: darwin's `ps` prints hundredths ("0:00.03"), linux's precise /proc clock advances in
+// jiffies. Equality across a window shorter than the quantum is not evidence of rest. Crossing 30
+// ticks means the tree burned <1 tick in 30, i.e. under ~3% of one core. This process-tree liveness
+// primitive lives here rather than in daemon.ts so lower-level gate waits can use it without closing
+// the daemon -> run-gates -> llm -> daemon dependency cycle.
+const HARVEST_CPU_FLAT_MS = 3_000;
+const HARVEST_CPU_FLAT_TICKS = 30;
+const WORKER_TREE_CPU_ACCOUNTING_POLL_MS = 100;
+const WORKER_TREE_CPU_UNMEASURABLE_SAMPLE_CAP = 20;
+let harvestCpuFlatMs;
+export function harvestCpuFlatWindowMs(resolutionMs) {
+    return harvestCpuFlatMs ?? Math.max(HARVEST_CPU_FLAT_MS, resolutionMs * HARVEST_CPU_FLAT_TICKS);
+}
+/** Test seam — pin the quantization-aware flat window without changing production policy. */
+export function setHarvestCpuFlatMsForTests(ms) {
+    harvestCpuFlatMs = ms;
+}
+export function resetHarvestCpuFlatMsForTests() {
+    harvestCpuFlatMs = undefined;
+}
+// `ps` CPU time: "[[dd-]hh:]mm:ss[.frac]". Anything else is a header or a row this parser must
+// not guess at. `frac` reports whether this host exposes sub-second digits so callers use the
+// sampled clock's quantum rather than assuming one.
+function parsePsCpu(raw) {
+    const m = /^(?:(\d+)-)?(?:(\d+):)?(\d+):(\d+(?:\.\d+)?)$/.exec(raw);
+    if (!m)
+        return undefined;
+    const ms = ((Number(m[1] ?? 0) * 24 + Number(m[2] ?? 0)) * 60 + Number(m[3])) * 60_000
+        + Math.round(Number(m[4]) * 1000);
+    return { ms, frac: m[4].includes(".") };
+}
+let linuxClockTickMs;
+function linuxProcessCpuMs(pid, cwd) {
+    if (!existsSync("/proc/self/stat"))
+        return Promise.resolve(undefined);
+    // shGit, not sh: the accountant samples at 100ms cadence and must not run the operator's login
+    // profile (nvm/pyenv/direnv side effects included) on every sample.
+    linuxClockTickMs ??= shGit("getconf CLK_TCK", cwd, 15_000).then((r) => {
+        const ticks = r.code === 0 ? Number(r.stdout.trim()) : Number.NaN;
+        return Number.isFinite(ticks) && ticks > 0 ? 1_000 / ticks : undefined;
+    });
+    return linuxClockTickMs.then((resolutionMs) => {
+        if (resolutionMs === undefined)
+            return undefined;
+        try {
+            // `/proc/<pid>/stat` fields 14-17 are user/system jiffies for the process and its waited-for
+            // children. Child totals retain tools that start and exit wholly between live-tree polls.
+            const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+            const fields = stat.slice(stat.lastIndexOf(")") + 2).trim().split(/\s+/);
+            const ticks = Number(fields[11]) + Number(fields[12]) + Number(fields[13]) + Number(fields[14]);
+            return Number.isFinite(ticks) ? { ms: ticks * resolutionMs, resolutionMs } : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    });
+}
+// Every non-seeded worker process descends from its attempt-unique dispatch script. One ps snapshot
+// finds that root and its descendants. An empty tree is measurable zero; a failed or unparseable
+// snapshot is undefined because missing evidence can never prove inactivity.
+async function workerTreeCpuSnapshot(marker, cwd) {
+    const snapshot = await shGit("ps -Awwo pid=,ppid=,time=,command=", cwd, 15_000);
+    if (snapshot.code !== 0)
+        return undefined;
+    const rows = [];
+    for (const line of snapshot.stdout.split("\n")) {
+        const m = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/.exec(line);
+        if (!m)
+            continue;
+        const cpu = parsePsCpu(m[3]);
+        if (cpu !== undefined)
+            rows.push({ pid: m[1], ppid: m[2], cpuMs: cpu.ms, frac: cpu.frac, cmd: m[4] });
