tickmarkr 2.1.3 → 2.1.4

package/dist/cli/commands/status.d.ts

@@ -8,6 +8,9 @@ export type StatusOpts = {
     readWorkerOutput?: (taskId: string, attempt: number, runId: string) => Promise<string | undefined>;
     webhookUrl?: string;
     postWebhook?: DecisionWebhookPost;
+    /** How often the live board rewrites its own `watch` beat. Fixtures choose it so a death drill can
+     *  watch the record STOP inside a test's patience; unset means SUPERVISION_BEAT_MS. */
+    supervisionBeatMs?: number;
 };
 export declare const GATE_KEYS: {
     readonly build: "B";

package/dist/cli/commands/status.js

@@ -12,7 +12,7 @@ import { isPidLive } from "../../run/lock.js";
 import { normalizeGateOutcome } from "../../run/outcome.js";
 import { desiredPanes } from "../../run/reconcile.js";
 import { normalizeStallSnapshot } from "../../run/stall.js";
-import { readSupervision, supervisionText } from "../../run/supervision.js";
+import { armSupervision, readSupervision, supervisionText } from "../../run/supervision.js";
 import { deriveRunCockpitData, } from "../../tui/cockpit/derive.js";
 import { COCKPIT_COLUMN_FLOOR } from "../../tui/cockpit/layout.js";
 import { cellWidth, fitCells, wrapCells } from "../../tui/cockpit/width.js";
@@ -1370,6 +1370,20 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
         }
         return fresh;
     };
+    // SUP-06: the live board IS the `watch` tier, so it is the only process that can beat it — which is
+    // why that tier could only ever print ABSENT about itself while every other seat had a beater. A word
+    // one tier can only ever say in one of its five states trains every reader to skip it.
+    //
+    // Armed ONLY when UNBOUNDED. A bounded render is a READER, and the purity fence (D-02: a bounded
+    // --watch leaves .tickmarkr/ byte-identical) is exactly the test that catches a reader beating on a
+    // watcher's behalf, which would report every dead tier healthy. Armed BEFORE the first frame, so the
+    // board's own first print already names its tier armed rather than one interval later.
+    //
+    // The handle is HELD and stood down in the finally. Discarding it is not a smaller version of this —
+    // it INVERTS it: armSupervision's interval outlives the board in any host that outlives one board, so
+    // a dead board keeps writing and reads ARMED. That is the over-claiming direction, the one an operator
+    // acts on, and the one this instrument exists to close.
+    const armed = bounded ? undefined : armSupervision(cwd, "watch", opts.supervisionBeatMs);
     let titleSaved = false;
     const restoreTitle = () => {
         if (!titleSaved)
@@ -1427,6 +1441,14 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
         }
     }
     finally {
+        // Stops the interval as well as recording the hand-off: a board that returns must not leave a
+        // timer beating for it. A board that is KILLED never reaches here, its beat ages out, and the
+        // tier reads STALE — armed-then-lost, which is the truth about a killed board.
+        // Boards OVERLAP — a second pane is one keystroke away — and the stand-down marker speaks for the
+        // whole tier, so this hand-off is recorded only when no other board is still present (see
+        // armSupervision's presence files). Otherwise the first pane closed would render the second
+        // pane's own tier down while it is drawing frames.
+        armed?.disarm();
         if (titleSaved) {
             process.removeListener("exit", restoreTitle);
             restoreTitle();

package/dist/compile/gsd.js

@@ -106,6 +106,22 @@ function extractWriteDirectives(body, storedPath) {
     return writes;
 }
 const isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function summaryCompletionStatus(planFile) {
+    const summaryFile = join(dirname(planFile), `${basename(planFile).replace(/-PLAN\.md$/, "")}-SUMMARY.md`);
+    if (!existsSync(summaryFile))
+        return undefined;
+    try {
+        const content = readFileSync(summaryFile, "utf8");
+        const fmMatch = /^---\r?\n([\s\S]*?)\r?\n---/.exec(content);
+        if (!fmMatch)
+            return undefined;
+        const fm = parseYaml(fmMatch[1]);
+        return isPlainObject(fm) ? fm.status : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 // schema-legal, branch-safe id segment: dots etc. → dashes; no "--" runs (task-branch separator)
 // or trailing dash — the id schema rejects both
 const sanitize = (s) => s
@@ -170,7 +186,11 @@ function compileOne(file, storedPath) {
         .filter((p) => !p.includes("$") && !p.startsWith("~") && !p.startsWith("/") && !p.split("/").includes(".."));
     const taskCount = [...body.matchAll(/<task[\s>]/g)].length;
     const humanGate = fm.autonomous === false || /<task type="checkpoint:/.test(body);
-    const done = existsSync(join(dirname(file), `${basename(file).replace(/-PLAN\.md$/, "")}-SUMMARY.md`));
+    const summaryStatus = summaryCompletionStatus(file);
+    // GSD source rule (`/gsd:quick status`): a SUMMARY is complete only when its frontmatter says
+    // `status: complete`; when `status` is absent it reports `INCOMPLETE`. The compiler must preserve
+    // that distinction because an artifact can record a reviewed failure rather than completion.
+    const done = summaryStatus === "complete";
     const files = strings(fm.files_modified).map((f) => f.replace(/^\.\//, ""));
     assertWriteScope(file, `P${key}`, files, extractWriteDirectives(body, storedPath));
     // fail closed (D-03): a silently dropped floor/pin routes the task cheap instead of erroring

package/dist/run/daemon.d.ts

@@ -18,7 +18,6 @@ export interface RunOptions {
     mode?: RoutingMode;
     narrate?: (event: JournalEvent) => void;
     exit?: (code: number) => void;
-    supervise?: boolean;
 }
 export type ModeSource = "run flag" | "spec" | "repo config" | "global config" | "default";
 export interface ResolvedRunMode {

