tickmarkr 2.1.0 → 2.1.1

package/dist/cli/commands/status.js

@@ -527,10 +527,34 @@ const foldTaskEffort = (tasks, events) => {
     return [...effort.values()].sort((left, right) => right.total - left.total
         || order.get(left.taskId) - order.get(right.taskId));
 };
-// Attention (review) and failure (park) wear the ONE amethyst, so the bar segments and their legend
-// markers carry the distinction in SHAPE: a full block for dispatch, light shade for a review round,
-// dark shade for a human park. Same display width, so the fitted bar keeps its measured columns.
-const EFFORT_GLYPH = { dispatch: "\u2588", review: "\u2592", park: "\u2593" };
+// ONE glyph for every segment, distinction by COLOUR. This was shade-based — full block for dispatch,
+// light shade for a review round, dark shade for a human park — because attention and failure share the
+// ONE amethyst and shape was their only discriminator. OPERATOR 2026-08-25, with a screenshot: the rows
+// rendered at DIFFERENT HEIGHTS. A row carrying the shade glyphs pulls a fallback font whose cell box is
+// taller, so the whole line grows and its full blocks stretch with it — T1 (dispatch+review+park) stood
+// visibly taller than T3 (dispatch only). Same display WIDTH was verified and preserved; nobody checked
+// height, and the fitted-column arithmetic cannot see it.
+//
+// So review moves off amethyst onto `information` (cornflower) — an EXISTING token. Deliberately not a
+// new amber: brand.ts calls the five live colours operator-approved and says "no token introduces a
+// sixth colour", and a bar chart is not the place to spend that.
+//
+// The shape scheme existed so a reader WITHOUT colour could still separate a review round from a human
+// park. That reader does not exist on this panel. `renderFrame` computes `const unicode = visual()`
+// (`visual()` = `isTTY === true && NO_COLOR === undefined`) and, when it is false, EARLY-RETURNS the
+// ASCII machine/CI surface at the `if (!unicode)` branch — which sits ABOVE the `effortPanel(...)` call
+// below, so the panel is never built on that path. Measured before it was explained: a frame rendered
+// with isTTY=true and NO_COLOR=1 contains no "WHERE THE EFFORT WENT" and no block glyph at all.
+// (The `--watch` loop has its own `visual()` gate; that one is NOT what suppresses this panel, and the
+// non-watch path reaches renderFrame unconditionally.) So the shades were paying an accessibility cost
+// on a surface that cannot render colourless, and a conditional to restore them under NO_COLOR would
+// have been an unreachable branch (the v1.80 injected-clock lesson: the fix for that is deletion).
+//
+// One glyph, three colours. Review moves off amethyst onto `information` (cornflower) — an EXISTING
+// token, deliberately not a new amber: brand.ts calls the five live colours operator-approved and says
+// "no token introduces a sixth colour". Every row now draws the same block, which is what makes the
+// rows equal height.
+const EFFORT_GLYPH = { dispatch: "\u2588", review: "\u2588", park: "\u2588" };
 /**
  * Prototype panel, fitted by the cockpit's display-cell authority before board-wide wrapping.
  *
@@ -557,7 +581,7 @@ const effortPanel = (tasks, events, columns) => {
         const reviewEnd = Math.round(((task.dispatches + task.reviews) / maxTotal) * barColumns);
         const parkEnd = Math.round((task.total / maxTotal) * barColumns);
         const stack = ok(EFFORT_GLYPH.dispatch.repeat(dispatchEnd))
-            + warn(EFFORT_GLYPH.review.repeat(Math.max(0, reviewEnd - dispatchEnd)))
+            + information(EFFORT_GLYPH.review.repeat(Math.max(0, reviewEnd - dispatchEnd)))
             + fail(EFFORT_GLYPH.park.repeat(Math.max(0, parkEnd - reviewEnd)));
         return `${prefix}${fitCells(stack, barColumns)}  ${counts}`;
     });
@@ -567,7 +591,7 @@ const effortPanel = (tasks, events, columns) => {
         "",
         ...rows,
         "",
-        `   ${ok(EFFORT_GLYPH.dispatch)} ${dim("dispatch")}  ${warn(EFFORT_GLYPH.review)} ${dim("review round")}  ${fail(EFFORT_GLYPH.park)} ${dim("human park")}`,
+        `   ${ok(EFFORT_GLYPH.dispatch)} ${dim("dispatch")}  ${information(EFFORT_GLYPH.review)} ${dim("review round")}  ${fail(EFFORT_GLYPH.park)} ${dim("human park")}`,
     ];
 };
 // VIS-11 (v1.13): a liveness header for renderFrame — last journal event age + whether the recorded