+    }
+    if (rows.length === 0)
+        return undefined;
+    const tree = new Set(rows.filter((p) => p.cmd.includes(marker)).map((p) => p.pid));
+    // ps output is not topologically ordered; relax the parent -> child closure until stable.
+    for (let grew = true; grew;) {
+        grew = false;
+        for (const p of rows) {
+            if (!tree.has(p.pid) && tree.has(p.ppid)) {
+                tree.add(p.pid);
+                grew = true;
+            }
+        }
+    }
+    const precise = new Map();
+    let preciseResolutionMs;
+    for (const p of rows) {
+        if (!tree.has(p.pid))
+            continue;
+        const cpu = await linuxProcessCpuMs(p.pid, cwd);
+        precise.set(p.pid, cpu?.ms ?? p.cpuMs);
+        if (cpu !== undefined)
+            preciseResolutionMs = cpu.resolutionMs;
+    }
+    if (preciseResolutionMs === undefined && existsSync("/proc/self/stat")) {
+        preciseResolutionMs = (await linuxProcessCpuMs(String(process.pid), cwd))?.resolutionMs;
+    }
+    return {
+        processes: precise,
+        resolutionMs: preciseResolutionMs ?? (rows.some((p) => p.frac) ? 10 : 1_000),
+    };
+}
+export async function workerTreeCpuMs(marker, cwd) {
+    const snapshot = await workerTreeCpuSnapshot(marker, cwd);
+    if (snapshot === undefined)
+        return undefined;
+    return {
+        ms: [...snapshot.processes.values()].reduce((sum, cpuMs) => sum + cpuMs, 0),
+        resolutionMs: snapshot.resolutionMs,
+    };
+}
+// Sparse live-tree totals forget a tool's CPU as soon as it exits. This attempt-local accountant
+// instead accumulates each observed PID's delta and replaces only the live-PID cursor. Daemon workers
+// and gate workers deliberately share these semantics: the marker is the unique dispatch script,
+// an unreadable sample clears the current evidence, and stopped descendants remain in the total.
+export class WorkerTreeCpuAccountant {
+    marker;
+    cwd;
+    active = false;
+    loop;
+    live = new Map();
+    totalMs = 0;
+    gaps = 0;
+    consecutiveGaps = 0;
+    latest;
+    constructor(marker, cwd) {
+        this.marker = marker;
+        this.cwd = cwd;
+    }
+    async sample() {
+        const snapshot = await workerTreeCpuSnapshot(this.marker, this.cwd);
+        if (snapshot === undefined) {
+            this.gaps++;
+            this.live.clear();
+            this.latest = undefined;
+            if (++this.consecutiveGaps >= WORKER_TREE_CPU_UNMEASURABLE_SAMPLE_CAP)
+                this.active = false;
+            return;
+        }
+        this.consecutiveGaps = 0;
+        for (const [pid, cpuMs] of snapshot.processes) {
+            const prior = this.live.get(pid);
+            this.totalMs += prior === undefined || cpuMs < prior ? cpuMs : cpuMs - prior;
+        }
+        this.live = snapshot.processes;
+        this.latest = { ms: this.totalMs, resolutionMs: snapshot.resolutionMs };
+    }
+    async start() {
+        if (this.active)
+            return;
+        this.active = true;
+        await this.sample();
+        this.loop = (async () => {
+            while (this.active) {
+                await new Promise((resolve) => setTimeout(resolve, WORKER_TREE_CPU_ACCOUNTING_POLL_MS));
+                if (this.active)
+                    await this.sample();
+            }
+        })();
+    }
+    read() {
+        return { cpu: this.latest, gaps: this.gaps };
+    }
+    async stop() {
+        this.active = false;
+        await this.loop;
+    }
+}
 // T1 (OBS-262): the rescue nudge's adapter scope — claude-code only (steering path proven,
 // OBS-122). Widening it is a future fixture-capture chore (an occupied-frame capture per adapter,
 // OBS-181 scar), never a drive-by edit. Lives in the stall module so the watchdog's policy and its

