tickmarkr 2.1.0 → 2.1.2

package/dist/cli/commands/init.js

@@ -105,7 +105,7 @@ Outside multi-agent environments, run the loop directly.
 
 ### Version preflight
 
-Before \`tickmarkr compile\` or \`tickmarkr run\`: run \`tickmarkr version\`, read \`package.json\` version, and if the binary is older on major.minor, stop and tell the operator to update. Never proceed on hope — stale binaries silently skip daemon gates. Also verify no run is live before starting one: \`pgrep -f "tickmarkr (run|resume)"\` must be empty — match the process, not one install path (\`dist/cli/index.js\` alone misses global and homebrew installs), and treat a held \`.tickmarkr/graph.lock\` as a live run until its holder pid is proven dead.
+Before \`tickmarkr compile\` or \`tickmarkr run\`: run \`tickmarkr version\`, read \`package.json\` version, and stop if the versions differ anywhere (major, minor, or patch); the binary and repository must agree on the entire version, so binary \`2.1.0\` versus repository \`2.1.1\` is a stop. Tell the operator to update or link the correct binary. Never proceed on hope — stale binaries silently skip daemon gates. Also verify no run is live in this repository before starting one: lead with this repository's \`.tickmarkr/graph.lock\`, read its holder pid, and treat it as live until \`kill -0 <pid>\` proves that holder dead. Never require a machine-wide process pattern to be empty: a lawful run in another repository — or the probing shell's own argv — can match. If you use a process probe as secondary evidence, exclude the probing process, resolve every candidate's own cwd (for example with \`lsof -a -p <pid> -d cwd\`), and count only candidates whose cwd is this repository root.
 
 ### Tip-verify-before-green
 

package/dist/cli/commands/status.js

@@ -527,10 +527,34 @@ const foldTaskEffort = (tasks, events) => {
     return [...effort.values()].sort((left, right) => right.total - left.total
         || order.get(left.taskId) - order.get(right.taskId));
 };
-// Attention (review) and failure (park) wear the ONE amethyst, so the bar segments and their legend
-// markers carry the distinction in SHAPE: a full block for dispatch, light shade for a review round,
-// dark shade for a human park. Same display width, so the fitted bar keeps its measured columns.
-const EFFORT_GLYPH = { dispatch: "\u2588", review: "\u2592", park: "\u2593" };
+// ONE glyph for every segment, distinction by COLOUR. This was shade-based — full block for dispatch,
+// light shade for a review round, dark shade for a human park — because attention and failure share the
+// ONE amethyst and shape was their only discriminator. OPERATOR 2026-08-25, with a screenshot: the rows
+// rendered at DIFFERENT HEIGHTS. A row carrying the shade glyphs pulls a fallback font whose cell box is
+// taller, so the whole line grows and its full blocks stretch with it — T1 (dispatch+review+park) stood
+// visibly taller than T3 (dispatch only). Same display WIDTH was verified and preserved; nobody checked
+// height, and the fitted-column arithmetic cannot see it.
+//
+// So review moves off amethyst onto `information` (cornflower) — an EXISTING token. Deliberately not a
+// new amber: brand.ts calls the five live colours operator-approved and says "no token introduces a
+// sixth colour", and a bar chart is not the place to spend that.
+//
+// The shape scheme existed so a reader WITHOUT colour could still separate a review round from a human
+// park. That reader does not exist on this panel. `renderFrame` computes `const unicode = visual()`
+// (`visual()` = `isTTY === true && NO_COLOR === undefined`) and, when it is false, EARLY-RETURNS the
+// ASCII machine/CI surface at the `if (!unicode)` branch — which sits ABOVE the `effortPanel(...)` call
+// below, so the panel is never built on that path. Measured before it was explained: a frame rendered
+// with isTTY=true and NO_COLOR=1 contains no "WHERE THE EFFORT WENT" and no block glyph at all.
+// (The `--watch` loop has its own `visual()` gate; that one is NOT what suppresses this panel, and the
+// non-watch path reaches renderFrame unconditionally.) So the shades were paying an accessibility cost
+// on a surface that cannot render colourless, and a conditional to restore them under NO_COLOR would
+// have been an unreachable branch (the v1.80 injected-clock lesson: the fix for that is deletion).
+//
+// One glyph, three colours. Review moves off amethyst onto `information` (cornflower) — an EXISTING
+// token, deliberately not a new amber: brand.ts calls the five live colours operator-approved and says
+// "no token introduces a sixth colour". Every row now draws the same block, which is what makes the
+// rows equal height.
+const EFFORT_GLYPH = { dispatch: "\u2588", review: "\u2588", park: "\u2588" };
 /**
  * Prototype panel, fitted by the cockpit's display-cell authority before board-wide wrapping.
  *
@@ -557,7 +581,7 @@ const effortPanel = (tasks, events, columns) => {
         const reviewEnd = Math.round(((task.dispatches + task.reviews) / maxTotal) * barColumns);
         const parkEnd = Math.round((task.total / maxTotal) * barColumns);
         const stack = ok(EFFORT_GLYPH.dispatch.repeat(dispatchEnd))
-            + warn(EFFORT_GLYPH.review.repeat(Math.max(0, reviewEnd - dispatchEnd)))
+            + information(EFFORT_GLYPH.review.repeat(Math.max(0, reviewEnd - dispatchEnd)))
             + fail(EFFORT_GLYPH.park.repeat(Math.max(0, parkEnd - reviewEnd)));
         return `${prefix}${fitCells(stack, barColumns)}  ${counts}`;
     });
@@ -567,7 +591,7 @@ const effortPanel = (tasks, events, columns) => {
         "",
         ...rows,
         "",
-        `   ${ok(EFFORT_GLYPH.dispatch)} ${dim("dispatch")}  ${warn(EFFORT_GLYPH.review)} ${dim("review round")}  ${fail(EFFORT_GLYPH.park)} ${dim("human park")}`,
+        `   ${ok(EFFORT_GLYPH.dispatch)} ${dim("dispatch")}  ${information(EFFORT_GLYPH.review)} ${dim("review round")}  ${fail(EFFORT_GLYPH.park)} ${dim("human park")}`,
     ];
 };
 // VIS-11 (v1.13): a liveness header for renderFrame — last journal event age + whether the recorded

package/dist/cli/commands/verify.js

@@ -104,7 +104,15 @@ export async function verify(argv, cwd = process.cwd()) {
     }
     const wantAcceptance = acceptance.length > 0 && !values["no-acceptance"];
     const wantReview = !values["no-review"];
-    const gates = GATE_NAMES.filter((g) => (g !== "acceptance" || wantAcceptance) && (g !== "review" || wantReview));
+    // A gate that enforced nothing must not print a green row. `files` has exactly three sources —
+    // explicit --files, a compiled task's own files[], or nothing — and only the third leaves the
+    // allowlist empty, where scopeGate passes as "no file scope declared — unrestricted"
+    // (scope.ts:41). An honest `details` string is no defence: the ROW is what gets quoted, and
+    // quoting it launders a check that never ran. So scope filters on availability exactly as
+    // acceptance and review do below — the report omits the gate rather than crediting one that
+    // gated no allowlist. (Narrowing the empty allowlist to the changed set is the same green row by
+    // another mechanism, and hides the same fact.)
+    const gates = GATE_NAMES.filter((g) => (g !== "acceptance" || wantAcceptance) && (g !== "review" || wantReview) && (g !== "scope" || files.length > 0));
     const task = {
         id: "VERIFY", title: "standalone verification", goal, shape: "implement", complexity: 5,
         deps: [], files, context: [], acceptance: acceptance.length ? acceptance : ["(deterministic verification only)"],