package/dist/drivers/herdr.d.ts

@@ -23,17 +23,17 @@ export declare class DeliveryCorruptedError extends Error {
 export type DriverJournal = (event: string, slotName: string, data: Record<string, unknown>) => void;
 /** First-generation join direction from measured trailer-safe floor (43-MEASUREMENT.md). */
 export declare function workerSplitDirection(paneCols: number | null, safeFloor?: number, margin?: number): "right" | "down";
-export declare const BOARD_HEIGHT_SHARE = 0.72;
+export declare const BOARD_WIDTH_SHARE = 0.5;
 export interface BoardPlacement {
-    /** Always down: the split is vertical, so the board can own the caller's FULL width. */
-    direction: "down";
-    /** herdr's split ratio is the FIRST child's share, and a down split's first child is the TOP
-     *  region — the region the board occupies once it is swapped above the caller. */
+    /** Always right: the board sits BESIDE the caller, so the narration keeps a column of its own. */
+    direction: "right";
+    /** herdr's split ratio is the FIRST child's share, and a right split's first child is the LEFT
+     *  region — the caller's, i.e. the narration. The board takes the remainder, on the right.
+     *  Measured against a live herdr 2026-08-25: a 256-col caller split right at 0.5 leaves the caller
+     *  at x=36 w=128 and puts the NEW pane at x=164 w=128. */
     ratio: number;
-    /** The new pane is swapped ABOVE the caller; the split alone would leave the board underneath. */
-    swap: "above";
 }
-/** The single approved vertical-stack record. The caller's columns are accepted and deliberately
+/** The single approved side-by-side record. The caller's columns are accepted and deliberately
  *  ignored: this signature is where width used to decide the arrangement, and the parameter stays
  *  so that "the plan does not depend on it" is a property a caller (and a test) can exercise. */
 export declare function boardSplitPlan(_callerCols?: number | null): BoardPlacement;

package/dist/drivers/herdr.js

@@ -73,15 +73,27 @@ export function workerSplitDirection(paneCols, safeFloor = TRAILER_SAFE_FLOOR_CO
 // placement any more. Every width-derived variant of this placement has been wrong in the operator's
 // tab: the halving floor sent a 189-column board below the seat (2026-08-18), and the width-first
 // side split that replaced it puts the board and the narration shoulder to shoulder when the board is
-// the surface the operator reads and the narration is the rail beneath it. The placement is now ONE
-// record — the board stacked ABOVE the caller at full width, taking 72% of the height — and it is
-// invariant: no terminal width, measured or unmeasurable, can select a different arrangement.
-export const BOARD_HEIGHT_SHARE = 0.72; // board 72 / narration 28, the operator's stack
-/** The single approved vertical-stack record. The caller's columns are accepted and deliberately
+// the surface the operator reads and the narration is the rail beneath it. The placement is ONE
+// record and it is invariant: no terminal width, measured or unmeasurable, can select a different
+// arrangement. THAT invariance is the hard-won part and it is unchanged here.
+//
+// What the record SAYS changed on operator instruction (2026-08-25): the board sits to the RIGHT of
+// the caller, not stacked above it. The vertical stack gave the board 72% of the HEIGHT at full
+// width, and in the operator's own tab that was mostly empty board over a squeezed narration rail —
+// a task table is a handful of rows, so height was the axis it did not need and the narration did.
+// Side by side spends the axis the board actually uses.
+//
+// ⚠ This is NOT a return to the width-derived placement that was wrong twice. Those variants let the
+// MEASURED width choose the arrangement, so the same run rendered differently in different terminals
+// and neither operator nor test could name one expected geometry. This record is constant: every
+// caller width gets `right`, and `boardSplitPlan` still ignores the columns it is handed. The
+// invariance test's width-sensitive control still fails, which is the property that mattered.
+export const BOARD_WIDTH_SHARE = 0.5; // narration 50 / board 50, side by side
+/** The single approved side-by-side record. The caller's columns are accepted and deliberately
  *  ignored: this signature is where width used to decide the arrangement, and the parameter stays
  *  so that "the plan does not depend on it" is a property a caller (and a test) can exercise. */
 export function boardSplitPlan(_callerCols) {
-    return { direction: "down", ratio: BOARD_HEIGHT_SHARE, swap: "above" };
+    return { direction: "right", ratio: BOARD_WIDTH_SHARE };
 }
 /** The tab a slot belongs to: its TASK — worker, judge, review and consult panes for one task share it.
  *  Returns undefined for everything else, which keeps those on the dedicated-tab path.
@@ -1081,16 +1093,17 @@ export class HerdrDriver {
             return p.workspace_id === this.ws && typeof p.pane_id === "string" && owned?.role === "watch" && owned.taskId === "run";
         }).map((p) => p.pane_id);
     }
-    // T2: the watch is a sibling of the daemon's own pane, never a separate tab — stacked ABOVE it at
-    // the caller's full width, always, whatever the terminal measures. Its durable owned name is how a
+    // T2: the watch is a sibling of the daemon's own pane, never a separate tab — placed to the RIGHT
+    // of it, always, whatever the terminal measures. Its durable owned name is how a
     // later daemon RECOGNIZES the board it must retire, so a run never stacks a second one.
     async watchSlot(cwd, name) {
         if (!this.ws)
             throw new Error("herdr watch placement requires HERDR_WORKSPACE_ID — refusing unseeded pane");
         if (!this.callerPane)
             throw new Error("herdr watch placement requires HERDR_PANE_ID — refusing untargeted split");
-        // One invariant placement (boardSplitPlan): split the caller down, then swap the new pane above
-        // it. No layout read decides this — width chose the arrangement twice and was wrong twice.
+        // One invariant placement (boardSplitPlan): split the caller RIGHT. No layout read decides this —
+        // width chose the arrangement twice and was wrong twice. No swap: a right split already lands the
+        // new pane — the board — beside the caller, so there is no second operation to verify.
         const plan = boardSplitPlan();
         const sp = await this.herdr(`pane split ${shq(this.callerPane)} --direction ${plan.direction} --ratio ${plan.ratio} --no-focus`);
         if (sp.code !== 0)
@@ -1104,30 +1117,12 @@ export class HerdrDriver {
         }
         if (typeof pane !== "string" || !pane)
             throw new Error(`herdr watch split returned no pane id: ${sp.stdout}`);
-        // The split leaves the board UNDER the caller; the swap is what makes the stack the requested
-        // one. Verified, not assumed: a swap that failed would leave a board below the narration while
-        // the daemon reported the geometry it asked for. Instead the split pane is closed and the failure
-        // propagates — the daemon swallows it and runs boardless, which is honest about what is on screen.
-        // `pane swap` answers a no-op with a ZERO exit and `changed:false` (herdr socket API: a swap it
-        // declined is a non-error response), so an exit code alone proves nothing about the geometry —
-        // that is exactly the path that would leave the board below the narration while the daemon
-        // reported the stack. The documented `changed` flag is the verification; anything else — a
-        // nonzero exit, `changed:false`, an unparseable result — fails closed.
-        const swapped = await this.herdr(`pane swap --source-pane ${shq(pane)} --target-pane ${shq(this.callerPane)}`);
-        // Flag lives at `result.swap.changed` (verbatim 0.8.0); see herdr-swap-shape.test.ts.
-        let swapChanged;
-        try {
-            const result = JSON.parse(swapped.stdout).result;
-            swapChanged = result?.swap?.changed ?? result?.changed;
-        }
-        catch {
-            /* fail closed below */
-        }
-        if (swapped.code !== 0 || swapChanged !== true) {
-            await this.discardSplit(pane, `herdr watch swap ${plan.swap} failed: ${swapped.code !== 0
-                ? swapped.stderr || swapped.stdout
-                : `herdr reported no swap took place: ${swapped.stdout || swapped.stderr}`}`);
-        }
+        // No swap step to verify any more. The stack needed one — the split landed the board UNDER the
+        // caller and only the swap made the geometry the requested one, so a `pane swap` that no-opped
+        // with a ZERO exit could leave a board below the narration while the daemon reported the stack;
+        // the `changed` flag existed to catch exactly that. A right split places the board where it
+        // belongs in ONE operation that either returns a pane id or throws above, so there is no
+        // second-operation gap left to fail closed on.
         const renamed = await this.herdr(`pane rename ${shq(pane)} ${shq(name)}`);
         if (renamed.code !== 0 || await this.namedPaneId(name) !== pane) {
             await this.discardSplit(pane, `herdr watch rename failed: ${renamed.stderr || renamed.stdout}`);

