tickmarkr 2.1.2 → 2.1.3

package/dist/run/lock.d.ts

@@ -10,6 +10,7 @@ export interface Inspection {
     ino: number;
 }
 export declare function shouldRefuse(i: Pick<Inspection, "garbage" | "dead">): boolean;
+export declare function isPidLive(pid: number): boolean;
 export declare function acquireRunLock(repoRoot: string, runId: string): {
     reclaimed?: {
         pid: number;

package/dist/run/lock.js

@@ -45,6 +45,23 @@ process.once("exit", () => { if (heldPath)
 export function shouldRefuse(i) {
     return i.garbage || !i.dead;
 }
+// LOCK-04, PID-SCOPED: the same decision table, in the shape a caller holding only a pid can consume.
+// Every other liveness export here takes a repository root, so a reader with a pid off a journal row
+// had no seam to reach and wrote the four lines itself — twice. One copy was faithful; the other
+// treated ANY thrown error as death, so a daemon owned by another user (EPERM) read dead there and
+// alive here. A rule that forbids a second `process.kill(pid, 0)` without exporting a usable
+// predicate produces exactly those copies, so this is the predicate. no throw ⇒ ALIVE; ESRCH ⇒ the
+// only proof-positive death; ANY other errno (EPERM = alive-but-not-ours, EINVAL, …) ⇒ ALIVE,
+// because none of them is evidence of death and this table fails closed toward alive.
+export function isPidLive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (k) {
+        return k.code !== "ESRCH";
+    }
+}
 // statSync throws ENOENT when no lock exists — callers treat that as "not held".
 function inspect(p) {
     const st = statSync(p); // single stat: both the heartbeat mtime and the reclaim-guard inode
@@ -53,16 +70,8 @@ function inspect(p) {
     const parsed = PayloadSchema.safeParse(readPayload(p));
     const garbage = !parsed.success; // LOCK-01: its own state — shouldRefuse refuses it unconditionally; only `tickmarkr unlock` removes it
     const pid = parsed.success ? parsed.data.pid : undefined;
-    let dead = pid === undefined; // harmless fallback for the garbage row — garbage short-circuits shouldRefuse before this is read
-    if (pid !== undefined) {
-        try {
-            process.kill(pid, 0);
-            dead = false;
-        } // no throw ⇒ ALIVE
-        catch (k) {
-            dead = k.code === "ESRCH";
-        } // ESRCH ⇒ dead; EPERM ⇒ ALIVE
-    }
+    // harmless fallback for the garbage row — garbage short-circuits shouldRefuse before this is read
+    const dead = pid === undefined ? true : !isPidLive(pid);
     return { pid, runId: parsed.success ? parsed.data.runId : undefined, garbage, dead, expired, mtimeMs, ino: st.ino };
 }
 function readPayload(p) {
@@ -222,9 +231,10 @@ export async function acquireApprovalSerialization(repoRoot, runId) {
     }
 }
 // LOCK-04: the owner the decision table sees, read-only, for callers that need the pid as well as
-// the answer. inspect() owns pid-liveness (ESRCH dead / EPERM alive / garbage fail-closed); a second
-// `process.kill(pid, 0)` anywhere else would be a second copy of that rule, free to drift. undefined
-// ⇒ no lock at all — never conflate that with a lock whose recorded owner is dead.
+// the answer. inspect() owns pid-liveness (ESRCH dead / EPERM alive / garbage fail-closed) and reads
+// it from isPidLive above; a second `process.kill(pid, 0)` anywhere else would be a second copy of
+// that rule, free to drift — a caller holding only a pid consumes isPidLive, never its own probe.
+// undefined ⇒ no lock at all — never conflate that with a lock whose recorded owner is dead.
 export function runLockOwner(repoRoot) {
     let insp;
     try {

