tickmarkr 2.1.5 → 2.1.7

package/dist/run/supervision.js

@@ -14,8 +14,8 @@ import { stateDirName, tickmarkrDir } from "../graph/graph.js";
 //
 // SUP-02: the beat mtime is the ONLY input. Nothing here reads a process table and nothing matches a
 // process name — a poll-grep watcher carries `grep` in its own argv, so the filter that removes the
-// probing grep removes the watched one. The payload records a pid for an OPERATOR to read off a STALE
-// record; the derivation never consults it, so a reused, dead or unreadable pid changes no state.
+// probing grep removes the watched one. The payload's exitedWriterPid identifies the one-shot writer
+// for an OPERATOR reading a STALE record; no derivation consults it, so its value changes no state.
 // Zero new deps — node:fs stdlib, exactly as lock.ts.
 /** How often a watcher rewrites its own tier's beat. */
 export const SUPERVISION_BEAT_MS = 10_000;
@@ -27,6 +27,8 @@ export const SUPERVISION_STALE_MS = 6 * SUPERVISION_BEAT_MS;
 // millisecond into the future. A second of slack covers even a coarse filesystem. Anything past it
 // is SKEW, and skew is the one direction this instrument may not fail in: see readTierLiveness.
 export const SUPERVISION_FUTURE_GRACE_MS = 1_000;
+/** Context watchers act at 75% unless their invocation declares another threshold. */
+export const SUPERVISION_DEFAULT_THRESHOLD_PCT = 75;
 // The supervision seats this harness has. An unlisted tier is an INVISIBLE tier, which is the failure
 // mode itself — an auditor read "no watchers were ever armed" off a surface that named none. Adding a
 // seat means adding it here, and `status` then renders it whether or not it has ever beaten.
@@ -55,6 +57,8 @@ const supervisionDir = (repoRoot) => join(repoRoot, stateDirName(repoRoot), "sup
 export const supervisionBeatPath = (repoRoot, tier) => join(supervisionDir(repoRoot), `${tier}.beat`);
 /** Where a watcher records that it STOOD DOWN. Its own file: the beat keeps meaning only "alive". */
 export const supervisionStandDownPath = (repoRoot, tier) => join(supervisionDir(repoRoot), `${tier}.standdown`);
+/** The independent latch a stand-down cannot overwrite or remove. */
+const supervisionObligationPath = (repoRoot, tier) => join(supervisionDir(repoRoot), `${tier}.clear-owed`);
 // SUP-06: PRESENCE — one file per ARMED WATCHER, because a tier may legitimately have more than one.
 // Two boards watch one repo the moment an operator opens a second pane, and the tier is armed while
 // EITHER of them lives. The stand-down marker speaks for the whole tier, so the first board out
@@ -93,25 +97,102 @@ function stalePeersIfLast(repoRoot, tier, id, now = Date.now()) {
     }
     return stale;
 }
+/** Read the latch without creating, touching or repairing it. */
+function readClearObligation(repoRoot, tier) {
+    const p = supervisionObligationPath(repoRoot, tier);
+    let st;
+    try {
+        st = statSync(p);
+    }
+    catch (e) {
+        const code = e.code;
+        return code === "ENOENT" || code === "ENOTDIR" ? "NONE" : "UNREADABLE";
+    }
+    if (!st.isFile())
+        return "UNREADABLE";
+    try {
+        const rec = JSON.parse(readFileSync(p, "utf8"));
+        if (rec?.tier !== tier)
+            return "UNREADABLE";
+        if (typeof rec.clearOwedSince !== "string" || Number.isNaN(Date.parse(rec.clearOwedSince)))
+            return "UNREADABLE";
+        if (typeof rec.armId !== "string" || !rec.armId.trim())
+            return "UNREADABLE";
+        if (typeof rec.thresholdPct !== "number" || !Number.isFinite(rec.thresholdPct)
+            || rec.thresholdPct < 0 || rec.thresholdPct > 100)
+            return "UNREADABLE";
+        return { clearOwedSince: rec.clearOwedSince, armId: rec.armId, thresholdPct: rec.thresholdPct };
+    }
+    catch {
+        return "UNREADABLE";
+    }
+}
+/** Publish a crossing atomically; a firing replacement inherits the original duty's instant. */
+function raiseClearObligation(repoRoot, tier, armId, thresholdPct) {
+    const existing = readClearObligation(repoRoot, tier);
+    if (typeof existing === "object" && existing.armId === armId)
+        return;
+    if (existing === "UNREADABLE") {
+        throw new Error(`${tier} clear obligation is unreadable — refusing to overwrite a duty that may still be owed`);
+    }
+    const p = supervisionObligationPath(repoRoot, tier);
+    const tmp = `${p}.${process.pid}.${randomUUID()}.tmp`;
+    mkdirSync(dirname(p), { recursive: true });
+    writeFileSync(tmp, JSON.stringify({
+        tier, armId, thresholdPct,
+        clearOwedSince: typeof existing === "object" ? existing.clearOwedSince : new Date().toISOString(),
+    }) + "\n");
+    renameSync(tmp, p);
+}
+/** Only a different arm observed below the firing threshold proves the old seat was cleared. */
+function dischargeClearObligation(repoRoot, tier, observation) {
+    const existing = readClearObligation(repoRoot, tier);
