tickmarkr 2.1.1 → 2.1.3

package/dist/run/git.js

@@ -64,6 +64,31 @@ export const runWithForkBudget = (concurrency, fn) => forkBudget.run(String(deri
 export const resolvedForkCap = () => forkBudget.getStore() ?? DEFAULT_FORK_CAP;
 /** The shipped shell ceiling: the fallback every caller gets when nothing measured a better one. */
 export const DEFAULT_SHELL_TIMEOUT_MS = 600000;
+/**
+ * OBS-688: every gate, every baseline capture and every tip verification reaches the machine through
+ * this one seam, and the seam took its spawn from the standard library directly — so the one failure
+ * it must handle, the kernel REFUSING the fork, was unreachable from a fixture and could only be
+ * described. It is injectable here for exactly that reason; production always holds `spawn` itself.
+ * Undefined-until-set, never captured at module load: the standard library binding stays read at
+ * CALL time, exactly as before this seam existed, so a suite that mocks `node:child_process` without
+ * a `spawn` export still imports this module (tests/adapters/pi-auth.test.ts does).
+ */
+let spawnChild;
+export const setSpawnForTests = (fn) => { spawnChild = fn; };
+export const resetSpawnForTests = () => { spawnChild = undefined; };
+/**
+ * A refusal is NOT evidence about the work: the command never started, so nothing ran, and a retry
+ * cannot repeat a side effect. That argument is the whole safety case for retrying here, and it
+ * holds for exactly one closed case — the kernel refused the fork for a temporary resource shortage
+ * (EAGAIN: the fork table is full, which a gate burst does to a box twice in one night). Every
+ * other spawn error is a standing fact about the machine — a missing interpreter above all — and
+ * retrying it buys nothing while delaying every genuine failure by the whole backoff, so it returns
+ * on the first read. The retry is also gated on the child having produced NO byte and never having
+ * emitted `spawn`: past either, a command has run and re-running it is a side effect, never a retry.
+ */
+const RETRYABLE_SPAWN_CODE = "EAGAIN";
+export const SPAWN_ATTEMPT_LIMIT = 4;
+export const SPAWN_RETRY_BACKOFF_MS = 50;
 // stdin "ignore": same class as HARD-05 / SubprocessDriver — never leave an open pipe a child can block on
 // (pi -p / codex exec wait for stdin EOF). timedOut distinguishes SIGKILL-timeout from a real nonzero exit.
 function shell(cmd, cwd, timeoutMs, login) {
@@ -77,14 +102,14 @@ function shell(cmd, cwd, timeoutMs, login) {
     // OBS-110: apply the run's own fork cap only when the operator has not already set one.
     if (!(FORK_CAP_ENV in env))
         env[FORK_CAP_ENV] = resolvedForkCap();
-    return new Promise((resolve) => {
+    const attempt = () => new Promise((resolve) => {
         const startedAt = Date.now();
         // detached: bash gets its own process group so a timeout can kill the whole tree —
         // SIGKILLing bash alone orphans grandchildren (codex/pi) that hold the stdio pipes
         // open, so "close" never fires and the promise wedges forever (v1.33.1 init hang).
-        const p = spawn("bash", [login ? "-lc" : "-c", cmd], { cwd, env, stdio: ["ignore", "pipe", "pipe"], detached: true });
+        const p = (spawnChild ?? spawn)("bash", [login ? "-lc" : "-c", cmd], { cwd, env, stdio: ["ignore", "pipe", "pipe"], detached: true });
         let stdout = "", stderr = "";
-        let timedOut = false, done = false;
+        let timedOut = false, done = false, started = false;
         const finish = (code, err) => {
             if (done)
                 return;
@@ -101,14 +126,37 @@ function shell(cmd, cwd, timeoutMs, login) {
                 p.kill("SIGKILL");
             }
         }, timeoutMs);
+        p.on("spawn", () => { started = true; }); // the command exists from here on — never retryable past it
         p.stdout.on("data", (d) => (stdout += d));
         p.stderr.on("data", (d) => (stderr += d));
-        p.on("error", (e) => finish(127, String(e)));
+        p.on("error", (e) => {
+            if (!done && !started && !stdout && !stderr && e.code === RETRYABLE_SPAWN_CODE) {
+                done = true;
+                clearTimeout(timer);
+                resolve({ refused: e });
+                return;
+            }
+            finish(127, String(e));
+        });
         p.on("close", (code) => finish(code ?? 1));
         // "close" waits for stdio to drain; a surviving pipe-holder must not outlive the timeout
         p.on("exit", (code) => { if (timedOut)
             finish(code ?? 1); });
     });
+    return (async () => {
+        const startedAt = Date.now();
+        for (let n = 1;; n++) {
+            const r = await attempt();
+            if (!("refused" in r))
+                return r;
+            // Bounded, and the bound is what makes a persisting shortage a REPORTED failure rather than a
+            // wedged daemon: past it the caller gets the refusal's own text under exit 127, as before.
+            if (n >= SPAWN_ATTEMPT_LIMIT) {
+                return { code: 127, stdout: "", stderr: String(r.refused), durationMs: Date.now() - startedAt };
+            }
+            await new Promise((wake) => setTimeout(wake, SPAWN_RETRY_BACKOFF_MS * n));
+        }
+    })();
 }
 export function sh(cmd, cwd, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS) {
     return shell(cmd, cwd, timeoutMs, true);

