tickmarkr 2.1.6 → 2.1.7

package/dist/cli/commands/beat.js

@@ -1,7 +1,7 @@
 import { mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { tickmarkrDir } from "../../graph/graph.js";
-import { SUPERVISION_BEAT_MS, SUPERVISION_STALE_MS, SUPERVISION_TIERS, beatSupervision, supervisionStandDownPath, } from "../../run/supervision.js";
+import { SUPERVISION_BEAT_MS, SUPERVISION_DEFAULT_THRESHOLD_PCT, SUPERVISION_STALE_MS, SUPERVISION_TIERS, beatSupervision, supervisionStandDownPath, } from "../../run/supervision.js";
 // SUP-04: the writer side of supervision, as a VERB. `beatSupervision` and `SUPERVISION_BEAT_MS` shipped
 // with exactly one in-repo caller — the daemon, on one tier — so `status` printed
 // `orchestrator ARMED / overseer ABSENT / watch ABSENT` while a real overseer worked the run: two thirds
@@ -18,16 +18,22 @@ import { SUPERVISION_BEAT_MS, SUPERVISION_STALE_MS, SUPERVISION_TIERS, beatSuper
 // reads UNREADABLE. Here the writes are unguarded: a failure leaves the process with a non-zero exit
 // and a message instead of a claim. The LOOP belongs to the caller, which is what makes the beat
 // evidence: stop calling it and the tier ages into STALE on its own.
+const VALUE_OPTIONS = ["--seat", "--arm-id", "--pct", "--threshold-pct"];
 export async function beat(argv, cwd = process.cwd()) {
     const standDown = argv.includes("--stand-down");
     const seat = seatOf(argv);
-    const named = argv.find((a, i) => !a.startsWith("--") && argv[i - 1] !== "--seat");
+    const pct = percentageOf(argv, "--pct");
+    const thresholdPct = percentageOf(argv, "--threshold-pct") ?? SUPERVISION_DEFAULT_THRESHOLD_PCT;
+    const armId = optionOf(argv, "--arm-id");
+    const named = argv.find((a, i) => !a.startsWith("--") && !VALUE_OPTIONS.includes(argv[i - 1] ?? ""));
     if (!isTier(named)) {
-        throw new Error(`usage: tickmarkr beat <${SUPERVISION_TIERS.join("|")}> --seat <identity> [--stand-down] — got ${named ? `\`${named}\`` : "no tier"}`);
+        throw new Error(`usage: tickmarkr beat <${SUPERVISION_TIERS.join("|")}> --seat <identity> ` +
+            `[--arm-id <identity> --pct <0..100> --threshold-pct <0..100>] [--stand-down] — ` +
+            `got ${named ? `\`${named}\`` : "no tier"}`);
     }
     // SUP-05: NO SEAT, NO BEAT — and the refusal comes before any write, so a refused invocation leaves
-    // the tier exactly as it found it. This verb is one-shot: the pid it would otherwise record has
-    // already exited by the time anyone reads the record, so tier + pid + instant is a beat nobody can
+    // the tier exactly as it found it. This verb is one-shot: the exitedWriterPid it records has
+    // already exited by the time anyone reads the record, so tier + writer + instant is a beat nobody can
     // attribute to a seat. Measured 2026-08-26: a consult seat ran the documented loop verbatim and the
     // board read that tier ARMED with no seat of that tier having armed anything, and a seatless ARMED
     // reads as coverage — worse than ABSENT, because ABSENT sends someone to look.
@@ -42,16 +48,35 @@ export async function beat(argv, cwd = process.cwd()) {
     // uncleared marker would render DISARMED while this verb claimed ARMED, so the removal is unguarded
     // too — `force` makes the ordinary "no marker" case a no-op, and anything else is a real failure.
     rmSync(supervisionStandDownPath(cwd, named), { force: true, recursive: true });
-    beatSupervision(cwd, named, seat);
+    beatSupervision(cwd, named, seat, pct === undefined ? undefined : { armId: armId ?? seat, pct, thresholdPct });
     return `${named} ARMED as ${seat} — beat again every ${SUPERVISION_BEAT_MS / 1_000}s; the tier reads STALE ${SUPERVISION_STALE_MS / 1_000}s after the last beat`;
 }
 /** `--seat <identity>` or `--seat=<identity>`; blank and missing are the same answer — none. */
 function seatOf(argv) {
-    const inline = argv.find((a) => a.startsWith("--seat="))?.slice("--seat=".length);
-    const spaced = argv[argv.indexOf("--seat") + 1];
-    const seat = (inline ?? (argv.includes("--seat") ? spaced : undefined))?.trim();
+    const seat = optionOf(argv, "--seat")?.trim();
     return seat && !seat.startsWith("--") ? seat : undefined;
 }
+/** A `--name value` or `--name=value` option, excluding a missing value or the next flag. */
+function optionOf(argv, name) {
+    const inline = argv.find((a) => a.startsWith(`${name}=`))?.slice(name.length + 1).trim();
+    const spaced = argv[argv.indexOf(name) + 1]?.trim();
+    const value = inline ?? (argv.includes(name) ? spaced : undefined);
+    return value && !value.startsWith("--") ? value : undefined;
+}
+function percentageOf(argv, name) {
+    const raw = optionOf(argv, name);
+    if (raw === undefined) {
+        if (argv.includes(name) || argv.some((a) => a.startsWith(`${name}=`))) {
+            throw new Error(`${name} needs a number from 0 through 100`);
+        }
+        return undefined;
+    }
+    const value = Number(raw);
+    if (!Number.isFinite(value) || value < 0 || value > 100) {
+        throw new Error(`${name} must be a number from 0 through 100`);
+    }
+    return value;
+}
 // Stand-down is a RECORDED act, not a silence: the marker tells a reader this watcher left on purpose,
 // so the tier reads DISARMED rather than ageing out as a death. Published atomically — written aside,
 // renamed over — because a torn marker is rejected by the reader, and a rejected stand-down reports a
@@ -63,7 +88,9 @@ function standDownTier(repoRoot, tier, seat) {
     mkdirSync(dirname(p), { recursive: true });
     // The marker names the seat for the same reason the beat does: "someone stood this tier down" is not
     // a hand-off anyone can act on, and on a seat tier the reader rejects an anonymous one outright.
-    writeFileSync(tmp, JSON.stringify({ tier, seat, pid: process.pid, disarmedAt: new Date().toISOString() }) + "\n");
+    writeFileSync(tmp, JSON.stringify({
+        tier, seat, exitedWriterPid: process.pid, disarmedAt: new Date().toISOString(),
+    }) + "\n");
     renameSync(tmp, p);
     return `${tier} DISARMED — ${seat} handed off; status reads it stood down, not dead`;
 }