package/dist/drivers/herdr.d.ts

@@ -23,17 +23,17 @@ export declare class DeliveryCorruptedError extends Error {
 export type DriverJournal = (event: string, slotName: string, data: Record<string, unknown>) => void;
 /** First-generation join direction from measured trailer-safe floor (43-MEASUREMENT.md). */
 export declare function workerSplitDirection(paneCols: number | null, safeFloor?: number, margin?: number): "right" | "down";
-export declare const BOARD_HEIGHT_SHARE = 0.72;
+export declare const BOARD_WIDTH_SHARE = 0.5;
 export interface BoardPlacement {
-    /** Always down: the split is vertical, so the board can own the caller's FULL width. */
-    direction: "down";
-    /** herdr's split ratio is the FIRST child's share, and a down split's first child is the TOP
-     *  region — the region the board occupies once it is swapped above the caller. */
+    /** Always right: the board sits BESIDE the caller, so the narration keeps a column of its own. */
+    direction: "right";
+    /** herdr's split ratio is the FIRST child's share, and a right split's first child is the LEFT
+     *  region — the caller's, i.e. the narration. The board takes the remainder, on the right.
+     *  Measured against a live herdr 2026-08-25: a 256-col caller split right at 0.5 leaves the caller
+     *  at x=36 w=128 and puts the NEW pane at x=164 w=128. */
     ratio: number;
-    /** The new pane is swapped ABOVE the caller; the split alone would leave the board underneath. */
-    swap: "above";
 }
-/** The single approved vertical-stack record. The caller's columns are accepted and deliberately
+/** The single approved side-by-side record. The caller's columns are accepted and deliberately
  *  ignored: this signature is where width used to decide the arrangement, and the parameter stays
  *  so that "the plan does not depend on it" is a property a caller (and a test) can exercise. */
 export declare function boardSplitPlan(_callerCols?: number | null): BoardPlacement;

package/dist/drivers/herdr.js

@@ -73,15 +73,27 @@ export function workerSplitDirection(paneCols, safeFloor = TRAILER_SAFE_FLOOR_CO
 // placement any more. Every width-derived variant of this placement has been wrong in the operator's
 // tab: the halving floor sent a 189-column board below the seat (2026-08-18), and the width-first
 // side split that replaced it puts the board and the narration shoulder to shoulder when the board is
-// the surface the operator reads and the narration is the rail beneath it. The placement is now ONE
-// record — the board stacked ABOVE the caller at full width, taking 72% of the height — and it is
-// invariant: no terminal width, measured or unmeasurable, can select a different arrangement.
-export const BOARD_HEIGHT_SHARE = 0.72; // board 72 / narration 28, the operator's stack
-/** The single approved vertical-stack record. The caller's columns are accepted and deliberately
+// the surface the operator reads and the narration is the rail beneath it. The placement is ONE
+// record and it is invariant: no terminal width, measured or unmeasurable, can select a different
+// arrangement. THAT invariance is the hard-won part and it is unchanged here.
+//
+// What the record SAYS changed on operator instruction (2026-08-25): the board sits to the RIGHT of
+// the caller, not stacked above it. The vertical stack gave the board 72% of the HEIGHT at full
+// width, and in the operator's own tab that was mostly empty board over a squeezed narration rail —
+// a task table is a handful of rows, so height was the axis it did not need and the narration did.
+// Side by side spends the axis the board actually uses.
+//
+// ⚠ This is NOT a return to the width-derived placement that was wrong twice. Those variants let the
+// MEASURED width choose the arrangement, so the same run rendered differently in different terminals
+// and neither operator nor test could name one expected geometry. This record is constant: every
+// caller width gets `right`, and `boardSplitPlan` still ignores the columns it is handed. The
+// invariance test's width-sensitive control still fails, which is the property that mattered.
+export const BOARD_WIDTH_SHARE = 0.5; // narration 50 / board 50, side by side
+/** The single approved side-by-side record. The caller's columns are accepted and deliberately
  *  ignored: this signature is where width used to decide the arrangement, and the parameter stays
  *  so that "the plan does not depend on it" is a property a caller (and a test) can exercise. */
 export function boardSplitPlan(_callerCols) {
-    return { direction: "down", ratio: BOARD_HEIGHT_SHARE, swap: "above" };
+    return { direction: "right", ratio: BOARD_WIDTH_SHARE };
 }
 /** The tab a slot belongs to: its TASK — worker, judge, review and consult panes for one task share it.
  *  Returns undefined for everything else, which keeps those on the dedicated-tab path.
@@ -1081,16 +1093,17 @@ export class HerdrDriver {
             return p.workspace_id === this.ws && typeof p.pane_id === "string" && owned?.role === "watch" && owned.taskId === "run";
         }).map((p) => p.pane_id);
     }
-    // T2: the watch is a sibling of the daemon's own pane, never a separate tab — stacked ABOVE it at
-    // the caller's full width, always, whatever the terminal measures. Its durable owned name is how a
+    // T2: the watch is a sibling of the daemon's own pane, never a separate tab — placed to the RIGHT
+    // of it, always, whatever the terminal measures. Its durable owned name is how a
     // later daemon RECOGNIZES the board it must retire, so a run never stacks a second one.
     async watchSlot(cwd, name) {
         if (!this.ws)
             throw new Error("herdr watch placement requires HERDR_WORKSPACE_ID — refusing unseeded pane");
         if (!this.callerPane)
             throw new Error("herdr watch placement requires HERDR_PANE_ID — refusing untargeted split");
-        // One invariant placement (boardSplitPlan): split the caller down, then swap the new pane above
-        // it. No layout read decides this — width chose the arrangement twice and was wrong twice.
+        // One invariant placement (boardSplitPlan): split the caller RIGHT. No layout read decides this —
+        // width chose the arrangement twice and was wrong twice. No swap: a right split already lands the
+        // new pane — the board — beside the caller, so there is no second operation to verify.
         const plan = boardSplitPlan();
         const sp = await this.herdr(`pane split ${shq(this.callerPane)} --direction ${plan.direction} --ratio ${plan.ratio} --no-focus`);
         if (sp.code !== 0)
@@ -1104,30 +1117,12 @@ export class HerdrDriver {
         }
         if (typeof pane !== "string" || !pane)
             throw new Error(`herdr watch split returned no pane id: ${sp.stdout}`);
-        // The split leaves the board UNDER the caller; the swap is what makes the stack the requested
-        // one. Verified, not assumed: a swap that failed would leave a board below the narration while
-        // the daemon reported the geometry it asked for. Instead the split pane is closed and the failure
-        // propagates — the daemon swallows it and runs boardless, which is honest about what is on screen.
-        // `pane swap` answers a no-op with a ZERO exit and `changed:false` (herdr socket API: a swap it
-        // declined is a non-error response), so an exit code alone proves nothing about the geometry —
-        // that is exactly the path that would leave the board below the narration while the daemon
-        // reported the stack. The documented `changed` flag is the verification; anything else — a
-        // nonzero exit, `changed:false`, an unparseable result — fails closed.
-        const swapped = await this.herdr(`pane swap --source-pane ${shq(pane)} --target-pane ${shq(this.callerPane)}`);
-        // Flag lives at `result.swap.changed` (verbatim 0.8.0); see herdr-swap-shape.test.ts.
-        let swapChanged;
-        try {
-            const result = JSON.parse(swapped.stdout).result;
-            swapChanged = result?.swap?.changed ?? result?.changed;
-        }
-        catch {
-            /* fail closed below */
-        }
-        if (swapped.code !== 0 || swapChanged !== true) {
-            await this.discardSplit(pane, `herdr watch swap ${plan.swap} failed: ${swapped.code !== 0
-                ? swapped.stderr || swapped.stdout
-                : `herdr reported no swap took place: ${swapped.stdout || swapped.stderr}`}`);
-        }
+        // No swap step to verify any more. The stack needed one — the split landed the board UNDER the
+        // caller and only the swap made the geometry the requested one, so a `pane swap` that no-opped
+        // with a ZERO exit could leave a board below the narration while the daemon reported the stack;
+        // the `changed` flag existed to catch exactly that. A right split places the board where it
+        // belongs in ONE operation that either returns a pane id or throws above, so there is no
+        // second-operation gap left to fail closed on.
         const renamed = await this.herdr(`pane rename ${shq(pane)} ${shq(name)}`);
         if (renamed.code !== 0 || await this.namedPaneId(name) !== pane) {
             await this.discardSplit(pane, `herdr watch rename failed: ${renamed.stderr || renamed.stdout}`);

