tickmarkr 2.1.4 → 2.1.6

package/dist/run/git.js

@@ -63,6 +63,53 @@ export const deriveForkCap = (concurrency, cores = availableParallelism()) => Ma
 export const runWithForkBudget = (concurrency, fn) => forkBudget.run(String(deriveForkCap(concurrency)), fn);
 /** The cap owned by the run on this async context; the standalone default outside one. */
 export const resolvedForkCap = () => forkBudget.getStore() ?? DEFAULT_FORK_CAP;
+const positiveInt = (v) => typeof v === "number" && Number.isInteger(v) && v > 0;
+/**
+ * Three states, never two. A record carrying NO capacity is an older record from before this stamp
+ * existed: it keeps exactly the verdict it has today. A record carrying a capacity it cannot state —
+ * half the pair, an empty container, a zero, a negative, an unparseable value — is a NEWER record
+ * that is malformed, and reading it as an older one is how a fail-closed guard stops firing silently.
+ */
+export function readCapacity(value) {
+    if (value === undefined)
+        return { state: "absent" };
+    if (value === null || typeof value !== "object")
+        return { state: "malformed" };
+    const { forkCap, cores } = value;
+    return positiveInt(forkCap) && positiveInt(cores)
+        ? { state: "present", capacity: { forkCap, cores } }
+        : { state: "malformed" };
+}
+/**
+ * May a verdict recorded under `recorded` be reused — forgiven, cached, replayed — by a session
+ * running under `current`? Absent → yes, unchanged. Present and identical → yes. Malformed, a
+ * different capacity, or a current capacity the caller could not state → no.
+ */
+export function sameCapacity(recorded, current) {
+    const read = readCapacity(recorded);
+    if (read.state === "absent")
+        return true;
+    if (read.state === "malformed" || current === undefined)
+        return false;
+    return read.capacity.forkCap === current.forkCap && read.capacity.cores === current.cores;
+}
+export const describeCapacity = (value) => {
+    const read = readCapacity(value);
+    return read.state === "present"
+        ? `fork cap ${read.capacity.forkCap} of ${read.capacity.cores} cores`
+        : read.state === "absent" ? "an unrecorded capacity" : "a malformed capacity";
+};
+/**
+ * The capacity a child spawned on THIS async context would receive: the same precedence `shell`
+ * applies below — an operator export of the cap wins over the run's own derived value — beside the
+ * cores it was divided from. A caller holding a command's own result reads the capacity off THAT
+ * result (`ShResult.capacity`, stamped where the child's environment was built); this is for the
+ * decisions taken BEFORE any child exists — a cache hit, a reuse predicate.
+ */
+export const resolvedCapacity = () => ({
+    forkCap: Number(FORK_CAP_ENV in process.env ? process.env[FORK_CAP_ENV] : resolvedForkCap()),
+    cores: availableParallelism(),
+});
 /** The shipped shell ceiling: the fallback every caller gets when nothing measured a better one. */
 export const DEFAULT_SHELL_TIMEOUT_MS = 600000;
 /**
@@ -103,6 +150,13 @@ function shell(cmd, cwd, timeoutMs, login) {
     // OBS-110: apply the run's own fork cap only when the operator has not already set one.
     if (!(FORK_CAP_ENV in env))
         env[FORK_CAP_ENV] = resolvedForkCap();
+    // T7: the capacity every result of this shell carries, read HERE — off the environment the child
+    // is about to receive, after the precedence above has settled. An operator export is already in
+    // `env`, so what gets recorded is the operator's number, which is the case a release was re-taken
+    // for; re-deriving the run's own budget after the command returned would stamp a cap no child ran
+    // under. `Number` of an unparseable export is NaN, which every reader treats as malformed and
+    // therefore fails closed — the honest direction when the cap in play cannot be stated.
+    const capacity = { forkCap: Number(env[FORK_CAP_ENV]), cores: availableParallelism() };
     const attempt = () => new Promise((resolve) => {
         const startedAt = Date.now();
         // detached: bash gets its own process group so a timeout can kill the whole tree —
@@ -120,7 +174,7 @@ function shell(cmd, cwd, timeoutMs, login) {
             clearTimeout(timer);
             stdout += stdoutDecoder.end();
             stderr += stderrDecoder.end();
-            resolve({ code, stdout, stderr: err ?? stderr, timedOut, durationMs: Date.now() - startedAt });
+            resolve({ code, stdout, stderr: err ?? stderr, timedOut, durationMs: Date.now() - startedAt, capacity });
         };
         const timer = setTimeout(() => {
             timedOut = true;
@@ -170,7 +224,7 @@ function shell(cmd, cwd, timeoutMs, login) {
             // Bounded, and the bound is what makes a persisting shortage a REPORTED failure rather than a
             // wedged daemon: past it the caller gets the refusal's own text under exit 127, as before.