package/dist/cli/commands/run.js

@@ -167,7 +167,7 @@ const railTone = (event, fallback) => {
     // `gate-result` is the one event whose data IS a gate result; every other row carrying a `gate`
     // names a gate without reporting one (a start, a reuse, a retry) and keeps its declared tone.
     if (event.event === "gate-result")
-        return GATE_OUTCOME_TONES[normalizeGateOutcome(event.data).kind] ?? fallback;
+        return GATE_OUTCOME_TONES[normalizeGateOutcome(event.data).kind];
     const verdict = event.data.pass ?? event.data.ok;
     return verdict === true ? "pass" : verdict === false ? "fail" : fallback;
 };
@@ -226,7 +226,24 @@ const railSalient = (data) => RAIL_SALIENT.flatMap(({ key, render }) => {
  * This is one detail vocabulary stated twice, so `brand-surfaces.test.ts` pins the two against each
  * other over the whole event corpus: the pipe's bytes must equal event/taskId/THIS detail put through
  * the formatter's legacy squeeze-and-slice. A ladder that drifts fails there rather than in a tab.
+ * Gate-result verdict words are the deliberate exception: the pipe is byte-frozen, while the TTY rail
+ * names the normalized outcome so a held selected-test screen is not narrated as a pass.
  */
+const gateResultDetail = (data) => {
+    if (typeof data.gate !== "string")
+        return undefined;
+    switch (normalizeGateOutcome(data).kind) {
+        case "passed":
+            return `${data.gate} passed`;
+        case "failed":
+            return `${data.gate} failed`;
+        case "held":
+            // The kind is already normalized; the selected-test list only chooses this surface noun.
+            return Array.isArray(data.selectedTests) ? `${data.gate} selected-test screen` : `${data.gate} held`;
+        default:
+            return data.gate;
+    }
+};
 const formatterDetail = ({ event, data }) => {
     const assignment = data.assignment;
     const direct = [data.summary, data.reason, data.error, data.step, data.action, data.lint, data.branch, data.from]
@@ -240,7 +257,9 @@ const formatterDetail = ({ event, data }) => {
         }
         if (event === "tip-verify")
             return `${data.gate} passed`;
-        return `${data.gate}${data.pass === true ? " passed" : data.pass === false ? " failed" : ""}`;
+        if (event === "gate-result")
+            return gateResultDetail(data);
+        return `${data.gate}`;
     }
     if (typeof data.code === "number")
         return `exit ${data.code}`;