package/dist/gates/baseline.d.ts

@@ -90,6 +90,25 @@ export declare const effectiveCeilingMs: (entry?: Pick<BaselineCommand, "duratio
  * and never enters baseline forgiveness (there is no runner output to forgive).
  */
 export declare function ceilingKillResult(gate: string, r: ShResult, ceilingMs: number): GateResult | undefined;
+/**
+ * OBS-612: the capture gets its OWN ceiling, thirty minutes, and it is not the shell default.
+ *
+ * `captureBaseline` used to call `sh(cmd, cwd)` with no ceiling argument, so it inherited
+ * `DEFAULT_SHELL_TIMEOUT_MS` (600s) — while every CONSUMER of the result sizes its ceiling with
+ * `effectiveCeilingMs`. A repo whose suite runs longer than ten minutes therefore had its capture
+ * SIGKILLed every single time, recording `{infra: true, fingerprints: []}`, and `freshFailures`
+ * correctly forgives nothing for an infra entry. The result is a baseline that forgives nothing on a
+ * repo that has pre-existing failures — every task gate reds on failures the diff did not cause.
+ *
+ * Measured before it was fixed: EIGHT consecutive runs of this repository, 2026-08-20 to 2026-08-25,
+ * every one killed within 325ms of 600000ms on a suite that needs ~700s. That tight a cluster is a
+ * hard timeout, not variable failure. Each of those captures dutifully computed and stored
+ * `ceilingMs ≈ 1800000` — the right answer — which the next run never read.
+ *
+ * A capture is a MEASUREMENT of how long the suite takes; giving it the same ceiling as an ordinary
+ * shell asks it to finish faster than the thing it is measuring.
+ */
+export declare const CAPTURE_CEILING_MS = 1800000;
 export declare function captureBaseline(cwd: string, commands: Record<string, string>): Promise<Baseline>;
 export interface VacuousOracleWarning {
     kind: "vacuous-oracle";

package/dist/gates/baseline.js

@@ -318,10 +318,29 @@ export function ceilingKillResult(gate, r, ceilingMs) {
         meta: { classification: "infra", infra: true, kind: "ceiling-kill", durationMs, ceilingMs },
     };
 }
+/**
+ * OBS-612: the capture gets its OWN ceiling, thirty minutes, and it is not the shell default.
+ *
+ * `captureBaseline` used to call `sh(cmd, cwd)` with no ceiling argument, so it inherited
+ * `DEFAULT_SHELL_TIMEOUT_MS` (600s) — while every CONSUMER of the result sizes its ceiling with
+ * `effectiveCeilingMs`. A repo whose suite runs longer than ten minutes therefore had its capture
+ * SIGKILLed every single time, recording `{infra: true, fingerprints: []}`, and `freshFailures`
+ * correctly forgives nothing for an infra entry. The result is a baseline that forgives nothing on a
+ * repo that has pre-existing failures — every task gate reds on failures the diff did not cause.
+ *
+ * Measured before it was fixed: EIGHT consecutive runs of this repository, 2026-08-20 to 2026-08-25,
+ * every one killed within 325ms of 600000ms on a suite that needs ~700s. That tight a cluster is a
+ * hard timeout, not variable failure. Each of those captures dutifully computed and stored
+ * `ceilingMs ≈ 1800000` — the right answer — which the next run never read.
+ *
+ * A capture is a MEASUREMENT of how long the suite takes; giving it the same ceiling as an ordinary
+ * shell asks it to finish faster than the thing it is measuring.
+ */
+export const CAPTURE_CEILING_MS = 1_800_000;
 export async function captureBaseline(cwd, commands) {
     const base = { commands: {} };
     for (const [name, cmd] of Object.entries(commands)) {
-        const r = await sh(cmd, cwd);
+        const r = await sh(cmd, cwd, CAPTURE_CEILING_MS);
         // ponytail: strip the executing cwd so repo-root capture and worktree compare fingerprint identically; /private-vs-/tmp symlink variance is out of scope
         // ponytail: a capture that was itself killed records the ceiling as its "measurement", which
         // scales the next ceiling up — the right direction for a suite that never finished once.
@@ -336,6 +355,14 @@ export async function captureBaseline(cwd, commands) {
         // it is the one thing the kill did establish — and still scales the next ceiling up.
         // `timedOut` is set in exactly one place (git.ts's kill timer), so no ordinary exit reaches here.
         if (r.timedOut === true) {
+            // OBS-612: SAY SO. An unbaselinable command is invisible on every surface — `status` reports
+            // gates and supervision, never "your baseline forgives nothing" — so eight runs of this repo
+            // passed through here in silence while every later gate paid for it. The operator reads this
+            // line at run start, BEFORE any task gate reds, which is the whole point: the failure is
+            // otherwise indistinguishable from a repo that simply has flaky tests.
+            console.error(`tickmarkr: baseline capture for "${name}" was killed at its ${CAPTURE_CEILING_MS}ms ceiling — `
+                + `it recorded NO fingerprints, so nothing is forgiven and every gate will treat a pre-existing `
+                + `failure as a fresh one. Raise the ceiling or shorten the command.`);
             base.commands[name] = { infra: true, fingerprints: [], durationMs, ceilingMs: effectiveCeilingMs({ durationMs }) };
             continue;
         }