package/dist/run/lock.d.ts

@@ -10,6 +10,7 @@ export interface Inspection {
     ino: number;
 }
 export declare function shouldRefuse(i: Pick<Inspection, "garbage" | "dead">): boolean;
+export declare function isPidLive(pid: number): boolean;
 export declare function acquireRunLock(repoRoot: string, runId: string): {
     reclaimed?: {
         pid: number;

package/dist/run/lock.js

@@ -45,6 +45,23 @@ process.once("exit", () => { if (heldPath)
 export function shouldRefuse(i) {
     return i.garbage || !i.dead;
 }
+// LOCK-04, PID-SCOPED: the same decision table, in the shape a caller holding only a pid can consume.
+// Every other liveness export here takes a repository root, so a reader with a pid off a journal row
+// had no seam to reach and wrote the four lines itself — twice. One copy was faithful; the other
+// treated ANY thrown error as death, so a daemon owned by another user (EPERM) read dead there and
+// alive here. A rule that forbids a second `process.kill(pid, 0)` without exporting a usable
+// predicate produces exactly those copies, so this is the predicate. no throw ⇒ ALIVE; ESRCH ⇒ the
+// only proof-positive death; ANY other errno (EPERM = alive-but-not-ours, EINVAL, …) ⇒ ALIVE,
+// because none of them is evidence of death and this table fails closed toward alive.
+export function isPidLive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (k) {
+        return k.code !== "ESRCH";
+    }
+}
 // statSync throws ENOENT when no lock exists — callers treat that as "not held".
 function inspect(p) {
     const st = statSync(p); // single stat: both the heartbeat mtime and the reclaim-guard inode
@@ -53,16 +70,8 @@ function inspect(p) {
     const parsed = PayloadSchema.safeParse(readPayload(p));
     const garbage = !parsed.success; // LOCK-01: its own state — shouldRefuse refuses it unconditionally; only `tickmarkr unlock` removes it
     const pid = parsed.success ? parsed.data.pid : undefined;
-    let dead = pid === undefined; // harmless fallback for the garbage row — garbage short-circuits shouldRefuse before this is read
-    if (pid !== undefined) {
-        try {
-            process.kill(pid, 0);
-            dead = false;
-        } // no throw ⇒ ALIVE
-        catch (k) {
-            dead = k.code === "ESRCH";
-        } // ESRCH ⇒ dead; EPERM ⇒ ALIVE
-    }
+    // harmless fallback for the garbage row — garbage short-circuits shouldRefuse before this is read
+    const dead = pid === undefined ? true : !isPidLive(pid);
     return { pid, runId: parsed.success ? parsed.data.runId : undefined, garbage, dead, expired, mtimeMs, ino: st.ino };
 }
 function readPayload(p) {
@@ -222,9 +231,10 @@ export async function acquireApprovalSerialization(repoRoot, runId) {
     }
 }
 // LOCK-04: the owner the decision table sees, read-only, for callers that need the pid as well as
-// the answer. inspect() owns pid-liveness (ESRCH dead / EPERM alive / garbage fail-closed); a second
-// `process.kill(pid, 0)` anywhere else would be a second copy of that rule, free to drift. undefined
-// ⇒ no lock at all — never conflate that with a lock whose recorded owner is dead.
+// the answer. inspect() owns pid-liveness (ESRCH dead / EPERM alive / garbage fail-closed) and reads
+// it from isPidLive above; a second `process.kill(pid, 0)` anywhere else would be a second copy of
+// that rule, free to drift — a caller holding only a pid consumes isPidLive, never its own probe.
+// undefined ⇒ no lock at all — never conflate that with a lock whose recorded owner is dead.
 export function runLockOwner(repoRoot) {
     let insp;
     try {