package/dist/run/daemon.js

@@ -19,16 +19,15 @@ import { addEvidence, attributeBlocked, blockedTasks, getTask, graphDefinitionHa
 import { GATE_NAMES } from "../graph/schema.js";
 import { augmentRetryBrief, consult, renderRetryGuidance } from "./consult.js";
 import { runEnvironment } from "./environment.js";
-import { cleanupRunWorktrees, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, runWithForkBudget, sh, shGit, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
+import { cleanupRunWorktrees, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, preserveWorktree, runWithForkBudget, sh, shGit, WORKTREE_LAYOUT_CONTRACT, worktreePath } from "./git.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
-import { activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
+import { activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingReviewFindings, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
 import { isDiffCapPark } from "../gates/review.js";
 import { acquireApprovalSerialization, acquireRunLock, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, verifyIntegrationTip } from "./merge.js";
 import { nextChannel, route } from "../route/router.js";
 import { desiredPanes } from "./reconcile.js";
 import { harvestCpuFlatWindowMs, NUDGEABLE_ADAPTERS, PANE_READ_ROWS, StallProgressTracker, stallSnapshotBannerRows, WorkerTreeCpuAccountant, } from "./stall.js";
-import { armSupervision } from "./supervision.js";
 // Compatibility exports for the daemon liveness tests and existing consumers. The implementation
 // lives in stall.ts so gate dispatch can depend on it without importing the daemon.
 export { harvestCpuFlatWindowMs, resetHarvestCpuFlatMsForTests, setHarvestCpuFlatMsForTests, workerTreeCpuMs, } from "./stall.js";
@@ -721,13 +720,9 @@ export async function runDaemon(repoRoot, opts = {}) {
     // subprocess, so the optional-chain open below is a no-op there). Cosmetic-only: any failure is
     // swallowed (never affects the run); the operator closes a surviving watch pane.
     const lock = acquireRunLock(repoRoot, runId);
-    // T16: the orchestrator seat IS this daemon, so this is where the tier gets armed — the writer half
-    // T3 shipped had no caller outside its own tests, which made the reader honest and useless: it read
-    // ABSENT for the entire life of every run. Armed immediately after the lock (the first instant this
-    // process owns the run) and held to the last, so the beat's span is the run's span. armSupervision
-    // never throws, so an unwritable beat can never take a run down; it is deregistered in BOTH exits
-    // below, because the signal reaper exits the process before the finally can run.
-    const supervision = opts.supervise === false ? undefined : armSupervision(repoRoot, "orchestrator");
+    // D10: the lock is this daemon's liveness record and already carries its pid; status prints that
+    // identity beside the supervision row. The `orchestrator` tier belongs exclusively to the seated
+    // supervisor, so a run never beats or stands down that seat's record on the daemon's behalf.
     // v1.54 T2: declared before the try so the finally can always deregister (a throw before
     // registration leaves it undefined — the guard below covers that path).
     let onTermination;
@@ -855,7 +850,6 @@ export async function runDaemon(repoRoot, opts = {}) {
                             }
                             catch { /* cosmetic — visibility is never a gate */ }
                         }
-                        supervision?.disarm(); // T16: same reason as the lock — this seat stood down, it did not die
                         releaseRunLock(repoRoot); // the process dies at exit() below — the finally never runs on this path
                     }
                     abortRun(new Error(`terminated by ${sig}`));
@@ -1145,6 +1139,17 @@ export async function runDaemon(repoRoot, opts = {}) {
                     await park(t, `humanGate: "${t.title}" requires approval before dispatch`, "human-gate", null, 0, startMs);
                     return;
                 }
+                // The driver owns how a checkout is created, but runDaemon owns the destructive transition:
+                // every task-checkout recreation passes through this wrapper before any driver can remove the
+                // old path. A preservation failure throws and therefore leaves the old checkout in place. The
+                // row is deliberately written before the later worktree-recreation row so the journal cannot
+                // describe only the commits it carried while omitting uncommitted work the removal destroyed.
+                const recreateTaskWorktree = async (taskBranch, taskBase, priorWt) => {
+                    const ref = await preserveWorktree(priorWt);
+                    if (ref)
+                        journal.append("worktree-preserved", t.id, { ref });
+                    return driver.worktree(repoRoot, taskBranch, taskBase);
+                };
                 const r = route(t, cfg, channels, profile, undefined, demotedChannels);
                 for (const lint of r.lints)
                     journal.append("routing-lint", t.id, { lint });
@@ -1457,7 +1462,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     const priorTaskTip = await gitHead(priorWt);
                     const priorTaskSubject = await gateCommitSubject(taskBase, priorTaskTip, priorWt);
                     const commitsToCarry = await commitsAheadOf(taskBase, priorWt);
-                    const wt = await driver.worktree(repoRoot, taskBranch, taskBase);
+                    const wt = await recreateTaskWorktree(taskBranch, taskBase, priorWt);
                     const carriedCommits = await cherryPickCommits(wt, commitsToCarry);
                     // Reuse is about the tree the gates will actually inspect. The integration tip may have moved
                     // while the daemon was down, so compare after recreating the task on today's taskBase rather
@@ -1753,6 +1758,22 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const brief = journaledRows.join("\n\n");
                         feedback = feedback ? `${brief}\n\n${feedback}` : brief;
                     }
+                    // T6: both carries above are ATTEMPT-scoped — the funded repair is spent at the next
+                    // worker-launch (and budgeted at two), and the journaled brief is reset there too, so it hands
+                    // this dispatch only the LAST attempt's bytes. An unresolved review finding is a property of the
+                    // TASK: the moment one attempt fails for an unrelated reason — a red build, a refused tree, or a
+                    // death that journals no gate row at all — the finding is in neither carry and the next worker
+                    // re-derives the task from the spec and lands on the same gap the reviewer already anchored.
+                    // Re-derived from the journal on EVERY dispatch and retired only by a review that passes on this
+                    // task (journal.ts `outstandingReviewFindings`). Appended row-wise, because this round's own
+                    // feedback or a repair brief may already quote a finding and repeating it helps no worker.
+                    const outstandingFindings = outstandingReviewFindings(journaledSoFar, t.id);
+                    const unquoted = outstandingFindings.filter((f) => !feedback.includes(f.note));
+                    if (unquoted.length > 0) {
+                        const brief = ["## Outstanding review findings — a review has NOT passed on these yet",
+                            ...unquoted.map((f) => `- ${f.path}: ${f.note}`)].join("\n");
+                        feedback = feedback ? `${feedback}\n\n${brief}` : brief;
+                    }
                     retryMode = repairFindings
                         ? "repair"
                         : priorSession
@@ -1775,21 +1796,29 @@ export async function runDaemon(repoRoot, opts = {}) {
                     lastContextTokens = undefined;
                     graph = setStatus(graph, t.id, "running");
                     saveGraph(repoRoot, graph);
-                    journal.append("task-dispatch", t.id, { assignment, attempt, provenance: dispatchProvenance(r.provenance), retryMode });
+                    // T6: a dispatch that carries an outstanding finding says so, and names it. Without this the
+                    // ledger cannot tell a carried dispatch from an amnesiac one — the exact question a run that
+                    // spends two frontier attempts re-deriving a known defect has to be able to answer afterwards.
+                    journal.append("task-dispatch", t.id, {
+                        assignment, attempt, provenance: dispatchProvenance(r.provenance), retryMode,
+                        ...(outstandingFindings.length > 0 ? { carriedFindings: outstandingFindings } : {}),
+                    });
                     journal.phaseStart(t.id, "worker", { attempt, assignment });
                     const taskBase = await integrationHead(intWt); // deps are merged → visible to this task
                     const taskBranch = `${branch}--${t.id}`; // "--": a ref can't nest under the existing integration branch (locked decision 10)
                     const priorWt = worktreePath(repoRoot, taskBranch);
-                    const commitsToCarry = existsSync(priorWt) ? await commitsAheadOf(taskBase, priorWt) : [];
-                    const wt = await driver.worktree(repoRoot, taskBranch, taskBase);
+                    const recreating = existsSync(priorWt);
+                    const commitsToCarry = recreating ? await commitsAheadOf(taskBase, priorWt) : [];
+                    const wt = await recreateTaskWorktree(taskBranch, taskBase, priorWt);
                     // OBS-58: quota-failover and every retry recreate the task worktree from the integration tip —
                     // cherry-pick prior attempts' landed commits forward so a failover dispatch cannot silently
                     // orphan work a consult already verified as landed.
                     let carriedCommits = [];
                     if (commitsToCarry.length > 0) {
                         carriedCommits = await cherryPickCommits(wt, commitsToCarry);
-                        journal.append("worktree-recreation", t.id, { attempted: commitsToCarry, carried: carriedCommits });
                     }
+                    if (recreating)
+                        journal.append("worktree-recreation", t.id, { attempted: commitsToCarry, carried: carriedCommits });
                     // T2 review (material): harvest eligibility is "does this WORKTREE carry unverified work",
                     // measured against taskBase — the same base the fast-kill's delta probe and the gates
                     // themselves use. It was measured against this attempt's post-carry HEAD, which excluded
@@ -2892,6 +2921,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                         if (results.some((g) => g.gate === "test" && !g.pass))
                             testGateFailed = true;
                         if (results.every(gateSatisfied)) {
+                            // T6: every gate — the review included — is satisfied on this commit, so the failure brief
+                            // this loop is still holding describes nothing outstanding. It is dropped HERE, before the
+                            // merge, because a conflict below sends the task around the attempt loop again: a brief kept
+                            // across that retry hands the next worker findings a later review has since passed on, while
+                            // `carriedFindings` — re-derived from the journal, which retired them — is correctly empty,
+                            // leaving that dispatch's row indistinguishable from an amnesiac one. Rebuilt exactly as the
+                            // gate-fail brief is, so prior-RUN evidence (retired by its own rule, not by this reviewer)
+                            // survives and only this run's settled findings go.
+                            feedback = withCarriedEvidence("");
                             const m = await mergeSerial(taskBranch, t, gated);
                             if (m.tipMoved) {
                                 journal.append("tip-moved", t.id, m.tipMoved);
@@ -3188,9 +3226,6 @@ export async function runDaemon(repoRoot, opts = {}) {
             process.removeListener("SIGINT", onTermination);
             process.removeListener("SIGTERM", onTermination);
         }
-        // T16: every other exit — normal end, throw, termination unwind. disarm() is idempotent, so the
-        // signal path having already stood the tier down changes nothing here.
-        supervision?.disarm();
         try {
             releaseRunLock(repoRoot);
         }