+    if (existing === "UNREADABLE") {
+        throw new Error(`${tier} clear obligation is unreadable — refusing to erase a duty that may still be owed`);
+    }
+    if (typeof existing === "object" && existing.armId !== observation.armId
+        && observation.pct < existing.thresholdPct) {
+        rmSync(supervisionObligationPath(repoRoot, tier), { force: true });
+    }
+}
+function validateObservation(observation) {
+    if (!observation.armId.trim())
+        throw new Error("a supervision observation needs a non-empty arm identity");
+    for (const [name, value] of [["pct", observation.pct], ["threshold-pct", observation.thresholdPct]]) {
+        if (!Number.isFinite(value) || value < 0 || value > 100) {
+            throw new Error(`--${name} must be a number from 0 through 100`);
+        }
+    }
+}
 // WRITER — a watcher's own call, on its own tier, every SUPERVISION_BEAT_MS. Never a reader's: the
 // purity fence (status --watch leaves the state dir byte-identical) is the test that catches a reader
 // that beats on the watcher's behalf, which would report every dead tier as healthy.
-function writeSupervisionBeat(repoRoot, tier, seat, armId) {
+function writeSupervisionBeat(repoRoot, tier, seat, armId, observation) {
     // A seat tier may not be armed anonymously, and the refusal belongs HERE rather than only in the
     // verb: any caller that could write a seatless record could arm a tier nobody occupies.
     if (isSeatTier(tier) && !seat?.trim()) {
         throw new Error(`${tier} is a per-seat tier — a beat must declare the seat identity it speaks for`);
     }
+    if (observation !== undefined)
+        validateObservation(observation);
     tickmarkrDir(repoRoot); // the write path DOES create — beats land inside the gitignored state dir
     const p = supervisionBeatPath(repoRoot, tier);
     mkdirSync(dirname(p), { recursive: true });
+    // Raise before the beat so a later beat failure cannot hide a duty; discharge only after the
+    // below-threshold observation exists on disk.
+    if (observation !== undefined && observation.pct >= observation.thresholdPct) {
+        raiseClearObligation(repoRoot, tier, observation.armId, observation.thresholdPct);
+    }
     writeFileSync(p, JSON.stringify({
         tier, ...(seat ? { seat } : {}), ...(armId ? { armId } : {}),
-        pid: process.pid, beatAt: new Date().toISOString(),
+        ...(observation !== undefined ? { pct: observation.pct, thresholdPct: observation.thresholdPct } : {}),
+        exitedWriterPid: process.pid, beatAt: new Date().toISOString(),
     }) + "\n");
+    if (observation !== undefined)
+        dischargeClearObligation(repoRoot, tier, observation);
 }
-export function beatSupervision(repoRoot, tier, seat) {
-    writeSupervisionBeat(repoRoot, tier, seat);
+export function beatSupervision(repoRoot, tier, seat, observation) {
+    writeSupervisionBeat(repoRoot, tier, seat, undefined, observation);
 }
 // THE WATCHER-FACING ENTRY POINT — the loop SUPERVISION_BEAT_MS actually drives. A supervising seat
 // calls this once at the top of its watch and holds the handle for the duration; a seat that dies,
@@ -138,7 +219,7 @@ export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS, sea
     }
     catch { /* uncleared: the reader validates the marker and a newer beat outranks it — never masked */ }
     // This watcher's own identity fences BOTH its presence and its stand-down against every later arm.
-    // pid alone collides between two boards in one host (and after pid reuse); a UUID never aliases the
+    // A process id alone collides between two boards in one host (and after reuse); a UUID never aliases the
     // stale presence of a killed process that a later last-one-out cleanup may already have observed.
     const id = `${process.pid}.${randomUUID()}`;
     const presence = supervisionPresencePath(repoRoot, tier, id);
@@ -146,7 +227,7 @@ export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS, sea
     const mark = () => {
         try {
             writeSupervisionBeat(repoRoot, tier, seat, id); // creates the directory presence is written into
-            writeFileSync(presence, JSON.stringify({ tier, pid: process.pid, id }) + "\n");
+            writeFileSync(presence, JSON.stringify({ tier, exitedWriterPid: process.pid, id }) + "\n");
         }
         catch { /* repo gone / disk full / no seat — the tier ages out rather than crashing its watcher */ }
     };
@@ -182,7 +263,7 @@ export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS, sea
                 mkdirSync(dirname(p), { recursive: true });
                 writeFileSync(tmp, JSON.stringify({
                     tier, ...(seat ? { seat } : {}), armId: id,
-                    pid: process.pid, disarmedAt: new Date().toISOString(),
+                    exitedWriterPid: process.pid, disarmedAt: new Date().toISOString(),