package/dist/run/supervision.d.ts

@@ -3,24 +3,30 @@ export declare const SUPERVISION_BEAT_MS = 10000;
 /** Ceiling before a beat reads STALE: SIX beats, lock.ts's ratio — five may be missed before alarm. */
 export declare const SUPERVISION_STALE_MS: number;
 export declare const SUPERVISION_FUTURE_GRACE_MS = 1000;
-export declare const SUPERVISION_TIERS: readonly ["orchestrator", "overseer", "watch"];
+export declare const SUPERVISION_TIERS: readonly ["orchestrator", "orchestrator-context", "overseer", "overseer-context", "watch"];
 export type SupervisionTier = (typeof SUPERVISION_TIERS)[number];
+export declare const SUPERVISION_SEAT_TIERS: readonly ["orchestrator-context", "overseer-context"];
+export type SeatTier = (typeof SUPERVISION_SEAT_TIERS)[number];
+/** Does this tier's record have to name the seat it speaks for? */
+export declare const isSeatTier: (tier: string) => tier is SeatTier;
 export type SupervisionState = "ABSENT" | "STALE" | "ARMED" | "UNREADABLE" | "DISARMED";
 export interface TierLiveness {
     tier: SupervisionTier;
     state: SupervisionState;
     /** Absent for ABSENT, UNREADABLE and DISARMED — no beat to age. Always present for STALE and ARMED. */
     beatAgeMs?: number;
+    /** The seat the record names, when it names one. Always present on a seat tier that is not ABSENT. */
+    seat?: string;
 }
 export declare const supervisionBeatPath: (repoRoot: string, tier: SupervisionTier) => string;
 /** Where a watcher records that it STOOD DOWN. Its own file: the beat keeps meaning only "alive". */
 export declare const supervisionStandDownPath: (repoRoot: string, tier: SupervisionTier) => string;
-export declare function beatSupervision(repoRoot: string, tier: SupervisionTier): void;
+export declare function beatSupervision(repoRoot: string, tier: SupervisionTier, seat?: string): void;
 /** Handle a watcher holds for as long as it is supervising; disarm stands it down and is idempotent. */
 export interface ArmedSupervision {
     disarm: () => void;
 }
-export declare function armSupervision(repoRoot: string, tier: SupervisionTier, beatMs?: number): ArmedSupervision;
+export declare function armSupervision(repoRoot: string, tier: SupervisionTier, beatMs?: number, seat?: string): ArmedSupervision;
 export declare function readTierLiveness(repoRoot: string, tier: SupervisionTier, now?: number): TierLiveness;
 export declare function supervisionStatus(repoRoot: string, tier: SupervisionTier, now?: number): TierLiveness;
 /** Every KNOWN tier, always — a tier omitted from this list would read as one that is fine. */