             if (n >= SPAWN_ATTEMPT_LIMIT) {
-                return { code: 127, stdout: "", stderr: String(r.refused), durationMs: Date.now() - startedAt };
+                return { code: 127, stdout: "", stderr: String(r.refused), durationMs: Date.now() - startedAt, capacity };
             }
             await new Promise((wake) => setTimeout(wake, SPAWN_RETRY_BACKOFF_MS * n));
         }

package/dist/run/journal.d.ts

@@ -29,6 +29,11 @@ export declare const ATTEMPT_CAP_RELEASE: "attempt-cap";
 export declare const GATE_SATISFIED_RELEASE: "gate-satisfied";
 export declare const REVIEW_UPHELD_RELEASE: "review-upheld";
 export declare const RECHECK_RELEASE: "recheck";
+export interface PreservedRef {
+    ref: string;
+    diffCommand: string;
+}
+export declare function preservedRefsByTask(events: JournalEvent[]): Map<string, PreservedRef[]>;
 export declare function reviewRoundsSinceApproval(events: JournalEvent[], taskId: string): number;
 export declare function upheldFeedbackByTask(events: JournalEvent[]): Map<string, string>;
 export interface StructuredFinding {
@@ -36,6 +41,7 @@ export interface StructuredFinding {
     path: string;
     symbol: string;
     note: string;
+    rationale?: string;
     fingerprint: string;
 }
 export declare const UNIDENTIFIED = "<unidentified>";
@@ -52,6 +58,15 @@ export declare const UNIDENTIFIED = "<unidentified>";
  * normalized words (see toFinding).
  */
 export declare function structuredFindings(gate: string, details: string, _scopeFiles?: string[]): StructuredFinding[];
+export declare function isDeferredFinding(finding: StructuredFinding): boolean;
+/**
+ * The findings a PASSING review DEFERRED — the rows a blocking-only projection drops on the floor.
+ * A passing review's details are prose; without this the deferral has no identity a later round can
+ * match, and every structured reader of the journal is blind to a defect the reviewer itself named.
+ */
+export declare function deferredReviewFindings(details: string): StructuredFinding[];
+/** The exact review.ts details fragment represented by a structured review finding. */
+export declare function renderStructuredReviewFinding(finding: StructuredFinding): string;
 export interface PriorRunJournal {
     runId: string;
     events: JournalEvent[];
@@ -126,6 +141,19 @@ export declare function journaledFailureBrief(events: JournalEvent[], taskId: st
  * finding was dropped at the exact moment the operator paid for another attempt to fix it. A review
  * that DECLINED (`skipped`) is not a verdict and neither adds nor retires — fail closed. Findings are
  * keyed by fingerprint, so a reviewer restating one across rounds carries it once, not once per round.
+ *
+ * v2.1.5 T2: a passing review settles the findings it BLOCKED on. It does not settle the ones it
+ * DEFERRED — those it saw, declined to block on, and recorded a rationale for, and nothing has fixed
+ * them. So a pass retires the blocking set and re-seats its own deferrals, and the two retirements
+ * stay distinguishable: the blocking finding is gone, the deferral travels on as accepted work.
+ *
+ * A deferral's bound is the SAME single release as a blocking finding's — the operator accepting the
+ * review gate itself (`GATE_SATISFIED_RELEASE` stamped `gate: "review"`), the one approval in which a
+ * human actually looked at what the reviewer waved through. It is deliberately NOT bounded by a round
+ * count or by a time window: both retire a finding by arithmetic nobody read, which is the silent drop
+ * this fold exists to refuse. Nor can it accumulate — a reviewer restating the same path/note round
+ * after round re-seats ONE fingerprint, and a revised rationale replaces the prior rationale on that
+ * row. N rounds of the same concern therefore carry the newest accepted explanation once, not N rows.
  */
 export declare function outstandingReviewFindings(events: JournalEvent[], taskId: string): StructuredFinding[];
 /** The findings a funded repair must carry into the next dispatch, or undefined if none is pending. */

package/dist/run/journal.js

@@ -2,7 +2,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
-import { channelKey, TokenUsageSchema } from "../adapters/types.js";
+import { channelKey, shq, TokenUsageSchema } from "../adapters/types.js";
 import { stateDirName, taskContentDigest, tickmarkrDir } from "../graph/graph.js";
 import { GATE_NAMES, TIERS } from "../graph/schema.js";
 import { buildProfile, classify } from "../route/profile.js";
@@ -56,6 +56,24 @@ export const REVIEW_UPHELD_RELEASE = "review-upheld";
 // so the corrected declaration is the thing that earns the green. Budget semantics match attempt-cap
 // (fresh attempts, tried survives) because the park cost the task its remaining budget.
 export const RECHECK_RELEASE = "recheck";
+// OBS-738: one authority for every recovery surface. The ref is accepted only from the row that
+// preservation itself writes; task-human prose, branch heads and commit history are deliberately
+// absent from this fold. Keep every row in journal order — one task can be recreated more than once,
+// and the terminal record owes the operator every resulting recovery handle, not merely the newest.