                 }) + "\n");
                 renameSync(tmp, p);
             }
@@ -198,6 +279,10 @@ export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS, sea
         },
     };
 }
+/** Arm the live status board's own tier through the normal supervision writer and lifecycle. */
+export function armWatchSupervision(repoRoot, beatMs = SUPERVISION_BEAT_MS) {
+    return armSupervision(repoRoot, "watch", beatMs);
+}
 // BEAT DERIVATION — pure, and the only thing that reads the beat. One statSync: never creates,
 // touches or reaps the record it reports on, and never creates the directory that holds it. ONLY a
 // missing path is ABSENT: ENOENT (no beat file) and ENOTDIR (nothing that could hold one) mean no
@@ -206,7 +291,7 @@ export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS, sea
 // never silently ARMED. Callers wanting the TIER's state want supervisionStatus below; this answers
 // the narrower question "does the beat say alive", which is all a beat can ever say.
 export function readTierLiveness(repoRoot, tier, now = Date.now()) {
-    return beatLiveness(tier, readBeat(repoRoot, tier), now);
+    return withClearObligation(repoRoot, tier, beatLiveness(tier, readBeat(repoRoot, tier), now));
 }
 // The beat's inode, or why there is no age to derive from it. Split out so the stand-down ranking below
 // reads the SAME mtime this derivation does rather than a second, later stat of a moving record.
@@ -266,6 +351,15 @@ function beatLiveness(tier, beat, now) {
     const beatAgeMs = Math.max(0, age); // inside the grace: the two clocks' resolutions, not skew
     return { tier, state: beatAgeMs > SUPERVISION_STALE_MS ? "STALE" : "ARMED", beatAgeMs, ...named };
 }
+/** Add the independent duty without replacing or reinterpreting the watcher's state. */
+function withClearObligation(repoRoot, tier, liveness) {
+    const obligation = readClearObligation(repoRoot, tier);
+    if (obligation === "NONE")
+        return liveness;
+    return obligation === "UNREADABLE"
+        ? { ...liveness, clearOwedUnreadable: true }
+        : { ...liveness, clearOwedSince: obligation.clearOwedSince };
+}
 // A stand-down is only what a watcher RECORDED, so the record has to READ as one: a regular file whose
 // payload names this tier and the instant it stood down. Path existence is not proof — a directory, a
 // torn write or a stray file at that path says nothing about any watcher, and calling one of those a
@@ -317,15 +411,17 @@ export function supervisionStatus(repoRoot, tier, now = Date.now()) {
     const beat = readBeat(repoRoot, tier);
     const standDown = readStandDown(repoRoot, tier);
     if (standDown === "UNREADABLE")
-        return { tier, state: "UNREADABLE" };
+        return withClearObligation(repoRoot, tier, { tier, state: "UNREADABLE" });
     const beatOutranksStandDown = standDown !== "NONE" && typeof beat === "object" && (beat.mtimeMs > standDown.mtimeMs || (now - beat.mtimeMs <= SUPERVISION_STALE_MS &&
         beat.armId !== undefined && standDown.armId !== undefined && beat.armId !== standDown.armId));
     if (standDown !== "NONE" && !beatOutranksStandDown) {
         // the seat that stood down is named by the marker, falling back to whatever its last beat named
         const seat = standDown.seat ?? (typeof beat === "object" ? beat.seat : undefined);
-        return { tier, state: "DISARMED", ...(seat !== undefined ? { seat } : {}) };
+        return withClearObligation(repoRoot, tier, {
+            tier, state: "DISARMED", ...(seat !== undefined ? { seat } : {}),
+        });
     }
-    return beatLiveness(tier, beat, now);
+    return withClearObligation(repoRoot, tier, beatLiveness(tier, beat, now));
 }
 /** Every KNOWN tier, always — a tier omitted from this list would read as one that is fine. */
 export const readSupervision = (repoRoot, now = Date.now()) => SUPERVISION_TIERS.map((tier) => supervisionStatus(repoRoot, tier, now));
@@ -333,4 +429,6 @@ export const readSupervision = (repoRoot, now = Date.now()) => SUPERVISION_TIERS
 // The seat is rendered BESIDE the state, never instead of it: `overseer-context ARMED (w3:p2)` says
 // both that something is beating and who is behind it, which is the pair an operator needs to act. A
 // row with no seat to name renders exactly as it always did.
-export const supervisionText = (tiers, divider = " · ") => `supervision: ${tiers.map((t) => `${t.tier} ${t.state}${t.seat ? ` (${t.seat})` : ""}`).join(divider)}`;
+export const supervisionText = (tiers, divider = " · ") => `supervision: ${tiers.map((t) => `${t.tier} ${t.state}${t.seat ? ` (${t.seat})` : ""}` +
+    `${t.clearOwedSince ? ` CLEAR-OWED since ${t.clearOwedSince}` : ""}` +
+    `${t.clearOwedUnreadable ? " CLEAR-OWED unreadable" : ""}`).join(divider)}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.1.5",
+  "version": "2.1.7",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-auto/SKILL.md