package/dist/run/git.d.ts

@@ -63,6 +63,21 @@ export declare function cleanupRunWorktrees(repo: string, branch: string, opts:
     removeTaskIds: string[];
 }): Promise<void>;
 export declare function resolveIntegrationBranch(_repo: string, branch: string): Promise<string>;
+/**
+ * Preserve the bytes an existing checkout holds before recreation removes it.
+ *
+ * `git stash create` cannot do this job: its apparent `-u` argument is accepted as a message and
+ * untracked files never enter the stash object. Build the snapshot through a disposable index
+ * instead. The index starts at HEAD (so no unrelated residue from the checkout's real index enters
+ * the tree), stages the complete working tree including ordinary untracked paths, and lives outside
+ * the repository so it cannot stage itself. None of these plumbing commands writes the checkout or
+ * its real index.
+ *
+ * The returned ref is the durable recovery handle. A clean checkout returns undefined and creates
+ * neither a commit nor a ref, keeping meaningful deaths visible rather than minting one ref per
+ * ordinary dispatch.
+ */
+export declare function preserveWorktree(cwd: string): Promise<string | undefined>;
 export declare function createWorktree(repo: string, branch: string, baseRef: string): Promise<string>;
 export declare function linkNodeModules(repo: string, dir: string, { force }?: {
     force?: boolean | undefined;