+export function preservedRefsByTask(events) {
+    const byTask = new Map();
+    for (const event of events) {
+        if (event.event !== "worktree-preserved" || !event.taskId || typeof event.data.ref !== "string"
+            || event.data.ref === "")
+            continue;
+        const ref = event.data.ref;
+        byTask.set(event.taskId, [
+            ...(byTask.get(event.taskId) ?? []),
+            { ref, diffCommand: `git diff ${shq(`${ref}^!`)}` },
+        ]);
+    }
+    return byTask;
+}
 // OBS-189: review rounds are scoped to the current ENGAGEMENT — the stretch since the newest operator
 // approval for the task. A whole-journal count re-parks an upheld task before its funded attempt can
 // dispatch (measured live on run-20260726-213539), making a fresh journal the only escape. A T15
@@ -114,10 +132,11 @@ export function upheldFeedbackByTask(events) {
 // for a resolved one is the silent-lie shape the gates exist to refuse, so the field says so outright.
 export const UNIDENTIFIED = "<unidentified>";
 const ANCHORED_RE = /^- (\S+?):(\d+) — (.*)$/; // "## Anchored review" rows (llm.ts)
-const REVIEW_ROW_RE = /^- \[([^\]]+)\] (.*)$/; // "- [material] …" (review.ts)
+const REVIEW_ROW_START_RE = /^- \[([^\]\r\n]+)\] /gm; // "- [material] …" (review.ts)
 const JUDGE_ROW_RE = /^✗ ([\w.-]+): (.*)$/; // "✗ c1: …" (acceptance.ts) — id, then reason
 const PATH_RE = /\b((?:[\w.@~+-]+\/)+[\w.@~+-]+\.\w{1,6})\b/;
 const LINE_REF_RE = /(:\d+(?::\d+)?\b)|(\bline \d+\b)/gi;
+const REVIEW_RATIONALE_SEPARATOR = " — rationale: ";
 // ponytail: repo-relative tail from the first known top-level directory — enough to make an absolute
 // worktree path and its repo-relative twin the same identity. Widen the marker list if a run ever
 // names findings outside these roots.
@@ -143,10 +162,46 @@ function identifierIn(note) {
 // code identity still has one stable identity of its own: its own words, with the volatile tokens
 // swept out so line/path churn cannot mint a new symbol for the same finding. It is the reviewer's
 // own bytes, never a guess, and it can never fuse two different findings into one.
-function toFinding(cls, note, path, symbol) {
+function toFinding(cls, note, path, symbol, rationale) {
     const p = path || UNIDENTIFIED;
     const s = symbol || normalizeGateFailure(note) || UNIDENTIFIED;
-    return { class: cls, path: p, symbol: s, note, fingerprint: `${cls}|${p}|${s}` };
+    return {
+        class: cls, path: p, symbol: s, note,
+        ...(rationale !== undefined ? { rationale } : {}),
+        fingerprint: `${cls}|${p}|${s}`,
+    };
+}
+/**
+ * Decode review.ts's row rendering without treating physical lines as findings. A review finding's
+ * note and rationale are JSON strings before rendering and may therefore contain newlines; the next
+ * typed row (or the anchored-review block) is the record boundary. The fixed rationale separator is
+ * removed before identity is computed, so changing only why a concern was accepted re-seats it.
+ */
+function reviewDetailFindings(details) {
+    const anchoredAt = details.indexOf("\n\n## Anchored review");
+    let prose = anchoredAt === -1 ? details : details.slice(0, anchoredAt);
+    const inconsistencyAt = prose.search(/\nreview (?:finding|verdict) inconsistent:/);
+    if (inconsistencyAt !== -1)
+        prose = prose.slice(0, inconsistencyAt);
+    const starts = [...prose.matchAll(REVIEW_ROW_START_RE)];
+    return starts.map((start, i) => {
+        const contentStart = start.index + start[0].length;
+        const contentEnd = starts[i + 1]?.index ?? prose.length;
+        let content = prose.slice(contentStart, contentEnd);
+        // The newline before the next typed row is framing, while every earlier newline belongs to the
+        // reviewer's field. At EOF/anchored-review there is no framing newline to remove.
+        if (starts[i + 1] && content.endsWith("\n"))
+            content = content.slice(0, -1);
+        const deferred = String(start[1]).startsWith("deferred/");
+        const separatorAt = deferred ? content.indexOf(REVIEW_RATIONALE_SEPARATOR) : -1;
+        return separatorAt === -1
+            ? { label: start[1], note: content }
+            : {
+                label: start[1],
+                note: content.slice(0, separatorAt),
+                rationale: content.slice(separatorAt + REVIEW_RATIONALE_SEPARATOR.length),
+            };
+    });
 }
 /**
  * Structured findings for a BLOCKING review/judge gate result, parsed from the details the gate
@@ -163,24 +218,22 @@ function toFinding(cls, note, path, symbol) {
 export function structuredFindings(gate, details, _scopeFiles = []) {
     const lines = details.split("\n");
     const rows = [];
-    const push = (cls, note, ownPath, fallbackSymbol = "") => {
+    const push = (cls, note, ownPath, fallbackSymbol = "", rationale) => {
         const own = canonicalPath(ownPath || PATH_RE.exec(note)?.[1] || "");
         const sym = identifierIn(note) || fallbackSymbol;
-        rows.push(toFinding(cls, note, own, sym));
+        rows.push(toFinding(cls, note, own, sym, rationale));
     };
+    if (gate === "review") {
+        for (const finding of reviewDetailFindings(details)) {
+            push(`review:${finding.label}`, finding.note, "", "", finding.rationale);
+        }
+    }
     for (const line of lines) {
         const a = ANCHORED_RE.exec(line);
         if (a) {
             push(`${gate}:anchored`, a[3], a[1]);
             continue;
         }
-        if (gate === "review") {
-            const r = REVIEW_ROW_RE.exec(line);
-            if (r) {
-                push(`review:${r[1]}`, r[2], "");
-                continue;
-            }
-        }
         if (gate === "acceptance") {
             const j = JUDGE_ROW_RE.exec(line);
             // the criterion id IS a stable symbol for an unmet acceptance criterion — the same criterion is
@@ -197,6 +250,29 @@ export function structuredFindings(gate, details, _scopeFiles = []) {
     }
     return rows;
 }
+// v2.1.5 T2: the reviewer's DEFERRAL channel, kept structured. `classifyReviewFindings`
+// (gates/review.ts) renders a deferred finding as `- [deferred/<severity>] <note> — rationale: …`.