package/dist/gates/baseline.d.ts

@@ -90,6 +90,25 @@ export declare const effectiveCeilingMs: (entry?: Pick<BaselineCommand, "duratio
  * and never enters baseline forgiveness (there is no runner output to forgive).
  */
 export declare function ceilingKillResult(gate: string, r: ShResult, ceilingMs: number): GateResult | undefined;
+/**
+ * OBS-612: the capture gets its OWN ceiling, thirty minutes, and it is not the shell default.
+ *
+ * `captureBaseline` used to call `sh(cmd, cwd)` with no ceiling argument, so it inherited
+ * `DEFAULT_SHELL_TIMEOUT_MS` (600s) — while every CONSUMER of the result sizes its ceiling with
+ * `effectiveCeilingMs`. A repo whose suite runs longer than ten minutes therefore had its capture
+ * SIGKILLed every single time, recording `{infra: true, fingerprints: []}`, and `freshFailures`
+ * correctly forgives nothing for an infra entry. The result is a baseline that forgives nothing on a
+ * repo that has pre-existing failures — every task gate reds on failures the diff did not cause.
+ *
+ * Measured before it was fixed: EIGHT consecutive runs of this repository, 2026-08-20 to 2026-08-25,
+ * every one killed within 325ms of 600000ms on a suite that needs ~700s. That tight a cluster is a
+ * hard timeout, not variable failure. Each of those captures dutifully computed and stored
+ * `ceilingMs ≈ 1800000` — the right answer — which the next run never read.
+ *
+ * A capture is a MEASUREMENT of how long the suite takes; giving it the same ceiling as an ordinary
+ * shell asks it to finish faster than the thing it is measuring.
+ */
+export declare const CAPTURE_CEILING_MS = 1800000;
 export declare function captureBaseline(cwd: string, commands: Record<string, string>): Promise<Baseline>;
 export interface VacuousOracleWarning {
     kind: "vacuous-oracle";