package/dist/run/git.js

@@ -1,8 +1,9 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { spawn } from "node:child_process";
-import { existsSync, lstatSync, mkdirSync, readFileSync, readlinkSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
-import { availableParallelism } from "node:os";
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readlinkSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { availableParallelism, tmpdir } from "node:os";
 import { join, resolve } from "node:path";
+import { StringDecoder } from "node:string_decoder";
 import { shq } from "../adapters/types.js";
 import { tickmarkrDir } from "../graph/graph.js";
 import { ROUTING_ENV_SEAMS } from "../route/router.js";
@@ -109,12 +110,16 @@ function shell(cmd, cwd, timeoutMs, login) {
         // open, so "close" never fires and the promise wedges forever (v1.33.1 init hang).
         const p = (spawnChild ?? spawn)("bash", [login ? "-lc" : "-c", cmd], { cwd, env, stdio: ["ignore", "pipe", "pipe"], detached: true });
         let stdout = "", stderr = "";
-        let timedOut = false, done = false, started = false;
+        const stdoutDecoder = new StringDecoder("utf8");
+        const stderrDecoder = new StringDecoder("utf8");
+        let timedOut = false, done = false, started = false, outputSeen = false;
         const finish = (code, err) => {
             if (done)
                 return;
             done = true;
             clearTimeout(timer);
+            stdout += stdoutDecoder.end();
+            stderr += stderrDecoder.end();
             resolve({ code, stdout, stderr: err ?? stderr, timedOut, durationMs: Date.now() - startedAt });
         };
         const timer = setTimeout(() => {
@@ -127,10 +132,23 @@ function shell(cmd, cwd, timeoutMs, login) {
             }
         }, timeoutMs);
         p.on("spawn", () => { started = true; }); // the command exists from here on — never retryable past it
-        p.stdout.on("data", (d) => (stdout += d));
-        p.stderr.on("data", (d) => (stderr += d));
+        // OBS-716: one stateful decoder per stream carries an incomplete UTF-8 sequence into that
+        // stream's next pipe chunk; decoding each chunk through string concatenation corrupts bytes at
+        // kernel-chosen boundaries. A deterministic fixture proves this decoder correct rather than
+        // proving every caller byte-safe: real chunk boundaries are the kernel's to choose, so timing
+        // still decides whether a chunk-local decoder exposes the defect in any particular run.
+        p.stdout.on("data", (d) => {
+            if (d.length > 0)
+                outputSeen = true;
+            stdout += stdoutDecoder.write(d);
+        });
+        p.stderr.on("data", (d) => {
+            if (d.length > 0)
+                outputSeen = true;
+            stderr += stderrDecoder.write(d);
+        });
         p.on("error", (e) => {
-            if (!done && !started && !stdout && !stderr && e.code === RETRYABLE_SPAWN_CODE) {
+            if (!done && !started && !outputSeen && e.code === RETRYABLE_SPAWN_CODE) {
                 done = true;
                 clearTimeout(timer);
                 resolve({ refused: e });
@@ -260,6 +278,46 @@ const resolveTaskBranch = async (repo, branch) => {
     const integration = await resolveIntegrationBranch(repo, branch.slice(0, split));
     return `${integration}${branch.slice(split)}`;
 };
+/**
+ * Preserve the bytes an existing checkout holds before recreation removes it.
+ *
+ * `git stash create` cannot do this job: its apparent `-u` argument is accepted as a message and
+ * untracked files never enter the stash object. Build the snapshot through a disposable index
+ * instead. The index starts at HEAD (so no unrelated residue from the checkout's real index enters
+ * the tree), stages the complete working tree including ordinary untracked paths, and lives outside
+ * the repository so it cannot stage itself. None of these plumbing commands writes the checkout or
+ * its real index.
+ *
+ * The returned ref is the durable recovery handle. A clean checkout returns undefined and creates
+ * neither a commit nor a ref, keeping meaningful deaths visible rather than minting one ref per
+ * ordinary dispatch.
+ */
+export async function preserveWorktree(cwd) {
+    if (!existsSync(cwd))
+        return undefined;
+    const scratch = mkdtempSync(join(tmpdir(), "tickmarkr-preserve-index-"));
+    const index = join(scratch, "index");
+    const withIndex = (command) => `GIT_INDEX_FILE=${shq(index)} ${command}`;
+    try {
+        await shGitOk(withIndex("git read-tree HEAD"), cwd);
+        await shGitOk(withIndex("git add -A -- ."), cwd);
+        const tree = (await shGitOk(withIndex("git write-tree"), cwd)).trim();
+        const headTree = (await shGitOk("git rev-parse 'HEAD^{tree}'", cwd)).trim();
+        if (tree === headTree)
+            return undefined;
+        // Do not depend on consumer-level identity configuration: this is an engine recovery object,
+        // not an authored project commit. Its HEAD parent makes the preserved tree directly inspectable.
+        const identity = "GIT_AUTHOR_NAME=tickmarkr GIT_AUTHOR_EMAIL=tickmarkr@localhost "
+            + "GIT_COMMITTER_NAME=tickmarkr GIT_COMMITTER_EMAIL=tickmarkr@localhost";
+        const commit = (await shGitOk(`${identity} git commit-tree ${shq(tree)} -p HEAD -m ${shq("tickmarkr: preserve uncommitted worktree")}`, cwd)).trim();
+        const ref = `refs/tickmarkr/preserved/${commit}`;
+        await shGitOk(`git update-ref ${shq(ref)} ${shq(commit)}`, cwd);
+        return ref;
+    }
+    finally {
+        rmSync(scratch, { recursive: true, force: true });
+    }
+}
 export async function createWorktree(repo, branch, baseRef) {
     branch = await resolveTaskBranch(repo, branch);
     const dir = join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));