package/dist/cli/commands/stats.js

@@ -1,8 +1,8 @@
 import { existsSync, readdirSync } from "node:fs";
 import { join } from "node:path";
-import { classifyFailureOutput } from "../../gates/baseline.js";
 import { stateDirName } from "../../graph/graph.js";
 import { Journal } from "../../run/journal.js";
+import { normalizeGateOutcome } from "../../run/outcome.js";
 // The operator-facing schema is deliberately closed. Adding a fact to the table therefore requires
 // adding it here as a conscious compatibility change, rather than letting incidental journal fields
 // leak into an analytics surface.
@@ -35,14 +35,6 @@ const reviewerFrom = (data) => {
         return undefined;
     return /\breviewer(?:\s+|:\s*)([\w@./+-]+:[\w@./+-]+)/iu.exec(data.details)?.[1];
 };
-const redEvidence = (data) => {
-    const fingerprints = Array.isArray(data.fingerprints)
-        ? data.fingerprints.filter((value) => typeof value === "string")
-        : [];
-    const prose = [data.details, data.error, data.reason]
-        .filter((value) => typeof value === "string");
-    return [...fingerprints, ...prose].join("\n");
-};
 const historyFor = (tasks, taskId) => {
     let history = tasks.get(taskId);
     if (!history) {
@@ -143,12 +135,10 @@ export function collectChannelStats(cwd = process.cwd()) {
                 if (reviewer)
                     channel.reviewers.add(reviewer);
             }
-            if (event.data.pass !== false)
-                continue;
-            const infra = event.data.infra === true || classifyFailureOutput(redEvidence(event.data)) === "infra";
-            if (infra)
+            const outcome = normalizeGateOutcome(event.data);
+            if (outcome.kind === "infra")
                 channel.infraReds += 1;
-            else
+            else if (outcome.kind === "failed")
                 channel.realReds += 1;
         }
         // A rescue is task-matched, not attempt-matched: one edge says the failed author and delivering

package/dist/cli/commands/status.js

@@ -12,7 +12,7 @@ import { isPidLive } from "../../run/lock.js";
 import { normalizeGateOutcome } from "../../run/outcome.js";
 import { desiredPanes } from "../../run/reconcile.js";
 import { normalizeStallSnapshot } from "../../run/stall.js";
-import { armSupervision, readSupervision, supervisionText } from "../../run/supervision.js";
+import { armWatchSupervision, readSupervision, supervisionText } from "../../run/supervision.js";
 import { deriveRunCockpitData, } from "../../tui/cockpit/derive.js";
 import { COCKPIT_COLUMN_FLOOR } from "../../tui/cockpit/layout.js";
 import { cellWidth, fitCells, wrapCells } from "../../tui/cockpit/width.js";
@@ -109,6 +109,15 @@ const ASCII_SPINNER = ["|", "/", "-", "\\"];
 const SAVE_TERMINAL_TITLE = "\x1b[22;0t";
 const RESTORE_TERMINAL_TITLE = "\x1b[23;0t";
 const decisionEvidence = (stateDir, runId, sequence) => `${stateDir}/runs/${runId}/journal.jsonl#L${sequence}`;
+const DECISION_GATE_VERDICTS = {
+    passed: "passed",
+    failed: "failed",
+    skipped: "skipped",
+    declined: "skipped",
+    held: "unknown",
+    unavailable: "unknown",
+    infra: "unknown",
+};
 // v1.79 T4: a deterministic JSONL projection over journal truth. Sequence/evidence come from the
 // append-only line position, timestamps and claims come from the row, and no watcher-local clock or
 // filesystem write participates. Re-reading the same bytes therefore returns the same event bytes.
@@ -126,13 +135,7 @@ export const decisionEventsFromJournal = (events, runId, stateDir = ".tickmarkr"
         return [{ ...base, type: "phase-change", tier: "routine", phase: event.data.phase }];
     }
     if (event.event === "gate-result" && typeof event.data.gate === "string") {
-        const verdict = event.data.skipped === true
-            ? "skipped"
-            : event.data.pass === true
-                ? "passed"
-                : event.data.pass === false
-                    ? "failed"
-                    : "unknown";
+        const verdict = DECISION_GATE_VERDICTS[normalizeGateOutcome(event.data).kind];
         return [{
                 ...base,
                 type: "gate-verdict",
@@ -381,6 +384,13 @@ export const gateBox = (state, unicode) => {
     return state === "pass" ? "[x]" : state === "fail" ? "[!]" : state === "skip" ? "." : "[ ]";
 };
 export const defaultGateStates = (task) => GATE_NAMES.map((gate) => task.gates.includes(gate) ? "open" : "skip");
+const GATE_OUTCOME_STATES = {
+    // The board state is a rendering vocabulary over the normalized outcome, not another field reader.
+    passed: "pass",
+    failed: "fail",
+    skipped: "skip",
+    declined: "skip",
+};
 const gateSnapshot = (task, events, rehashAt) => {
     const outcomes = new Map();
     const start = attemptStartIdx(events, task.id);
@@ -389,12 +399,9 @@ const gateSnapshot = (task, events, rehashAt) => {
             const e = events[eventIndex];
             if (e.taskId !== task.id || e.event !== "gate-result" || typeof e.data.gate !== "string")
                 continue;
-            if (e.data.skipped === true)
-                outcomes.set(e.data.gate, { state: "skip", eventIndex });
-            else if (e.data.pass === true)
-                outcomes.set(e.data.gate, { state: "pass", eventIndex });
-            else if (e.data.pass === false)
-                outcomes.set(e.data.gate, { state: "fail", eventIndex });
+            const state = GATE_OUTCOME_STATES[normalizeGateOutcome(e.data).kind];
+            if (state)
+                outcomes.set(e.data.gate, { state, eventIndex });
         }
     }
     return {
@@ -519,7 +526,7 @@ const foldTaskEffort = (tasks, events) => {
             task.dispatches += 1;
         else if (event.event === "gate-result" && event.data.gate === "review"
             && event.data.replayMeasurement !== true
-            && REVIEW_VERDICTS.has(normalizeGateOutcome(event.data.outcome ?? event.data).kind))
+            && REVIEW_VERDICTS.has(normalizeGateOutcome(event.data).kind))
             task.reviews += 1;
         else if (event.event === "task-human")
             task.parks += 1;
@@ -1408,7 +1415,7 @@ export async function status(argv, cwd = process.cwd(), opts = {}) {
     // it INVERTS it: armSupervision's interval outlives the board in any host that outlives one board, so
     // a dead board keeps writing and reads ARMED. That is the over-claiming direction, the one an operator
     // acts on, and the one this instrument exists to close.
-    const armed = bounded ? undefined : armSupervision(cwd, "watch", opts.supervisionBeatMs);
+    const armed = bounded ? undefined : armWatchSupervision(cwd, opts.supervisionBeatMs);
     let titleSaved = false;
     const restoreTitle = () => {
         if (!titleSaved)