package/dist/gates/baseline.js

@@ -318,10 +318,29 @@ export function ceilingKillResult(gate, r, ceilingMs) {
         meta: { classification: "infra", infra: true, kind: "ceiling-kill", durationMs, ceilingMs },
     };
 }
+/**
+ * OBS-612: the capture gets its OWN ceiling, thirty minutes, and it is not the shell default.
+ *
+ * `captureBaseline` used to call `sh(cmd, cwd)` with no ceiling argument, so it inherited
+ * `DEFAULT_SHELL_TIMEOUT_MS` (600s) — while every CONSUMER of the result sizes its ceiling with
+ * `effectiveCeilingMs`. A repo whose suite runs longer than ten minutes therefore had its capture
+ * SIGKILLed every single time, recording `{infra: true, fingerprints: []}`, and `freshFailures`
+ * correctly forgives nothing for an infra entry. The result is a baseline that forgives nothing on a
+ * repo that has pre-existing failures — every task gate reds on failures the diff did not cause.
+ *
+ * Measured before it was fixed: EIGHT consecutive runs of this repository, 2026-08-20 to 2026-08-25,
+ * every one killed within 325ms of 600000ms on a suite that needs ~700s. That tight a cluster is a
+ * hard timeout, not variable failure. Each of those captures dutifully computed and stored
+ * `ceilingMs ≈ 1800000` — the right answer — which the next run never read.
+ *
+ * A capture is a MEASUREMENT of how long the suite takes; giving it the same ceiling as an ordinary
+ * shell asks it to finish faster than the thing it is measuring.
+ */
+export const CAPTURE_CEILING_MS = 1_800_000;
 export async function captureBaseline(cwd, commands) {
     const base = { commands: {} };
     for (const [name, cmd] of Object.entries(commands)) {
-        const r = await sh(cmd, cwd);
+        const r = await sh(cmd, cwd, CAPTURE_CEILING_MS);
         // ponytail: strip the executing cwd so repo-root capture and worktree compare fingerprint identically; /private-vs-/tmp symlink variance is out of scope
         // ponytail: a capture that was itself killed records the ceiling as its "measurement", which
         // scales the next ceiling up — the right direction for a suite that never finished once.
@@ -336,6 +355,14 @@ export async function captureBaseline(cwd, commands) {
         // it is the one thing the kill did establish — and still scales the next ceiling up.
         // `timedOut` is set in exactly one place (git.ts's kill timer), so no ordinary exit reaches here.
         if (r.timedOut === true) {
+            // OBS-612: SAY SO. An unbaselinable command is invisible on every surface — `status` reports
+            // gates and supervision, never "your baseline forgives nothing" — so eight runs of this repo
+            // passed through here in silence while every later gate paid for it. The operator reads this
+            // line at run start, BEFORE any task gate reds, which is the whole point: the failure is
+            // otherwise indistinguishable from a repo that simply has flaky tests.
+            console.error(`tickmarkr: baseline capture for "${name}" was killed at its ${CAPTURE_CEILING_MS}ms ceiling — `
+                + `it recorded NO fingerprints, so nothing is forgiven and every gate will treat a pre-existing `
+                + `failure as a fresh one. Raise the ceiling or shorten the command.`);
             base.commands[name] = { infra: true, fingerprints: [], durationMs, ceilingMs: effectiveCeilingMs({ durationMs }) };
             continue;
         }

package/dist/run/git.d.ts

@@ -3,11 +3,30 @@ export { ROUTING_ENV_SEAMS };
 export declare const FORK_CAP_ENV = "VITEST_MAX_FORKS";
 export declare const DEFAULT_FORK_CAP = "6";
 /**
- * cap = max(1, floor(cores / concurrency)). Total test parallelism is then cap × concurrency, which
- * never exceeds max(cores, concurrency): at or below the core count the floor keeps the product
- * under `cores`, and above it the floor is 0 so the minimum of 1 pins the product to `concurrency`
- * itself. (The tempting `cap × concurrency ≤ cores` is unsatisfiable once concurrency > cores —
- * a run cannot give a suite less than one fork.)
+ * OBS-618: how many PROCESSES one vitest fork can hold at its peak — the fork, a daemon it spawns,
+ * and that daemon's own `git` child. The previous formula counted FORKS and assumed one process
+ * each, which is the assumption this suite violates by design: its tests spawn daemons that spawn
+ * git, so demand is a MULTIPLE of the cap and the fork table sees that multiple, not the cap.
+ *
+ * Measured, not guessed: on an 18-core machine at `concurrency: 1` the old formula authorised 18
+ * forks. Six gate batteries across two tasks with no shared file (T1, T3) and two vendors (claude,
+ * codex) then died on `spawn EAGAIN` — at load1 as low as 2.21, so this is fork-table exhaustion and
+ * not CPU saturation. 18 ÷ 3 = 6, which is exactly the value `DEFAULT_FORK_CAP` was already set to;
+ * the number was right and only the derivation was missing.
+ */
+export declare const SPAWN_FANOUT = 3;
+/**
+ * cap = max(1, floor(cores / (concurrency × SPAWN_FANOUT))). Total PROCESS demand is then
+ * cap × concurrency × SPAWN_FANOUT, which stays at or under `cores` wherever the floor is non-zero,
+ * and the `max(1, …)` pins it to one fork per run when the machine is too small to divide — a run
+ * cannot give a suite less than one fork.
+ *
+ * Portable by construction: `availableParallelism()` reports the CPUs actually usable by this
+ * process (it honours CPU affinity), so a 2-core CI runner derives 1, an 18-core workstation derives
+ * 6, and a 64-core host derives 21 — no machine is named anywhere and no value is pinned.
+ * ⚠ It is a FLOOR of 1, never 0: on a small host the cap stops dividing and the protection this
+ * provides runs out. That is the honest bound — a 2-core runner at concurrency 1 gets one fork and
+ * the fan-out is then bounded by the suite itself, not by us.
  */
 export declare const deriveForkCap: (concurrency: number, cores?: number) => number;
 /** Run `fn` with the fork budget this run's resolved concurrency implies. */