package/dist/run/journal.d.ts

@@ -104,6 +104,30 @@ export declare function repairsSinceApproval(events: JournalEvent[], taskId: str
  * retires the findings it settled — the uphold case re-derives its own brief separately).
  */
 export declare function journaledFailureBrief(events: JournalEvent[], taskId: string): string[];
+/**
+ * T6: the review findings still OUTSTANDING on a task. A review finding is a property of the TASK,
+ * not of the attempt that drew it: it stays outstanding until a later review PASSES on the task (or
+ * an operator approval settles it), and it therefore travels on EVERY dispatch until then.
+ *
+ * The two carries beside this one are attempt-scoped by construction and both lose it. The funded
+ * repair (`pendingRepairFindings`) is spent at the next `worker-launch` and is budgeted at two per
+ * engagement; `journaledFailureBrief` is reset at that same launch, so it hands the next brief only
+ * the LAST attempt's bytes. The moment one attempt fails for an unrelated reason — a red build, a
+ * refused tree, or a death that produces no verdict at all and journals no gate row whatsoever — the
+ * outstanding finding is in neither carry, and the run re-derives the task from the spec and lands on
+ * the same gap the reviewer already anchored.
+ *
+ * Retirement is closed and narrow: a review that PASSED, or the one approval that accepts the review
+ * gate itself (`GATE_SATISFIED_RELEASE` stamped `gate: "review"` — the operator taking the diff the
+ * reviewer rejected). Every other approval RETAINS. `--uphold` funds an attempt to FIX the findings;
+ * `--recheck` and an attempt-cap release fund another dispatch and say nothing about the reviewer's
+ * objection; a plain human-gate approval predates any review; a gate-satisfied release naming some
+ * other gate settled that gate, not this one. Reading "approved" as "settled" is how a still-open
+ * finding was dropped at the exact moment the operator paid for another attempt to fix it. A review
+ * that DECLINED (`skipped`) is not a verdict and neither adds nor retires — fail closed. Findings are
+ * keyed by fingerprint, so a reviewer restating one across rounds carries it once, not once per round.
+ */
+export declare function outstandingReviewFindings(events: JournalEvent[], taskId: string): StructuredFinding[];
 /** The findings a funded repair must carry into the next dispatch, or undefined if none is pending. */
 export declare function pendingRepairFindings(events: JournalEvent[], taskId: string): string | undefined;
 /**

package/dist/run/journal.js

@@ -87,6 +87,13 @@ export function upheldFeedbackByTask(events) {
             && typeof e.data.details === "string") {
             lastReviewFail.set(e.taskId, e.data.details);
         }
+        else if (e.event === "gate-result" && e.data.gate === "review" && e.data.pass === true
+            && e.data.skipped !== true) {
+            // A later review pass settles the upheld finding. Retire both the active brief and the failed
+            // verdict it came from so a still-later approval cannot resurrect already-settled feedback.
+            upheld.delete(e.taskId);
+            lastReviewFail.delete(e.taskId);
+        }
         else if (e.event === "task-approved") {
             // any later approval supersedes: a plain accept-the-diff approval retires the uphold brief.
             if (e.data.release === REVIEW_UPHELD_RELEASE) {
@@ -480,6 +487,49 @@ export function journaledFailureBrief(events, taskId) {
     }
     return rows;
 }
+/**
+ * T6: the review findings still OUTSTANDING on a task. A review finding is a property of the TASK,
+ * not of the attempt that drew it: it stays outstanding until a later review PASSES on the task (or
+ * an operator approval settles it), and it therefore travels on EVERY dispatch until then.
+ *
+ * The two carries beside this one are attempt-scoped by construction and both lose it. The funded
+ * repair (`pendingRepairFindings`) is spent at the next `worker-launch` and is budgeted at two per
+ * engagement; `journaledFailureBrief` is reset at that same launch, so it hands the next brief only
+ * the LAST attempt's bytes. The moment one attempt fails for an unrelated reason — a red build, a
+ * refused tree, or a death that produces no verdict at all and journals no gate row whatsoever — the
+ * outstanding finding is in neither carry, and the run re-derives the task from the spec and lands on
+ * the same gap the reviewer already anchored.
+ *
+ * Retirement is closed and narrow: a review that PASSED, or the one approval that accepts the review
+ * gate itself (`GATE_SATISFIED_RELEASE` stamped `gate: "review"` — the operator taking the diff the
+ * reviewer rejected). Every other approval RETAINS. `--uphold` funds an attempt to FIX the findings;
+ * `--recheck` and an attempt-cap release fund another dispatch and say nothing about the reviewer's
+ * objection; a plain human-gate approval predates any review; a gate-satisfied release naming some
+ * other gate settled that gate, not this one. Reading "approved" as "settled" is how a still-open
+ * finding was dropped at the exact moment the operator paid for another attempt to fix it. A review
+ * that DECLINED (`skipped`) is not a verdict and neither adds nor retires — fail closed. Findings are
+ * keyed by fingerprint, so a reviewer restating one across rounds carries it once, not once per round.
+ */
+export function outstandingReviewFindings(events, taskId) {
+    const open = new Map();
+    for (const e of events) {
+        if (e.taskId !== taskId)
+            continue;
+        if (e.event === "task-approved") {
+            if (e.data.release === GATE_SATISFIED_RELEASE && e.data.gate === "review")
+                open.clear();
+            continue;
+        }
+        if (e.event !== "gate-result" || e.data.gate !== "review" || e.data.skipped === true)
+            continue;
+        if (e.data.pass !== false)
+            open.clear(); // a later review PASSED on this task: nothing is outstanding
+        else
+            for (const finding of findingRows(e, "review"))
+                open.set(finding.fingerprint, finding);
+    }
+    return [...open.values()];
+}
 /** The findings a funded repair must carry into the next dispatch, or undefined if none is pending. */
 export function pendingRepairFindings(events, taskId) {
     const e = decisionForNextDispatch(events, taskId, "repair-attempt");
@@ -1055,12 +1105,16 @@ export class Journal {
     }
     replayResumeState() {
         const m = new Map();
+        const events = this.read();
+        // Keep the legacy resume-state field aligned with the journal-authoritative prompt-time fold.
+        // In particular, a review pass after an uphold must erase the fallback daemon.ts may consult.
+        const activeUpheldFeedback = upheldFeedbackByTask(events);
         const pendingReroute = new Set(); // reroute verdicts not yet cleared by a later dispatch
         // OBS-547: what the last dispatch ADDED, so a scope-authoring event can take it back. An
         // unchargeable dispatch must replay as if it never happened — no attempt counted, no channel burned.
         const lastDispatch = new Map();
         const lastReviewFail = new Map(); // OBS-189: newest failed review details per task
-        for (const e of this.read()) {
+        for (const e of events) {
             if (!e.taskId)
                 continue;
             if (e.event === "gate-result" && e.data.gate === "review" && e.data.pass === false
@@ -1160,6 +1214,13 @@ export class Journal {
                 st.lastAssignment = undefined;
             }
         }
+        for (const [taskId, st] of m) {
+            const feedback = activeUpheldFeedback.get(taskId);
+            if (feedback)
+                st.upheldFeedback = feedback;
+            else
+                delete st.upheldFeedback;
+        }
         return m;
     }
     // OBS-130: gate satisfaction is authority, not an inferred daemon state. Only an explicit