package/dist/run/supervision.d.ts

@@ -3,24 +3,30 @@ export declare const SUPERVISION_BEAT_MS = 10000;
 /** Ceiling before a beat reads STALE: SIX beats, lock.ts's ratio — five may be missed before alarm. */
 export declare const SUPERVISION_STALE_MS: number;
 export declare const SUPERVISION_FUTURE_GRACE_MS = 1000;
-export declare const SUPERVISION_TIERS: readonly ["orchestrator", "overseer", "watch"];
+export declare const SUPERVISION_TIERS: readonly ["orchestrator", "orchestrator-context", "overseer", "overseer-context", "watch"];
 export type SupervisionTier = (typeof SUPERVISION_TIERS)[number];
+export declare const SUPERVISION_SEAT_TIERS: readonly ["orchestrator-context", "overseer-context"];
+export type SeatTier = (typeof SUPERVISION_SEAT_TIERS)[number];
+/** Does this tier's record have to name the seat it speaks for? */
+export declare const isSeatTier: (tier: string) => tier is SeatTier;
 export type SupervisionState = "ABSENT" | "STALE" | "ARMED" | "UNREADABLE" | "DISARMED";
 export interface TierLiveness {
     tier: SupervisionTier;
     state: SupervisionState;
     /** Absent for ABSENT, UNREADABLE and DISARMED — no beat to age. Always present for STALE and ARMED. */
     beatAgeMs?: number;
+    /** The seat the record names, when it names one. Always present on a seat tier that is not ABSENT. */
+    seat?: string;
 }
 export declare const supervisionBeatPath: (repoRoot: string, tier: SupervisionTier) => string;
 /** Where a watcher records that it STOOD DOWN. Its own file: the beat keeps meaning only "alive". */
 export declare const supervisionStandDownPath: (repoRoot: string, tier: SupervisionTier) => string;
-export declare function beatSupervision(repoRoot: string, tier: SupervisionTier): void;
+export declare function beatSupervision(repoRoot: string, tier: SupervisionTier, seat?: string): void;
 /** Handle a watcher holds for as long as it is supervising; disarm stands it down and is idempotent. */
 export interface ArmedSupervision {
     disarm: () => void;
 }
-export declare function armSupervision(repoRoot: string, tier: SupervisionTier, beatMs?: number): ArmedSupervision;
+export declare function armSupervision(repoRoot: string, tier: SupervisionTier, beatMs?: number, seat?: string): ArmedSupervision;
 export declare function readTierLiveness(repoRoot: string, tier: SupervisionTier, now?: number): TierLiveness;
 export declare function supervisionStatus(repoRoot: string, tier: SupervisionTier, now?: number): TierLiveness;
 /** Every KNOWN tier, always — a tier omitted from this list would read as one that is fine. */