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.96.0",
+  "version": "2.0.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-overseer/SKILL.md

@@ -64,13 +64,15 @@ through brief lineage. **An executor choice nobody made is still an executor cho
    **FIVE-TAB CANON (standing operator layout — corrected three times on 2026-07-27, layout approved
    2026-07-29, re-earned 2026-08-17):**
    - `OVERSEER` — you. Do not add a second live run surface: the daemon self-places the shipped board
-     beside the supervising seat that invokes the run.
-   - `ORCH` — the orchestrator and the daemon-placed, run-id-pinned shipped board beside it. **Look for
-     that `role: "watch"` pane; never hand-place or hand-roll a live run surface. Nothing else, ever: a
-     work seat NEVER splits into the ORCH tab.** Operator verbatim: *"in orch tab should be the orch and
-     the watcher only."* Re-earned 2026-08-17: a planning seat split beside the orchestrator, and the
-     operator caught it, again. The daemon owns the side placement and board-first width allocation;
-     neither the worker-pane halving floor nor an overseer split command places this pane.
+     ABOVE the supervising seat that invokes the run.
+   - `ORCH` — the orchestrator with the daemon-placed, run-id-pinned shipped board STACKED ABOVE it: the
+     board owns the tab's full width and the top 72% of its height, and the orchestrator's own narration
+     is the rail underneath. **Look for that `role: "watch"` pane; never hand-place or hand-roll a live
+     run surface. Nothing else, ever: a work seat NEVER splits into the ORCH tab.** Operator verbatim:
+     *"in orch tab should be the orch and the watcher only."* Re-earned 2026-08-17: a planning seat split
+     beside the orchestrator, and the operator caught it, again. The daemon owns this vertical stack and
+     places it the same way at every terminal width; neither the worker-pane halving floor, nor a
+     measured column count, nor an overseer split command places this pane.
    - Worker/seat tabs — tickmarkr opens ONE TAB PER TASK itself; GSD-leg seats get the same treatment
      (own tab, or a shared WORKERS tab), never the ORCH tab.
    - `CONSULT · <topic>` — ONE shared tab for ALL consultants of a round, side-by-side splits; never one
@@ -134,10 +136,12 @@ journal tail to decide what happens next, or sweeping orphans — you have taken
 ### What the ORCHESTRATOR does, and what you require of it
 
 - **The live surface arrives with the run.** `tickmarkr run` is stdout-silent until run-end by design;
-  its daemon self-places one shipped `role: "watch"` board beside the supervising seat and pins that
-  board to the daemon's run id. **Look for the matching daemon-placed pane.** If it is absent, treat that
-  as a daemon/run liveness fault and use the normal recovery path; never hand-place, hand-roll, or launch
-  a replacement live surface.
+  its daemon self-places one shipped `role: "watch"` board ABOVE the supervising seat — full width, top
+  72% of the height, narration below — and pins that board to the daemon's run id. **Look for the matching
+  daemon-placed pane.** If it is absent, treat that as a daemon/run liveness fault and use the normal
+  recovery path; never hand-place, hand-roll, or launch a replacement live surface. A board the daemon
+  could not stack is not silently re-arranged: the split is closed and the run continues BOARDLESS, so an
+  absent board means the placement failed, never that it landed somewhere else in the tab.
 - **The journal is the source of truth**, not panes. Watchers go on `run-end` / `task-human` /
   `task-failed` / `consult-verdict`; never sleep-poll inside an agent turn. **Never key a watcher on an
   agent's `done`** — that is turn end and fires the moment a seat finishes acknowledging you.
@@ -551,10 +555,11 @@ orchestrator turn boundary.
     safe 53 → floor 108"*), and it splits right only while `paneWidth/2 ≥ 108 + 2` (`herdr.ts:494`),
     otherwise **down**. Apply the same test by hand: `herdr pane layout --pane <id>`, halve the width,
     and if the halves fall under the floor, split `--direction down`.
-  - **The daemon-placed ORCH board is outside this manual split rule.** The halving bound protects
-    worker-pane trailers; the daemon, not the overseer, places the run-id-pinned shipped board beside
-    the supervising seat and owns its board-first width allocation. Look for that pane and do not split,
-    place, or recreate it.
+  - **The daemon-placed ORCH board is outside this manual split rule — width does not place it at all.**
+    The halving bound protects worker-pane trailers; the board carries none. The daemon, not the overseer,
+    splits the supervising seat DOWN at ratio 0.72 and swaps the new pane ABOVE it (`boardSplitPlan`,
+    `src/drivers/herdr.ts`), so the board is full width and the narration is the rail beneath it at every
+    terminal width. Look for that pane and do not split, place, resize, or recreate it.
   - **Binary splits cannot produce an even 3-column row at any width.** 220 goes to 110/55/55 whichever
     pane you split. **At a 220-col terminal the width-derived cap is TWO side-by-side panes**; a third
     seat goes below one of them, or into its own tab. "Three panes" is a *height* heuristic

package/skills/tickmarkr-overseer/scripts/seat-send.sh

@@ -25,7 +25,10 @@
 #
 # First output line is the machine-greppable verdict:
 #   DELIVERED_SUBMITTED | QUEUED_BEHIND_TURN | SEND_UNSUBMITTED | INTERRUPT_FAILED | TARGET_GONE
-#   | REFUSED_SIZE | REFUSED_BOX_OCCUPIED
+#   | REFUSED_SIZE | REFUSED_BOX_OCCUPIED | SEND_UNVERIFIED | SEND_REFUSED | SEND_FAILED
+#
+# A success verdict names the surface that delivered when it was not the default one, so a fallback
+# is visible in the transcript rather than inferred (OBS-552).
 #
 # This verifies SUBMISSION — the text left the input box — never that the seat understood or acted.
 # Read the seat's ARTIFACT for that; a send receipt is not a response.
@@ -46,6 +49,14 @@ status_of() {
     | sed -n 's/.*"agent_status":"\([a-z_]*\)".*/\1/p' | head -1
 }
 