package/dist/run/supervision.d.ts

@@ -5,7 +5,7 @@ export declare const SUPERVISION_STALE_MS: number;
 export declare const SUPERVISION_FUTURE_GRACE_MS = 1000;
 export declare const SUPERVISION_TIERS: readonly ["orchestrator", "orchestrator-context", "overseer", "overseer-context", "watch"];
 export type SupervisionTier = (typeof SUPERVISION_TIERS)[number];
-export declare const SUPERVISION_SEAT_TIERS: readonly ["orchestrator-context", "overseer-context"];
+export declare const SUPERVISION_SEAT_TIERS: readonly ["orchestrator", "orchestrator-context", "overseer", "overseer-context"];
 export type SeatTier = (typeof SUPERVISION_SEAT_TIERS)[number];
 /** Does this tier's record have to name the seat it speaks for? */
 export declare const isSeatTier: (tier: string) => tier is SeatTier;

package/dist/run/supervision.js

@@ -1,4 +1,5 @@
-import { mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { randomUUID } from "node:crypto";
 import { dirname, join } from "node:path";
 import { stateDirName, tickmarkrDir } from "../graph/graph.js";
 // SUP-01: supervision liveness as FILE STATE, not as a report — lock.ts's proven shape, one file per
@@ -32,8 +33,9 @@ export const SUPERVISION_FUTURE_GRACE_MS = 1_000;
 // SUP-05: CONTEXT is per SEAT, so its tiers are per seat too. One shared `context` tier would be read
 // by both supervising seats and beaten by whichever of them still had a watcher, so a live overseer
 // watcher would render the dead orchestrator one as armed — the mask this whole instrument exists to
-// remove. The enumeration is CLOSED at one tier per supervising seat: orchestrator and overseer.
-// `watch` beats nowhere on this tree and stays ABSENT, which is what ABSENT means.
+// remove. The enumeration is CLOSED at one supervision tier and one context tier per supervising
+// seat: orchestrator and overseer. `watch` is the sole process-owned tier and is armed seatlessly by
+// the live unbounded board.
 export const SUPERVISION_TIERS = [
     "orchestrator", "orchestrator-context", "overseer", "overseer-context", "watch",
 ];
@@ -42,18 +44,59 @@ export const SUPERVISION_TIERS = [
 // to a seat. Measured 2026-08-26: a consult seat of another tier ran the documented beat loop and the
 // board read that tier armed with no seat of that tier having armed anything. ARMED-and-seatless reads
 // as coverage, which is worse than ABSENT, so on these tiers a record that names no seat is not a beat.
-export const SUPERVISION_SEAT_TIERS = ["orchestrator-context", "overseer-context"];
+export const SUPERVISION_SEAT_TIERS = [
+    "orchestrator", "orchestrator-context", "overseer", "overseer-context",
+];
 /** Does this tier's record have to name the seat it speaks for? */
 export const isSeatTier = (tier) => SUPERVISION_SEAT_TIERS.includes(tier);
 // PURE path math: stateDirName, never tickmarkrDir — the latter mkdirs the state dir and writes its
 // .gitignore, so routing a READER through it would make status create the very tree it reports on.
-export const supervisionBeatPath = (repoRoot, tier) => join(repoRoot, stateDirName(repoRoot), "supervision", `${tier}.beat`);
+const supervisionDir = (repoRoot) => join(repoRoot, stateDirName(repoRoot), "supervision");
+export const supervisionBeatPath = (repoRoot, tier) => join(supervisionDir(repoRoot), `${tier}.beat`);
 /** Where a watcher records that it STOOD DOWN. Its own file: the beat keeps meaning only "alive". */
-export const supervisionStandDownPath = (repoRoot, tier) => join(repoRoot, stateDirName(repoRoot), "supervision", `${tier}.standdown`);
+export const supervisionStandDownPath = (repoRoot, tier) => join(supervisionDir(repoRoot), `${tier}.standdown`);
+// SUP-06: PRESENCE — one file per ARMED WATCHER, because a tier may legitimately have more than one.
+// Two boards watch one repo the moment an operator opens a second pane, and the tier is armed while
+// EITHER of them lives. The stand-down marker speaks for the whole tier, so the first board out
+// writing it renders the second board's own tier DISARMED until that board's next beat — a live seat
+// reported down, which is the under-claiming half of exactly the lie this instrument exists to remove.
+// So the marker is written only by the LAST watcher out, and these files are how it knows it is last.
+// Freshness decides presence, never a process table (SUP-02): a watcher that is killed cannot remove
+// its own file, and an unremoved file ages past the same ceiling a beat does and stops counting.
+const presencePrefix = (tier) => `${tier}.live.`;
+const supervisionPresencePath = (repoRoot, tier, id) => join(supervisionDir(repoRoot), `${presencePrefix(tier)}${id}`);
+/** Every presence file on this tier, by name. Missing directory ⇒ nobody is present. */
+const presenceNames = (repoRoot, tier) => {
+    try {
+        return readdirSync(supervisionDir(repoRoot)).filter((n) => n.startsWith(presencePrefix(tier)));
+    }
+    catch {
+        return [];
+    }
+};
+/**
+ * Stale peers observed in ONE directory snapshot, or undefined when that same snapshot saw a live
+ * one. A later arm has a new id and is deliberately absent from the returned cleanup set.
+ */
+function stalePeersIfLast(repoRoot, tier, id, now = Date.now()) {
+    const own = `${presencePrefix(tier)}${id}`;
+    const stale = [];
+    for (const name of presenceNames(repoRoot, tier)) {
+        if (name === own)
+            continue;
+        try {
+            if (now - statSync(join(supervisionDir(repoRoot), name)).mtimeMs <= SUPERVISION_STALE_MS)
+                return undefined;
+            stale.push(name);
+        }
+        catch { /* a vanished peer needs no cleanup and is not evidence of a live watcher */ }
+    }
+    return stale;
+}
 // WRITER — a watcher's own call, on its own tier, every SUPERVISION_BEAT_MS. Never a reader's: the
 // purity fence (status --watch leaves the state dir byte-identical) is the test that catches a reader
 // that beats on the watcher's behalf, which would report every dead tier as healthy.
-export function beatSupervision(repoRoot, tier, seat) {
+function writeSupervisionBeat(repoRoot, tier, seat, armId) {
     // A seat tier may not be armed anonymously, and the refusal belongs HERE rather than only in the