package/dist/run/supervision.js

@@ -29,7 +29,22 @@ export const SUPERVISION_FUTURE_GRACE_MS = 1_000;
 // The supervision seats this harness has. An unlisted tier is an INVISIBLE tier, which is the failure
 // mode itself — an auditor read "no watchers were ever armed" off a surface that named none. Adding a
 // seat means adding it here, and `status` then renders it whether or not it has ever beaten.
-export const SUPERVISION_TIERS = ["orchestrator", "overseer", "watch"];
+// SUP-05: CONTEXT is per SEAT, so its tiers are per seat too. One shared `context` tier would be read
+// by both supervising seats and beaten by whichever of them still had a watcher, so a live overseer
+// watcher would render the dead orchestrator one as armed — the mask this whole instrument exists to
+// remove. The enumeration is CLOSED at one tier per supervising seat: orchestrator and overseer.
+// `watch` beats nowhere on this tree and stays ABSENT, which is what ABSENT means.
+export const SUPERVISION_TIERS = [
+    "orchestrator", "orchestrator-context", "overseer", "overseer-context", "watch",
+];
+// The tiers whose records must NAME the seat behind them. A one-shot `tickmarkr beat` records a pid
+// that has already exited by the time anyone reads it, and an instant — nothing a reader can attribute
+// to a seat. Measured 2026-08-26: a consult seat of another tier ran the documented beat loop and the
+// board read that tier armed with no seat of that tier having armed anything. ARMED-and-seatless reads
+// as coverage, which is worse than ABSENT, so on these tiers a record that names no seat is not a beat.
+export const SUPERVISION_SEAT_TIERS = ["orchestrator-context", "overseer-context"];
+/** Does this tier's record have to name the seat it speaks for? */
+export const isSeatTier = (tier) => SUPERVISION_SEAT_TIERS.includes(tier);
 // PURE path math: stateDirName, never tickmarkrDir — the latter mkdirs the state dir and writes its
 // .gitignore, so routing a READER through it would make status create the very tree it reports on.
 export const supervisionBeatPath = (repoRoot, tier) => join(repoRoot, stateDirName(repoRoot), "supervision", `${tier}.beat`);
@@ -38,11 +53,16 @@ export const supervisionStandDownPath = (repoRoot, tier) => join(repoRoot, state
 // WRITER — a watcher's own call, on its own tier, every SUPERVISION_BEAT_MS. Never a reader's: the
 // purity fence (status --watch leaves the state dir byte-identical) is the test that catches a reader
 // that beats on the watcher's behalf, which would report every dead tier as healthy.
-export function beatSupervision(repoRoot, tier) {
+export function beatSupervision(repoRoot, tier, seat) {
+    // A seat tier may not be armed anonymously, and the refusal belongs HERE rather than only in the
+    // verb: any caller that could write a seatless record could arm a tier nobody occupies.
+    if (isSeatTier(tier) && !seat?.trim()) {
+        throw new Error(`${tier} is a per-seat tier — a beat must declare the seat identity it speaks for`);
+    }
     tickmarkrDir(repoRoot); // the write path DOES create — beats land inside the gitignored state dir
     const p = supervisionBeatPath(repoRoot, tier);
     mkdirSync(dirname(p), { recursive: true });
-    writeFileSync(p, JSON.stringify({ tier, pid: process.pid, beatAt: new Date().toISOString() }) + "\n");
+    writeFileSync(p, JSON.stringify({ tier, ...(seat ? { seat } : {}), pid: process.pid, beatAt: new Date().toISOString() }) + "\n");
 }
 // THE WATCHER-FACING ENTRY POINT — the loop SUPERVISION_BEAT_MS actually drives. A supervising seat
 // calls this once at the top of its watch and holds the handle for the duration; a seat that dies,
@@ -57,7 +77,7 @@ export function beatSupervision(repoRoot, tier) {
 //
 // Arming CLEARS any prior stand-down record: a tier that stood down and armed again is armed, and a
 // marker left behind by the last run would otherwise report the live one as stood down forever.
-export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS) {
+export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS, seat) {
     // The clearing gets its OWN try: a cleanup that cannot complete (a directory dropped at the marker
     // path, a permission) must not cost the first beat. Sharing one try did exactly that — the tier armed
     // with NO beat while the old marker stayed on disk, the one combination that reports a live watcher
@@ -67,12 +87,12 @@ export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS) {
     }
     catch { /* uncleared: the reader validates the marker and a newer beat outranks it — never masked */ }
     try {
-        beatSupervision(repoRoot, tier);
+        beatSupervision(repoRoot, tier, seat);
     }
-    catch { /* repo gone / disk full — the tier reads ABSENT rather than crashing its watcher */ }
+    catch { /* repo gone / disk full / no seat — the tier reads ABSENT rather than crashing its watcher */ }
     const timer = setInterval(() => {
         try {
-            beatSupervision(repoRoot, tier);
+            beatSupervision(repoRoot, tier, seat);
         }
         catch { /* repo gone / disk full — let the beat expire */ }
     }, beatMs);
@@ -94,7 +114,9 @@ export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS) {
             const tmp = `${p}.${process.pid}.tmp`;
             try {
                 mkdirSync(dirname(p), { recursive: true });
-                writeFileSync(tmp, JSON.stringify({ tier, pid: process.pid, disarmedAt: new Date().toISOString() }) + "\n");
+                writeFileSync(tmp, JSON.stringify({
+                    tier, ...(seat ? { seat } : {}), pid: process.pid, disarmedAt: new Date().toISOString(),
+                }) + "\n");
                 renameSync(tmp, p);
             }
             catch { /* unrecordable stand-down ages out as STALE — pessimistic, which is the safe way to fail */ }
@@ -109,25 +131,48 @@ export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS) {
 // never silently ARMED. Callers wanting the TIER's state want supervisionStatus below; this answers
 // the narrower question "does the beat say alive", which is all a beat can ever say.
 export function readTierLiveness(repoRoot, tier, now = Date.now()) {
-    return beatLiveness(tier, beatMtimeMs(repoRoot, tier), now);
+    return beatLiveness(tier, readBeat(repoRoot, tier), now);
 }
