tickmarkr 2.1.4 → 2.1.5

package/dist/run/journal.js

@@ -114,10 +114,11 @@ export function upheldFeedbackByTask(events) {
 // for a resolved one is the silent-lie shape the gates exist to refuse, so the field says so outright.
 export const UNIDENTIFIED = "<unidentified>";
 const ANCHORED_RE = /^- (\S+?):(\d+) — (.*)$/; // "## Anchored review" rows (llm.ts)
-const REVIEW_ROW_RE = /^- \[([^\]]+)\] (.*)$/; // "- [material] …" (review.ts)
+const REVIEW_ROW_START_RE = /^- \[([^\]\r\n]+)\] /gm; // "- [material] …" (review.ts)
 const JUDGE_ROW_RE = /^✗ ([\w.-]+): (.*)$/; // "✗ c1: …" (acceptance.ts) — id, then reason
 const PATH_RE = /\b((?:[\w.@~+-]+\/)+[\w.@~+-]+\.\w{1,6})\b/;
 const LINE_REF_RE = /(:\d+(?::\d+)?\b)|(\bline \d+\b)/gi;
+const REVIEW_RATIONALE_SEPARATOR = " — rationale: ";
 // ponytail: repo-relative tail from the first known top-level directory — enough to make an absolute
 // worktree path and its repo-relative twin the same identity. Widen the marker list if a run ever
 // names findings outside these roots.
@@ -143,10 +144,46 @@ function identifierIn(note) {
 // code identity still has one stable identity of its own: its own words, with the volatile tokens
 // swept out so line/path churn cannot mint a new symbol for the same finding. It is the reviewer's
 // own bytes, never a guess, and it can never fuse two different findings into one.
-function toFinding(cls, note, path, symbol) {
+function toFinding(cls, note, path, symbol, rationale) {
     const p = path || UNIDENTIFIED;
     const s = symbol || normalizeGateFailure(note) || UNIDENTIFIED;
-    return { class: cls, path: p, symbol: s, note, fingerprint: `${cls}|${p}|${s}` };
+    return {
+        class: cls, path: p, symbol: s, note,
+        ...(rationale !== undefined ? { rationale } : {}),
+        fingerprint: `${cls}|${p}|${s}`,
+    };
+}
+/**
+ * Decode review.ts's row rendering without treating physical lines as findings. A review finding's
+ * note and rationale are JSON strings before rendering and may therefore contain newlines; the next
+ * typed row (or the anchored-review block) is the record boundary. The fixed rationale separator is
+ * removed before identity is computed, so changing only why a concern was accepted re-seats it.
+ */
+function reviewDetailFindings(details) {
+    const anchoredAt = details.indexOf("\n\n## Anchored review");
+    let prose = anchoredAt === -1 ? details : details.slice(0, anchoredAt);
+    const inconsistencyAt = prose.search(/\nreview (?:finding|verdict) inconsistent:/);
+    if (inconsistencyAt !== -1)
+        prose = prose.slice(0, inconsistencyAt);
+    const starts = [...prose.matchAll(REVIEW_ROW_START_RE)];
+    return starts.map((start, i) => {
+        const contentStart = start.index + start[0].length;
+        const contentEnd = starts[i + 1]?.index ?? prose.length;
+        let content = prose.slice(contentStart, contentEnd);
+        // The newline before the next typed row is framing, while every earlier newline belongs to the
+        // reviewer's field. At EOF/anchored-review there is no framing newline to remove.
+        if (starts[i + 1] && content.endsWith("\n"))
+            content = content.slice(0, -1);
+        const deferred = String(start[1]).startsWith("deferred/");
+        const separatorAt = deferred ? content.indexOf(REVIEW_RATIONALE_SEPARATOR) : -1;
+        return separatorAt === -1
+            ? { label: start[1], note: content }
+            : {
+                label: start[1],
+                note: content.slice(0, separatorAt),
+                rationale: content.slice(separatorAt + REVIEW_RATIONALE_SEPARATOR.length),
+            };
+    });
 }
 /**
  * Structured findings for a BLOCKING review/judge gate result, parsed from the details the gate
@@ -163,24 +200,22 @@ function toFinding(cls, note, path, symbol) {
 export function structuredFindings(gate, details, _scopeFiles = []) {
     const lines = details.split("\n");
     const rows = [];
-    const push = (cls, note, ownPath, fallbackSymbol = "") => {
+    const push = (cls, note, ownPath, fallbackSymbol = "", rationale) => {
         const own = canonicalPath(ownPath || PATH_RE.exec(note)?.[1] || "");
         const sym = identifierIn(note) || fallbackSymbol;
-        rows.push(toFinding(cls, note, own, sym));
+        rows.push(toFinding(cls, note, own, sym, rationale));
     };
+    if (gate === "review") {
+        for (const finding of reviewDetailFindings(details)) {
+            push(`review:${finding.label}`, finding.note, "", "", finding.rationale);
+        }
+    }
     for (const line of lines) {
         const a = ANCHORED_RE.exec(line);
         if (a) {
             push(`${gate}:anchored`, a[3], a[1]);
             continue;
         }
-        if (gate === "review") {
-            const r = REVIEW_ROW_RE.exec(line);
-            if (r) {
-                push(`review:${r[1]}`, r[2], "");
-                continue;
-            }
-        }
         if (gate === "acceptance") {
             const j = JUDGE_ROW_RE.exec(line);
             // the criterion id IS a stable symbol for an unmet acceptance criterion — the same criterion is