package/dist/compile/index.d.ts

@@ -10,6 +10,6 @@ export type PlanIR = {
     tasks: RunGraph["tasks"];
 };
 export type PlanFinalizationHook = (plan: PlanIR) => PlanIR;
-export declare function finalizePlan(plan: PlanIR, src: string): RunGraph;
+export declare function finalizePlan(plan: PlanIR, src: string, repoRoot?: string): RunGraph;
 export declare function compileSource(src: string, type?: SourceType, root?: string, beforeFinalize?: PlanFinalizationHook): RunGraph;
 export {};

package/dist/compile/index.js

@@ -2,6 +2,7 @@ import { existsSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { validateGraph } from "../graph/schema.js";
 import { taskUnitContractErrors } from "./collateral.js";
+import { ownershipFindings, renderOwnershipFinding } from "./ownership.js";
 import { CompileError } from "./common.js";
 import { compileGsd, isGsdPhaseDir } from "./gsd.js";
 import { compileNative, TICKMARKR_NATIVE_MARKER } from "./native.js";
@@ -40,8 +41,8 @@ function enforceTaskUnitContract(g, src) {
     }
     return g;
 }
-export function finalizePlan(plan, src) {
-    const graph = validateGraph({
+export function finalizePlan(plan, src, repoRoot) {
+    const graph = enforceTaskUnitContract(validateGraph({
         version: plan.version,
         ...(plan.mode !== undefined ? { mode: plan.mode } : {}),
         spec: {
@@ -51,8 +52,16 @@ export function finalizePlan(plan, src) {
             ...(plan.base !== undefined ? { base: plan.base } : {}),
         },
         tasks: plan.tasks,
-    });
-    return enforceTaskUnitContract(graph, src);
+    }), src);
+    // overseer-217: report-only in 2.1.7. The 2.1.8 removal condition is one real authored-graph run
+    // plus a measured false-positive rate for the conventional source-name → test-name mapping.
+    // Until then this warning MUST NOT become a compile abort: a heuristic cannot deadlock compile.
+    if (repoRoot) {
+        for (const finding of ownershipFindings(graph.tasks, repoRoot)) {
+            console.warn(renderOwnershipFinding(finding));
+        }
+    }
+    return graph;
 }
 function compilePlan(src, type, root) {
     const kind = type ?? detect(src);
@@ -75,5 +84,5 @@ function compilePlan(src, type, root) {
     };
 }
 export function compileSource(src, type, root, beforeFinalize = (plan) => plan) {
-    return finalizePlan(beforeFinalize(compilePlan(src, type, root)), src);
+    return finalizePlan(beforeFinalize(compilePlan(src, type, root)), src, root);
 }