     // verb: any caller that could write a seatless record could arm a tier nobody occupies.
     if (isSeatTier(tier) && !seat?.trim()) {
@@ -62,7 +105,13 @@ export function beatSupervision(repoRoot, tier, seat) {
     tickmarkrDir(repoRoot); // the write path DOES create — beats land inside the gitignored state dir
     const p = supervisionBeatPath(repoRoot, tier);
     mkdirSync(dirname(p), { recursive: true });
-    writeFileSync(p, JSON.stringify({ tier, ...(seat ? { seat } : {}), pid: process.pid, beatAt: new Date().toISOString() }) + "\n");
+    writeFileSync(p, JSON.stringify({
+        tier, ...(seat ? { seat } : {}), ...(armId ? { armId } : {}),
+        pid: process.pid, beatAt: new Date().toISOString(),
+    }) + "\n");
+}
+export function beatSupervision(repoRoot, tier, seat) {
+    writeSupervisionBeat(repoRoot, tier, seat);
 }
 // THE WATCHER-FACING ENTRY POINT — the loop SUPERVISION_BEAT_MS actually drives. A supervising seat
 // calls this once at the top of its watch and holds the handle for the duration; a seat that dies,
@@ -71,9 +120,11 @@ export function beatSupervision(repoRoot, tier, seat) {
 // an unref'd interval that never holds the watcher's event loop open, and a beat failure that is
 // swallowed rather than crashing the watcher — an unwritten beat ages out and reads STALE, which is
 // the truth. The FIRST beat is swallowed on the same rule: a cosmetic instrument that could not write
-// must not take the run down with it. NOT called from `status`: status is a reader (its purity fence
-// is a test); the in-repo callsite is runDaemon, which arms the orchestrator tier for the life of
-// the run. A tier nobody arms reads ABSENT — exactly what ABSENT means, not a false "healthy".
+// must not take the watcher down with it. The sole production in-repo callsite is `status --watch`
+// when UNBOUNDED, which arms `watch` seatlessly for the life of the board — a bounded render is a
+// reader and arms nothing, which is the purity fence D-02 tests. Supervising seats write their named
+// tiers through the shipped beat verb instead. A tier nobody arms reads ABSENT — exactly what ABSENT
+// means, not a false "healthy".
 //
 // Arming CLEARS any prior stand-down record: a tier that stood down and armed again is armed, and a
 // marker left behind by the last run would otherwise report the live one as stood down forever.
@@ -86,40 +137,64 @@ export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS, sea
         rmSync(supervisionStandDownPath(repoRoot, tier), { force: true, recursive: true });
     }
     catch { /* uncleared: the reader validates the marker and a newer beat outranks it — never masked */ }
-    try {
-        beatSupervision(repoRoot, tier, seat);
-    }
-    catch { /* repo gone / disk full / no seat — the tier reads ABSENT rather than crashing its watcher */ }
-    const timer = setInterval(() => {
+    // This watcher's own identity fences BOTH its presence and its stand-down against every later arm.
+    // pid alone collides between two boards in one host (and after pid reuse); a UUID never aliases the
+    // stale presence of a killed process that a later last-one-out cleanup may already have observed.
+    const id = `${process.pid}.${randomUUID()}`;
+    const presence = supervisionPresencePath(repoRoot, tier, id);
+    // Presence is refreshed with the beat, so it ages by the same clock and needs no separate loop.
+    const mark = () => {
         try {
-            beatSupervision(repoRoot, tier, seat);
+            writeSupervisionBeat(repoRoot, tier, seat, id); // creates the directory presence is written into
+            writeFileSync(presence, JSON.stringify({ tier, pid: process.pid, id }) + "\n");
         }
-        catch { /* repo gone / disk full — let the beat expire */ }
-    }, beatMs);
+        catch { /* repo gone / disk full / no seat — the tier ages out rather than crashing its watcher */ }
+    };
+    mark();
+    const timer = setInterval(mark, beatMs);
     timer.unref();
     let stoodDown = false;
     return {
-        // Stand down: stop beating AND say so. Idempotent because the daemon disarms from more than one
-        // exit path (its signal reaper exits the process before the finally can run), and the recorded
-        // instant belongs to the first stand-down.
+        // Stand down: stop beating AND say so. Idempotence lets a watcher safely share cleanup across
+        // multiple exit paths; the recorded instant belongs to the first stand-down.
         disarm: () => {
             if (stoodDown)
                 return;
             stoodDown = true;
             clearInterval(timer);
+            try {
+                rmSync(presence, { force: true, recursive: true });
+            }
+            catch { /* ages out on its own */ }
+            // The marker speaks for the TIER, so only the last watcher out may write one: a peer still
+            // present means the tier is not down, and saying it is would render that live board's own tier
+            // DISARMED. The snapshot also fixes the cleanup set: a board arming after this decision receives
+            // a new id, so this older board can neither sweep its presence nor claim its beat stood down.
+            const stalePeers = stalePeersIfLast(repoRoot, tier, id);
+            if (stalePeers === undefined)
+                return;
             // Published ATOMICALLY — written aside, renamed over — so no reader can ever meet a half-written
             // marker. A torn marker is rejected anyway (see readStandDown), but a stand-down that reads as
             // garbage is a stand-down that reports as a death, and the rename costs one line.
             const p = supervisionStandDownPath(repoRoot, tier);
-            const tmp = `${p}.${process.pid}.tmp`;
+            const tmp = `${p}.${id}.tmp`;
             try {
                 mkdirSync(dirname(p), { recursive: true });
                 writeFileSync(tmp, JSON.stringify({
-                    tier, ...(seat ? { seat } : {}), pid: process.pid, disarmedAt: new Date().toISOString(),
+                    tier, ...(seat ? { seat } : {}), armId: id,