package/dist/run/supervision.js

@@ -29,7 +29,22 @@ export const SUPERVISION_FUTURE_GRACE_MS = 1_000;
 // The supervision seats this harness has. An unlisted tier is an INVISIBLE tier, which is the failure
 // mode itself — an auditor read "no watchers were ever armed" off a surface that named none. Adding a
 // seat means adding it here, and `status` then renders it whether or not it has ever beaten.
-export const SUPERVISION_TIERS = ["orchestrator", "overseer", "watch"];
+// SUP-05: CONTEXT is per SEAT, so its tiers are per seat too. One shared `context` tier would be read
+// by both supervising seats and beaten by whichever of them still had a watcher, so a live overseer
+// watcher would render the dead orchestrator one as armed — the mask this whole instrument exists to
+// remove. The enumeration is CLOSED at one tier per supervising seat: orchestrator and overseer.
+// `watch` beats nowhere on this tree and stays ABSENT, which is what ABSENT means.
+export const SUPERVISION_TIERS = [
+    "orchestrator", "orchestrator-context", "overseer", "overseer-context", "watch",
+];
+// The tiers whose records must NAME the seat behind them. A one-shot `tickmarkr beat` records a pid
+// that has already exited by the time anyone reads it, and an instant — nothing a reader can attribute
+// to a seat. Measured 2026-08-26: a consult seat of another tier ran the documented beat loop and the
+// board read that tier armed with no seat of that tier having armed anything. ARMED-and-seatless reads
+// as coverage, which is worse than ABSENT, so on these tiers a record that names no seat is not a beat.
+export const SUPERVISION_SEAT_TIERS = ["orchestrator-context", "overseer-context"];
+/** Does this tier's record have to name the seat it speaks for? */
+export const isSeatTier = (tier) => SUPERVISION_SEAT_TIERS.includes(tier);
 // PURE path math: stateDirName, never tickmarkrDir — the latter mkdirs the state dir and writes its
 // .gitignore, so routing a READER through it would make status create the very tree it reports on.
 export const supervisionBeatPath = (repoRoot, tier) => join(repoRoot, stateDirName(repoRoot), "supervision", `${tier}.beat`);
@@ -38,11 +53,16 @@ export const supervisionStandDownPath = (repoRoot, tier) => join(repoRoot, state
 // WRITER — a watcher's own call, on its own tier, every SUPERVISION_BEAT_MS. Never a reader's: the
 // purity fence (status --watch leaves the state dir byte-identical) is the test that catches a reader
 // that beats on the watcher's behalf, which would report every dead tier as healthy.
-export function beatSupervision(repoRoot, tier) {
+export function beatSupervision(repoRoot, tier, seat) {
+    // A seat tier may not be armed anonymously, and the refusal belongs HERE rather than only in the
+    // verb: any caller that could write a seatless record could arm a tier nobody occupies.
+    if (isSeatTier(tier) && !seat?.trim()) {
+        throw new Error(`${tier} is a per-seat tier — a beat must declare the seat identity it speaks for`);
+    }
     tickmarkrDir(repoRoot); // the write path DOES create — beats land inside the gitignored state dir
     const p = supervisionBeatPath(repoRoot, tier);
     mkdirSync(dirname(p), { recursive: true });
-    writeFileSync(p, JSON.stringify({ tier, pid: process.pid, beatAt: new Date().toISOString() }) + "\n");
+    writeFileSync(p, JSON.stringify({ tier, ...(seat ? { seat } : {}), pid: process.pid, beatAt: new Date().toISOString() }) + "\n");
 }
 // THE WATCHER-FACING ENTRY POINT — the loop SUPERVISION_BEAT_MS actually drives. A supervising seat
 // calls this once at the top of its watch and holds the handle for the duration; a seat that dies,
@@ -57,7 +77,7 @@ export function beatSupervision(repoRoot, tier) {
 //
 // Arming CLEARS any prior stand-down record: a tier that stood down and armed again is armed, and a
 // marker left behind by the last run would otherwise report the live one as stood down forever.
-export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS) {
+export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS, seat) {
     // The clearing gets its OWN try: a cleanup that cannot complete (a directory dropped at the marker
     // path, a permission) must not cost the first beat. Sharing one try did exactly that — the tier armed