@@ -197,6 +232,29 @@ export function structuredFindings(gate, details, _scopeFiles = []) {
     }
     return rows;
 }
+// v2.1.5 T2: the reviewer's DEFERRAL channel, kept structured. `classifyReviewFindings`
+// (gates/review.ts) renders a deferred finding as `- [deferred/<severity>] <note> — rationale: …`.
+// The parser above preserves multiline fields and separates rationale from identity; an older journal
+// whose row holds only prose still degrades through the same parse rather than to nothing. A deferred
+// finding is a concern the reviewer SAW and chose not to block on; it is not a concern that was fixed.
+const DEFERRED_CLASS_RE = /^review:deferred\b/;
+export function isDeferredFinding(finding) {
+    return DEFERRED_CLASS_RE.test(finding.class);
+}
+/**
+ * The findings a PASSING review DEFERRED — the rows a blocking-only projection drops on the floor.
+ * A passing review's details are prose; without this the deferral has no identity a later round can
+ * match, and every structured reader of the journal is blind to a defect the reviewer itself named.
+ */
+export function deferredReviewFindings(details) {
+    return structuredFindings("review", details).filter(isDeferredFinding);
+}
+/** The exact review.ts details fragment represented by a structured review finding. */
+export function renderStructuredReviewFinding(finding) {
+    const label = finding.class.startsWith("review:") ? finding.class.slice("review:".length) : finding.class;
+    const rationale = finding.rationale === undefined ? "" : `${REVIEW_RATIONALE_SEPARATOR}${finding.rationale}`;
+    return `- [${label}] ${finding.note}${rationale}`;
+}
 const findingRows = (event, gate) => {
     if (Array.isArray(event.data.findings)) {
         const rows = event.data.findings.filter((finding) => {
@@ -205,6 +263,7 @@ const findingRows = (event, gate) => {
             const row = finding;
             return typeof row.class === "string" && typeof row.path === "string"
                 && typeof row.symbol === "string" && typeof row.note === "string"
+                && (row.rationale === undefined || typeof row.rationale === "string")
                 && typeof row.fingerprint === "string";
         });
         if (rows.length > 0)
@@ -509,6 +568,19 @@ export function journaledFailureBrief(events, taskId) {
  * finding was dropped at the exact moment the operator paid for another attempt to fix it. A review
  * that DECLINED (`skipped`) is not a verdict and neither adds nor retires — fail closed. Findings are
  * keyed by fingerprint, so a reviewer restating one across rounds carries it once, not once per round.
+ *
+ * v2.1.5 T2: a passing review settles the findings it BLOCKED on. It does not settle the ones it
+ * DEFERRED — those it saw, declined to block on, and recorded a rationale for, and nothing has fixed
+ * them. So a pass retires the blocking set and re-seats its own deferrals, and the two retirements
+ * stay distinguishable: the blocking finding is gone, the deferral travels on as accepted work.
+ *
+ * A deferral's bound is the SAME single release as a blocking finding's — the operator accepting the
+ * review gate itself (`GATE_SATISFIED_RELEASE` stamped `gate: "review"`), the one approval in which a
+ * human actually looked at what the reviewer waved through. It is deliberately NOT bounded by a round
+ * count or by a time window: both retire a finding by arithmetic nobody read, which is the silent drop
+ * this fold exists to refuse. Nor can it accumulate — a reviewer restating the same path/note round
+ * after round re-seats ONE fingerprint, and a revised rationale replaces the prior rationale on that
+ * row. N rounds of the same concern therefore carry the newest accepted explanation once, not N rows.
  */
 export function outstandingReviewFindings(events, taskId) {
     const open = new Map();
@@ -522,8 +594,18 @@ export function outstandingReviewFindings(events, taskId) {
         }
         if (e.event !== "gate-result" || e.data.gate !== "review" || e.data.skipped === true)
             continue;
-        if (e.data.pass !== false)
-            open.clear(); // a later review PASSED on this task: nothing is outstanding
+        if (e.data.pass !== false) {
+            // a later review PASSED on this task: every finding it BLOCKED on is settled …
+            for (const [key, finding] of open)
+                if (!isDeferredFinding(finding))
+                    open.delete(key);
+            // … and no deferral is, whether or not this pass restated it. A pass is silent about a
+            // deferral it does not mention: the concern is unfixed either way, and the reviewer that
+            // waved it through is not the release that accepts it. Retiring on omission would drop it on
+            // the very next round — the same silent drop by a different door.
+            for (const finding of findingRows(e, "review").filter(isDeferredFinding))
+                open.set(finding.fingerprint, finding);
+        }
         else
             for (const finding of findingRows(e, "review"))
                 open.set(finding.fingerprint, finding);