@@ -45,7 +45,8 @@ Before `tickmarkr compile` or `tickmarkr run`, compare the installed binary agai
 
 1. Run `tickmarkr version` (one line, machine-parseable).
 2. Read the `version` field from the repository's `package.json`.
-3. If the binary and repository do not **agree on the entire version** (including the patch; e.g. binary `2.1.0` vs repo `2.1.1`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`) or link the repo binary. Do not compile, plan, or run on hope.
+3. If the binary and repository do not **agree on the entire version** (including the patch; e.g. binary `2.1.0` vs repo `2.1.1`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`), or to install this repository's build as a REAL COPY — `npm pack`, then `npm i -g ./<tarball>`. Do not compile, plan, or run on hope.
+   > ⚠ **Never `npm i -g .` on the repository directory, and never link it.** npm SYMLINKS a directory install, which makes the working tree itself the machine-wide binary: every later build — including a gate's own `npm run build` — silently hot-swaps the CLI for every repository on the machine, with no version change to notice it by. Measured 2026-08-29: a verify build gate rewrote the shared binary while another repository's daemon was mid-run against it, and a positive control that rebuilds at a pre-fix ref would have installed the very defect it was proving fixed, machine-wide (OBS-771). Verify an install by comparing the global and repo **inodes** — they must DIFFER — never by `tickmarkr version`, which cannot go red when nothing is bumped.
 
 A stale binary silently skips daemon gates shipped in newer releases — the v1.38 run exposed this when a global `1.36.0` binary missed the daemon tip-verify gate entirely (OBS-38). Preflight failure is always stop-and-report; never proceed-and-hope.
 

package/skills/tickmarkr-loop/SKILL.md

@@ -40,7 +40,8 @@ Before `tickmarkr compile` or `tickmarkr run`, compare the installed binary agai
 
 1. Run `tickmarkr version` (one line, machine-parseable).
 2. Read the `version` field from the repository's `package.json`.
-3. If the binary and repository do not **agree on the entire version** (including the patch; e.g. binary `2.1.0` vs repo `2.1.1`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`) or link the repo binary. Do not compile, plan, or run on hope.
+3. If the binary and repository do not **agree on the entire version** (including the patch; e.g. binary `2.1.0` vs repo `2.1.1`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`), or to install this repository's build as a REAL COPY — `npm pack`, then `npm i -g ./<tarball>`. Do not compile, plan, or run on hope.
+   > ⚠ **Never `npm i -g .` on the repository directory, and never link it.** npm SYMLINKS a directory install, which makes the working tree itself the machine-wide binary: every later build — including a gate's own `npm run build` — silently hot-swaps the CLI for every repository on the machine, with no version change to notice it by. Measured 2026-08-29: a verify build gate rewrote the shared binary while another repository's daemon was mid-run against it, and a positive control that rebuilds at a pre-fix ref would have installed the very defect it was proving fixed, machine-wide (OBS-771). Verify an install by comparing the global and repo **inodes** — they must DIFFER — never by `tickmarkr version`, which cannot go red when nothing is bumped.
 