+# The submit-fallback needs a PANE id, and $TARGET may be an agent NAME. `agent get` answers for a
+# detected-but-undrivable seat — it is only `agent prompt` that refuses one (OBS-552) — so this
+# resolves either target form. The first `pane_id` in the response is the agent's own.
+pane_of() {
+  herdr agent get "$TARGET" 2>/dev/null \
+    | sed -n 's/.*"pane_id":"\([^"]*\)".*/\1/p' | head -1
+}
+
 # The rendered `❯` line — the only state that discriminates submitted from sitting. head -1 returns
 # the first rendered line, i.e. a PREFIX of a wrapped draft, so callers compare prefixes, never
 # whole sentences (OBS-396: a full-sentence match returns false on a message that arrived intact).
@@ -54,6 +65,24 @@ prompt_line() {
     | sed -n 's/^[[:space:]]*❯[[:space:]]*//p' | head -1 | sed 's/[[:space:]]*$//'
 }
 
+# STAGED-QUEUE DISCRIMINATOR (OBS-552 addendum, captured 2026-08-19 on a live kimi seat). After its
+# first turn ends, kimi stages every later message into a SECOND `❯` region —
+# `❯ <text> ↑ to edit · ctrl-s to steer immediately` — and EMPTIES the ordinary box when it does. So
+# `prompt_line`'s emptiness is not submission on a kimi seat: it is the queue swallowing the
+# directive. Six consecutive paths were tried against that state and the pane revision never moved
+# off 3; `seat-send.sh` called the first one DELIVERED_SUBMITTED. This reads the staging AFFORDANCE
+# rather than the vendor name, so any TUI that grows the same queue is covered without a matcher list.
+# Returns the staged TEXT only: the `❯` marker and the trailing affordance are chrome, and leaving the
+# affordance on would break `is_ours`, whose contract is that the rendered text is a PREFIX of $MSG
+# (OBS-396). A wrapped staged entry still yields a prefix, which is all the comparison needs.
+staged_line() {
+  herdr agent read "$TARGET" --source visible --lines 14 2>/dev/null \
+    | sed -n '/↑ to edit/{/steer/p;}' | head -1 \
+    | sed 's/^[[:space:]]*❯[[:space:]]*//' \
+    | sed 's/[[:space:]]*↑ to edit.*$//' \
+    | sed 's/[[:space:]]*$//'
+}
+
 # Is $1 a rendered prefix of our message? (first line of a wrapped draft = prefix of MSG)
 is_ours() {
   case "$MSG" in "$1"*) return 0 ;; *) return 1 ;; esac
@@ -107,9 +136,73 @@ fi
 
 # Atomic text+Enter honouring the pane's live bracketed-paste mode — never send-text + separate
 # Enter, which is the "sitting unsubmitted" failure by construction.
-herdr agent prompt "$TARGET" "$MSG" >/dev/null 2>&1
+#
+# OBS-552: the outcome of this verb was thrown away — `>/dev/null 2>&1` discarded BOTH the exit code
+# and the reason. A refusal that wrote NOTHING then fell through to the prompt-line checks below with
+# an empty line, which is byte-identical to a clean submit, and this script exited 0 announcing
+# DELIVERED_SUBMITTED — or QUEUED_BEHIND_TURN when the seat read `working`, which also EXPLAINS AWAY
+# the silence that follows. Measured 2026-08-19 against a live seat: `herdr agent prompt` refuses a
+# detected-but-undrivable occupant with `agent_not_ready` and never touches the input box, while
+# `pane run` delivers to that same pane. A send receipt that cannot fail is not a receipt.
+PROMPT_ERR=$(herdr agent prompt "$TARGET" "$MSG" 2>&1 >/dev/null)
+PROMPT_RC=$?
+VIA=""
+if [ "$PROMPT_RC" -ne 0 ]; then
+  case "$PROMPT_ERR" in
+    *agent_not_ready*)
+      # UNEQUIVOCALLY PRE-WRITE: herdr rejected the target before typing anything, so a second
+      # delivery cannot duplicate. This is the ONLY class that earns a fallback.
+      PANE=$(pane_of)
+      if [ -z "$PANE" ]; then
+        echo "SEND_REFUSED $TARGET — agent prompt refused pre-write and no pane id resolved: $PROMPT_ERR"
+        exit 1
+      fi
+      PANE_ERR=$(herdr pane run "$PANE" "$MSG" 2>&1 >/dev/null)
+      PANE_RC=$?
+      if [ "$PANE_RC" -ne 0 ]; then
+        echo "SEND_FAILED $TARGET — both delivery surfaces refused; nothing was typed."
+        echo "  agent prompt: $PROMPT_ERR"
+        echo "  pane run ($PANE): $PANE_ERR"
+        exit 1
+      fi
+      VIA=" (via pane run $PANE — agent prompt refused pre-write: $PROMPT_ERR)"
+      ;;
+    *)
+      # AMBIGUOUS: this class cannot prove the write did not land, and a second delivery APPENDS to
+      # whatever did. So it never retries — it surfaces the cause and stops, which is the one outcome
+      # the discarded stderr made impossible.
+      echo "SEND_UNVERIFIED $TARGET — agent prompt exited $PROMPT_RC with an ambiguous outcome: $PROMPT_ERR"
+      echo "  NOT retrying (a second send appends to anything that landed). Read the pane, then decide."
+      exit 1
+      ;;
+  esac
+fi
 