+                    pid: process.pid, disarmedAt: new Date().toISOString(),
                 }) + "\n");
                 renameSync(tmp, p);
             }
             catch { /* unrecordable stand-down ages out as STALE — pessimistic, which is the safe way to fail */ }
+            // Sweep only stale names in the pre-publication snapshot. Re-reading here used to catch and
+            // delete a newer board that armed between the peer check and this older board's rename.
+            for (const name of stalePeers) {
+                try {
+                    rmSync(join(supervisionDir(repoRoot), name), { force: true, recursive: true });
+                }
+                catch { /* next sweep */ }
+            }
         },
     };
 }
@@ -153,20 +228,26 @@ function readBeat(repoRoot, tier) {
     // is not evidence that nobody armed the tier). On a SEAT tier it is the opposite: a record naming no
     // seat leaves the tier armed and unattributable, which reads as coverage no seat is providing, so
     // it is UNREADABLE — something is there and no beat any reader can attribute comes out of it.
-    const seat = beatSeat(p);
+    const { seat, armId } = beatMetadata(p);
     if (isSeatTier(tier) && seat === undefined)
         return "UNREADABLE";
-    return { mtimeMs: st.mtimeMs, ...(seat !== undefined ? { seat } : {}) };
+    return {
+        mtimeMs: st.mtimeMs,
+        ...(seat !== undefined ? { seat } : {}),
+        ...(armId !== undefined ? { armId } : {}),
+    };
 }
-/** The seat a record declares, or undefined for any record that declares none this reader can use. */
-function beatSeat(path) {
+/** Optional metadata declared by a beat; its mtime remains the only source of age. */
+function beatMetadata(path) {
     try {
         const rec = JSON.parse(readFileSync(path, "utf8"));
-        return typeof rec?.seat === "string" && rec.seat.trim() ? rec.seat : undefined;
+        const seat = typeof rec?.seat === "string" && rec.seat.trim() ? rec.seat : undefined;
+        const armId = typeof rec?.armId === "string" && rec.armId.trim() ? rec.armId : undefined;
+        return { ...(seat !== undefined ? { seat } : {}), ...(armId !== undefined ? { armId } : {}) };
     }
     catch {
-        return undefined;
-    } // unparseable bytes name no seat — the caller decides what that means
+        return {};
+    } // unparseable bytes name no seat or arm — the caller decides what that means
 }
 function beatLiveness(tier, beat, now) {
     if (typeof beat !== "object")
@@ -203,6 +284,7 @@ function readStandDown(repoRoot, tier) {
     if (!st.isFile())
         return "UNREADABLE";
     let seat;
+    let armId;
     try {
         const rec = JSON.parse(readFileSync(p, "utf8"));
         if (rec?.tier !== tier)
@@ -210,6 +292,7 @@ function readStandDown(repoRoot, tier) {
         if (typeof rec.disarmedAt !== "string" || Number.isNaN(Date.parse(rec.disarmedAt)))
             return "UNREADABLE";
         seat = typeof rec.seat === "string" && rec.seat.trim() ? rec.seat : undefined;
+        armId = typeof rec.armId === "string" && rec.armId.trim() ? rec.armId : undefined;
         // A seat tier's hand-off names WHICH seat left, on the same rule as its beat: an anonymous
         // stand-down on a per-seat tier says a watcher left without saying whose, so it is no record.
         if (isSeatTier(tier) && seat === undefined)
@@ -218,18 +301,26 @@ function readStandDown(repoRoot, tier) {
     catch {
         return "UNREADABLE";
     } // unparseable or unreadable bytes — not a stand-down anyone can read
-    return { mtimeMs: st.mtimeMs, ...(seat !== undefined ? { seat } : {}) };
+    return {
+        mtimeMs: st.mtimeMs,
+        ...(seat !== undefined ? { seat } : {}),
+        ...(armId !== undefined ? { armId } : {}),
+    };
 }
 // THE TIER'S STATE — what every surface and every operator reads. A valid stand-down outranks the beat:
 // the watcher that wrote it is gone ON PURPOSE, and its last beat ages out exactly like a dead one's
-// would. It outranks the beat it FOLLOWED and no other — a beat stamped after the marker was written by
-// a watcher that armed again, so a marker some failed cleanup left behind can never mask a live tier.
+// would. It outranks the beat it FOLLOWED and no other — a later timestamp OR a FRESH different
+// armed-watcher identity is another arm, so a marker whose rename lost that race cannot mask a live
+// watcher. Once that foreign beat is stale, a newer clean hand-off must win: otherwise overlapping
+// boards closed in last-beater-first order would leave the tier reporting a death forever.
 export function supervisionStatus(repoRoot, tier, now = Date.now()) {
     const beat = readBeat(repoRoot, tier);
     const standDown = readStandDown(repoRoot, tier);
     if (standDown === "UNREADABLE")
         return { tier, state: "UNREADABLE" };
-    if (standDown !== "NONE" && !(typeof beat === "object" && beat.mtimeMs > standDown.mtimeMs)) {
+    const beatOutranksStandDown = standDown !== "NONE" && typeof beat === "object" && (beat.mtimeMs > standDown.mtimeMs || (now - beat.mtimeMs <= SUPERVISION_STALE_MS &&
+        beat.armId !== undefined && standDown.armId !== undefined && beat.armId !== standDown.armId));
+    if (standDown !== "NONE" && !beatOutranksStandDown) {
         // the seat that stood down is named by the marker, falling back to whatever its last beat named
         const seat = standDown.seat ?? (typeof beat === "object" ? beat.seat : undefined);
         return { tier, state: "DISARMED", ...(seat !== undefined ? { seat } : {}) };

package/fixtures/gsd-sample/07-live-check/07-03-SUMMARY.md

@@ -1 +1,5 @@
+---
+status: complete
+---
+
 # done earlier

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.1.3",
+  "version": "2.1.4",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-overseer/scripts/watch-context.sh

@@ -81,7 +81,7 @@ handoff_fresh() {
   [ -f "$HANDOFF" ] || return 1
   local age now mt
   now=$(date +%s)
-  mt=$(stat -f %m "$HANDOFF" 2>/dev/null || stat -c %Y "$HANDOFF" 2>/dev/null) || return 1
+  mt=$(stat -c %Y "$HANDOFF" 2>/dev/null || stat -f %m "$HANDOFF" 2>/dev/null) || return 1
   age=$((now - mt))
   [ "$age" -le "$MAXAGE" ]
 }