package/dist/run/git.d.ts

@@ -3,11 +3,30 @@ export { ROUTING_ENV_SEAMS };
 export declare const FORK_CAP_ENV = "VITEST_MAX_FORKS";
 export declare const DEFAULT_FORK_CAP = "6";
 /**
- * cap = max(1, floor(cores / concurrency)). Total test parallelism is then cap × concurrency, which
- * never exceeds max(cores, concurrency): at or below the core count the floor keeps the product
- * under `cores`, and above it the floor is 0 so the minimum of 1 pins the product to `concurrency`
- * itself. (The tempting `cap × concurrency ≤ cores` is unsatisfiable once concurrency > cores —
- * a run cannot give a suite less than one fork.)
+ * OBS-618: how many PROCESSES one vitest fork can hold at its peak — the fork, a daemon it spawns,
+ * and that daemon's own `git` child. The previous formula counted FORKS and assumed one process
+ * each, which is the assumption this suite violates by design: its tests spawn daemons that spawn
+ * git, so demand is a MULTIPLE of the cap and the fork table sees that multiple, not the cap.
+ *
+ * Measured, not guessed: on an 18-core machine at `concurrency: 1` the old formula authorised 18
+ * forks. Six gate batteries across two tasks with no shared file (T1, T3) and two vendors (claude,
+ * codex) then died on `spawn EAGAIN` — at load1 as low as 2.21, so this is fork-table exhaustion and
+ * not CPU saturation. 18 ÷ 3 = 6, which is exactly the value `DEFAULT_FORK_CAP` was already set to;
+ * the number was right and only the derivation was missing.
+ */
+export declare const SPAWN_FANOUT = 3;
+/**
+ * cap = max(1, floor(cores / (concurrency × SPAWN_FANOUT))). Total PROCESS demand is then
+ * cap × concurrency × SPAWN_FANOUT, which stays at or under `cores` wherever the floor is non-zero,
+ * and the `max(1, …)` pins it to one fork per run when the machine is too small to divide — a run
+ * cannot give a suite less than one fork.
+ *
+ * Portable by construction: `availableParallelism()` reports the CPUs actually usable by this
+ * process (it honours CPU affinity), so a 2-core CI runner derives 1, an 18-core workstation derives
+ * 6, and a 64-core host derives 21 — no machine is named anywhere and no value is pinned.
+ * ⚠ It is a FLOOR of 1, never 0: on a small host the cap stops dividing and the protection this
+ * provides runs out. That is the honest bound — a 2-core runner at concurrency 1 gets one fork and
+ * the fan-out is then bounded by the suite itself, not by us.
  */
 export declare const deriveForkCap: (concurrency: number, cores?: number) => number;
 /** Run `fn` with the fork budget this run's resolved concurrency implies. */

package/dist/run/git.js

@@ -32,13 +32,32 @@ export const DEFAULT_FORK_CAP = "6";
  */
 const forkBudget = new AsyncLocalStorage();
 /**
- * cap = max(1, floor(cores / concurrency)). Total test parallelism is then cap × concurrency, which
- * never exceeds max(cores, concurrency): at or below the core count the floor keeps the product
- * under `cores`, and above it the floor is 0 so the minimum of 1 pins the product to `concurrency`
- * itself. (The tempting `cap × concurrency ≤ cores` is unsatisfiable once concurrency > cores —
- * a run cannot give a suite less than one fork.)
+ * OBS-618: how many PROCESSES one vitest fork can hold at its peak — the fork, a daemon it spawns,
+ * and that daemon's own `git` child. The previous formula counted FORKS and assumed one process
+ * each, which is the assumption this suite violates by design: its tests spawn daemons that spawn
+ * git, so demand is a MULTIPLE of the cap and the fork table sees that multiple, not the cap.
+ *
+ * Measured, not guessed: on an 18-core machine at `concurrency: 1` the old formula authorised 18
+ * forks. Six gate batteries across two tasks with no shared file (T1, T3) and two vendors (claude,
+ * codex) then died on `spawn EAGAIN` — at load1 as low as 2.21, so this is fork-table exhaustion and
+ * not CPU saturation. 18 ÷ 3 = 6, which is exactly the value `DEFAULT_FORK_CAP` was already set to;
+ * the number was right and only the derivation was missing.
+ */
+export const SPAWN_FANOUT = 3;
+/**
+ * cap = max(1, floor(cores / (concurrency × SPAWN_FANOUT))). Total PROCESS demand is then
+ * cap × concurrency × SPAWN_FANOUT, which stays at or under `cores` wherever the floor is non-zero,
+ * and the `max(1, …)` pins it to one fork per run when the machine is too small to divide — a run
+ * cannot give a suite less than one fork.
+ *
+ * Portable by construction: `availableParallelism()` reports the CPUs actually usable by this
+ * process (it honours CPU affinity), so a 2-core CI runner derives 1, an 18-core workstation derives
+ * 6, and a 64-core host derives 21 — no machine is named anywhere and no value is pinned.
+ * ⚠ It is a FLOOR of 1, never 0: on a small host the cap stops dividing and the protection this
+ * provides runs out. That is the honest bound — a 2-core runner at concurrency 1 gets one fork and
+ * the fan-out is then bounded by the suite itself, not by us.
  */
-export const deriveForkCap = (concurrency, cores = availableParallelism()) => Math.max(1, Math.floor(cores / Math.max(1, concurrency)));
+export const deriveForkCap = (concurrency, cores = availableParallelism()) => Math.max(1, Math.floor(cores / (Math.max(1, concurrency) * SPAWN_FANOUT)));
 /** Run `fn` with the fork budget this run's resolved concurrency implies. */
 export const runWithForkBudget = (concurrency, fn) => forkBudget.run(String(deriveForkCap(concurrency)), fn);
 /** The cap owned by the run on this async context; the standalone default outside one. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.1.0",
+  "version": "2.1.2",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-auto/SKILL.md

@@ -45,10 +45,27 @@ Before `tickmarkr compile` or `tickmarkr run`, compare the installed binary agai
 
 1. Run `tickmarkr version` (one line, machine-parseable).
 2. Read the `version` field from the repository's `package.json`.
-3. If the binary is **older on major.minor** than the repo (e.g. binary `1.36.x` vs repo `1.38.x`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`) or link the repo binary. Do not compile, plan, or run on hope.
+3. If the binary and repository do not **agree on the entire version** (including the patch; e.g. binary `2.1.0` vs repo `2.1.1`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`) or link the repo binary. Do not compile, plan, or run on hope.
 
 A stale binary silently skips daemon gates shipped in newer releases — the v1.38 run exposed this when a global `1.36.0` binary missed the daemon tip-verify gate entirely (OBS-38). Preflight failure is always stop-and-report; never proceed-and-hope.
 