+// The parser above preserves multiline fields and separates rationale from identity; an older journal
+// whose row holds only prose still degrades through the same parse rather than to nothing. A deferred
+// finding is a concern the reviewer SAW and chose not to block on; it is not a concern that was fixed.
+const DEFERRED_CLASS_RE = /^review:deferred\b/;
+export function isDeferredFinding(finding) {
+    return DEFERRED_CLASS_RE.test(finding.class);
+}
+/**
+ * The findings a PASSING review DEFERRED — the rows a blocking-only projection drops on the floor.
+ * A passing review's details are prose; without this the deferral has no identity a later round can
+ * match, and every structured reader of the journal is blind to a defect the reviewer itself named.
+ */
+export function deferredReviewFindings(details) {
+    return structuredFindings("review", details).filter(isDeferredFinding);
+}
+/** The exact review.ts details fragment represented by a structured review finding. */
+export function renderStructuredReviewFinding(finding) {
+    const label = finding.class.startsWith("review:") ? finding.class.slice("review:".length) : finding.class;
+    const rationale = finding.rationale === undefined ? "" : `${REVIEW_RATIONALE_SEPARATOR}${finding.rationale}`;
+    return `- [${label}] ${finding.note}${rationale}`;
+}
 const findingRows = (event, gate) => {
     if (Array.isArray(event.data.findings)) {
         const rows = event.data.findings.filter((finding) => {
@@ -205,6 +281,7 @@ const findingRows = (event, gate) => {
             const row = finding;
             return typeof row.class === "string" && typeof row.path === "string"
                 && typeof row.symbol === "string" && typeof row.note === "string"
+                && (row.rationale === undefined || typeof row.rationale === "string")
                 && typeof row.fingerprint === "string";
         });
         if (rows.length > 0)
@@ -509,6 +586,19 @@ export function journaledFailureBrief(events, taskId) {
  * finding was dropped at the exact moment the operator paid for another attempt to fix it. A review
  * that DECLINED (`skipped`) is not a verdict and neither adds nor retires — fail closed. Findings are
  * keyed by fingerprint, so a reviewer restating one across rounds carries it once, not once per round.
+ *
+ * v2.1.5 T2: a passing review settles the findings it BLOCKED on. It does not settle the ones it
+ * DEFERRED — those it saw, declined to block on, and recorded a rationale for, and nothing has fixed
+ * them. So a pass retires the blocking set and re-seats its own deferrals, and the two retirements
+ * stay distinguishable: the blocking finding is gone, the deferral travels on as accepted work.
+ *
+ * A deferral's bound is the SAME single release as a blocking finding's — the operator accepting the
+ * review gate itself (`GATE_SATISFIED_RELEASE` stamped `gate: "review"`), the one approval in which a
+ * human actually looked at what the reviewer waved through. It is deliberately NOT bounded by a round
+ * count or by a time window: both retire a finding by arithmetic nobody read, which is the silent drop
+ * this fold exists to refuse. Nor can it accumulate — a reviewer restating the same path/note round
+ * after round re-seats ONE fingerprint, and a revised rationale replaces the prior rationale on that
+ * row. N rounds of the same concern therefore carry the newest accepted explanation once, not N rows.
  */
 export function outstandingReviewFindings(events, taskId) {
     const open = new Map();
@@ -522,8 +612,18 @@ export function outstandingReviewFindings(events, taskId) {
         }
         if (e.event !== "gate-result" || e.data.gate !== "review" || e.data.skipped === true)
             continue;
-        if (e.data.pass !== false)
-            open.clear(); // a later review PASSED on this task: nothing is outstanding
+        if (e.data.pass !== false) {
+            // a later review PASSED on this task: every finding it BLOCKED on is settled …
+            for (const [key, finding] of open)
+                if (!isDeferredFinding(finding))
+                    open.delete(key);
+            // … and no deferral is, whether or not this pass restated it. A pass is silent about a
+            // deferral it does not mention: the concern is unfixed either way, and the reviewer that
+            // waved it through is not the release that accepts it. Retiring on omission would drop it on
+            // the very next round — the same silent drop by a different door.
+            for (const finding of findingRows(e, "review").filter(isDeferredFinding))
+                open.set(finding.fingerprint, finding);
+        }
         else
             for (const finding of findingRows(e, "review"))
                 open.set(finding.fingerprint, finding);
@@ -987,19 +1087,36 @@ export class Journal {
             ? undefined
             : DecisionEventSchema.parse({ ...eventOrDecision, ts: new Date().toISOString() });
         const event = decisionRow?.event ?? eventOrDecision;
+        const rowTaskId = decisionRow && "taskId" in decisionRow ? decisionRow.taskId : taskId;
         const inputData = decisionRow?.data ?? data;
+        // OBS-738: terminal and resume records reduce the journal that precedes them. Neither re-derives
+        // recovery facts from task-human prose: preserved refs come from preservedRefsByTask, and the
+        // upheld brief comes from the established prompt/replay reducer.