     // with NO beat while the old marker stayed on disk, the one combination that reports a live watcher
@@ -67,12 +87,12 @@ export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS) {
     }
     catch { /* uncleared: the reader validates the marker and a newer beat outranks it — never masked */ }
     try {
-        beatSupervision(repoRoot, tier);
+        beatSupervision(repoRoot, tier, seat);
     }
-    catch { /* repo gone / disk full — the tier reads ABSENT rather than crashing its watcher */ }
+    catch { /* repo gone / disk full / no seat — the tier reads ABSENT rather than crashing its watcher */ }
     const timer = setInterval(() => {
         try {
-            beatSupervision(repoRoot, tier);
+            beatSupervision(repoRoot, tier, seat);
         }
         catch { /* repo gone / disk full — let the beat expire */ }
     }, beatMs);
@@ -94,7 +114,9 @@ export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS) {
             const tmp = `${p}.${process.pid}.tmp`;
             try {
                 mkdirSync(dirname(p), { recursive: true });
-                writeFileSync(tmp, JSON.stringify({ tier, pid: process.pid, disarmedAt: new Date().toISOString() }) + "\n");
+                writeFileSync(tmp, JSON.stringify({
+                    tier, ...(seat ? { seat } : {}), pid: process.pid, disarmedAt: new Date().toISOString(),
+                }) + "\n");
                 renameSync(tmp, p);
             }
             catch { /* unrecordable stand-down ages out as STALE — pessimistic, which is the safe way to fail */ }
@@ -109,25 +131,48 @@ export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS) {
 // never silently ARMED. Callers wanting the TIER's state want supervisionStatus below; this answers
 // the narrower question "does the beat say alive", which is all a beat can ever say.
 export function readTierLiveness(repoRoot, tier, now = Date.now()) {
-    return beatLiveness(tier, beatMtimeMs(repoRoot, tier), now);
+    return beatLiveness(tier, readBeat(repoRoot, tier), now);
 }
 // The beat's inode, or why there is no age to derive from it. Split out so the stand-down ranking below
 // reads the SAME mtime this derivation does rather than a second, later stat of a moving record.
-function beatMtimeMs(repoRoot, tier) {
+function readBeat(repoRoot, tier) {
+    const p = supervisionBeatPath(repoRoot, tier);
     let st;
     try {
-        st = statSync(supervisionBeatPath(repoRoot, tier));
+        st = statSync(p);
     }
     catch (e) {
         const code = e.code;
         // never armed — reachable without anything having been written
         return code === "ENOENT" || code === "ENOTDIR" ? "ABSENT" : "UNREADABLE";
     }
-    return st.isFile() ? st.mtimeMs : "UNREADABLE"; // a directory at the beat path is not a heartbeat
+    if (!st.isFile())
+        return "UNREADABLE"; // a directory at the beat path is not a heartbeat
+    // SUP-05: the payload is read for ONE field — the seat — and never for the age, which stays the
+    // mtime. On the legacy tiers an unparseable payload is still a beat (a record that cannot be parsed
+    // is not evidence that nobody armed the tier). On a SEAT tier it is the opposite: a record naming no
+    // seat leaves the tier armed and unattributable, which reads as coverage no seat is providing, so
+    // it is UNREADABLE — something is there and no beat any reader can attribute comes out of it.
+    const seat = beatSeat(p);
+    if (isSeatTier(tier) && seat === undefined)
+        return "UNREADABLE";
+    return { mtimeMs: st.mtimeMs, ...(seat !== undefined ? { seat } : {}) };
+}
+/** The seat a record declares, or undefined for any record that declares none this reader can use. */
+function beatSeat(path) {
+    try {
+        const rec = JSON.parse(readFileSync(path, "utf8"));
+        return typeof rec?.seat === "string" && rec.seat.trim() ? rec.seat : undefined;
+    }
+    catch {
+        return undefined;
+    } // unparseable bytes name no seat — the caller decides what that means
 }
-function beatLiveness(tier, mtimeMs, now) {
-    if (typeof mtimeMs !== "number")
-        return { tier, state: mtimeMs };
+function beatLiveness(tier, beat, now) {
+    if (typeof beat !== "object")