+### No run may be live in THIS repository
+
+The version check above is only half the preflight. Before `compile` or `run`, confirm no run is already
+live **in this repository**:
+
+1. Lead with this repository's own `.tickmarkr/graph.lock`. Read its recorded holder pid.
+2. Treat the lock as held by a LIVE run until `kill -0 <pid>` proves that holder dead.
+3. **Never require a machine-wide process pattern to be empty.** A lawful run in another repository — or
+   the probing shell's own argv — matches such a pattern, so an empty result is not evidence of safety
+   and a non-empty one is not evidence of danger.
+4. If you use a process probe as secondary evidence, exclude the probing process itself, resolve every
+   candidate's own working directory (for example `lsof -a -p <pid> -d cwd`), and count only candidates
+   whose cwd is **this repository root**.
+
+The invariant this protects is per-repository — *never run two tickmarkr runs in the same repository
+concurrently* — so a machine-wide check answers a question nobody asked and blocks work that is lawful.
+
 ## Verified handoffs (agent-to-agent messaging)
 
 When relaying missions between agents in a multi-agent terminal, **never use bare send-text** (`herdr agent send` / pane send-text) — it writes text without pressing Enter, so handoffs sit unsubmitted (OBS-39).

package/skills/tickmarkr-loop/SKILL.md

@@ -40,10 +40,27 @@ Before `tickmarkr compile` or `tickmarkr run`, compare the installed binary agai
 
 1. Run `tickmarkr version` (one line, machine-parseable).
 2. Read the `version` field from the repository's `package.json`.
-3. If the binary is **older on major.minor** than the repo (e.g. binary `1.36.x` vs repo `1.38.x`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`) or link the repo binary. Do not compile, plan, or run on hope.
+3. If the binary and repository do not **agree on the entire version** (including the patch; e.g. binary `2.1.0` vs repo `2.1.1`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`) or link the repo binary. Do not compile, plan, or run on hope.
 
 A stale binary silently skips daemon gates shipped in newer releases — the v1.38 run exposed this when a global `1.36.0` binary missed the daemon tip-verify gate entirely (OBS-38). Preflight failure is always stop-and-report; never proceed-and-hope.
 
+### No run may be live in THIS repository
+
+The version check above is only half the preflight. Before `compile` or `run`, confirm no run is already
+live **in this repository**:
+
+1. Lead with this repository's own `.tickmarkr/graph.lock`. Read its recorded holder pid.
+2. Treat the lock as held by a LIVE run until `kill -0 <pid>` proves that holder dead.
+3. **Never require a machine-wide process pattern to be empty.** A lawful run in another repository — or
+   the probing shell's own argv — matches such a pattern, so an empty result is not evidence of safety
+   and a non-empty one is not evidence of danger.
+4. If you use a process probe as secondary evidence, exclude the probing process itself, resolve every
+   candidate's own working directory (for example `lsof -a -p <pid> -d cwd`), and count only candidates
+   whose cwd is **this repository root**.
+
+The invariant this protects is per-repository — *never run two tickmarkr runs in the same repository
+concurrently* — so a machine-wide check answers a question nobody asked and blocks work that is lawful.
+
 ## Verified handoffs (agent-to-agent messaging)
 
 When relaying missions between agents in a multi-agent terminal, **never use bare send-text** (`herdr agent send` / pane send-text) — it writes text without pressing Enter, so handoffs sit unsubmitted (OBS-39).

package/skills/tickmarkr-overseer/SKILL.md

@@ -35,6 +35,16 @@ through brief lineage. **An executor choice nobody made is still an executor cho
    status, and either ADOPT the
    existing orchestrator (updated brief, re-armed watchers) or, if the old hierarchy is dead, archive the
    stale brief and build fresh.
+   ⚠ **VERIFY EVERY INHERITED WATCHER FROM THE PROCESS TABLE BEFORE YOU TRUST IT — re-arming your own
+   watchers is NOT enough, and a seat told only to re-arm its own is told the wrong thing.** An inherited
+   *"watcher armed"* line is a claim, not a watcher: it is a report by a seat that no longer exists, which
+   is strictly WEAKER than the live seat's report rule 11 already forbids trusting — and it reads as
+   settled fact. So at every adopt, walk the predecessor's watchers by class — **journal watchers,
+   artifact watchers, dialog watchers and beat loops, which is the closed set a session owns** — probe
+   each from the process table yourself (`pgrep -f <token>`, discriminated per rule 11), and re-arm every
+   one the table does not show. Earned 2026-08-25 (OBS-622): a handoff recorded *"artifact watcher armed"*
+   over two live consult verdicts; at adopt the only `watch-artifacts.sh` on the machine belonged to a
+   different repository, and nothing had been watching either file.
    **An adopted seat ANNOUNCES itself, in the same act as re-arming:** tell the adopted orchestrator the
    fresh seat is live (verified send: probe token + read-back). Through the gap its view of your tier read
    STALE, and a tier that believes it is unsupervised escalates into a file nobody is reading. Earned
@@ -69,9 +79,10 @@ through brief lineage. **An executor choice nobody made is still an executor cho
    2026-07-29, re-earned 2026-08-17):**
    - `OVERSEER` — you. Do not add a second live run surface: the daemon self-places the shipped board
      ABOVE the supervising seat that invokes the run.
-   - `ORCH` — the orchestrator with the daemon-placed, run-id-pinned shipped board STACKED ABOVE it: the
-     board owns the tab's full width and the top 72% of its height, and the orchestrator's own narration
-     is the rail underneath. **Look for that `role: "watch"` pane; never hand-place or hand-roll a live
+   - `ORCH` — the orchestrator with the daemon-placed, run-id-pinned shipped board BESIDE it: the board
+     takes the RIGHT half of the tab and the orchestrator's own narration keeps the LEFT half. (It was a
+     full-width board above a narration rail until 2026-08-25; the operator changed it, because a task
+     table is a few rows and it was spending height it did not need while squeezing the narration.) **Look for that `role: "watch"` pane; never hand-place or hand-roll a live
      run surface. Nothing else, ever: a work seat NEVER splits into the ORCH tab.** Operator verbatim:
      *"in orch tab should be the orch and the watcher only."* Re-earned 2026-08-17: a planning seat split
      beside the orchestrator, and the operator caught it, again. The daemon owns this vertical stack and
@@ -140,8 +151,8 @@ journal tail to decide what happens next, or sweeping orphans — you have taken
 ### What the ORCHESTRATOR does, and what you require of it
 