package/dist/compile/ownership.d.ts

@@ -0,0 +1,25 @@
+import type { Task } from "../graph/schema.js";
+export type OwnershipFinding = {
+    code: "unowned-test";
+    test: string;
+    taskIds: string[];
+    detail: string;
+} | {
+    code: "test-path-outside-allowlist";
+    taskId: string;
+    test: string;
+    path: string;
+    detail: string;
+} | {
+    code: "unordered-context-write";
+    taskId: string;
+    ownerTaskId: string;
+    path: string;
+    detail: string;
+};
+/**
+ * Advisory cross-task ownership check. Findings are data: callers may report them, but this checker
+ * never throws and never changes the graph.
+ */
+export declare function ownershipFindings(tasks: readonly Task[], repoRoot: string): OwnershipFinding[];
+export declare function renderOwnershipFinding(finding: OwnershipFinding): string;

package/dist/compile/ownership.js

@@ -0,0 +1,142 @@
+import { readFileSync, readdirSync } from "node:fs";
+import { basename, extname, join } from "node:path";
+import { filesGlob } from "../graph/files-glob.js";
+import { collateralHits } from "./collateral.js";
+const normalize = (path) => path.replace(/^\.\//, "").split("\\").join("/");
+function testSources(repoRoot) {
+    const root = join(repoRoot, "tests");
+    try {
+        return readdirSync(root, { recursive: true, encoding: "utf8" })
+            .filter((path) => path.endsWith(".test.ts"))
+            .sort()
+            .flatMap((path) => {
+            try {
+                return [{ path: `tests/${normalize(path)}`, text: readFileSync(join(root, path), "utf8") }];
+            }
+            catch {
+                return [];
+            }
+        });
+    }
+    catch {
+        return [];
+    }
+}
+// Conventional, not universal: status-watch-alive.test.ts is dedicated to status.ts even though it
+// reaches that command through the CLI entry point. Keep this heuristic advisory until authored-graph
+// measurements establish its false-positive rate.
+function namedSourceTasks(test, tasks) {
+    const stem = basename(test).replace(/\.test\.ts$/, "");
+    const ids = new Set();
+    for (const task of tasks) {
+        for (const entry of task.files.map(normalize).filter((path) => path.startsWith("src/") && !/[*?{[]/.test(path))) {
+            const source = basename(entry, extname(entry));
+            if (stem === source || stem.startsWith(`${source}-`))
+                ids.add(task.id);
+        }
+    }
+    return [...ids];
+}
+function repositoryPaths(text) {
+    const paths = new Set();
+    for (const match of text.matchAll(/["'`]((?:src|tests|fixtures|scripts|skills|docs|\.claude)\/[^"'`\s]+)["'`]/g)) {
+        paths.add(normalize(match[1]));
+    }
+    return [...paths].sort();
+}
+function dependencyOrdered(a, b, byId) {
+    const reaches = (from, target) => {
+        const seen = new Set();
+        const pending = [...from.deps];
+        while (pending.length > 0) {
+            const id = pending.pop();
+            if (id === target)
+                return true;
+            if (seen.has(id))
+                continue;
+            seen.add(id);
+            pending.push(...(byId.get(id)?.deps ?? []));
+        }
+        return false;
+    };
+    return reaches(a, b.id) || reaches(b, a.id);
+}
+/**
+ * Advisory cross-task ownership check. Findings are data: callers may report them, but this checker
+ * never throws and never changes the graph.
+ */
+export function ownershipFindings(tasks, repoRoot) {
+    const sources = testSources(repoRoot);
+    const byId = new Map(tasks.map((task) => [task.id, task]));
+    const indexed = tasks.map((task) => {
+        const files = task.files.map(normalize);
+        const context = task.context.map(normalize);
+        return {
+            task,
+            owns: files.length === 0 ? () => false : filesGlob(files),
+            allows: files.length === 0 ? () => true : filesGlob([...files, ...context]),
+        };
+    });
+    const owners = (path) => indexed.filter(({ owns }) => owns(path));
+    const predictedBy = new Map();
+    for (const [taskId, hits] of collateralHits(tasks, repoRoot)) {
+        for (const hit of hits) {
+            const ids = predictedBy.get(hit) ?? new Set();
+            ids.add(taskId);
+            predictedBy.set(hit, ids);
+        }
+    }
+    for (const source of sources) {
+        const ids = predictedBy.get(source.path) ?? new Set();
+        for (const taskId of namedSourceTasks(source.path, tasks))
+            ids.add(taskId);
+        if (ids.size > 0)
+            predictedBy.set(source.path, ids);
+    }
+    const findings = [];
+    for (const [test, taskIds] of predictedBy) {
+        if (owners(test).length === 0) {
+            const ids = [...taskIds].sort();
+            findings.push({
+                code: "unowned-test",
+                test,
+                taskIds: ids,
+                detail: `${test} is a dedicated test of source owned by ${ids.join(", ")} but no task owns the test`,
+            });
+        }
+    }
+    for (const source of sources) {
+        for (const owner of owners(source.path)) {
+            for (const path of repositoryPaths(source.text)) {
+                if (!owner.allows(path)) {
+                    findings.push({
+                        code: "test-path-outside-allowlist",
+                        taskId: owner.task.id,
+                        test: source.path,
+                        path,
+                        detail: `${source.path} owned by ${owner.task.id} references ${path} outside that task's files[] and context[]`,
+                    });
+                }
+            }
+        }
+    }
+    for (const reader of indexed) {
+        for (const entry of reader.task.context.map(normalize)) {
+            for (const owner of owners(entry)) {
+                if (owner.task.id === reader.task.id || dependencyOrdered(reader.task, owner.task, byId))
+                    continue;
+                findings.push({
+                    code: "unordered-context-write",
+                    taskId: reader.task.id,
+                    ownerTaskId: owner.task.id,
+                    path: entry,
+                    detail: `${reader.task.id} names ${entry} as context while ${owner.task.id} owns it for writing, with no dependency order between them`,
+                });
+            }
+        }
+    }
+    return findings.sort((a, b) => `${a.code}:${"test" in a ? a.test : a.path}:${"taskId" in a ? a.taskId : ""}`.localeCompare(`${b.code}:${"test" in b ? b.test : b.path}:${"taskId" in b ? b.taskId : ""}`));
+}
+export function renderOwnershipFinding(finding) {
+    return `tickmarkr: ownership-lint[${finding.code}]: ${finding.detail}`;
+}