 // The beat's inode, or why there is no age to derive from it. Split out so the stand-down ranking below
 // reads the SAME mtime this derivation does rather than a second, later stat of a moving record.
-function beatMtimeMs(repoRoot, tier) {
+function readBeat(repoRoot, tier) {
+    const p = supervisionBeatPath(repoRoot, tier);
     let st;
     try {
-        st = statSync(supervisionBeatPath(repoRoot, tier));
+        st = statSync(p);
     }
     catch (e) {
         const code = e.code;
         // never armed — reachable without anything having been written
         return code === "ENOENT" || code === "ENOTDIR" ? "ABSENT" : "UNREADABLE";
     }
-    return st.isFile() ? st.mtimeMs : "UNREADABLE"; // a directory at the beat path is not a heartbeat
+    if (!st.isFile())
+        return "UNREADABLE"; // a directory at the beat path is not a heartbeat
+    // SUP-05: the payload is read for ONE field — the seat — and never for the age, which stays the
+    // mtime. On the legacy tiers an unparseable payload is still a beat (a record that cannot be parsed
+    // is not evidence that nobody armed the tier). On a SEAT tier it is the opposite: a record naming no
+    // seat leaves the tier armed and unattributable, which reads as coverage no seat is providing, so
+    // it is UNREADABLE — something is there and no beat any reader can attribute comes out of it.
+    const seat = beatSeat(p);
+    if (isSeatTier(tier) && seat === undefined)
+        return "UNREADABLE";
+    return { mtimeMs: st.mtimeMs, ...(seat !== undefined ? { seat } : {}) };
+}
+/** The seat a record declares, or undefined for any record that declares none this reader can use. */
+function beatSeat(path) {
+    try {
+        const rec = JSON.parse(readFileSync(path, "utf8"));
+        return typeof rec?.seat === "string" && rec.seat.trim() ? rec.seat : undefined;
+    }
+    catch {
+        return undefined;
+    } // unparseable bytes name no seat — the caller decides what that means
 }
-function beatLiveness(tier, mtimeMs, now) {
-    if (typeof mtimeMs !== "number")
-        return { tier, state: mtimeMs };
+function beatLiveness(tier, beat, now) {
+    if (typeof beat !== "object")
+        return { tier, state: beat };
+    const { mtimeMs, seat } = beat;
+    const named = seat !== undefined ? { seat } : {};
     const age = now - mtimeMs;
     // SUP-03: a beat dated AHEAD of the reader's clock past the grace above is not a fresh beat — it is
     // a record whose age cannot be derived. Clamping it to zero (what this line used to do) made any
@@ -138,7 +183,7 @@ function beatLiveness(tier, mtimeMs, now) {
     if (age < -SUPERVISION_FUTURE_GRACE_MS)
         return { tier, state: "UNREADABLE" };
     const beatAgeMs = Math.max(0, age); // inside the grace: the two clocks' resolutions, not skew
-    return { tier, state: beatAgeMs > SUPERVISION_STALE_MS ? "STALE" : "ARMED", beatAgeMs };
+    return { tier, state: beatAgeMs > SUPERVISION_STALE_MS ? "STALE" : "ARMED", beatAgeMs, ...named };
 }
 // A stand-down is only what a watcher RECORDED, so the record has to READ as one: a regular file whose
 // payload names this tier and the instant it stood down. Path existence is not proof — a directory, a
@@ -157,33 +202,44 @@ function readStandDown(repoRoot, tier) {
     }
     if (!st.isFile())
         return "UNREADABLE";
+    let seat;
     try {
         const rec = JSON.parse(readFileSync(p, "utf8"));
         if (rec?.tier !== tier)
             return "UNREADABLE";
         if (typeof rec.disarmedAt !== "string" || Number.isNaN(Date.parse(rec.disarmedAt)))
             return "UNREADABLE";
+        seat = typeof rec.seat === "string" && rec.seat.trim() ? rec.seat : undefined;
+        // A seat tier's hand-off names WHICH seat left, on the same rule as its beat: an anonymous
+        // stand-down on a per-seat tier says a watcher left without saying whose, so it is no record.
+        if (isSeatTier(tier) && seat === undefined)
+            return "UNREADABLE";
     }
     catch {
         return "UNREADABLE";
     } // unparseable or unreadable bytes — not a stand-down anyone can read
-    return { mtimeMs: st.mtimeMs };
+    return { mtimeMs: st.mtimeMs, ...(seat !== undefined ? { seat } : {}) };
 }
 // THE TIER'S STATE — what every surface and every operator reads. A valid stand-down outranks the beat:
 // the watcher that wrote it is gone ON PURPOSE, and its last beat ages out exactly like a dead one's
 // would. It outranks the beat it FOLLOWED and no other — a beat stamped after the marker was written by
 // a watcher that armed again, so a marker some failed cleanup left behind can never mask a live tier.
 export function supervisionStatus(repoRoot, tier, now = Date.now()) {
-    const beat = beatMtimeMs(repoRoot, tier);
+    const beat = readBeat(repoRoot, tier);
     const standDown = readStandDown(repoRoot, tier);
     if (standDown === "UNREADABLE")
         return { tier, state: "UNREADABLE" };
-    if (standDown !== "NONE" && !(typeof beat === "number" && beat > standDown.mtimeMs)) {
-        return { tier, state: "DISARMED" };
+    if (standDown !== "NONE" && !(typeof beat === "object" && beat.mtimeMs > standDown.mtimeMs)) {
+        // the seat that stood down is named by the marker, falling back to whatever its last beat named
+        const seat = standDown.seat ?? (typeof beat === "object" ? beat.seat : undefined);
+        return { tier, state: "DISARMED", ...(seat !== undefined ? { seat } : {}) };
     }
     return beatLiveness(tier, beat, now);
 }
 /** Every KNOWN tier, always — a tier omitted from this list would read as one that is fine. */
 export const readSupervision = (repoRoot, now = Date.now()) => SUPERVISION_TIERS.map((tier) => supervisionStatus(repoRoot, tier, now));
 /** One line, one word per tier. Shared by both status surfaces so neither can render a state twice. */
-export const supervisionText = (tiers, divider = " · ") => `supervision: ${tiers.map((t) => `${t.tier} ${t.state}`).join(divider)}`;
+// The seat is rendered BESIDE the state, never instead of it: `overseer-context ARMED (w3:p2)` says
+// both that something is beating and who is behind it, which is the pair an operator needs to act. A
+// row with no seat to name renders exactly as it always did.
+export const supervisionText = (tiers, divider = " · ") => `supervision: ${tiers.map((t) => `${t.tier} ${t.state}${t.seat ? ` (${t.seat})` : ""}`).join(divider)}`;