package/dist/run/git.js

@@ -32,13 +32,32 @@ export const DEFAULT_FORK_CAP = "6";
  */
 const forkBudget = new AsyncLocalStorage();
 /**
- * cap = max(1, floor(cores / concurrency)). Total test parallelism is then cap × concurrency, which
- * never exceeds max(cores, concurrency): at or below the core count the floor keeps the product
- * under `cores`, and above it the floor is 0 so the minimum of 1 pins the product to `concurrency`
- * itself. (The tempting `cap × concurrency ≤ cores` is unsatisfiable once concurrency > cores —
- * a run cannot give a suite less than one fork.)
+ * OBS-618: how many PROCESSES one vitest fork can hold at its peak — the fork, a daemon it spawns,
+ * and that daemon's own `git` child. The previous formula counted FORKS and assumed one process
+ * each, which is the assumption this suite violates by design: its tests spawn daemons that spawn
+ * git, so demand is a MULTIPLE of the cap and the fork table sees that multiple, not the cap.
+ *
+ * Measured, not guessed: on an 18-core machine at `concurrency: 1` the old formula authorised 18
+ * forks. Six gate batteries across two tasks with no shared file (T1, T3) and two vendors (claude,
+ * codex) then died on `spawn EAGAIN` — at load1 as low as 2.21, so this is fork-table exhaustion and
+ * not CPU saturation. 18 ÷ 3 = 6, which is exactly the value `DEFAULT_FORK_CAP` was already set to;
+ * the number was right and only the derivation was missing.
+ */
+export const SPAWN_FANOUT = 3;
+/**
+ * cap = max(1, floor(cores / (concurrency × SPAWN_FANOUT))). Total PROCESS demand is then
+ * cap × concurrency × SPAWN_FANOUT, which stays at or under `cores` wherever the floor is non-zero,
+ * and the `max(1, …)` pins it to one fork per run when the machine is too small to divide — a run
+ * cannot give a suite less than one fork.
+ *
+ * Portable by construction: `availableParallelism()` reports the CPUs actually usable by this
+ * process (it honours CPU affinity), so a 2-core CI runner derives 1, an 18-core workstation derives
+ * 6, and a 64-core host derives 21 — no machine is named anywhere and no value is pinned.
+ * ⚠ It is a FLOOR of 1, never 0: on a small host the cap stops dividing and the protection this
+ * provides runs out. That is the honest bound — a 2-core runner at concurrency 1 gets one fork and
+ * the fan-out is then bounded by the suite itself, not by us.
  */
-export const deriveForkCap = (concurrency, cores = availableParallelism()) => Math.max(1, Math.floor(cores / Math.max(1, concurrency)));
+export const deriveForkCap = (concurrency, cores = availableParallelism()) => Math.max(1, Math.floor(cores / (Math.max(1, concurrency) * SPAWN_FANOUT)));
 /** Run `fn` with the fork budget this run's resolved concurrency implies. */
 export const runWithForkBudget = (concurrency, fn) => forkBudget.run(String(deriveForkCap(concurrency)), fn);
 /** The cap owned by the run on this async context; the standalone default outside one. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-overseer/SKILL.md

@@ -69,9 +69,10 @@ through brief lineage. **An executor choice nobody made is still an executor cho
    2026-07-29, re-earned 2026-08-17):**
    - `OVERSEER` — you. Do not add a second live run surface: the daemon self-places the shipped board
      ABOVE the supervising seat that invokes the run.
-   - `ORCH` — the orchestrator with the daemon-placed, run-id-pinned shipped board STACKED ABOVE it: the
-     board owns the tab's full width and the top 72% of its height, and the orchestrator's own narration
-     is the rail underneath. **Look for that `role: "watch"` pane; never hand-place or hand-roll a live
+   - `ORCH` — the orchestrator with the daemon-placed, run-id-pinned shipped board BESIDE it: the board
+     takes the RIGHT half of the tab and the orchestrator's own narration keeps the LEFT half. (It was a
+     full-width board above a narration rail until 2026-08-25; the operator changed it, because a task
+     table is a few rows and it was spending height it did not need while squeezing the narration.) **Look for that `role: "watch"` pane; never hand-place or hand-roll a live
      run surface. Nothing else, ever: a work seat NEVER splits into the ORCH tab.** Operator verbatim:
      *"in orch tab should be the orch and the watcher only."* Re-earned 2026-08-17: a planning seat split
      beside the orchestrator, and the operator caught it, again. The daemon owns this vertical stack and
@@ -140,8 +141,8 @@ journal tail to decide what happens next, or sweeping orphans — you have taken
 ### What the ORCHESTRATOR does, and what you require of it
 