package/dist/drivers/herdr.d.ts

@@ -125,6 +125,7 @@ export declare class HerdrDriver implements ExecutorDriver {
     narrator(cwd: string, command: string, runId?: string): Promise<Slot>;
     reconcile(desired: Set<string>, runId: string, opts?: {
         spareLiveLlm?: boolean;
+        endedRunIds?: Set<string>;
     }): Promise<void>;
     worktree(repo: string, branch: string, baseRef: string): Promise<string>;
 }

package/dist/drivers/herdr.js

@@ -1188,12 +1188,13 @@ export class HerdrDriver {
             return s;
         });
     }
-    // OBS-17 T2 / v1.22b T1: close every tickmarkr-owned pane that should not exist (superseded attempts,
-    // killed-daemon orphans, leftovers from OLDER runs) — in this run's workspace OR misplaced in any
-    // other one — then reap the tabs those closes emptied. Ownership is decided ONLY by parseOwnedName
-    // (drivers/types.ts panesToClose) — foreign names never become candidates, in any workspace; a pane
-    // this same run legitimately holds elsewhere is left alone (only run age marks a misplaced pane
-    // garbage). spareLiveLlm: same-run judge/review/consult panes have no journal row while live (their
+    // OBS-17 T2 / v1.22b T1: close THIS RUN'S OWN tickmarkr-owned panes that should not exist
+    // (superseded attempts, killed-daemon orphans of this run), in this run's workspace, then reap the
+    // tabs those closes emptied. Ownership is decided ONLY by parseOwnedName (drivers/types.ts
+    // panesToClose) — foreign names never become candidates. OBS-769/OBS-772/OBS-777: the sweep does
+    // NOT reach other workspaces and reaches another runId only when the daemon's repository-scoped
+    // snapshot proves that run ended. Run age is not consulted and never was. spareLiveLlm: same-run
+    // judge/review/consult panes have no journal row while live (their
     // events land after the verdict is read), so mid-run sweeps spare them; boundary sweeps (start/
     // resume/end) run with nothing in flight and take them too. Cosmetic by contract: every failure —
     // herdr gone, pane vanished mid-sweep, unparseable listing — is swallowed; this method never throws.