+        return { tier, state: beat };
+    const { mtimeMs, seat } = beat;
+    const named = seat !== undefined ? { seat } : {};
     const age = now - mtimeMs;
     // SUP-03: a beat dated AHEAD of the reader's clock past the grace above is not a fresh beat — it is
     // a record whose age cannot be derived. Clamping it to zero (what this line used to do) made any
@@ -138,7 +183,7 @@ function beatLiveness(tier, mtimeMs, now) {
     if (age < -SUPERVISION_FUTURE_GRACE_MS)
         return { tier, state: "UNREADABLE" };
     const beatAgeMs = Math.max(0, age); // inside the grace: the two clocks' resolutions, not skew
-    return { tier, state: beatAgeMs > SUPERVISION_STALE_MS ? "STALE" : "ARMED", beatAgeMs };
+    return { tier, state: beatAgeMs > SUPERVISION_STALE_MS ? "STALE" : "ARMED", beatAgeMs, ...named };
 }
 // A stand-down is only what a watcher RECORDED, so the record has to READ as one: a regular file whose
 // payload names this tier and the instant it stood down. Path existence is not proof — a directory, a
@@ -157,33 +202,44 @@ function readStandDown(repoRoot, tier) {
     }
     if (!st.isFile())
         return "UNREADABLE";
+    let seat;
     try {
         const rec = JSON.parse(readFileSync(p, "utf8"));
         if (rec?.tier !== tier)
             return "UNREADABLE";
         if (typeof rec.disarmedAt !== "string" || Number.isNaN(Date.parse(rec.disarmedAt)))
             return "UNREADABLE";
+        seat = typeof rec.seat === "string" && rec.seat.trim() ? rec.seat : undefined;
+        // A seat tier's hand-off names WHICH seat left, on the same rule as its beat: an anonymous
+        // stand-down on a per-seat tier says a watcher left without saying whose, so it is no record.
+        if (isSeatTier(tier) && seat === undefined)
+            return "UNREADABLE";
     }
     catch {
         return "UNREADABLE";
     } // unparseable or unreadable bytes — not a stand-down anyone can read
-    return { mtimeMs: st.mtimeMs };
+    return { mtimeMs: st.mtimeMs, ...(seat !== undefined ? { seat } : {}) };
 }
 // THE TIER'S STATE — what every surface and every operator reads. A valid stand-down outranks the beat:
 // the watcher that wrote it is gone ON PURPOSE, and its last beat ages out exactly like a dead one's
 // would. It outranks the beat it FOLLOWED and no other — a beat stamped after the marker was written by
 // a watcher that armed again, so a marker some failed cleanup left behind can never mask a live tier.
 export function supervisionStatus(repoRoot, tier, now = Date.now()) {
-    const beat = beatMtimeMs(repoRoot, tier);
+    const beat = readBeat(repoRoot, tier);
     const standDown = readStandDown(repoRoot, tier);
     if (standDown === "UNREADABLE")
         return { tier, state: "UNREADABLE" };
-    if (standDown !== "NONE" && !(typeof beat === "number" && beat > standDown.mtimeMs)) {
-        return { tier, state: "DISARMED" };
+    if (standDown !== "NONE" && !(typeof beat === "object" && beat.mtimeMs > standDown.mtimeMs)) {
+        // the seat that stood down is named by the marker, falling back to whatever its last beat named
+        const seat = standDown.seat ?? (typeof beat === "object" ? beat.seat : undefined);
+        return { tier, state: "DISARMED", ...(seat !== undefined ? { seat } : {}) };
     }
     return beatLiveness(tier, beat, now);
 }
 /** Every KNOWN tier, always — a tier omitted from this list would read as one that is fine. */
 export const readSupervision = (repoRoot, now = Date.now()) => SUPERVISION_TIERS.map((tier) => supervisionStatus(repoRoot, tier, now));
 /** One line, one word per tier. Shared by both status surfaces so neither can render a state twice. */
-export const supervisionText = (tiers, divider = " · ") => `supervision: ${tiers.map((t) => `${t.tier} ${t.state}`).join(divider)}`;
+// The seat is rendered BESIDE the state, never instead of it: `overseer-context ARMED (w3:p2)` says
+// both that something is beating and who is behind it, which is the pair an operator needs to act. A
+// row with no seat to name renders exactly as it always did.
+export const supervisionText = (tiers, divider = " · ") => `supervision: ${tiers.map((t) => `${t.tier} ${t.state}${t.seat ? ` (${t.seat})` : ""}`).join(divider)}`;