 - **The live surface arrives with the run.** `tickmarkr run` is stdout-silent until run-end by design;
-  its daemon self-places one shipped `role: "watch"` board ABOVE the supervising seat — full width, top
-  72% of the height, narration below — and pins that board to the daemon's run id. **Look for the matching
+  its daemon self-places one shipped `role: "watch"` board BESIDE the supervising seat — the right half
+  of the tab, narration on the left — and pins that board to the daemon's run id. **Look for the matching
   daemon-placed pane.** If it is absent, treat that as a daemon/run liveness fault and use the normal
   recovery path; never hand-place, hand-roll, or launch a replacement live surface. A board the daemon
   could not stack is not silently re-arranged: the split is closed and the run continues BOARDLESS, so an
@@ -347,6 +358,21 @@ they are left implicit:
   - Five distinct send failures in one leg — front-truncation, sitting unsubmitted, two silent losses,
     a probe that mistook its own echo for a reply — is what a prose send protocol costs under load:
     run `scripts/seat-send.sh` instead.
+- **A `pane run` into a pane whose FOREGROUND is busy is a DELAYED command, not a lost one.** The
+  shell buffers the line and executes it the instant the foreground process exits — which, when that
+  process is a run daemon, means *at run-end*, unattended, possibly hours later. Measured 2026-08-24: a
+  resume typed into the run pane while the daemon still held it fired by itself at the next run-end;
+  the seat that sent it read the later activity as an unattributed injection and nearly declared the
+  pane compromised. Two consequences: **check the target pane's foreground before sending** (a live
+  daemon owns it — send from your own shell instead), and **before attributing any unexplained
+  activity to an intruder, ask what YOU left buffered there.** The benign explanation is the common
+  one, and the alarming one costs a false security incident.
+- **A compound command that `cd`s POISONS every later relative path in the same call.** The Bash tool's
+  working directory persists, so `cd /tmp && …` followed by `cat .planning/x` silently reads the wrong
+  tree. Measured twice on 2026-08-24: once reading a worktree's config and nearly authoring a duplicate
+  fix for interims that were present all along, once failing a release export script that existed.
+  **State reads during supervision use ABSOLUTE paths**, and a read that contradicts what you believe
+  is a cue to check your cwd before you rewrite your model of the world.
 - **Guard-before-Enter** (race-safe prompt answering): chain with `&&` — pane get shows `blocked` && pane
   read shows the expected option under the cursor && only then send-keys. If no longer `blocked`, someone
   already answered; do nothing.
@@ -408,6 +434,24 @@ tier ages to `STALE` (never `ABSENT`) within six beats, which is the state that
 Stand down explicitly when you hand off, or a deliberate exit reads as a death. Same rule as rule 29
 below, now with a conventional path the other tier already reads: `tickmarkr status` shows it.
 
+⚠ **THE LOOP ABOVE BINDS TO A PROCESS, NOT TO A SEAT — and that is a defect this skill shipped.**
+The beat keeps running while its *session* lives, so a loop started by a seat that has since been
+cleared, re-briefed, or replaced keeps beating that tier's file forever. Measured 2026-08-24
+(OBS-583): a **2d20h** orphan loop from a predecessor seat held `orchestrator ARMED` through a
+**three-hour window in which no orchestrator was alive**, and it would have silently re-armed a
+recorded stand-down within 10 seconds. On the same sweep the overseer tier had **three** beat loops,
+one owned by an unrelated session. So:
+- **At every adopt, clear, or re-brief, sweep for pre-existing loops on YOUR tier before arming one**
+  (`pgrep -f "tickmarkr beat <tier>"`), trace each to its parent session, and kill the **loop only**
+  — never the parent — then verify the parent survived.
+- **`ARMED` is a claim about a process, not about a seat.** Before trusting any tier's `ARMED`, ask
+  whose session owns the beater; a tier can be armed and seatless, which is *worse* than ABSENT
+  because it reads as coverage (rule 11's outliving-its-trigger failure, in beat form).
+- Stand-down must kill the loop **and** run `--stand-down`; the second without the first is undone
+  by the next tick.
+The product fix (a seat-bound or sentinel-terminated beat, armed and stood down in one act) is
+queued; until it ships, this sweep is the guard.
+
 Arm the bundled watcher as its OWN Bash call with `run_in_background` — chaining it after other commands
 with `&` orphans it from the wake chain. It prints one wake reason and exits; re-arm after every wake.
 
@@ -427,6 +471,21 @@ mid-work — reading files, context climbing. So a status-keyed watcher can both
 worker** and **fire on a working one**, and neither failure announces itself. The bundled watcher inherits
 this; so does any `herdr agent wait`. It is still worth arming — it catches vanished panes and real
 blocks — but **never treat its silence as evidence a worker is healthy.**
+**A THIRD failure of the same proxy, and it hits the SUPERVISING seat, not a worker: a session wedged
+on a provider error or a CLI auto-update reports `working` forever.** Measured 2026-08-24: an
+orchestrator took an API 529 mid-turn, its frame froze with the error rendered, and `agent_status`
+read `working` across ten minutes while nothing advanced — and its own last transcript line claimed a
+resume it had never issued, which disk falsified (journal ended at `run-end`, no lock, no daemon).
+Nothing in a watcher set aimed at the RUN can see this: a wake delivered to a wedged seat's queue
+reaches nobody. Two cheap guards, both of which this seat lacked:
+- **Poll the supervised seat's VIEWPORT for a persistent error frame** — the same text present in two
+  reads minutes apart is the tell; one read cannot distinguish a frozen frame from a live one.
+- **Falsify the seat's own claims against disk at every state change it reports.** A wedged or
+  context-exhausted seat narrates intentions as completions. The lock, the journal's last row, and the
+  process table settle it in one command.
+When it fires: interrupt (Esc, bounded), have the seat correct the false record in writing rather than
+silently, then handoff + `/clear` + fresh brief BEFORE it takes the next boundary — a seat that just
+mis-reported its own state is not the seat to hand a release decision to.
 Two keys that do not lie, in order of strength:
 - **The daemon's own waiter.** What `herdr pane wait-output` is matching on tells you the phase from the
   harness's state machine rather than from a status field: a `--match` on a readiness banner means the
@@ -501,6 +560,15 @@ that hang is byte-identical to a seat still working. The script prints each unfi
 last line on every timeout heartbeat — read it there, and when in doubt `tail -1` the artifact, never
 the transcript's claim about it.
 
+**An ABSENT artifact ALONE cannot discriminate a working producer from a dead watcher.** A producer still
+working and a watcher that died with its seat write byte-identical evidence — nothing — so a missing file
+is one signal carrying at least three meanings (still working, watcher dead, producer dead), and it is
+**never** evidence that the watcher is still waiting. Reading it that way infers an instrument's liveness
+from the silence it was built to sit through. Settle it with two probes that do not share a failure:
+the watcher from the process table, the producer from its pane or seat status. Measured 2026-08-25
+(OBS-622): both consultants were live and had written nothing, so the artifact side could not see that
+nothing was watching them.
+
 **Arm it in the same call as the spawn, not the next one.** A watcher armed "after I finish this step"
 leaves a gap exactly as wide as however long you stay busy, and you will be busy — you just spawned work.
 **Measured 2026-08-06 (OBS-369): two consult verdicts, 30KB and 12.8KB, sat COMPLETE with their markers
@@ -628,6 +696,50 @@ orchestrator turn boundary.
    fix helps ONE operator and leaves every other user with the defect. If an overlay is the interim, it
    says so in writing and names its removal condition.
 