package/dist/tui/cockpit/derive.js

@@ -1,4 +1,5 @@
 import { channelKey } from "../../adapters/types.js";
+import { isPidLive } from "../../run/lock.js";
 export const SPARKLINE_BUCKET_WINDOW = 12;
 const MINUTE_MS = 60_000;
 const SPARKLINE_BUCKET_WIDTH_LADDER_MINUTES = [
@@ -85,15 +86,6 @@ function elapsedReading(first, last) {
     const padded = (part) => String(part).padStart(2, "0");
     return `${padded(hours)}:${padded(minutes)}:${padded(remainder)}`;
 }
-function defaultDaemonLiveness(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
 function latestLifecycle(events) {
     for (let index = events.length - 1; index >= 0; index -= 1) {
         const event = events[index].event;
@@ -700,7 +692,10 @@ export function deriveRunCockpitData(source, binaryVersion, options = {}) {
     const pid = daemonPid(events);
     const alive = lifecycle !== "active"
         ? false
-        : pid !== undefined && (options.isDaemonAlive ?? defaultDaemonLiveness)(pid);
+        // lock.ts's isPidLive is the ONE pid-liveness table. The local copy this replaced treated ANY
+        // thrown probe error as death, so a daemon owned by another user (EPERM) read dead here and
+        // alive in the lock — the cockpit called a live run interrupted.
+        : pid !== undefined && (options.isDaemonAlive ?? isPidLive)(pid);
     const interrupted = !alive;
     const tasks = deriveTasks(events, interrupted);
     const taskFacts = [...tasks.values()];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.1.2",
+  "version": "2.1.3",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",
@@ -32,7 +32,7 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "build:clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && npm run build",
-    "lint": "oxlint src tests scripts",
+    "lint": "oxlint src tests scripts --format stylish",
     "pretest": "npm run build",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",

package/skills/tickmarkr-auto/SKILL.md

@@ -83,6 +83,6 @@ After sending, **confirm delivery** by reading the target pane and verifying the
 2. **Compile** — run `tickmarkr compile <spec-or-directory>`. Fix source-spec defects instead of editing the generated graph.
 3. **Plan** — run `tickmarkr plan`. Review routes, capability-floor warnings, and human gates before execution.
 4. **Run** — run `tickmarkr run`. Watch the run journal for its terminal event rather than polling agents — a self-terminating poll (`until grep -q '"event":"run-end"' <state-dir>/runs/<runId>/journal.jsonl; do sleep 20; done`), never `tail -F | grep -m1` (wedges on the journal's final line) and never a pane-level done wait (turn-end flaps). Resolve blocked interactions in the relevant agent session.
-5. **Verify and consolidate** — continue only after a green run. A run is green when the run-end event exists in the journal AND the tip verify is not "failed". Tickmarkr consolidates accepted work on `tickmarkr/<runId>` and never signs off to the main branch. A human controls any later release merge.
+5. **Verify and consolidate** — continue only after a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", and the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty — a run with a parked task is partial, not green. Tickmarkr consolidates accepted work on `tickmarkr/<runId>` and never signs off to the main branch. A human controls any later release merge.
 6. **Record** — write `tickmarkr report <runId> --md` beside the source spec and commit the execution record when the repository tracks those records.
 7. **Continue** — move to the next requested target. If a target fails or is parked, stop with the journal evidence rather than silently skipping it.