 - **The live surface arrives with the run.** `tickmarkr run` is stdout-silent until run-end by design;
-  its daemon self-places one shipped `role: "watch"` board ABOVE the supervising seat — full width, top
-  72% of the height, narration below — and pins that board to the daemon's run id. **Look for the matching
+  its daemon self-places one shipped `role: "watch"` board BESIDE the supervising seat — the right half
+  of the tab, narration on the left — and pins that board to the daemon's run id. **Look for the matching
   daemon-placed pane.** If it is absent, treat that as a daemon/run liveness fault and use the normal
   recovery path; never hand-place, hand-roll, or launch a replacement live surface. A board the daemon
   could not stack is not silently re-arranged: the split is closed and the run continues BOARDLESS, so an
@@ -347,6 +348,21 @@ they are left implicit:
   - Five distinct send failures in one leg — front-truncation, sitting unsubmitted, two silent losses,
     a probe that mistook its own echo for a reply — is what a prose send protocol costs under load:
     run `scripts/seat-send.sh` instead.
+- **A `pane run` into a pane whose FOREGROUND is busy is a DELAYED command, not a lost one.** The
+  shell buffers the line and executes it the instant the foreground process exits — which, when that
+  process is a run daemon, means *at run-end*, unattended, possibly hours later. Measured 2026-08-24: a
+  resume typed into the run pane while the daemon still held it fired by itself at the next run-end;
+  the seat that sent it read the later activity as an unattributed injection and nearly declared the
+  pane compromised. Two consequences: **check the target pane's foreground before sending** (a live
+  daemon owns it — send from your own shell instead), and **before attributing any unexplained
+  activity to an intruder, ask what YOU left buffered there.** The benign explanation is the common
+  one, and the alarming one costs a false security incident.
+- **A compound command that `cd`s POISONS every later relative path in the same call.** The Bash tool's
+  working directory persists, so `cd /tmp && …` followed by `cat .planning/x` silently reads the wrong
+  tree. Measured twice on 2026-08-24: once reading a worktree's config and nearly authoring a duplicate
+  fix for interims that were present all along, once failing a release export script that existed.
+  **State reads during supervision use ABSOLUTE paths**, and a read that contradicts what you believe
+  is a cue to check your cwd before you rewrite your model of the world.
 - **Guard-before-Enter** (race-safe prompt answering): chain with `&&` — pane get shows `blocked` && pane
   read shows the expected option under the cursor && only then send-keys. If no longer `blocked`, someone
   already answered; do nothing.
@@ -408,6 +424,24 @@ tier ages to `STALE` (never `ABSENT`) within six beats, which is the state that
 Stand down explicitly when you hand off, or a deliberate exit reads as a death. Same rule as rule 29
 below, now with a conventional path the other tier already reads: `tickmarkr status` shows it.
 
+⚠ **THE LOOP ABOVE BINDS TO A PROCESS, NOT TO A SEAT — and that is a defect this skill shipped.**
+The beat keeps running while its *session* lives, so a loop started by a seat that has since been
+cleared, re-briefed, or replaced keeps beating that tier's file forever. Measured 2026-08-24
+(OBS-583): a **2d20h** orphan loop from a predecessor seat held `orchestrator ARMED` through a
+**three-hour window in which no orchestrator was alive**, and it would have silently re-armed a
+recorded stand-down within 10 seconds. On the same sweep the overseer tier had **three** beat loops,
+one owned by an unrelated session. So:
+- **At every adopt, clear, or re-brief, sweep for pre-existing loops on YOUR tier before arming one**
+  (`pgrep -f "tickmarkr beat <tier>"`), trace each to its parent session, and kill the **loop only**
+  — never the parent — then verify the parent survived.
+- **`ARMED` is a claim about a process, not about a seat.** Before trusting any tier's `ARMED`, ask
+  whose session owns the beater; a tier can be armed and seatless, which is *worse* than ABSENT
+  because it reads as coverage (rule 11's outliving-its-trigger failure, in beat form).
+- Stand-down must kill the loop **and** run `--stand-down`; the second without the first is undone
+  by the next tick.
+The product fix (a seat-bound or sentinel-terminated beat, armed and stood down in one act) is
+queued; until it ships, this sweep is the guard.
+
 Arm the bundled watcher as its OWN Bash call with `run_in_background` — chaining it after other commands
 with `&` orphans it from the wake chain. It prints one wake reason and exits; re-arm after every wake.
 
@@ -427,6 +461,21 @@ mid-work — reading files, context climbing. So a status-keyed watcher can both
 worker** and **fire on a working one**, and neither failure announces itself. The bundled watcher inherits
 this; so does any `herdr agent wait`. It is still worth arming — it catches vanished panes and real
 blocks — but **never treat its silence as evidence a worker is healthy.**
+**A THIRD failure of the same proxy, and it hits the SUPERVISING seat, not a worker: a session wedged
+on a provider error or a CLI auto-update reports `working` forever.** Measured 2026-08-24: an
+orchestrator took an API 529 mid-turn, its frame froze with the error rendered, and `agent_status`
+read `working` across ten minutes while nothing advanced — and its own last transcript line claimed a
+resume it had never issued, which disk falsified (journal ended at `run-end`, no lock, no daemon).
+Nothing in a watcher set aimed at the RUN can see this: a wake delivered to a wedged seat's queue
+reaches nobody. Two cheap guards, both of which this seat lacked:
+- **Poll the supervised seat's VIEWPORT for a persistent error frame** — the same text present in two
+  reads minutes apart is the tell; one read cannot distinguish a frozen frame from a live one.
+- **Falsify the seat's own claims against disk at every state change it reports.** A wedged or
+  context-exhausted seat narrates intentions as completions. The lock, the journal's last row, and the
+  process table settle it in one command.
+When it fires: interrupt (Esc, bounded), have the seat correct the false record in writing rather than
+silently, then handoff + `/clear` + fresh brief BEFORE it takes the next boundary — a seat that just
+mis-reported its own state is not the seat to hand a release decision to.
 Two keys that do not lie, in order of strength:
 - **The daemon's own waiter.** What `herdr pane wait-output` is matching on tells you the phase from the
   harness's state machine rather than from a status field: a `--match` on a readiness banner means the
@@ -708,6 +757,17 @@ twice.** They are mission-independent on purpose: nothing here names a task, a l
 