package/dist/run/merge.js

@@ -3,7 +3,7 @@ import { join } from "node:path";
 import { shq } from "../adapters/types.js";
 import { ceilingKillResult, classifyFailureOutput, effectiveCeilingMs, fingerprint, freshFailures, } from "../gates/baseline.js";
 import { tickmarkrDir } from "../graph/graph.js";
-import { gitHead, linkNodeModules, resolveIntegrationBranch, sh, shGit, shGitOk, WORKTREES_DIR } from "./git.js";
+import { describeCapacity, gitHead, linkNodeModules, resolveIntegrationBranch, sameCapacity, sh, shGit, shGitOk, WORKTREES_DIR } from "./git.js";
 export function integrationBranch(cfg, runId) {
     return `${cfg.integrationBranchPrefix}${runId}`;
 }
@@ -99,7 +99,13 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
         // Battery parity on the infra rule too (T9): infrastructure-only output means the runner never
         // completed a suite — nothing was verified, so nothing is forgivable, however familiar its
         // fingerprints. Stricter-than-battery edge kept: unreadable output never forgives.
-        const forgiven = r.code !== 0 && baselineRed && failing.length === 0 && !unreadable && cause !== "infra";
+        // T7: the SECOND reader of a baseline entry, and the same rule as the battery's (baseline.ts).
+        // Evidence crosses a session boundary here — the capture that would forgive this red is very
+        // often the previous session's — so a capture taken under a different resolved capacity forgives
+        // nothing at the tip either. An absent capacity is a pre-T7 baseline and keeps today's verdict.
+        const comparable = sameCapacity(entry?.capacity, r.capacity);
+        const forgiven = r.code !== 0 && baselineRed && failing.length === 0 && !unreadable && cause !== "infra"
+            && comparable;
         const pass = r.code === 0 || forgiven;
         if (!pass)
             writeFileSync(artifact, raw);
@@ -111,7 +117,11 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
             fingerprints: r.code !== 0 ? fingerprint(stripped) : [],
             details: r.code === 0 ? "exit 0"
                 : forgiven ? `exit ${r.code} but only baseline-recorded failures (forgiven vs baseline)`
-                    : `exit ${r.code}`,
+                    : !comparable && baselineRed && failing.length === 0
+                        ? `exit ${r.code}; every failure is baseline-recorded, but that capture ran under `
+                            + `${describeCapacity(entry?.capacity)} and this verification ran under ${describeCapacity(r.capacity)} `
+                            + `— forgiveness across a changed capacity is not evidence`
+                        : `exit ${r.code}`,
             ...(forgiven ? { forgiven: true } : {}),
             ...(cause ? { cause } : {}),
             ...(pass ? {} : { artifact }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.1.4",
+  "version": "2.1.5",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-overseer/SKILL.md

@@ -249,6 +249,111 @@ detect: **the ruling would have made the worker commit the violation the task wa
 