package/dist/tui/cockpit/derive.js

@@ -1,4 +1,5 @@
 import { channelKey } from "../../adapters/types.js";
+import { isPidLive } from "../../run/lock.js";
 export const SPARKLINE_BUCKET_WINDOW = 12;
 const MINUTE_MS = 60_000;
 const SPARKLINE_BUCKET_WIDTH_LADDER_MINUTES = [
@@ -85,15 +86,6 @@ function elapsedReading(first, last) {
     const padded = (part) => String(part).padStart(2, "0");
     return `${padded(hours)}:${padded(minutes)}:${padded(remainder)}`;
 }
-function defaultDaemonLiveness(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
 function latestLifecycle(events) {
     for (let index = events.length - 1; index >= 0; index -= 1) {
         const event = events[index].event;
@@ -700,7 +692,10 @@ export function deriveRunCockpitData(source, binaryVersion, options = {}) {
     const pid = daemonPid(events);
     const alive = lifecycle !== "active"
         ? false
-        : pid !== undefined && (options.isDaemonAlive ?? defaultDaemonLiveness)(pid);
+        // lock.ts's isPidLive is the ONE pid-liveness table. The local copy this replaced treated ANY
+        // thrown probe error as death, so a daemon owned by another user (EPERM) read dead here and
+        // alive in the lock — the cockpit called a live run interrupted.
+        : pid !== undefined && (options.isDaemonAlive ?? isPidLive)(pid);
     const interrupted = !alive;
     const tasks = deriveTasks(events, interrupted);
     const taskFacts = [...tasks.values()];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.1.1",
+  "version": "2.1.3",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",
@@ -32,7 +32,7 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "build:clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && npm run build",
-    "lint": "oxlint src tests scripts",
+    "lint": "oxlint src tests scripts --format stylish",
     "pretest": "npm run build",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",

package/skills/tickmarkr-auto/SKILL.md

@@ -45,10 +45,27 @@ Before `tickmarkr compile` or `tickmarkr run`, compare the installed binary agai
 
 1. Run `tickmarkr version` (one line, machine-parseable).
 2. Read the `version` field from the repository's `package.json`.
-3. If the binary is **older on major.minor** than the repo (e.g. binary `1.36.x` vs repo `1.38.x`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`) or link the repo binary. Do not compile, plan, or run on hope.
+3. If the binary and repository do not **agree on the entire version** (including the patch; e.g. binary `2.1.0` vs repo `2.1.1`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`) or link the repo binary. Do not compile, plan, or run on hope.
 
 A stale binary silently skips daemon gates shipped in newer releases — the v1.38 run exposed this when a global `1.36.0` binary missed the daemon tip-verify gate entirely (OBS-38). Preflight failure is always stop-and-report; never proceed-and-hope.
 
+### No run may be live in THIS repository
+
+The version check above is only half the preflight. Before `compile` or `run`, confirm no run is already
+live **in this repository**:
+
+1. Lead with this repository's own `.tickmarkr/graph.lock`. Read its recorded holder pid.
+2. Treat the lock as held by a LIVE run until `kill -0 <pid>` proves that holder dead.
+3. **Never require a machine-wide process pattern to be empty.** A lawful run in another repository — or
+   the probing shell's own argv — matches such a pattern, so an empty result is not evidence of safety
+   and a non-empty one is not evidence of danger.
+4. If you use a process probe as secondary evidence, exclude the probing process itself, resolve every
+   candidate's own working directory (for example `lsof -a -p <pid> -d cwd`), and count only candidates
+   whose cwd is **this repository root**.
+
+The invariant this protects is per-repository — *never run two tickmarkr runs in the same repository
+concurrently* — so a machine-wide check answers a question nobody asked and blocks work that is lawful.
+
 ## Verified handoffs (agent-to-agent messaging)
 
 When relaying missions between agents in a multi-agent terminal, **never use bare send-text** (`herdr agent send` / pane send-text) — it writes text without pressing Enter, so handoffs sit unsubmitted (OBS-39).
@@ -66,6 +83,6 @@ After sending, **confirm delivery** by reading the target pane and verifying the
 2. **Compile** — run `tickmarkr compile <spec-or-directory>`. Fix source-spec defects instead of editing the generated graph.
 3. **Plan** — run `tickmarkr plan`. Review routes, capability-floor warnings, and human gates before execution.
 4. **Run** — run `tickmarkr run`. Watch the run journal for its terminal event rather than polling agents — a self-terminating poll (`until grep -q '"event":"run-end"' <state-dir>/runs/<runId>/journal.jsonl; do sleep 20; done`), never `tail -F | grep -m1` (wedges on the journal's final line) and never a pane-level done wait (turn-end flaps). Resolve blocked interactions in the relevant agent session.
-5. **Verify and consolidate** — continue only after a green run. A run is green when the run-end event exists in the journal AND the tip verify is not "failed". Tickmarkr consolidates accepted work on `tickmarkr/<runId>` and never signs off to the main branch. A human controls any later release merge.
+5. **Verify and consolidate** — continue only after a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", and the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty — a run with a parked task is partial, not green. Tickmarkr consolidates accepted work on `tickmarkr/<runId>` and never signs off to the main branch. A human controls any later release merge.
 6. **Record** — write `tickmarkr report <runId> --md` beside the source spec and commit the execution record when the repository tracks those records.
 7. **Continue** — move to the next requested target. If a target fails or is parked, stop with the journal evidence rather than silently skipping it.