 **Instruments**
 
+10a. **A CONTROL NAMES THE PROPERTY IT VERIFIES, NEVER AN INSTANCE OF IT** — and when it names an
+    instance, the seat that wrote it must correct the CONTROL rather than let it stop lawful work.
+    Measured 2026-08-24: a ruling armed *"the dispatch must resolve to `codex:gpt-5.6-terra` — anything
+    else, STOP"*, when the property the control existed to prove was *"a lawful channel OUTSIDE the
+    task's tried set, admitted by the amended floor."* Marginal-cost routing correctly picked a
+    cheaper mid-tier channel that satisfied the property completely — never tried, proven on the same
+    run — and the letter of the control said halt. **An over-specified control converts a working
+    mechanism into a false stop, and the seat under it will obey.** Write the property; if you catch
+    yourself naming a channel, a model, a pid or a hash, ask what that instance is standing in for.
+    The converse holds too: **a control loose enough to pass on the wrong thing is worse** — the fix is
+    precision about the property, not about the example.
 11. **For any guard whose failure is SILENCE — detector, lint, watcher, gate, alarm branch — the acceptance
     test is a POSITIVE CONTROL, not a clean run.** A zero cannot distinguish *nothing is broken* from *the
     instrument is blind* from *the check does not exist*. Remove the condition it should catch and confirm
@@ -736,7 +796,19 @@ twice.** They are mission-independent on purpose: nothing here names a task, a l
     it as a defect — and was corrected forty minutes later when the watcher fired normally, having been
     alive throughout. Two hypotheses (`ps` truncation; multi-column truncation) were formed and killed by
     measurement first, and the first falsification was itself run against the wrong `ps` form. **Use
-    `pgrep -f <token>`, or read the lock's own pid.** The general rule: **an exclusion filter is exactly as
+    `pgrep -f <token>`, or read the lock's own pid.**
+    ⚠ **AND `pgrep -f` HAS ITS OWN INVERSE FAILURE, so the recommended fix is not free: it matches the
+    ARGV OF THE SHELL RUNNING IT.** A probe written as `pgrep -f "npm test"` is itself a process whose
+    command line contains `npm test`, so it returns its own shell — a PHANTOM that looks exactly like the
+    contamination you are hunting. Measured 2026-08-25: a load-ceiling wake was investigated, a second
+    `npm test` "outside the gate's worktree" was found, and it was the probe. It had vanished by the next
+    command, which is the tell — a real second suite does not exit between two reads. The escalation would
+    have been a false contamination alarm during a task's last attempt.
+    Discriminate before you believe a hit: **resolve each pid's `cwd` AND drop any whose own command
+    contains the probe** (`pgrep`/`bash -c`), or match a pattern the target has and the probe cannot —
+    the binary's real path rather than the words you typed. `grep -v grep` fails toward *not there*;
+    `pgrep -f` fails toward *there twice*, and this direction gets ACTED ON, which is worse.
+    The general rule: **an exclusion filter is exactly as
     dangerous as an over-broad inclusion filter, and it fails in the direction that reads as "not there" —
     which is the direction that gets acted on.**
     Two corollaries: **re-arm a wake-and-exit watcher as the same turn's LAST act**, not the next turn's

package/skills/tickmarkr-overseer/scripts/seat-send.sh

@@ -57,12 +57,34 @@ pane_of() {
     | sed -n 's/.*"pane_id":"\([^"]*\)".*/\1/p' | head -1
 }
 