+        const priorEvents = event === "run-end" || event === "resume-restore" ? this.read() : [];
+        const reducedData = event === "run-end"
+            ? (() => {
+                const preservedRefs = [...preservedRefsByTask(priorEvents)].flatMap(([preservedTaskId, refs]) => refs.map(({ ref, diffCommand }) => ({ taskId: preservedTaskId, ref, diffCommand })));
+                return preservedRefs.length > 0 ? { ...inputData, preservedRefs } : inputData;
+            })()
+            : event === "resume-restore" && rowTaskId && upheldFeedbackByTask(priorEvents).has(rowTaskId)
+                ? {
+                    ...inputData,
+                    upheldFeedbackRestoredFor: rowTaskId,
+                    summary: `upheld feedback restored for ${rowTaskId}`,
+                }
+                : inputData;
         const evidence = judgePersistence.getStore();
         const failed = evidence?.invocations.filter((invocation) => invocation.transcript !== undefined) ?? [];
         const persistedData = event === "judge-retry" && failed.length > 0
             ? {
-                ...inputData,
+                ...reducedData,
                 transcript: failed[0].transcript,
                 ...(failed[1] ? { retryTranscript: failed[1].transcript } : {}),
             }
-            : inputData;
-        const row = decisionRow ?? {
-            ts: new Date().toISOString(), event, ...(taskId ? { taskId } : {}), data: persistedData,
-        };
+            : reducedData;
+        const row = decisionRow
+            ? { ...decisionRow, data: persistedData }
+            : { ts: new Date().toISOString(), event, ...(taskId ? { taskId } : {}), data: persistedData };
         // T3 secret redaction: only the persisted bytes are masked — the caller's data stays untouched in
         // memory. The narrator receives the persisted (masked) row so a pane sink never shows a credential.
         const line = redactSecrets(JSON.stringify(row));

package/dist/run/merge.js

@@ -3,7 +3,7 @@ import { join } from "node:path";
 import { shq } from "../adapters/types.js";
 import { ceilingKillResult, classifyFailureOutput, effectiveCeilingMs, fingerprint, freshFailures, } from "../gates/baseline.js";
 import { tickmarkrDir } from "../graph/graph.js";
-import { gitHead, linkNodeModules, resolveIntegrationBranch, sh, shGit, shGitOk, WORKTREES_DIR } from "./git.js";
+import { describeCapacity, gitHead, linkNodeModules, resolveIntegrationBranch, sameCapacity, sh, shGit, shGitOk, WORKTREES_DIR } from "./git.js";
 export function integrationBranch(cfg, runId) {
     return `${cfg.integrationBranchPrefix}${runId}`;
 }
@@ -99,7 +99,13 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
         // Battery parity on the infra rule too (T9): infrastructure-only output means the runner never
         // completed a suite — nothing was verified, so nothing is forgivable, however familiar its
         // fingerprints. Stricter-than-battery edge kept: unreadable output never forgives.
-        const forgiven = r.code !== 0 && baselineRed && failing.length === 0 && !unreadable && cause !== "infra";
+        // T7: the SECOND reader of a baseline entry, and the same rule as the battery's (baseline.ts).
+        // Evidence crosses a session boundary here — the capture that would forgive this red is very
+        // often the previous session's — so a capture taken under a different resolved capacity forgives
+        // nothing at the tip either. An absent capacity is a pre-T7 baseline and keeps today's verdict.
+        const comparable = sameCapacity(entry?.capacity, r.capacity);
+        const forgiven = r.code !== 0 && baselineRed && failing.length === 0 && !unreadable && cause !== "infra"
+            && comparable;
         const pass = r.code === 0 || forgiven;
         if (!pass)
             writeFileSync(artifact, raw);
@@ -111,7 +117,11 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
             fingerprints: r.code !== 0 ? fingerprint(stripped) : [],
             details: r.code === 0 ? "exit 0"
                 : forgiven ? `exit ${r.code} but only baseline-recorded failures (forgiven vs baseline)`
-                    : `exit ${r.code}`,
+                    : !comparable && baselineRed && failing.length === 0
+                        ? `exit ${r.code}; every failure is baseline-recorded, but that capture ran under `
+                            + `${describeCapacity(entry?.capacity)} and this verification ran under ${describeCapacity(r.capacity)} `
+                            + `— forgiveness across a changed capacity is not evidence`
+                        : `exit ${r.code}`,
             ...(forgiven ? { forgiven: true } : {}),
             ...(cause ? { cause } : {}),
             ...(pass ? {} : { artifact }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.1.4",
+  "version": "2.1.6",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-overseer/SKILL.md

@@ -103,7 +103,7 @@ through brief lineage. **An executor choice nobody made is still an executor cho
    fraction (`ORCH · v1.19 4/5`, updated on every task-done); tickmarkr opens ONE TAB PER TASK, labelled
    with the task id and holding that task's worker plus its judge/review/consult panes (tickmarkr
    updates it). Never long context strings or ✓-chains.