 ### Context is a supervised resource, for BOTH tiers
 
+**THE TIERS CLEAR EACH OTHER AT 50%. Neither tier clears itself on its own notice.** Operator directive,
+2026-08-28, and it exists because **a seat cannot reliably observe its own exhaustion** — the seat that
+most needs clearing is the one least able to notice, and this project has now measured that three ways:
+an overseer ran nine hours at 86% unable to read its own number; a context watcher went **alive and blind**
+when the run's own status text pushed the percentage off the statusline; and an orchestrator went
+**366k → 970k of 1M between two checks** while its ACT wake sat unread in a detached log.
+
+The protocol, in both directions:
+
+1. **Overseer sees orch at ≥50%** → nudge it: write `HANDOFF-ORCH-<ver>.md`, then `/clear`, then re-read
+   its brief **and** its handoff, then **re-arm every watcher it listed** (a cleared session has none).
+2. **The returning orch, now fresh, checks the OVERSEER.** If the overseer is at ≥50%, it directs the
+   overseer to write its handoff and clear, and **points it at `HANDOFF-OVERSEER-<ver>.md` by path**.
+3. Whichever seat is fresh performs the check. **Never both at once** — the run keeps one supervising tier
+   at all times, and the seat holding the endgame goes second.
+4. **The duty to clear the other tier must SURVIVE a clear**, so it belongs in BOTH handoff files as a
+   standing re-arm item — not only in the message that ordered it. Earned 2026-08-28: the orchestrator
+   performed the check on the overseer BEFORE its own clear, precisely because clearing first would have
+   wiped the instruction to do it, and its handoff did not record the duty.
+5. **A seat cannot `/clear` ITSELF — so the OTHER TIER SENDS IT.** `/clear` is a CLI command typed into a
+   session and no tool invokes it in your own pane, but it is just text in someone else's: the partner
+   tier types it into your pane. **This is the whole reason the protocol is mutual**, and it means the
+   loop closes without the operator. The exchange, both directions, in this exact order:
+
+   ```bash
+   # 1. the seat crossing 50% writes its handoff FIRST, ending with its terminal marker
+   # 2. it asks the partner, naming its own pane and handoff path:
+   herdr pane run <partner> "I am at <N>%. Clear me: send /clear to <my-pane>, then point me at <my-handoff>."
+   # 3. the PARTNER sends the clear, then VERIFIES before pointing:
+   herdr pane run <my-pane> "/clear"
+   #    read the pane back — a cleared claude session shows an empty prompt and a reset context gauge
+   # 4. and only THEN, as a SEPARATE send, the re-orientation:
+   herdr pane run <my-pane> "You were cleared at <N>%. Read <handoff> and <brief>, re-arm EVERY watcher
+   they name — a cleared session has none — then confirm you are back."
+   ```
+
+   ⚠ **Steps 3 and 4 are two sends, never one.** A pointer batched with the clear lands *during* it and is
+   lost with the context it was meant to survive. Verify the clear landed by reading the prompt line
+   before sending the pointer — the same read-back every other send in this skill requires.
+   ⚠ **The partner must not clear itself in the same window.** One supervising tier stays live at all
+   times; the seat holding the endgame goes second.
+   ⚠ **Step 4 must state an EXPECTED-RETURN DEADLINE**, e.g. *"confirm you are back within 10 minutes."*
+   A clear order without one is an unbounded wait: see rule 6.
+
+6. **THE RETURN LEG — the returning seat's FIRST act after re-arming is a verified notice to its partner.**
+   Not its second, not once the next milestone lands. **Measured 2026-08-28 (OBS-743):** an overseer cleared
+   at 00:05Z, was back at 00:07Z, *read the orchestrator's pane at 00:10Z to take its percentage* — and said
+   nothing. The orchestrator's last line had been *"T7 is mine until you're back."* It then held the task
+   alone for **53 minutes** across a reviewer flake, a retry, a merge and the whole tip verify, with no
+   signal that its supervising tier existed. The notice went out only because the operator noticed the gap.
+
+   **A one-way read is not a handshake.** The adopt step tells you to READ the partner's pane, which feels
+   like contact and transmits nothing — that is exactly how this gets skipped by a seat following the
+   protocol correctly.
+
+   The notice is ONE line (a newline submits early), sent with `herdr pane run` and **read back**, and it
+   carries four things:
+   ```bash
+   herdr pane run <partner> "RETURN NOTICE <seat>: back on <my-pane> since <HH:MM>Z. WATCHERS I NOW HOLD:
+   <list>. SWEPT: <what was dead>. MISSION STATE AS I READ IT: <one clause>. Reply with every watcher YOU
+   still hold so we deconflict — do not arm anything I just named."
+   ```
+   - **where and since when**, so the partner can stop holding your duties;
+   - **the watcher inventory you now hold** — coverage is the thing both tiers silently assume about each
+     other, and a returning seat that re-arms without saying so produces double-coverage that reads as
+     redundancy and is actually two tiers each trusting the other;
+   - **anything you swept**, because a dead watcher the partner armed is *its* belief about coverage, not
+     yours, and it will keep believing it;
+   - **an explicit deconfliction request.** Ask for the partner's inventory back; do not infer it.
+
+   ⚠ **RE-ADOPT EVERY DETACHED WATCHER ON RETURN, and prove it from disk.** A detached watcher (`ppid 1`)
+   is the one kind that SURVIVES your clear, which is exactly why it rots unattended: `stat` its heartbeat
+   and treat **stale as dead**. Measured the same morning (OBS-742): a detached resolution watcher's
+   heartbeat was **157 minutes stale** and the task it existed to report had resolved **2h04m after its
+   last beat** — present, silent, and indistinguishable from healthy to anyone who did not look. Sweep it,
+   archive the heartbeat rather than deleting it so the gap stays measurable, and name it in the notice.
+
+   ⚠ **A CLEAR AND A DEATH ARE THE SAME SILENCE.** A seat that clears and never returns — wrong pane,
+   crashed host, operator closed the tab — is indistinguishable from one mid-`/clear`. That is why step 4
+   states a deadline: **partner silent past it → escalate to the operator.** Without the deadline the
+   protocol's most dangerous state has no timeout, and the surviving tier waits forever on a peer that no
+   longer exists.
+
+⚠ **`∑ NNNk tok` ON A CLAUDE STATUSLINE IS CUMULATIVE SESSION SPEND, NOT CONTEXT FILL.** The percentage
+is the fill; the token total is what has been spent across every turn and keeps climbing after a compaction
+or a clear. **Measured 2026-08-28, expensively:** this seat built a fallback watcher on `∑ Nk tok`, read
+`970k` as 97% of a 1M window, and sent an urgent clear-order to an orchestrator that was actually at
+**33%** — which then began a handoff and offered to discard a session two-thirds fresh, mid-endgame.
+**Read the `%`. Never derive fill from the token total, and never build an instrument on a signal whose
+SEMANTICS you have not verified against a second source.**
+
+**Why 50% and not 85%:** a handoff written at 50% is written by a seat whose judgment is intact. One
+written at 85% is written by a seat already degraded, about the decisions it is least able to summarise.
+The threshold buys judgment, not headroom.
+
+**Why the OTHER tier issues it:** a self-issued clear competes with whatever the seat is doing and loses.
+An instruction from the other tier arrives as work, and the tier issuing it is not the tier that has to
+overcome its own momentum to obey.
+
+⚠ **A detached watcher gives COVERAGE and takes away NOTIFICATION.** A wake written to a log file that no
+seat reads is not a wake. If the watcher must outlive a turn, it also needs a path that reaches a seat —
+a beat the other tier reads, a notification, or an artifact the other tier watches. **Measured 2026-08-28:
+`ACT: orch-215 at 970k/1000k — handoff + /clear NOW` fired correctly and sat unread in a scratchpad log
+while the orchestrator kept working.**
+
 Arm a context watcher on the orchestrator at spawn time and treat a threshold wake as a first-class event:
 finish the step, write a handoff, `/clear` **plus a fresh brief — never `/compact`**, because a compaction
 is a lossy summary nobody trusts while a clean session re-oriented from disk-verifiable state is reliable.
@@ -257,8 +362,9 @@ good, not after. If your own context cannot be read by the watcher, say so to th
 number — an unmeasured budget is not a small budget.
 
 ```bash
-.claude/skills/tickmarkr-overseer/scripts/watch-context.sh orchestrator <orchestrator-agent-or-pane> 60 75 <handoff-file>
-.claude/skills/tickmarkr-overseer/scripts/watch-context.sh overseer <overseer-agent-or-pane> 60 75 <handoff-file>
+# WARN 50 / ACT 50 — the mutual-clear threshold above, not a headroom alarm.
+.claude/skills/tickmarkr-overseer/scripts/watch-context.sh orchestrator <orchestrator-agent-or-pane> 50 50 <handoff-file>
+.claude/skills/tickmarkr-overseer/scripts/watch-context.sh overseer <overseer-agent-or-pane> 50 50 <handoff-file>
 ```
 