package/skills/tickmarkr-loop/SKILL.md

@@ -87,5 +87,5 @@ When spawning consultants (agents gathering synthesis input for decisions like S
 2. **Compile** — run `tickmarkr compile <spec>`. Correct compilation errors in the spec, never in the generated graph.
 3. **Plan** — run `tickmarkr plan`. Review the routing table, capability-floor warnings, and every human gate, including work that each gate blocks.
 4. **Run** — run `tickmarkr run`. Watch the run journal for its terminal event rather than repeatedly polling agents. Use a self-terminating poll — `until grep -q '"event":"run-end"' <state-dir>/runs/<runId>/journal.jsonl; do sleep 20; done` — never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). Resolve blocked interactions in the agent session; do not turn them into proxy questions.
-5. **Verify and consolidate** — accept only a green run. A run is green when the run-end event exists in the journal AND the tip verify is not "failed". Tickmarkr consolidates accepted task work on `tickmarkr/<runId>`; it never signs off to the main branch. A human may later merge that integration branch through the repository's normal release process.
+5. **Verify and consolidate** — accept only a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", and the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty — a run with a parked task is partial, not green. Tickmarkr consolidates accepted task work on `tickmarkr/<runId>`; it never signs off to the main branch. A human may later merge that integration branch through the repository's normal release process.
 6. **Record** — write `tickmarkr report <runId> --md` beside the source spec and commit the execution record when the repository tracks those records. Then [stand down](#stand-down-mission-end-and-retirement).