package/skills/tickmarkr-loop/SKILL.md

@@ -40,10 +40,27 @@ Before `tickmarkr compile` or `tickmarkr run`, compare the installed binary agai
 
 1. Run `tickmarkr version` (one line, machine-parseable).
 2. Read the `version` field from the repository's `package.json`.
-3. If the binary is **older on major.minor** than the repo (e.g. binary `1.36.x` vs repo `1.38.x`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`) or link the repo binary. Do not compile, plan, or run on hope.
+3. If the binary and repository do not **agree on the entire version** (including the patch; e.g. binary `2.1.0` vs repo `2.1.1`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`) or link the repo binary. Do not compile, plan, or run on hope.
 
 A stale binary silently skips daemon gates shipped in newer releases — the v1.38 run exposed this when a global `1.36.0` binary missed the daemon tip-verify gate entirely (OBS-38). Preflight failure is always stop-and-report; never proceed-and-hope.
 
+### No run may be live in THIS repository
+
+The version check above is only half the preflight. Before `compile` or `run`, confirm no run is already
+live **in this repository**:
+
+1. Lead with this repository's own `.tickmarkr/graph.lock`. Read its recorded holder pid.
+2. Treat the lock as held by a LIVE run until `kill -0 <pid>` proves that holder dead.
+3. **Never require a machine-wide process pattern to be empty.** A lawful run in another repository — or
+   the probing shell's own argv — matches such a pattern, so an empty result is not evidence of safety
+   and a non-empty one is not evidence of danger.
+4. If you use a process probe as secondary evidence, exclude the probing process itself, resolve every
+   candidate's own working directory (for example `lsof -a -p <pid> -d cwd`), and count only candidates
+   whose cwd is **this repository root**.
+
+The invariant this protects is per-repository — *never run two tickmarkr runs in the same repository
+concurrently* — so a machine-wide check answers a question nobody asked and blocks work that is lawful.
+
 ## Verified handoffs (agent-to-agent messaging)
 
 When relaying missions between agents in a multi-agent terminal, **never use bare send-text** (`herdr agent send` / pane send-text) — it writes text without pressing Enter, so handoffs sit unsubmitted (OBS-39).
@@ -70,5 +87,5 @@ When spawning consultants (agents gathering synthesis input for decisions like S
 2. **Compile** — run `tickmarkr compile <spec>`. Correct compilation errors in the spec, never in the generated graph.
 3. **Plan** — run `tickmarkr plan`. Review the routing table, capability-floor warnings, and every human gate, including work that each gate blocks.
 4. **Run** — run `tickmarkr run`. Watch the run journal for its terminal event rather than repeatedly polling agents. Use a self-terminating poll — `until grep -q '"event":"run-end"' <state-dir>/runs/<runId>/journal.jsonl; do sleep 20; done` — never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). Resolve blocked interactions in the agent session; do not turn them into proxy questions.
-5. **Verify and consolidate** — accept only a green run. A run is green when the run-end event exists in the journal AND the tip verify is not "failed". Tickmarkr consolidates accepted task work on `tickmarkr/<runId>`; it never signs off to the main branch. A human may later merge that integration branch through the repository's normal release process.
+5. **Verify and consolidate** — accept only a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", and the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty — a run with a parked task is partial, not green. Tickmarkr consolidates accepted task work on `tickmarkr/<runId>`; it never signs off to the main branch. A human may later merge that integration branch through the repository's normal release process.
 6. **Record** — write `tickmarkr report <runId> --md` beside the source spec and commit the execution record when the repository tracks those records. Then [stand down](#stand-down-mission-end-and-retirement).