 The first argument chooses the closed per-seat tier (`orchestrator-context` or `overseer-context`),

package/skills/tickmarkr-overseer/scripts/watch-context.sh

@@ -26,12 +26,18 @@
 #      last beat aged into a permanent stale — gradual growth never reached the auto-clear path at all.
 #   4. EVERY TERMINAL EXIT STANDS THE TIER DOWN, so a watcher that finished reads DISARMED, not dead.
 #      Only a killed watcher reads STALE, which is exactly what STALE means.
+#   5. A BLIND READ ALARMS (OBS-739). Ageing the tier is visible only to someone already reading the beat
+#      table; the seat that armed this watcher must be TOLD its instrument went blind. Silence and health
+#      must never look alike.
 #
-# usage: watch-context.sh <orchestrator|overseer> <agent|pane> <warn-pct> <act-pct> [handoff-file] [poll-s] [cap-s]
+# usage: watch-context.sh <role-slug> <agent|pane> <warn-pct> <act-pct> [handoff-file] [poll-s] [cap-s]
+#   <role-slug> is ANY seat role — orchestrator, overseer, surgeon, consult — and names the tier
+#   `<role>-context`. It is deliberately NOT a closed set: see OBS-730 at the guard below.
 #   TKR_AUTO_CLEAR=1   at act-pct WITH a fresh handoff, send /clear and re-brief instead of waking.
 #   TKR_REBRIEF=<path> the file the re-briefed seat is told to read (defaults to the handoff).
 #   TKR_HANDOFF_MAX_AGE_S  how fresh "fresh" is (default 900).
 #   TKR_CLEAR_SETTLE_S     seconds to let a cleared seat settle before the re-brief (default 6).
+#   TKR_BLIND_ALARM_S      seconds unreadable before CONTEXT_BLIND alarms (default 120).
 
 set -u
 ROLE="${1:?supervising seat role required: orchestrator|overseer}"
@@ -45,10 +51,16 @@ MAXAGE="${TKR_HANDOFF_MAX_AGE_S:-900}"
 REBRIEF="${TKR_REBRIEF:-$HANDOFF}"
 SETTLE="${TKR_CLEAR_SETTLE_S:-6}"
 
+# OBS-730: this rejected every role that was not orchestrator|overseer with exit 64 — while the skill
+# mandates a context watcher on EVERY spawned seat. The rule and its own instrument disagreed, so the
+# rule was unsatisfiable for surgeons, consults and every auxiliary seat, and the gap read as coverage.
+# Any role slug names a tier; validate the SHAPE (a tier name reaches a shell) and never the membership.
 case "$ROLE" in
-  orchestrator|overseer) TIER="${ROLE}-context" ;;
-  *) echo "watch-context.sh: unknown seat role '$ROLE' — expected orchestrator or overseer" >&2; exit 64 ;;
+  *[!a-zA-Z0-9_-]*|'')
+    echo "watch-context.sh: role '$ROLE' must be a non-empty slug of [a-zA-Z0-9_-]" >&2; exit 64 ;;
 esac
+TIER="${ROLE}-context"
+
 
 # The supervision beat interval (SUPERVISION_BEAT_MS = 10s). The loop ticks at the beat cadence or the
 # caller's poll, whichever is SHORTER: a beat may only follow a successful read (rule 2), so the read
@@ -57,9 +69,33 @@ BEAT_EVERY=5
 TICK=$(( POLL < BEAT_EVERY ? POLL : BEAT_EVERY ))
 [ "$TICK" -ge 1 ] 2>/dev/null || TICK=1   # a zero or junk poll would spin, not watch
 SEAT="$TARGET"
+# ⚠ THE OTHER HALF OF OBS-730 LIVES IN THE PRODUCT, NOT HERE. `tickmarkr beat` enforces its own CLOSED
+# tier set (`src/run/supervision.ts:45`), so widening only this script would let an auxiliary seat's
+# watcher run while every beat failed SILENTLY — armed-looking, tier nonexistent. That is strictly worse
+# than the exit 64 it replaced, and it is the precise failure this whole file exists to prevent.
+# So PROBE ONCE and be loud about the answer. Watching still has real value without a tier — the warn,
+# act and blind lines all still fire — but it must never be mistaken for registered supervision.
 