-2. **Orchestrator**: Launch the orchestrator with your agent host. Spawning on current herdr is two-step — the one-shot `agent start --cwd` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138): first create the pane with `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` and parse `result.root_pane.pane_id` from its JSON, then start the agent in it. For Claude Code, use `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions` (append `--model <m>` after the `--` if the operator has a policy). For Codex, use `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` (add `--model <m>` to specify the model). The unsandboxed flag is REQUIRED: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation — do not downgrade it. Workers you never spawn — tickmarkr spawns its own visible worker panes. Auxiliary agents you do spawn (consultants, reviewers, scouts) follow the same forms: never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions --settings '{"promptSuggestionEnabled":false}'`, and a read-only codex consultant may use `--sandbox read-only`. **That `--settings` pair is not cosmetic and it is not optional:** claude-code's AUTOSUGGEST renders context-plausible ghost text into an idle seat's prompt line that is BYTE-IDENTICAL to a typed draft in text-format reads (OBS-482), so a supervising tier cannot tell a seat's own unsent work from a rendering artifact without `agent read --format ansi`. Turning the suggester off at spawn removes the ambiguity at its source instead of paying for the discrimination at every read. Verified against the shipped binary: `claude --settings '{"promptSuggestionEnabled":false}' -p …` exits 0 with a real response, and the key appears in the binary's own settings schema. **For kimi, pass `-y`** (`herdr agent start <name> --kind kimi --pane <id> -- -y`) — the adapter already launches its own workers that way (`src/adapters/kimi.ts:204`), and a kimi seat spawned without it sits on an approval prompt having done nothing. **Herdr cannot see that state**: it reports a kimi pane as `agent_status: working` with `screen_detection_skipped: true` while the prompt is up, so the BLOCKED-STATE watcher below is blind on this vendor and the spawn flag is the ONLY control. Every vendor you spawn needs its auto-approve form named here; a vendor absent from this list is a seat that will hang.
+2. **Orchestrator**: Launch the orchestrator with your agent host. Spawning on current herdr is two-step — the one-shot `agent start --cwd` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138): first create the pane with `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` and parse `result.root_pane.pane_id` from its JSON, then start the agent in it. For Claude Code, use `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions` (append `--model <m>` after the `--` if the operator has a policy). For Codex, use `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` (add `--model <m>` to specify the model). The unsandboxed flag is REQUIRED: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation — do not downgrade it. Workers you never spawn — tickmarkr spawns its own visible worker panes. Auxiliary agents you do spawn (consultants, reviewers, scouts) follow the same forms: never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions --settings '{"promptSuggestionEnabled":false}'`. **For a codex consultant, use `-a never --sandbox workspace-write` — NOT `--sandbox read-only`.** ⚠ **`--sandbox read-only` CONTRADICTS this skill's own completion protocol and will hang the seat.** Every seat you spawn is told to deliver an ARTIFACT ending in a terminal MARKER, because that is the only completion signal the artifact watcher can key on (`done` is turn end). A read-only sandbox cannot write that artifact, so codex blocks on `Would you like to make the following edits?` for its OWN report — and the report exists ONLY in the pending edit, so abandoning the prompt destroys the work rather than merely delaying it. Measured 2026-08-28: a consultant spawned `--sandbox read-only` finished a 14,604-byte verdict, sat blocked on the write, and the operator saw the prompt before the supervising tier did. `read-only` is correct ONLY for a seat that writes nothing at all — which, under the artifact+marker rule, is no seat this skill tells you to spawn. When the prompt does appear, answer **"Yes, and don't ask again for these files"** rather than plain yes: plain yes re-blocks on the next write of the same file. **That `--settings` pair is not cosmetic and it is not optional:** claude-code's AUTOSUGGEST renders context-plausible ghost text into an idle seat's prompt line that is BYTE-IDENTICAL to a typed draft in text-format reads (OBS-482), so a supervising tier cannot tell a seat's own unsent work from a rendering artifact without `agent read --format ansi`. Turning the suggester off at spawn removes the ambiguity at its source instead of paying for the discrimination at every read. Verified against the shipped binary: `claude --settings '{"promptSuggestionEnabled":false}' -p …` exits 0 with a real response, and the key appears in the binary's own settings schema. **For kimi, pass `-y`** (`herdr agent start <name> --kind kimi --pane <id> -- -y`) — the adapter already launches its own workers that way (`src/adapters/kimi.ts:204`), and a kimi seat spawned without it sits on an approval prompt having done nothing. **Herdr cannot see that state**: it reports a kimi pane as `agent_status: working` with `screen_detection_skipped: true` while the prompt is up, so the BLOCKED-STATE watcher below is blind on this vendor and the spawn flag is the ONLY control. Every vendor you spawn needs its auto-approve form named here; a vendor absent from this list is a seat that will hang.
 3. **Standing instructions travel as a brief FILE, never as pane text** — PTY input truncates at ~1024B and a
    truncated brief silently drops policy. Write the full brief to `<repo>/.tickmarkr/overseer/ORCH-BRIEF.md`
    (inside the tickmarkr state dir — already self-gitignored, no exclude step needed), then send one line:
@@ -249,6 +249,111 @@ detect: **the ruling would have made the worker commit the violation the task wa
 
 ### Context is a supervised resource, for BOTH tiers
 
+**THE TIERS CLEAR EACH OTHER AT 50%. Neither tier clears itself on its own notice.** Operator directive,
+2026-08-28, and it exists because **a seat cannot reliably observe its own exhaustion** — the seat that
+most needs clearing is the one least able to notice, and this project has now measured that three ways:
+an overseer ran nine hours at 86% unable to read its own number; a context watcher went **alive and blind**
+when the run's own status text pushed the percentage off the statusline; and an orchestrator went
+**366k → 970k of 1M between two checks** while its ACT wake sat unread in a detached log.