 A stale binary silently skips daemon gates shipped in newer releases — the v1.38 run exposed this when a global `1.36.0` binary missed the daemon tip-verify gate entirely (OBS-38). Preflight failure is always stop-and-report; never proceed-and-hope.
 

package/skills/tickmarkr-overseer/SKILL.md

@@ -60,6 +60,11 @@ through brief lineage. **An executor choice nobody made is still an executor cho
    OPERATOR LAYOUT/CONVENTION rather than a shipped milestone — names like `*-discipline`, `*-drill`,
    `*-parity`, `*-least-permission`, `context-reset-*`, `consults-*`, `agent-*`, `*-tab-layout`,
    `*-visible-*`, `*-panes*`, `user-tabs-*`.
+   **A standing instruction carries its revocation premise.** Every standing rule you lift from memory,
+   handoff or a live correction states the premise that makes it true and the concrete observation that
+   would falsify that premise and revoke the rule. If you cannot name the falsifier, you have written a
+   preference, not standing supervision law. When the falsifier arrives, retire or amend the rule in the
+   shipped skill in the same act; do not leave successors to obey a rule whose reason is already false.
    **Earned 2026-08-04, expensively.** That directory held `…-falsification-drill-discipline.md`, written
    three weeks earlier: *"a gate or grep-pin is assumed WRONG until a falsification drill proves it bites…
    run the drill that should redden it and SEE the red before trusting green."* That is Evidence discipline
@@ -103,7 +108,7 @@ through brief lineage. **An executor choice nobody made is still an executor cho
    fraction (`ORCH · v1.19 4/5`, updated on every task-done); tickmarkr opens ONE TAB PER TASK, labelled
    with the task id and holding that task's worker plus its judge/review/consult panes (tickmarkr
    updates it). Never long context strings or ✓-chains.
-2. **Orchestrator**: Launch the orchestrator with your agent host. Spawning on current herdr is two-step — the one-shot `agent start --cwd` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138): first create the pane with `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` and parse `result.root_pane.pane_id` from its JSON, then start the agent in it. For Claude Code, use `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions` (append `--model <m>` after the `--` if the operator has a policy). For Codex, use `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` (add `--model <m>` to specify the model). The unsandboxed flag is REQUIRED: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation — do not downgrade it. Workers you never spawn — tickmarkr spawns its own visible worker panes. Auxiliary agents you do spawn (consultants, reviewers, scouts) follow the same forms: never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions --settings '{"promptSuggestionEnabled":false}'`, and a read-only codex consultant may use `--sandbox read-only`. **That `--settings` pair is not cosmetic and it is not optional:** claude-code's AUTOSUGGEST renders context-plausible ghost text into an idle seat's prompt line that is BYTE-IDENTICAL to a typed draft in text-format reads (OBS-482), so a supervising tier cannot tell a seat's own unsent work from a rendering artifact without `agent read --format ansi`. Turning the suggester off at spawn removes the ambiguity at its source instead of paying for the discrimination at every read. Verified against the shipped binary: `claude --settings '{"promptSuggestionEnabled":false}' -p …` exits 0 with a real response, and the key appears in the binary's own settings schema. **For kimi, pass `-y`** (`herdr agent start <name> --kind kimi --pane <id> -- -y`) — the adapter already launches its own workers that way (`src/adapters/kimi.ts:204`), and a kimi seat spawned without it sits on an approval prompt having done nothing. **Herdr cannot see that state**: it reports a kimi pane as `agent_status: working` with `screen_detection_skipped: true` while the prompt is up, so the BLOCKED-STATE watcher below is blind on this vendor and the spawn flag is the ONLY control. Every vendor you spawn needs its auto-approve form named here; a vendor absent from this list is a seat that will hang.
+2. **Orchestrator**: Launch the orchestrator with your agent host. Spawning on current herdr is two-step — the one-shot `agent start --cwd` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138): first create the pane with `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` and parse `result.root_pane.pane_id` from its JSON, then start the agent in it. For Claude Code, use `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions` (append `--model <m>` after the `--` if the operator has a policy). For Codex, use `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` (add `--model <m>` to specify the model). The unsandboxed flag is REQUIRED: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation — do not downgrade it. Workers you never spawn — tickmarkr spawns its own visible worker panes. Auxiliary agents you do spawn (consultants, reviewers, scouts) follow the same forms: never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions --settings '{"promptSuggestionEnabled":false}'`. **For a codex consultant, use `-a never --sandbox workspace-write` — NOT `--sandbox read-only`.