+8. **A SHIPPED VERSION IS NOT DONE UNTIL THE STATE IT LEAVES BEHIND IS CLEAN.** Publishing is the loud
+   half; the quiet half is that the NEXT seat inherits either the truth or a confident lie. Run this
+   before you stand down from any release — **operator instruction, 2026-08-25: *"overseer should always
+   leave clean state after a version is shipped"***. Every line below is a defect that actually happened
+   on the release that produced this rule.
+
+   - **REWRITE THE MEMORY INDEX FIRST, and read it back.** Minutes after `2.1.1` hit npm, the index line
+     a fresh session loads still read *"⛔ 2.1.1 CANNOT ship from run …2011"* — true when written, and by
+     then the exact opposite of the truth. **The index is what everyone loads and the body is what nobody
+     opens** (Evidence rule 25), so a stale index is not a cosmetic lag; it is the most-read wrong
+     sentence in the project. State what shipped, what did NOT, and the first three things the next seat
+     should do.
+   - **VERIFY EVERY ID THE CODE NOW CITES ACTUALLY EXISTS.** A release lands source comments citing
+     ledger ids. One of that release's entries was written by a heredoc in a command that then timed out
+     — the entry survived, but nothing had checked. `grep -c '^## OBS-<id>'` for each id the diff
+     introduced. A citation pointing at nothing is the defect the ledger itself files (OBS-604), shipped
+     into `src/`.
+   - **KILL THE BEAT LOOP *AND* RUN `--stand-down`.** Either alone is worse than neither: the loop
+     without the stand-down re-arms a tier you retired within 10s, and the stand-down without the loop
+     is undone by the next tick. Verify `status` reads `DISARMED` — which means *handed off*, distinct
+     from `STALE` (armed then died) and `ABSENT` (never armed).
+   - **RECORD YOUR WATCHERS AS DYING WITH THIS SESSION — never as "armed".** A written stand-down or
+     handoff may NOT carry the bare wording *"watcher armed"* for anything this seat owns: that form
+     states an act and lets the successor read a fact, and it survived into a handoff exactly once before
+     costing two unwatched consult verdicts (OBS-622). The admissible form names the lifetime and the
+     work it leaves the successor — *"watchers armed by this session (journal, artifact, dialog, beat);
+     they die with it — re-arm on adopt"* — and, per rule 11, says which tier's watchers were NOT armed.
+     A detached watcher is the one exception and must be labelled as such, with its heartbeat file, since
+     it outlives the seat instead.
+   - **SWEEP THE PANES THE RUN LEFT.** A daemon killed by a signal flushes its journal and releases its
+     lock but **does not clean up its worker panes or its board**. Two orphaned worker panes and a dead
+     board pane sat in the operator's tab bar until he screenshotted them. Verify each is inert first
+     (no agent, nothing running in its worktree) and confirm the WORK is on its branch — then close.
+     Emptied tabs disappear on their own.
+   - **CORRECT EVERY TAB LABEL.** `ORCH · 2.1.1 T1 regate` was still on screen hours after that regate
+     ended. Tab labels are how the operator reads fleet state; a stale one is a false status report.
+   - **LEAVE THE TREE CLEAN AND SAY WHAT IS UNMERGED.** Name the branches that hold real but ungated
+     work, so the next seat neither discards nor trusts them. *"Zero merges, T1/T3 branches ungated, T5
+     never dispatched"* is a handoff; *"the run ended"* is not.
+
+   ⚠ **The half of this that is NOT operator discipline must be QUEUED, not absorbed:** a daemon that
+   orphans its panes on SIGTERM is a PRODUCT defect and belongs in `src/**`. Sweeping by hand every time
+   is the local remedy, and per rule 7 it says so in writing and names its removal condition.
+
 ---
 
 ## Briefing a seat to audit a security-shaped check — phrasing matters
@@ -708,6 +820,17 @@ twice.** They are mission-independent on purpose: nothing here names a task, a l
 
 **Instruments**
 
+10a. **A CONTROL NAMES THE PROPERTY IT VERIFIES, NEVER AN INSTANCE OF IT** — and when it names an
+    instance, the seat that wrote it must correct the CONTROL rather than let it stop lawful work.
+    Measured 2026-08-24: a ruling armed *"the dispatch must resolve to `codex:gpt-5.6-terra` — anything
+    else, STOP"*, when the property the control existed to prove was *"a lawful channel OUTSIDE the
+    task's tried set, admitted by the amended floor."* Marginal-cost routing correctly picked a
+    cheaper mid-tier channel that satisfied the property completely — never tried, proven on the same
+    run — and the letter of the control said halt. **An over-specified control converts a working
+    mechanism into a false stop, and the seat under it will obey.** Write the property; if you catch
+    yourself naming a channel, a model, a pid or a hash, ask what that instance is standing in for.
+    The converse holds too: **a control loose enough to pass on the wrong thing is worse** — the fix is
+    precision about the property, not about the example.
 11. **For any guard whose failure is SILENCE — detector, lint, watcher, gate, alarm branch — the acceptance
     test is a POSITIVE CONTROL, not a clean run.** A zero cannot distinguish *nothing is broken* from *the
     instrument is blind* from *the check does not exist*. Remove the condition it should catch and confirm
@@ -727,6 +850,14 @@ twice.** They are mission-independent on purpose: nothing here names a task, a l
     owns it** — "watchers alive" is the one claim a seat cannot verify about itself. Measured 2026-08-06:
     an orchestrator sat `idle` through three merges and two dispatches with no journal watcher in the
     process table, while its own last report read *"daemon, board, sweeper, watcher all alive"* (OBS-366).
+    **STATE THE LIFETIME, because an unstated one is read as the mission's: a session-scoped watcher DIES
+    WITH THE SEAT THAT ARMED IT.** Every watcher a seat arms — journal, artifact, dialog, beat loop — is
+    session-scoped unless it was deliberately detached (`ppid 1`, the heartbeat form below), so `/clear`,
+    a crash, an adopt or a stand-down ends it, and **a handoff is the one moment the arming seat stops
+    existing** — which is exactly when its watchers are most likely to be believed. The inverse failure is
+    the same root read the other way: a DETACHED loop outlives its seat and holds a tier `ARMED` with
+    nobody home (OBS-583). Neither direction may be assumed; the lifetime is a property of how the watcher
+    was launched, and it belongs in writing next to every claim that one is armed.
     **And the process-table probe has a standard idiom that DEFEATS it, so the rule above needs one more
     line to be usable.** Never probe for a watcher with `ps … | grep <token> | grep -v grep`: a poll-grep
     watcher carries the word `grep` in its own argv, so the filter whose job is removing the *probing* grep
@@ -736,7 +867,19 @@ twice.** They are mission-independent on purpose: nothing here names a task, a l
     it as a defect — and was corrected forty minutes later when the watcher fired normally, having been
     alive throughout. Two hypotheses (`ps` truncation; multi-column truncation) were formed and killed by
     measurement first, and the first falsification was itself run against the wrong `ps` form. **Use
-    `pgrep -f <token>`, or read the lock's own pid.** The general rule: **an exclusion filter is exactly as
+    `pgrep -f <token>`, or read the lock's own pid.**
+    ⚠ **AND `pgrep -f` HAS ITS OWN INVERSE FAILURE, so the recommended fix is not free: it matches the
+    ARGV OF THE SHELL RUNNING IT.** A probe written as `pgrep -f "npm test"` is itself a process whose
+    command line contains `npm test`, so it returns its own shell — a PHANTOM that looks exactly like the
+    contamination you are hunting. Measured 2026-08-25: a load-ceiling wake was investigated, a second
+    `npm test` "outside the gate's worktree" was found, and it was the probe. It had vanished by the next
+    command, which is the tell — a real second suite does not exit between two reads. The escalation would
+    have been a false contamination alarm during a task's last attempt.
+    Discriminate before you believe a hit: **resolve each pid's `cwd` AND drop any whose own command
+    contains the probe** (`pgrep`/`bash -c`), or match a pattern the target has and the probe cannot —
+    the binary's real path rather than the words you typed. `grep -v grep` fails toward *not there*;
+    `pgrep -f` fails toward *there twice*, and this direction gets ACTED ON, which is worse.
+    The general rule: **an exclusion filter is exactly as
     dangerous as an over-broad inclusion filter, and it fails in the direction that reads as "not there" —
     which is the direction that gets acted on.**
     Two corollaries: **re-arm a wake-and-exit watcher as the same turn's LAST act**, not the next turn's

package/skills/tickmarkr-overseer/scripts/seat-send.sh

@@ -57,12 +57,34 @@ pane_of() {
     | sed -n 's/.*"pane_id":"\([^"]*\)".*/\1/p' | head -1
 }
 