+
+The protocol, in both directions:
+
+1. **Overseer sees orch at ≥50%** → nudge it: write `HANDOFF-ORCH-<ver>.md`, then `/clear`, then re-read
+   its brief **and** its handoff, then **re-arm every watcher it listed** (a cleared session has none).
+2. **The returning orch, now fresh, checks the OVERSEER.** If the overseer is at ≥50%, it directs the
+   overseer to write its handoff and clear, and **points it at `HANDOFF-OVERSEER-<ver>.md` by path**.
+3. Whichever seat is fresh performs the check. **Never both at once** — the run keeps one supervising tier
+   at all times, and the seat holding the endgame goes second.
+4. **The duty to clear the other tier must SURVIVE a clear**, so it belongs in BOTH handoff files as a
+   standing re-arm item — not only in the message that ordered it. Earned 2026-08-28: the orchestrator
+   performed the check on the overseer BEFORE its own clear, precisely because clearing first would have
+   wiped the instruction to do it, and its handoff did not record the duty.
+5. **A seat cannot `/clear` ITSELF — so the OTHER TIER SENDS IT.** `/clear` is a CLI command typed into a
+   session and no tool invokes it in your own pane, but it is just text in someone else's: the partner
+   tier types it into your pane. **This is the whole reason the protocol is mutual**, and it means the
+   loop closes without the operator. The exchange, both directions, in this exact order:
+
+   ```bash
+   # 1. the seat crossing 50% writes its handoff FIRST, ending with its terminal marker
+   # 2. it asks the partner, naming its own pane and handoff path:
+   herdr pane run <partner> "I am at <N>%. Clear me: send /clear to <my-pane>, then point me at <my-handoff>."
+   # 3. the PARTNER sends the clear, then VERIFIES before pointing:
+   herdr pane run <my-pane> "/clear"
+   #    read the pane back — a cleared claude session shows an empty prompt and a reset context gauge
+   # 4. and only THEN, as a SEPARATE send, the re-orientation:
+   herdr pane run <my-pane> "You were cleared at <N>%. Read <handoff> and <brief>, re-arm EVERY watcher
+   they name — a cleared session has none — then confirm you are back."
+   ```
+
+   ⚠ **Steps 3 and 4 are two sends, never one.** A pointer batched with the clear lands *during* it and is
+   lost with the context it was meant to survive. Verify the clear landed by reading the prompt line
+   before sending the pointer — the same read-back every other send in this skill requires.
+   ⚠ **The partner must not clear itself in the same window.** One supervising tier stays live at all
+   times; the seat holding the endgame goes second.
+   ⚠ **Step 4 must state an EXPECTED-RETURN DEADLINE**, e.g. *"confirm you are back within 10 minutes."*
+   A clear order without one is an unbounded wait: see rule 6.
+
+6. **THE RETURN LEG — the returning seat's FIRST act after re-arming is a verified notice to its partner.**
+   Not its second, not once the next milestone lands. **Measured 2026-08-28 (OBS-743):** an overseer cleared
+   at 00:05Z, was back at 00:07Z, *read the orchestrator's pane at 00:10Z to take its percentage* — and said
+   nothing. The orchestrator's last line had been *"T7 is mine until you're back."* It then held the task
+   alone for **53 minutes** across a reviewer flake, a retry, a merge and the whole tip verify, with no
+   signal that its supervising tier existed. The notice went out only because the operator noticed the gap.
+
+   **A one-way read is not a handshake.** The adopt step tells you to READ the partner's pane, which feels
+   like contact and transmits nothing — that is exactly how this gets skipped by a seat following the
+   protocol correctly.
+
+   The notice is ONE line (a newline submits early), sent with `herdr pane run` and **read back**, and it
+   carries four things:
+   ```bash
+   herdr pane run <partner> "RETURN NOTICE <seat>: back on <my-pane> since <HH:MM>Z. WATCHERS I NOW HOLD:
+   <list>. SWEPT: <what was dead>. MISSION STATE AS I READ IT: <one clause>. Reply with every watcher YOU
+   still hold so we deconflict — do not arm anything I just named."
+   ```
+   - **where and since when**, so the partner can stop holding your duties;
+   - **the watcher inventory you now hold** — coverage is the thing both tiers silently assume about each
+     other, and a returning seat that re-arms without saying so produces double-coverage that reads as
+     redundancy and is actually two tiers each trusting the other;
+   - **anything you swept**, because a dead watcher the partner armed is *its* belief about coverage, not
+     yours, and it will keep believing it;
+   - **an explicit deconfliction request.** Ask for the partner's inventory back; do not infer it.