** ⚠ **`--sandbox read-only` CONTRADICTS this skill's own completion protocol and will hang the seat.** Every seat you spawn is told to deliver an ARTIFACT ending in a terminal MARKER, because that is the only completion signal the artifact watcher can key on (`done` is turn end). A read-only sandbox cannot write that artifact, so codex blocks on `Would you like to make the following edits?` for its OWN report — and the report exists ONLY in the pending edit, so abandoning the prompt destroys the work rather than merely delaying it. Measured 2026-08-28: a consultant spawned `--sandbox read-only` finished a 14,604-byte verdict, sat blocked on the write, and the operator saw the prompt before the supervising tier did. `read-only` is correct ONLY for a seat that writes nothing at all — which, under the artifact+marker rule, is no seat this skill tells you to spawn. When the prompt does appear, answer **"Yes, and don't ask again for these files"** rather than plain yes: plain yes re-blocks on the next write of the same file. **That `--settings` pair is not cosmetic and it is not optional:** claude-code's AUTOSUGGEST renders context-plausible ghost text into an idle seat's prompt line that is BYTE-IDENTICAL to a typed draft in text-format reads (OBS-482), so a supervising tier cannot tell a seat's own unsent work from a rendering artifact without `agent read --format ansi`. Turning the suggester off at spawn removes the ambiguity at its source instead of paying for the discrimination at every read. Verified against the shipped binary: `claude --settings '{"promptSuggestionEnabled":false}' -p …` exits 0 with a real response, and the key appears in the binary's own settings schema. **For kimi, pass `-y`** (`herdr agent start <name> --kind kimi --pane <id> -- -y`) — the adapter already launches its own workers that way (`src/adapters/kimi.ts:204`), and a kimi seat spawned without it sits on an approval prompt having done nothing. **Herdr cannot see that state**: it reports a kimi pane as `agent_status: working` with `screen_detection_skipped: true` while the prompt is up, so the BLOCKED-STATE watcher below is blind on this vendor and the spawn flag is the ONLY control. Every vendor you spawn needs its auto-approve form named here; a vendor absent from this list is a seat that will hang.
 3. **Standing instructions travel as a brief FILE, never as pane text** — PTY input truncates at ~1024B and a
    truncated brief silently drops policy. Write the full brief to `<repo>/.tickmarkr/overseer/ORCH-BRIEF.md`
    (inside the tickmarkr state dir — already self-gitignored, no exclude step needed), then send one line:
@@ -565,6 +570,10 @@ cleared, re-briefed, or replaced keeps beating that tier's file forever. Measure
 **three-hour window in which no orchestrator was alive**, and it would have silently re-armed a
 recorded stand-down within 10 seconds. On the same sweep the overseer tier had **three** beat loops,
 one owned by an unrelated session. So:
+- **Split the liveness reads.** A tier's liveness is read from beat freshness in the repository status
+  path; a loop's liveness is read from the live process payload that is emitting that beat (`tickmarkr
+  beat <tier> --seat <seat>` in this repo). Neither liveness claim is read from a recorded pid: a pid
+  recorded earlier can be stale, reused, or detached from the beat now holding the tier green.
 - **At every adopt, clear, or re-brief, sweep for pre-existing loops on YOUR tier before arming one**
   (`pgrep -f "tickmarkr beat <tier>"`), trace each to its parent session, and kill the **loop only**
   — never the parent — then verify the parent survived.
@@ -1053,6 +1062,17 @@ twice.** They are mission-independent on purpose: nothing here names a task, a l
     concluded both forms were valid. The tell is unavailable unless the tool volunteers it. Corollary —
     an instrument that takes an input must be handed a DELIBERATELY BAD one before its clean runs are
     worth anything (rule 11 applied to tools, not just to gates).
+    ⚠ **AND THE COMMONEST WRONG INPUT IS A BASE REF: after the first merge, a task's diff against the
+    run's `baseRef` is NEVER that task's diff.** Workers branch from the INTEGRATION TIP, so once any task
+    has merged, `git diff baseRef..HEAD` in a later worktree reports that task PLUS every task merged
+    before it, and the number looks entirely plausible. Diff from the task's OWN base — the integration
+    commit it branched from — and say which base you used whenever you quote a size.
+    **Measured 2026-08-28 in one run, twice, in both directions.** A supervising seat quoted "712
+    insertions across 7 files" for a task whose real contribution was **300 across 2**; the surplus was two
+    other tasks' merged work. On the next task the same trap was **larger** — 920 across 11 versus a true
+    167 across 4 — and it was caught only because the other tier had just been burned by it. A scope
+    judgement, a cost claim, or a review-size argument built on the baseRef diff is measuring three tasks
+    and calling it one.
 14. **A unit is not a measurement.** A configured timeout is a KILL CEILING, not a duration — never compare
     it to a wall clock or quote it to an operator as an estimate.
 15. **Verify through the path that LOADS, not the path you edited.** Mirrored trees and symlinks mean your