package/dist/drivers/types.d.ts

@@ -56,6 +56,7 @@ export interface FleetAgent {
 }
 export declare function panesToClose(agents: FleetAgent[], desired: Set<string>, ws: string, runId: string, opts?: {
     spareLiveLlm?: boolean;
+    endedRunIds?: Set<string>;
 }): {
     paneId: string;
     tabId?: string;
@@ -81,5 +82,6 @@ export interface ExecutorDriver {
     narrator?: (cwd: string, command: string, runId?: string) => Promise<Slot>;
     reconcile?: (desired: Set<string>, runId: string, opts?: {
         spareLiveLlm?: boolean;
+        endedRunIds?: Set<string>;
     }) => Promise<void>;
 }

package/dist/drivers/types.js

@@ -21,12 +21,53 @@ export function isForeignName(name) {
     return parseOwnedName(name) === null;
 }
 // v1.22b T1: workspace-aware fold over a fleet snapshot — decides which owned task panes are garbage
-// right now. In-workspace: the existing desired-set/spareLiveLlm sweep (OBS-17 T2). Out-of-workspace:
-// an owned pane from a DIFFERENT run is a misplaced leftover (bug, foreign actor, pre-VIS-10 relic)
-// and closes regardless of `desired`; an owned pane from THIS run elsewhere is left alone — a live
-// run can legitimately hold panes across workspaces, so only run age marks a misplaced pane garbage.
+// right now: the desired-set/spareLiveLlm sweep (OBS-17 T2), scoped to THIS RUN'S OWN panes (by runId,
+// OBS-772) in THIS RUN'S OWN WORKSPACE (OBS-769). Both conditions, and neither alone is the rule.
 // Watch panes are operator-owned after run end and are reclaimed by the next run; foreign names
-// (parseOwnedName fails) are never candidates, in any workspace.
+// (parseOwnedName fails) are never candidates.
+//
+// OBS-769 — WHY THE SWEEP STOPS AT THE WORKSPACE BOUNDARY. It used to close an owned pane carrying
+// any OTHER runId in any other workspace, unconditionally, as a "misplaced leftover". Two tickmarkr
+// runs in two repositories are lawful (the lock forbids two runs in ONE repository, not on one
+// machine) and herdr gives each its own workspace — so that branch made every pair of concurrent
+// runs kill each other's LIVE workers. Measured 2026-08-28: the run in w0 closed run ...2958's
+// panes at 23:42:40.351/.392, and 53s later ...2958's own task-human sweep closed w0's live codex
+// worker at 23:43:34.096. ...2958 ended 0/8. The death detector cannot see it: closing the pane
+// makes paneAbsent, processTree, confirmedProcessTree and worktreeDelta true by ONE cause, and a
+// closed pane can never accrue the CPU that the `cpu-accruing` hold reads.
+// The comment this replaces claimed "only run age marks a misplaced pane garbage" — there was no age
+// check in the code, and age is the wrong predicate anyway: w0's run STARTED EARLIER than ...2958,
+// so an age rule would have licensed exactly the kill that landed. Run age says nothing about
+// liveness, and a sweeping daemon cannot read another repository's run state. The workspace is the
+// only ownership boundary available without cross-repo I/O, so it is the one enforced.
+// Cost, named: an orphan pane from a dead run stranded in a workspace no later run opens is now left
+// for the operator. That is cosmetic (`reconcile` is cosmetic by contract — "visibility is never a
+// gate"), and a cosmetic cleanup must never be able to kill a live worker.
+// OBS-772 — WHY THE runId LINE EXISTS, AND WHY THE WORKSPACE LINE ALONE WAS NOT THE FIX. The first
+// repair was workspace-scoped only, and its own comment dismissed the residue — "two runs sharing one
+// workspace would still sweep each other" — as unreachable, on the reasoning that one workspace per run
+// is herdr's placement. That reasoned from ONE driver to the whole product. OrcaDriver has no workspace
+// dimension at all: orca.ts passes a single ORCA_SPACE as the workspaceId for EVERY checkout and as
+// `ws`, so `workspaceId !== ws` is never true there and every foreign pane fell straight through. Orca
+// users had zero protection while the defect read as fixed. The runId line is the real rule and it is
+// driver-agnostic: reconcile exists to clean up THIS RUN's panes, and a leftover from a dead run is
+// exactly what cannot be told from a live run's pane without liveness data this process does not have.
+// Both lines are kept — the workspace line preserves the pre-existing sparing of this run's own panes
+// in another workspace, which the runId line alone would not.
+// ⚠ WHAT THE runId LINE COST BEFORE OBS-777 — SUSPENDED, NOT NARROWED, and the price was larger than
+// it read. Sparing every other runId suspended OBS-17's FOUNDING use case: "a killed daemon can't
+// close its slots". This sweep was built to reclaim exactly those orphans, but could not reclaim ANY
+// previous run's panes. Three separate pins asserted the old behaviour (reconcile.test.ts,
+// orca-placement.test.ts,
+// reconcile-live.test.ts); all three were changed deliberately, and the third is why this paragraph
+// exists rather than a shorter one — two flipped pins is a trade, three is a pattern.
+// OBS-777 RESTORES that reclamation: the CALLER passes `opts.endedRunIds`, a Set the daemon computes
+// ONCE at run start from this repository's own `run-end` journals and dead lock holders. This fold
+// stays pure — it gains one optional field, not a repo root — a foreign repository's runId is never
+// resolvable and so stays spared by construction, and no driver learns about workspaces.
+// ponytail: two conditions, no geometry reasoning, nothing driver-specific. `reconcile` is cosmetic by
+// contract, and a cosmetic cleanup must never be able to kill a live worker — which is why the
+// ended-run authority is the only safe way to restore the sweep without reviving the cross-run kill.
 export function panesToClose(agents, desired, ws, runId, opts) {
     const out = [];
     for (const a of agents) {
@@ -35,15 +76,14 @@ export function panesToClose(agents, desired, ws, runId, opts) {
         const owned = parseOwnedName(a.name);
         if (!owned || owned.role === "watch")
             continue;
-        if (a.workspaceId === ws) {
-            if (desired.has(a.name))
-                continue;
-            if (opts?.spareLiveLlm && owned.runId === runId && (owned.role === "judge" || owned.role === "review" || owned.role === "consult"))
-                continue;
-        }
-        else if (owned.runId === runId) {
-            continue; // this run's own pane in another workspace — never touched
-        }
+        if (owned.runId !== runId && !opts?.endedRunIds?.has(owned.runId))
+            continue;
+        if (a.workspaceId !== ws)
+            continue; // OBS-769: another workspace is another run's business
+        if (desired.has(a.name))
+            continue;
+        if (opts?.spareLiveLlm && owned.runId === runId && (owned.role === "judge" || owned.role === "review" || owned.role === "consult"))
+            continue;
         out.push({ paneId: a.paneId, tabId: a.tabId });
     }
     return out;