package/skills/tickmarkr-overseer/SKILL.md

@@ -103,7 +103,7 @@ through brief lineage. **An executor choice nobody made is still an executor cho
    fraction (`ORCH · v1.19 4/5`, updated on every task-done); tickmarkr opens ONE TAB PER TASK, labelled
    with the task id and holding that task's worker plus its judge/review/consult panes (tickmarkr
    updates it). Never long context strings or ✓-chains.
-2. **Orchestrator**: Launch the orchestrator with your agent host. Spawning on current herdr is two-step — the one-shot `agent start --cwd` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138): first create the pane with `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` and parse `result.root_pane.pane_id` from its JSON, then start the agent in it. For Claude Code, use `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions` (append `--model <m>` after the `--` if the operator has a policy). For Codex, use `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` (add `--model <m>` to specify the model). The unsandboxed flag is REQUIRED: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation — do not downgrade it. Workers you never spawn — tickmarkr spawns its own visible worker panes. Auxiliary agents you do spawn (consultants, reviewers, scouts) follow the same forms: never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions`, and a read-only codex consultant may use `--sandbox read-only`.
+2. **Orchestrator**: Launch the orchestrator with your agent host. Spawning on current herdr is two-step — the one-shot `agent start --cwd` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138): first create the pane with `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` and parse `result.root_pane.pane_id` from its JSON, then start the agent in it. For Claude Code, use `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions` (append `--model <m>` after the `--` if the operator has a policy). For Codex, use `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` (add `--model <m>` to specify the model). The unsandboxed flag is REQUIRED: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation — do not downgrade it. Workers you never spawn — tickmarkr spawns its own visible worker panes. Auxiliary agents you do spawn (consultants, reviewers, scouts) follow the same forms: never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions --settings '{"promptSuggestionEnabled":false}'`, and a read-only codex consultant may use `--sandbox read-only`. **That `--settings` pair is not cosmetic and it is not optional:** claude-code's AUTOSUGGEST renders context-plausible ghost text into an idle seat's prompt line that is BYTE-IDENTICAL to a typed draft in text-format reads (OBS-482), so a supervising tier cannot tell a seat's own unsent work from a rendering artifact without `agent read --format ansi`. Turning the suggester off at spawn removes the ambiguity at its source instead of paying for the discrimination at every read. Verified against the shipped binary: `claude --settings '{"promptSuggestionEnabled":false}' -p …` exits 0 with a real response, and the key appears in the binary's own settings schema. **For kimi, pass `-y`** (`herdr agent start <name> --kind kimi --pane <id> -- -y`) — the adapter already launches its own workers that way (`src/adapters/kimi.ts:204`), and a kimi seat spawned without it sits on an approval prompt having done nothing. **Herdr cannot see that state**: it reports a kimi pane as `agent_status: working` with `screen_detection_skipped: true` while the prompt is up, so the BLOCKED-STATE watcher below is blind on this vendor and the spawn flag is the ONLY control. Every vendor you spawn needs its auto-approve form named here; a vendor absent from this list is a seat that will hang.
 3. **Standing instructions travel as a brief FILE, never as pane text** — PTY input truncates at ~1024B and a
    truncated brief silently drops policy. Write the full brief to `<repo>/.tickmarkr/overseer/ORCH-BRIEF.md`
    (inside the tickmarkr state dir — already self-gitignored, no exclude step needed), then send one line:
@@ -255,6 +255,17 @@ is a lossy summary nobody trusts while a clean session re-oriented from disk-ver
 **Do the same for yourself before you are forced to**: write the handoff while your judgment is still
 good, not after. If your own context cannot be read by the watcher, say so to the operator and ask for the
 number — an unmeasured budget is not a small budget.
+
+```bash
+.claude/skills/tickmarkr-overseer/scripts/watch-context.sh orchestrator <orchestrator-agent-or-pane> 60 75 <handoff-file>
+.claude/skills/tickmarkr-overseer/scripts/watch-context.sh overseer <overseer-agent-or-pane> 60 75 <handoff-file>
+```
+
+The first argument chooses the closed per-seat tier (`orchestrator-context` or `overseer-context`),
+and every beat names the second argument as that tier's seat. The watcher beats only after reading a
+rendered percentage, keeps beating on the supervision cadence even when its requested poll is slower,
+continues past WARN to ACT, and records a stand-down on each controlled exit. A killed watcher alone
+leaves its last beat to age into `STALE`.
 **Every handoff's re-arm list ends with the announce step from Setup 0** — inform the surviving
 orchestrator the fresh seat is live — or the next seat re-arms silently beside a tier that still
 believes it is alone.
@@ -406,7 +417,7 @@ they are left implicit:
   authors** — the seat's own draft, an operator, another agent's `agent send` (writes WITHOUT Enter),
   and claude-code's AUTOSUGGEST, which renders context-plausible ghost text BYTE-IDENTICAL to a typed
   draft in text-format reads (OBS-482). The check is mechanical and only works at observation time:
-  `agent read --format ansi` — dim/grey SGR around the text = autosuggest ghost, NOT input. Measured
+  `agent read --format ansi --source visible` — dim/grey SGR (`ESC[2m`) around the text = autosuggest ghost, NOT input. ⚠ **`--source` is load-bearing and its natural choice is the wrong one.** `--source detection` is the plain-text buffer used for agent detection: it strips ANSI *entirely*, so `--format ansi --source detection` returns ZERO escape sequences and every string reads as un-styled — i.e. as real typed input. Measured 2026-08-26 on a live orchestrator: `detection` returned 0 escapes and the ghost read as a genuine unsubmitted draft; `visible` returned 100 escapes and the same line came back `ESC[0mESC[2m…`, dim, ghost. **A probe that cannot render the evidence cannot fail**, so check the capture contains escapes at all before believing its answer — that is rule 11 aimed at your own instrument. Measured
   2026-08-17 (D-206): an unattributed instruction was found in an orchestrator's box, superseded
   defensively, and its origin stayed UNRESOLVED — the one probe that discriminates was not taken while
   the text still sat there. An origin question you can close in ten seconds at the pane becomes
@@ -424,17 +435,24 @@ The beat is one shipped command and the loop is yours, run from the repo root as
 `run_in_background` Bash call:
 
 ```bash
-cd <repo> && while :; do tickmarkr beat overseer; sleep 10; done   # 10s = SUPERVISION_BEAT_MS
-tickmarkr beat overseer --stand-down                               # at stand-down, in the same act
+cd <repo> && while :; do tickmarkr beat overseer --seat <overseer-agent-or-pane>; sleep 10; done
+tickmarkr beat overseer --seat <overseer-agent-or-pane> --stand-down  # after stopping that loop
 ```
 
+The pre-2.1.3 forms `while :; do tickmarkr beat overseer; sleep 10; done` and
+`tickmarkr beat overseer --stand-down` are preserved here only as migration warnings: both are now
+rejected because neither declares which seat the tier speaks for. Do not copy or run them.
+
 One beat per invocation, deliberately: the loop is what proves the seat is alive, so a command that
 kept beating on its own would keep reporting a dead seat as healthy. Stop the loop — or die — and the
 tier ages to `STALE` (never `ABSENT`) within six beats, which is the state that says *armed, then lost*.
 Stand down explicitly when you hand off, or a deliberate exit reads as a death. Same rule as rule 29
 below, now with a conventional path the other tier already reads: `tickmarkr status` shows it.
 