+
+   ⚠ **RE-ADOPT EVERY DETACHED WATCHER ON RETURN, and prove it from disk.** A detached watcher (`ppid 1`)
+   is the one kind that SURVIVES your clear, which is exactly why it rots unattended: `stat` its heartbeat
+   and treat **stale as dead**. Measured the same morning (OBS-742): a detached resolution watcher's
+   heartbeat was **157 minutes stale** and the task it existed to report had resolved **2h04m after its
+   last beat** — present, silent, and indistinguishable from healthy to anyone who did not look. Sweep it,
+   archive the heartbeat rather than deleting it so the gap stays measurable, and name it in the notice.
+
+   ⚠ **A CLEAR AND A DEATH ARE THE SAME SILENCE.** A seat that clears and never returns — wrong pane,
+   crashed host, operator closed the tab — is indistinguishable from one mid-`/clear`. That is why step 4
+   states a deadline: **partner silent past it → escalate to the operator.** Without the deadline the
+   protocol's most dangerous state has no timeout, and the surviving tier waits forever on a peer that no
+   longer exists.
+
+⚠ **`∑ NNNk tok` ON A CLAUDE STATUSLINE IS CUMULATIVE SESSION SPEND, NOT CONTEXT FILL.** The percentage
+is the fill; the token total is what has been spent across every turn and keeps climbing after a compaction
+or a clear. **Measured 2026-08-28, expensively:** this seat built a fallback watcher on `∑ Nk tok`, read
+`970k` as 97% of a 1M window, and sent an urgent clear-order to an orchestrator that was actually at
+**33%** — which then began a handoff and offered to discard a session two-thirds fresh, mid-endgame.
+**Read the `%`. Never derive fill from the token total, and never build an instrument on a signal whose
+SEMANTICS you have not verified against a second source.**
+
+**Why 50% and not 85%:** a handoff written at 50% is written by a seat whose judgment is intact. One
+written at 85% is written by a seat already degraded, about the decisions it is least able to summarise.
+The threshold buys judgment, not headroom.
+
+**Why the OTHER tier issues it:** a self-issued clear competes with whatever the seat is doing and loses.
+An instruction from the other tier arrives as work, and the tier issuing it is not the tier that has to
+overcome its own momentum to obey.
+
+⚠ **A detached watcher gives COVERAGE and takes away NOTIFICATION.** A wake written to a log file that no
+seat reads is not a wake. If the watcher must outlive a turn, it also needs a path that reaches a seat —
+a beat the other tier reads, a notification, or an artifact the other tier watches. **Measured 2026-08-28:
+`ACT: orch-215 at 970k/1000k — handoff + /clear NOW` fired correctly and sat unread in a scratchpad log
+while the orchestrator kept working.**
+
 Arm a context watcher on the orchestrator at spawn time and treat a threshold wake as a first-class event:
 finish the step, write a handoff, `/clear` **plus a fresh brief — never `/compact`**, because a compaction
 is a lossy summary nobody trusts while a clean session re-oriented from disk-verifiable state is reliable.
@@ -257,8 +362,9 @@ good, not after. If your own context cannot be read by the watcher, say so to th
 number — an unmeasured budget is not a small budget.
 
 ```bash
-.claude/skills/tickmarkr-overseer/scripts/watch-context.sh orchestrator <orchestrator-agent-or-pane> 60 75 <handoff-file>
-.claude/skills/tickmarkr-overseer/scripts/watch-context.sh overseer <overseer-agent-or-pane> 60 75 <handoff-file>
+# WARN 50 / ACT 50 — the mutual-clear threshold above, not a headroom alarm.
+.claude/skills/tickmarkr-overseer/scripts/watch-context.sh orchestrator <orchestrator-agent-or-pane> 50 50 <handoff-file>
+.claude/skills/tickmarkr-overseer/scripts/watch-context.sh overseer <overseer-agent-or-pane> 50 50 <handoff-file>
 ```
 
 The first argument chooses the closed per-seat tier (`orchestrator-context` or `overseer-context`),
@@ -947,6 +1053,17 @@ twice.** They are mission-independent on purpose: nothing here names a task, a l
     concluded both forms were valid. The tell is unavailable unless the tool volunteers it. Corollary —
     an instrument that takes an input must be handed a DELIBERATELY BAD one before its clean runs are
     worth anything (rule 11 applied to tools, not just to gates).
+    ⚠ **AND THE COMMONEST WRONG INPUT IS A BASE REF: after the first merge, a task's diff against the
+    run's `baseRef` is NEVER that task's diff.** Workers branch from the INTEGRATION TIP, so once any task
+    has merged, `git diff baseRef..HEAD` in a later worktree reports that task PLUS every task merged
+    before it, and the number looks entirely plausible. Diff from the task's OWN base — the integration
+    commit it branched from — and say which base you used whenever you quote a size.
+    **Measured 2026-08-28 in one run, twice, in both directions.** A supervising seat quoted "712
+    insertions across 7 files" for a task whose real contribution was **300 across 2**; the surplus was two
+    other tasks' merged work. On the next task the same trap was **larger** — 920 across 11 versus a true
+    167 across 4 — and it was caught only because the other tier had just been burned by it. A scope
+    judgement, a cost claim, or a review-size argument built on the baseRef diff is measuring three tasks
+    and calling it one.
 14. **A unit is not a measurement.** A configured timeout is a KILL CEILING, not a duration — never compare
     it to a wall clock or quote it to an operator as an estimate.
 15. **Verify through the path that LOADS, not the path you edited.** Mirrored trees and symlinks mean your