package/skills/tickmarkr-overseer/scripts/watch-context.sh

@@ -20,15 +20,15 @@
 # than absent. Four rules the shipped version broke, each of which made the tier lie:
 #   1. BEAT ON THE SUPERVISION CADENCE, NOT ON THE POLL. Beats gap by TICK (below), never by POLL, so a
 #      poll interval above the supervision beat interval cannot leave the tier stale half of every cycle.
-#   2. BEAT ONLY AFTER A SUCCESSFUL READ. A watcher that cannot see its seat's percentage is not
-#      watching it; beating anyway reports coverage it is not providing, and the tier must age out.
+#   2. BEAT AFTER EVERY SUCCESSFUL SCREEN READ. A missing percentage is an explicit UNREADABLE
+#      observation: it must keep the live watcher armed but can never reach warn or act. Only a failed
+#      screen read withholds the beat, because then the watcher cannot see its seat at all.
 #   3. WARN DOES NOT EXIT. Warn precedes act, so exiting at warn meant the act was never reached and the
 #      last beat aged into a permanent stale — gradual growth never reached the auto-clear path at all.
 #   4. EVERY TERMINAL EXIT STANDS THE TIER DOWN, so a watcher that finished reads DISARMED, not dead.
 #      Only a killed watcher reads STALE, which is exactly what STALE means.
-#   5. A BLIND READ ALARMS (OBS-739). Ageing the tier is visible only to someone already reading the beat
-#      table; the seat that armed this watcher must be TOLD its instrument went blind. Silence and health
-#      must never look alike.
+#   5. AN UNREADABLE FIELD REPORTS ITSELF (OBS-739/780). Silence, health and a trustworthy percentage
+#      are three different states. UNREADABLE stays supervised but never authorises a destructive act.
 #
 # usage: watch-context.sh <role-slug> <agent|pane> <warn-pct> <act-pct> [handoff-file] [poll-s] [cap-s]
 #   <role-slug> is ANY seat role — orchestrator, overseer, surgeon, consult — and names the tier
@@ -63,8 +63,8 @@ TIER="${ROLE}-context"
 
 
 # The supervision beat interval (SUPERVISION_BEAT_MS = 10s). The loop ticks at the beat cadence or the
-# caller's poll, whichever is SHORTER: a beat may only follow a successful read (rule 2), so the read
-# cadence is the floor on the beat cadence, and the tier's freshness is never the caller's to widen.
+# caller's poll, whichever is SHORTER. Every successful screen read beats; its result is either a
+# percentage safe to compare or the explicit UNREADABLE state.
 BEAT_EVERY=5
 TICK=$(( POLL < BEAT_EVERY ? POLL : BEAT_EVERY ))
 [ "$TICK" -ge 1 ] 2>/dev/null || TICK=1   # a zero or junk poll would spin, not watch
@@ -100,16 +100,18 @@ stand_down() { tickmarkr beat "$TIER" --stand-down --seat "$SEAT" >/dev/null 2>&
 # record the hand-off. A killed watcher never runs it, which is the one case that must read STALE.
 trap stand_down EXIT
 
-# The seat's own rendered truth. Prefer a line carrying a context marker so a percentage elsewhere on
-# screen cannot be mistaken for the gauge — but NEVER require one: the ✳ marker the shipped version
-# anchored on is rendered by a single vendor, so every other seat read empty, beat anyway and slept to
-# its cap while its tier claimed coverage. The last percentage in the statusline window is the fallback.
+# The seat's rendered truth lives on the model banner. Select that line first, then read a percentage
+# only from it: a bare numeric search across the visible window can borrow an old N% from scrollback
+# when a long live-run segment pushes the real field past the pane's visible width (OBS-780).
 context_pct() {
-  local screen marked
+  local screen banner pct
   screen=$(herdr agent read "$TARGET" --source visible --lines 8 2>/dev/null) || return 1
-  marked=$(printf '%s\n' "$screen" | grep -iE '✳|context' | grep -oE '[0-9]+%' | tail -1 | tr -d '%')
-  [ -n "$marked" ] && { printf '%s\n' "$marked"; return 0; }
-  printf '%s\n' "$screen" | grep -oE '[0-9]+%' | tail -1 | tr -d '%'
+  banner=$(printf '%s\n' "$screen" |
+    grep -Ei '(^|[^[:alnum:]])(claude|opus|sonnet|haiku|gpt|gemini|glm|kimi|grok|composer|openai|zai)[[:alnum:]_./-]*([[:space:]]|$)' |
+    tail -1)
+  [ -n "$banner" ] || { printf 'UNREADABLE\n'; return 0; }
+  pct=$(printf '%s\n' "$banner" | grep -oE '[0-9]+%' | tail -1 | tr -d '%')
+  [ -n "$pct" ] && printf '%s\n' "$pct" || printf 'UNREADABLE\n'
 }
 