-⚠ **THE LOOP ABOVE BINDS TO A PROCESS, NOT TO A SEAT — and that is a defect this skill shipped.**
+⚠ **THE LOOP ABOVE NAMES A SEAT BUT STILL BINDS ITS LIFETIME TO A PROCESS — and that distinction is
+load-bearing.** The command refuses an anonymous beat, and `status` renders the declared seat beside
+the tier state; a legacy tier+pid+instant record cannot be attributed and reads `UNREADABLE`, never
+`ARMED`. Naming the seat does not make the shell loop stop when that seat leaves.
 The beat keeps running while its *session* lives, so a loop started by a seat that has since been
 cleared, re-briefed, or replaced keeps beating that tier's file forever. Measured 2026-08-24
 (OBS-583): a **2d20h** orphan loop from a predecessor seat held `orchestrator ARMED` through a
@@ -444,13 +462,13 @@ one owned by an unrelated session. So:
 - **At every adopt, clear, or re-brief, sweep for pre-existing loops on YOUR tier before arming one**
   (`pgrep -f "tickmarkr beat <tier>"`), trace each to its parent session, and kill the **loop only**
   — never the parent — then verify the parent survived.
-- **`ARMED` is a claim about a process, not about a seat.** Before trusting any tier's `ARMED`, ask
-  whose session owns the beater; a tier can be armed and seatless, which is *worse* than ABSENT
-  because it reads as coverage (rule 11's outliving-its-trigger failure, in beat form).
+- **`ARMED (<seat>)` is an attributable claim, not proof that the named seat is still alive.** Before
+  trusting it, ask whose session owns the beater; an orphan loop can keep naming a departed seat
+  (rule 11's outliving-its-trigger failure, in beat form).
 - Stand-down must kill the loop **and** run `--stand-down`; the second without the first is undone
   by the next tick.
-The product fix (a seat-bound or sentinel-terminated beat, armed and stood down in one act) is
-queued; until it ships, this sweep is the guard.
+The remaining product fix (a sentinel-terminated beat, armed and stood down in one act) is queued;
+until it ships, this sweep is the guard.
 
 Arm the bundled watcher as its OWN Bash call with `run_in_background` — chaining it after other commands
 with `&` orphans it from the wake chain. It prints one wake reason and exits; re-arm after every wake.
@@ -499,10 +517,15 @@ Two keys that do not lie, in order of strength:
 will keep producing this stall, and a sweeper that has been running since 04:40 is evidence the gap was
 visible and got swept instead of fixed.
 
-**Every seat you spawn gets THREE watchers armed in the SAME call that spawns it — ARTIFACT,
-BLOCKED-STATE, and PENDING-INPUT.** Each is blind to what the others catch: the artifact watcher cannot see
-a stall, the blocked watcher cannot see a finish, and neither can see a seat sitting **idle with
-unsubmitted text in its own prompt**.
+**Every seat you spawn gets FOUR watchers armed in the SAME call that spawns it — ARTIFACT,
+BLOCKED-STATE, PENDING-INPUT, and CONTEXT.** Each is blind to what the others catch: the artifact watcher cannot
+see a stall, the blocked watcher cannot see a finish, neither can see a seat sitting **idle with
+unsubmitted text in its own prompt**, and none of them can see a seat running out of context.
+**CONTEXT was mandated in prose above and omitted from this list, so it shipped in 2.1.2 and was never armed
+once** — an overseer ran nine hours at 86% unable to read its own number. Arm
+`scripts/watch-context.sh` here, by name, like the other three. Note also that BLOCKED-STATE relies on
+Herdr's `agent_status`, which is unreliable for vendors whose screen detection is skipped (kimi) — for
+those, the spawn-time auto-approve flag is the control, not this watcher.
 
 ```bash
 .claude/skills/tickmarkr-overseer/scripts/watch-pending-input.sh <agent|pane> [poll-s] [cap-s] [confirm-polls]