-# The rendered `❯` line — the only state that discriminates submitted from sitting. head -1 returns
-# the first rendered line, i.e. a PREFIX of a wrapped draft, so callers compare prefixes, never
-# whole sentences (OBS-396: a full-sentence match returns false on a message that arrived intact).
+# The rendered `❯` line — the only state that discriminates submitted from sitting. tail -1 takes
+# the LAST `❯` line, which is always the LIVE INPUT BOX: a wrapped draft's continuation lines carry
+# no `❯`, so the last one is still that draft's FIRST rendered line, i.e. a PREFIX of the draft —
+# callers compare prefixes, never whole sentences (OBS-396: a full-sentence match returns false on a
+# message that arrived intact).
+#
+# SUBMITTED-ECHO DISCRIMINATOR (OBS-603, captured 2026-08-25 on an overseer's first send). claude-code
+# echoes a SUBMITTED message into the transcript with the same `❯` glyph, and a long one still occupies
+# this 14-line window ABOVE the empty box. The old `head -1` returned that echo, `is_ours` matched it
+# (the echo IS a prefix of $MSG), and one delivered message drew TWO false verdicts: SEND_UNSUBMITTED on
+# the send that made the echo, then REFUSED_BOX_OCCUPIED on the NEXT send — the worse half, because it
+# refuses to deliver at all and leaves the seat unreachable until the echo scrolls out. Both reactions
+# this script warns against are then wrong: re-sending appends and submits both, escalating reports a
+# failure that never happened. OBS-396's phantom, one layer up.
+#
+# ⚠ POSITION IS NOT THE DISCRIMINATOR, and the kimi control below proves it: the two TUIs render in
+# OPPOSITE order. kimi puts the live box FIRST and stages BELOW it; claude-code puts the echo FIRST and
+# the live box BELOW. So `head -1` is wrong for one and `tail -1` is wrong for the other — a fix that
+# only flipped them would have traded this defect for the staged-queue defect OBS-552 already paid for.
+# What actually identifies the ordinary input box is that it is the LAST `❯` line which is NOT a staged
+# entry: staged lines carry the `↑ to edit · ctrl-s to steer` affordance and belong to `staged_line()`,
+# which owns that concept. Dropping them here makes this function's contract exact — the live ORDINARY
+# box — instead of positional, and it reads the affordance rather than a vendor name, so any TUI that
+# grows the same queue is covered without a matcher list.
 prompt_line() {
   herdr agent read "$TARGET" --source visible --lines 14 2>/dev/null \
-    | sed -n 's/^[[:space:]]*❯[[:space:]]*//p' | head -1 | sed 's/[[:space:]]*$//'
+    | sed '/↑ to edit/{/steer/d;}' \
+    | sed -n 's/^[[:space:]]*❯[[:space:]]*//p' | tail -1 | sed 's/[[:space:]]*$//'
 }
 
 # STAGED-QUEUE DISCRIMINATOR (OBS-552 addendum, captured 2026-08-19 on a live kimi seat). After its

package/skills/tickmarkr-overseer/scripts/watch-contamination.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# watch-contamination.sh — wake the AUTHORITY seat when a gate VERDICT may be contaminated.
+# watch-contamination.sh — wake the AUTHORITY seat when a gate VERDICT may be contaminated.
 #
 # Operator, 2026-08-07: "that is the kind of job I need overseer to be vigilant about."
 #
@@ -30,7 +30,7 @@ INFRA_RE='vitest-worker|Timeout calling|JS heap out of memory|ENOMEM|EAGAIN|spaw
 
 load1() { uptime | sed 's/.*load averages*: *//' | awk '{print $1}' | tr -d ','; }
 # Count real vitest runners only. `pgrep -f vitest` over-counts by an order: it matches the WORD
-# in any argv — worker prompts, VITEST_MAX_FORKS in shell strings (measured 7 vs 2 real, 2026-08-10).
+# in any argv — worker prompts, VITEST_MAX_FORKS in shell strings (measured 7 vs 2 real, 2026-08-10).
 # [v] keeps the pattern from matching its own grep. Forked workers retitle to "node (vitest N)" (comm).
 vitest_n() { ps -axo comm,command 2>/dev/null | grep -Ec 'node_modules/(\.bin/)?[v]itest|[v]itest/dist/|\([v]itest [0-9]+\)'; }
 
@@ -47,7 +47,11 @@ while [ "$elapsed" -lt "$CAP" ]; do
   elapsed=$((elapsed + POLL))
 
   L=$(load1); V=$(vitest_n)
-  Li=${L%%.*}; [ -z "$Li" ] && Li=0
+  # OBS-585: strip at the first NON-DIGIT, never at "." - a locale that renders the load average
+  # with U+066B (3٫48) or a comma leaves the period-strip a no-op, the numeric test below then
+  # errors, and its 2>/dev/null hides that, so the LOAD trigger dies silently at every load.
+  # Proven against the incident this watcher exists for: 35٫26 vs ceiling 24 never fired.
+  Li=$(printf %s "$L" | sed "s/[^0-9].*//"); [ -z "$Li" ] && Li=0
 
   if [ -f "$J" ]; then
     seen=$(cat "$STATE" 2>/dev/null); [ -z "$seen" ] && seen=0
@@ -63,7 +67,7 @@ while [ "$elapsed" -lt "$CAP" ]; do
         task=$(printf '%s' "$hit" | sed -n 's/.*"taskId":"\([^"]*\)".*/\1/p')
         gate=$(printf '%s' "$hit" | sed -n 's/.*"gate":"\([^"]*\)".*/\1/p')
         echo "CONTAMINATED_VERDICT task=$task gate=$gate load=$L vitest=$V"
-        echo "  an infra fingerprint appeared in a FAILED gate — this red is not evidence about the diff"
+        echo "  an infra fingerprint appeared in a FAILED gate — this red is not evidence about the diff"
         echo "  ruling owed: is the attempt chargeable? (OBS-426: infra failures are not)"
         exit 0
       fi
@@ -77,4 +81,4 @@ while [ "$elapsed" -lt "$CAP" ]; do
   fi
 done
 
-echo "WATCH_CAP_REACHED load=$(load1) vitest=$(vitest_n) — no contaminated verdict seen in ${CAP}s"
+echo "WATCH_CAP_REACHED load=$(load1) vitest=$(vitest_n) — no contaminated verdict seen in ${CAP}s"