-# The rendered `❯` line — the only state that discriminates submitted from sitting. head -1 returns
-# the first rendered line, i.e. a PREFIX of a wrapped draft, so callers compare prefixes, never
-# whole sentences (OBS-396: a full-sentence match returns false on a message that arrived intact).
+# The rendered `❯` line — the only state that discriminates submitted from sitting. tail -1 takes
+# the LAST `❯` line, which is always the LIVE INPUT BOX: a wrapped draft's continuation lines carry
+# no `❯`, so the last one is still that draft's FIRST rendered line, i.e. a PREFIX of the draft —
+# callers compare prefixes, never whole sentences (OBS-396: a full-sentence match returns false on a
+# message that arrived intact).
+#
+# SUBMITTED-ECHO DISCRIMINATOR (OBS-603, captured 2026-08-25 on an overseer's first send). claude-code
+# echoes a SUBMITTED message into the transcript with the same `❯` glyph, and a long one still occupies
+# this 14-line window ABOVE the empty box. The old `head -1` returned that echo, `is_ours` matched it
+# (the echo IS a prefix of $MSG), and one delivered message drew TWO false verdicts: SEND_UNSUBMITTED on
+# the send that made the echo, then REFUSED_BOX_OCCUPIED on the NEXT send — the worse half, because it
+# refuses to deliver at all and leaves the seat unreachable until the echo scrolls out. Both reactions
+# this script warns against are then wrong: re-sending appends and submits both, escalating reports a
+# failure that never happened. OBS-396's phantom, one layer up.
+#
+# ⚠ POSITION IS NOT THE DISCRIMINATOR, and the kimi control below proves it: the two TUIs render in
+# OPPOSITE order. kimi puts the live box FIRST and stages BELOW it; claude-code puts the echo FIRST and
+# the live box BELOW. So `head -1` is wrong for one and `tail -1` is wrong for the other — a fix that
+# only flipped them would have traded this defect for the staged-queue defect OBS-552 already paid for.
+# What actually identifies the ordinary input box is that it is the LAST `❯` line which is NOT a staged
+# entry: staged lines carry the `↑ to edit · ctrl-s to steer` affordance and belong to `staged_line()`,
+# which owns that concept. Dropping them here makes this function's contract exact — the live ORDINARY
+# box — instead of positional, and it reads the affordance rather than a vendor name, so any TUI that
+# grows the same queue is covered without a matcher list.
 prompt_line() {
   herdr agent read "$TARGET" --source visible --lines 14 2>/dev/null \
-    | sed -n 's/^[[:space:]]*❯[[:space:]]*//p' | head -1 | sed 's/[[:space:]]*$//'
+    | sed '/↑ to edit/{/steer/d;}' \
+    | sed -n 's/^[[:space:]]*❯[[:space:]]*//p' | tail -1 | sed 's/[[:space:]]*$//'
 }
 
 # STAGED-QUEUE DISCRIMINATOR (OBS-552 addendum, captured 2026-08-19 on a live kimi seat). After its

package/skills/tickmarkr-overseer/scripts/watch-contamination.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# watch-contamination.sh — wake the AUTHORITY seat when a gate VERDICT may be contaminated.
+# watch-contamination.sh — wake the AUTHORITY seat when a gate VERDICT may be contaminated.
 #
 # Operator, 2026-08-07: "that is the kind of job I need overseer to be vigilant about."
 #
@@ -30,7 +30,7 @@ INFRA_RE='vitest-worker|Timeout calling|JS heap out of memory|ENOMEM|EAGAIN|spaw
 
 load1() { uptime | sed 's/.*load averages*: *//' | awk '{print $1}' | tr -d ','; }
 # Count real vitest runners only. `pgrep -f vitest` over-counts by an order: it matches the WORD
-# in any argv — worker prompts, VITEST_MAX_FORKS in shell strings (measured 7 vs 2 real, 2026-08-10).
+# in any argv — worker prompts, VITEST_MAX_FORKS in shell strings (measured 7 vs 2 real, 2026-08-10).
 # [v] keeps the pattern from matching its own grep. Forked workers retitle to "node (vitest N)" (comm).
 vitest_n() { ps -axo comm,command 2>/dev/null | grep -Ec 'node_modules/(\.bin/)?[v]itest|[v]itest/dist/|\([v]itest [0-9]+\)'; }
 
@@ -47,7 +47,11 @@ while [ "$elapsed" -lt "$CAP" ]; do
   elapsed=$((elapsed + POLL))
 
   L=$(load1); V=$(vitest_n)
-  Li=${L%%.*}; [ -z "$Li" ] && Li=0
+  # OBS-585: strip at the first NON-DIGIT, never at "." - a locale that renders the load average
+  # with U+066B (3٫48) or a comma leaves the period-strip a no-op, the numeric test below then
+  # errors, and its 2>/dev/null hides that, so the LOAD trigger dies silently at every load.
+  # Proven against the incident this watcher exists for: 35٫26 vs ceiling 24 never fired.
+  Li=$(printf %s "$L" | sed "s/[^0-9].*//"); [ -z "$Li" ] && Li=0
 
   if [ -f "$J" ]; then
     seen=$(cat "$STATE" 2>/dev/null); [ -z "$seen" ] && seen=0
@@ -63,7 +67,7 @@ while [ "$elapsed" -lt "$CAP" ]; do
         task=$(printf '%s' "$hit" | sed -n 's/.*"taskId":"\([^"]*\)".*/\1/p')
         gate=$(printf '%s' "$hit" | sed -n 's/.*"gate":"\([^"]*\)".*/\1/p')
         echo "CONTAMINATED_VERDICT task=$task gate=$gate load=$L vitest=$V"
-        echo "  an infra fingerprint appeared in a FAILED gate — this red is not evidence about the diff"
+        echo "  an infra fingerprint appeared in a FAILED gate — this red is not evidence about the diff"
         echo "  ruling owed: is the attempt chargeable? (OBS-426: infra failures are not)"
         exit 0
       fi
@@ -77,4 +81,4 @@ while [ "$elapsed" -lt "$CAP" ]; do
   fi
 done
 
-echo "WATCH_CAP_REACHED load=$(load1) vitest=$(vitest_n) — no contaminated verdict seen in ${CAP}s"
+echo "WATCH_CAP_REACHED load=$(load1) vitest=$(vitest_n) — no contaminated verdict seen in ${CAP}s"