package/dist/gates/baseline.js

@@ -117,7 +117,18 @@ const VOCAB_RE = /\b(?:error|fail(?:ed|ure|ing)?)\b/i;
 // shapes are emitted by the process that was asked to run the oracle; they are deliberately kept in
 // this runner-output classifier rather than applied to any judge-authored reason text. A real test
 // failure still dominates below because one regression-shaped line makes the whole output regression.
-const INFRA_RE = /\bE(?:AGAIN|MFILE|NFILE|NOMEM|NOSPC)\b|JavaScript heap out of memory|Cannot allocate memory|Resource temporarily unavailable|Token not found in system keyring|Process from config\.webServer was not able to start|\[birpc\] rpc is closed, cannot call\b/i;
+// OBS-791: `[vitest-worker]: Timeout calling "<method>"` is the SAME birpc mechanism one layer up.
+// Vitest's bundled birpc has a fixed 60s DEFAULT_TIMEOUT with no override (fixed upstream only in
+// vitest 4.x), so a suite whose tests all pass can still die at teardown when the worker->host RPC
+// window closes. `.github/workflows/release.yml` has forgiven this exact fingerprint since 2026-08-11
+// while this classifier called it a regression — the product charged a worker for the failure the
+// release gate was written to forgive. The METHOD NAME IS DELIBERATELY NOT PINNED: the timeout is a
+// property of the RPC window, not of `onTaskUpdate`, and pinning one method would forgive a run and
+// charge its sibling for the same infrastructure event. This stays a CLOSED signature — the
+// `[vitest-worker]: ` prefix is vitest's own RPC layer and never user assertion text — and the
+// per-line vetoes below are untouched, so one real failure anywhere still makes the whole output a
+// regression.
+const INFRA_RE = /\bE(?:AGAIN|MFILE|NFILE|NOMEM|NOSPC)\b|JavaScript heap out of memory|Cannot allocate memory|Resource temporarily unavailable|Token not found in system keyring|Process from config\.webServer was not able to start|\[birpc\] rpc is closed, cannot call\b|\[vitest-worker\]: Timeout calling\b/i;
 // Capture invalidation is deliberately narrower than the gate's infrastructure vocabulary above:
 // keyring/config-webServer startup failures remain gate concerns, while this policy is specifically
 // for evidence that the capture ran while the machine was resource-starved.