-beat()      { tickmarkr beat "$TIER" --seat "$SEAT" >/dev/null 2>&1; }
-stand_down() { tickmarkr beat "$TIER" --stand-down --seat "$SEAT" >/dev/null 2>&1; }
+# ⚠ THE OTHER HALF OF OBS-730 LIVES IN THE PRODUCT, NOT HERE. `tickmarkr beat` enforces its own CLOSED
+# tier set (`src/run/supervision.ts:45`), so widening only this script would let an auxiliary seat's
+# watcher run while every beat failed SILENTLY — armed-looking, tier nonexistent, which is strictly
+# WORSE than the exit 64 it replaced and is the precise failure this file exists to prevent.
+# The refusal is reported by the FIRST REAL BEAT rather than by a startup probe: a probe that beats
+# would emit one before any successful read and break rule 2 outright, and a probe that parses the
+# usage banner binds this script to another command's help text. Beating is what we do anyway, so it
+# perturbs nothing — and because a beat only ever follows a successful read, rule 2 still holds.
+beat_refused=0
+beat() {
+  tickmarkr beat "$TIER" --seat "$SEAT" >/dev/null 2>&1 && return 0
+  if [ "$beat_refused" -eq 0 ]; then
+    beat_refused=1
+    echo "TIER_UNREGISTERED ${TIER} — the product refused this tier (its set: src/run/supervision.ts:45)"
+    echo "  watching CONTINUES and every warn/act/blind line below is real"
+    echo "  but \`tickmarkr status\` will NOT show this seat as covered — never read that absence as safe"
+  fi
+  return 0
+}
+stand_down() { tickmarkr beat "$TIER" --stand-down --seat "$SEAT" >/dev/null 2>&1; return 0; }
 # EVERY terminal exit — act, unsafe-act, cap — leaves through here, so none of them can forget to
 # record the hand-off. A killed watcher never runs it, which is the one case that must read STALE.
 trap stand_down EXIT
@@ -108,13 +144,35 @@ act_on() {
 
 warned=0
 elapsed=0
+blind=0            # seconds in the current unreadable spell (OBS-739)
+blind_alarmed=0
+BLIND_ALARM_S="${TKR_BLIND_ALARM_S:-120}"
 while [ "$elapsed" -lt "$CAP" ]; do
   P=$(context_pct)
   if [ -z "$P" ]; then
     # Rule 2: no reading, no beat. The tier ages to STALE and a supervisor comes looking, which is the
     # truth about a watcher that cannot see the seat it was armed on.
+    #
+    # Rule 5 (OBS-739): ALARM ON THE BLIND READ. Ageing a tier is not enough — it is only visible to
+    # someone already reading the beat table, and the measured failure was a watcher ALIVE AND BLIND for
+    # hours because the run's own status text pushed the percentage off the statusline. An instrument
+    # that cannot report its own absence is worse than none: the seat believes it has coverage and stops
+    # looking. So say so on stdout, where the supervising seat is actually woken. Once per blind spell,
+    # not every tick — a repeating alarm trains the reader to ignore it.
+    blind=$((blind + TICK))
+    if [ "$blind" -ge "$BLIND_ALARM_S" ] && [ "$blind_alarmed" -eq 0 ]; then
+      blind_alarmed=1
+      echo "CONTEXT_BLIND $TARGET — no percentage readable for ${blind}s; tier ${TIER} is ALIVE AND BLIND"
+      echo "  this watcher is NOT providing coverage: read the seat by hand and re-arm on a clear statusline"
+      echo "  do NOT substitute the token total — '∑ Nk tok' is cumulative SPEND, not context fill"
+    fi
     sleep "$TICK"; elapsed=$((elapsed + TICK)); continue
   fi
+  # a successful read closes the blind spell and re-arms the alarm for the next one
+  if [ "$blind_alarmed" -eq 1 ]; then
+    echo "CONTEXT_BLIND_CLEARED $TARGET — percentage readable again at ${P}% after ${blind}s blind"
+  fi
+  blind=0; blind_alarmed=0
   beat
 
   if [ "$P" -ge "$ACT" ] 2>/dev/null; then