 sleep 2
+
+# BEFORE any emptiness verdict: a non-empty staged queue means this seat has accepted text and is not
+# running it, so an empty ordinary box proves nothing. Fail closed — there is no delivery remedy to
+# offer, and every one was tried against the captured instance: bare `enter` on the empty box no-ops,
+# `up`+`enter` moves the entry to the box and puts it straight BACK in the queue, `herdr agent
+# send-keys` cannot type kimi's own `ctrl-s` affordance (no ctrl chords), and `pane run` is a
+# shell-pane path with no effect on a TUI. Recovery is the operator's: capture provenance
+# (pid/ppid/pgid/lstart), TERM the CLI, then `herdr agent start … -- --auto -c` in the SAME pane —
+# session continuation preserved 136k of context and the queue drained on restart. NEVER retry here:
+# the entry may drain at any moment and a second send would then run twice.
+STAGED=$(staged_line)
+if [ -n "$STAGED" ]; then
+  if is_ours "$STAGED"; then
+    echo "SEND_UNVERIFIED $TARGET — the directive is STAGED in the seat's queue, not running: $STAGED"
+  else
+    echo "SEND_UNVERIFIED $TARGET — this seat's queue holds an entry that is not draining, so nothing sent now is running: $STAGED"
+  fi
+  echo "  An empty prompt line does NOT mean submitted on a staging TUI — the box is empty BECAUSE the"
+  echo "  text went to the queue. Do NOT re-send: the queue may drain at any moment and run it twice."
+  echo "  No input path drains it (enter no-ops, up+enter re-queues, send-keys has no ctrl chords,"
+  echo "  pane run is shell-only). Capture provenance, TERM the CLI, restart it in the SAME pane with"
+  echo "  session continuation, then verify the pane REVISION moves before trusting any receipt."
+  exit 1
+fi
 PL=$(prompt_line)
 if [ -n "$PL" ] && is_ours "$PL"; then
   # The text is SITTING, not sent — the swallowed-Enter shape. Submitting the existing draft is not a
@@ -127,14 +220,14 @@ fi
 
 if [ -n "$PL" ]; then
   # Not ours: either autosuggest ghost (dim SGR — benign) or a draft that appeared under us.
-  echo "DELIVERED_SUBMITTED $TARGET — prompt line clear of our text; NOTE it now holds: $PL"
+  echo "DELIVERED_SUBMITTED $TARGET$VIA — prompt line clear of our text; NOTE it now holds: $PL"
   echo "  ANSI-verify (dim = ghost). If typed, treat per D-206: discriminate before anyone clears it."
   exit 0
 fi
 
 if [ -n "$QUEUED" ]; then
-  echo "QUEUED_BEHIND_TURN $TARGET — submitted into a working seat's queue; it is READ at turn end. A freeze-class or superseding directive belongs behind TKR_INTERRUPT=1."
+  echo "QUEUED_BEHIND_TURN $TARGET$VIA — submitted into a working seat's queue; it is READ at turn end. A freeze-class or superseding directive belongs behind TKR_INTERRUPT=1."
 else
-  echo "DELIVERED_SUBMITTED $TARGET"
+  echo "DELIVERED_SUBMITTED $TARGET$VIA"
 fi
 exit 0