 handoff_fresh() {
@@ -144,35 +146,47 @@ act_on() {
 
 warned=0
 elapsed=0
-blind=0            # seconds in the current unreadable spell (OBS-739)
+blind=0            # seconds in the current failed-read spell (OBS-739)
 blind_alarmed=0
+unreadable_reported=0
 BLIND_ALARM_S="${TKR_BLIND_ALARM_S:-120}"
 while [ "$elapsed" -lt "$CAP" ]; do
-  P=$(context_pct)
+  if ! P=$(context_pct); then P=""; fi
   if [ -z "$P" ]; then
-    # Rule 2: no reading, no beat. The tier ages to STALE and a supervisor comes looking, which is the
-    # truth about a watcher that cannot see the seat it was armed on.
-    #
-    # Rule 5 (OBS-739): ALARM ON THE BLIND READ. Ageing a tier is not enough — it is only visible to
-    # someone already reading the beat table, and the measured failure was a watcher ALIVE AND BLIND for
-    # hours because the run's own status text pushed the percentage off the statusline. An instrument
-    # that cannot report its own absence is worse than none: the seat believes it has coverage and stops
-    # looking. So say so on stdout, where the supervising seat is actually woken. Once per blind spell,
-    # not every tick — a repeating alarm trains the reader to ignore it.
+    # The screen read itself failed: no observation, no beat. The tier ages to STALE and the watcher
+    # alarms once, because an instrument that cannot see its seat must never look healthy.
+    unreadable_reported=0
     blind=$((blind + TICK))
     if [ "$blind" -ge "$BLIND_ALARM_S" ] && [ "$blind_alarmed" -eq 0 ]; then
       blind_alarmed=1
-      echo "CONTEXT_BLIND $TARGET — no percentage readable for ${blind}s; tier ${TIER} is ALIVE AND BLIND"
-      echo "  this watcher is NOT providing coverage: read the seat by hand and re-arm on a clear statusline"
-      echo "  do NOT substitute the token total — '∑ Nk tok' is cumulative SPEND, not context fill"
+      echo "CONTEXT_BLIND $TARGET — screen unreadable for ${blind}s; tier ${TIER} is ALIVE AND BLIND"
+      echo "  this watcher is NOT providing coverage: read the seat by hand and repair the screen read"
     fi
     sleep "$TICK"; elapsed=$((elapsed + TICK)); continue
   fi
-  # a successful read closes the blind spell and re-arms the alarm for the next one
+
+  if [ "$P" = "UNREADABLE" ]; then
+    # The screen read succeeded, so keep the watcher armed. The absent field is still not a number:
+    # report it once per spell and never let it flow into warn or act.
+    if [ "$blind_alarmed" -eq 1 ]; then
+      echo "CONTEXT_BLIND_CLEARED $TARGET — screen readable again after ${blind}s blind"
+    fi
+    blind=0; blind_alarmed=0
+    beat
+    if [ "$unreadable_reported" -eq 0 ]; then
+      unreadable_reported=1
+      echo "CONTEXT_UNREADABLE $TARGET — model banner has no visible percentage; no warn or act authorised"
+    fi
+    sleep "$TICK"; elapsed=$((elapsed + TICK)); continue
+  fi
+
+  if [ "$unreadable_reported" -eq 1 ]; then
+    echo "CONTEXT_UNREADABLE_CLEARED $TARGET — percentage readable again at ${P}%"
+  fi
   if [ "$blind_alarmed" -eq 1 ]; then
     echo "CONTEXT_BLIND_CLEARED $TARGET — percentage readable again at ${P}% after ${blind}s blind"
   fi
-  blind=0; blind_alarmed=0
+  blind=0; blind_alarmed=0; unreadable_reported=0
   beat
 
   if [ "$P" -ge "$ACT" ] 2>/dev/null; then
@@ -190,4 +204,4 @@ while [ "$elapsed" -lt "$CAP" ]; do
   sleep "$TICK"; elapsed=$((elapsed + TICK))
 done
 
-echo "WATCH_CAP_REACHED $TARGET context=$(context_pct)% — no threshold crossed in ${CAP}s"
+echo "WATCH_CAP_REACHED $TARGET — no threshold crossed in ${CAP}s"