tickmarkr 2.1.6 → 2.1.7

package/dist/run/daemon.js

@@ -1,6 +1,6 @@
 import { createHash, randomBytes } from "node:crypto";
 import { shq } from "../adapters/types.js";
-import { appendFileSync, closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readlinkSync, readSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { appendFileSync, closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, readlinkSync, readSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { stringify } from "yaml";
@@ -15,7 +15,7 @@ import { herdrSealShellPrefix, SubprocessDriver } from "../drivers/subprocess.js
 import { formatOwnedName } from "../drivers/types.js";
 import { captureBaseline, detectGateCommands, detectVacuousOracles } from "../gates/baseline.js";
 import { runGates } from "../gates/run-gates.js";
-import { addEvidence, attributeBlocked, blockedTasks, getTask, graphDefinitionHash, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus, taskContentDigest } from "../graph/graph.js";
+import { addEvidence, attributeBlocked, blockedTasks, getTask, graphDefinitionHash, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus, taskContentDigest, tickmarkrDir } from "../graph/graph.js";
 import { GATE_NAMES } from "../graph/schema.js";
 import { augmentRetryBrief, consult, renderRetryGuidance } from "./consult.js";
 import { runEnvironment } from "./environment.js";
@@ -23,7 +23,7 @@ import { cleanupRunWorktrees, gitHead, linkNodeModules, npmDependencyInstallComm
 import { runInteractiveSeed } from "./interactive-seed.js";
 import { activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingReviewFindings, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, renderStructuredReviewFinding, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
 import { isDiffCapPark } from "../gates/review.js";
-import { acquireApprovalSerialization, acquireRunLock, releaseRunLock } from "./lock.js";
+import { acquireApprovalSerialization, acquireRunLock, isPidLive, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, verifyIntegrationTip } from "./merge.js";
 import { nextChannel, route } from "../route/router.js";
 import { desiredPanes } from "./reconcile.js";
@@ -764,6 +764,37 @@ function recordFatalRunEnd(journal, runId, branch, err) {
         console.error(`tickmarkr ${runId}: run crashed — no terminal record written; journal sink unwritable at ${journalPath} (${retryErr instanceof Error ? retryErr.message : String(retryErr)}) — original error: ${original}`);
     }
 }
+// OBS-777: the fleet fold cannot distinguish an orphan from another repository's live worker. Give
+// it one repository-scoped snapshot instead: terminal journals are ended, and an open lifecycle is
+// ended only when the shared lock predicate can prove its last recorded daemon pid dead.
+function endedRunIdsForReconcile(repoRoot) {
+    const ended = new Set();
+    const dir = join(tickmarkrDir(repoRoot), "runs");
+    if (!existsSync(dir))
+        return ended;
+    let runIds;
+    try {
+        runIds = readdirSync(dir);
+    }
+    catch {
+        return ended;
+    }
+    for (const runId of runIds) {
+        try {
+            const events = Journal.open(repoRoot, runId).read();
+            if (runHasEnded(events)) {
+                ended.add(runId);
+                continue;
+            }
+            const lifecycle = [...events].reverse().find((event) => (event.event === "run-start" || event.event === "run-resume")
+                && Number.isInteger(event.data.pid) && event.data.pid > 0);
+            if (lifecycle && !isPidLive(lifecycle.data.pid))
+                ended.add(runId);
+        }
+        catch { /* incomplete or foreign run directory — it proves nothing */ }
+    }
+    return ended;
+}
 export async function runDaemon(repoRoot, opts = {}) {
     // v1.51 T2 / OBS-89 (v1.60): retired --quality env seam. Mode resolution owns premium routing;
     // route() no longer reads the retired env at all, so the old entrypoint scrub is gone with it.
@@ -781,6 +812,7 @@ export async function runDaemon(repoRoot, opts = {}) {
     // subprocess, so the optional-chain open below is a no-op there). Cosmetic-only: any failure is
     // swallowed (never affects the run); the operator closes a surviving watch pane.
     const lock = acquireRunLock(repoRoot, runId);
+    const endedRunIds = endedRunIdsForReconcile(repoRoot); // one snapshot for every sweep this caller makes
     // D10: the lock is this daemon's liveness record and already carries its pid; status prints that
     // identity beside the supervision row. The `orchestrator` tier belongs exclusively to the seated
     // supervisor, so a run never beats or stands down that seat's record on the daemon's behalf.
@@ -878,7 +910,7 @@ export async function runDaemon(repoRoot, opts = {}) {
             // Termination (SIGINT/SIGTERM): record the daemon-controlled exit before closing every live slot,
             // reconcile owned panes against an EMPTY
             // desired set (herdr panes not in memory; panesToClose spares foreign names, watch panes, and
-            // other runs' panes by construction), release the run lock, then exit. There is still no run-end,
+            // live/unknown other runs' panes by construction), release the run lock, then exit. There is still no run-end,
             // so stop-amend-resume keeps resuming; exit-cause distinguishes this deliberate stop from an
             // observer-classified abrupt death. keepPanes:"forever" (the
             // keep-everything debug override) preserves panes but still releases the lock and exits.
@@ -907,7 +939,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 catch { /* cosmetic — reconcile is the backstop */ }
                             }
                             try {
-                                await driver.reconcile?.(new Set(), runId);
+                                await driver.reconcile?.(new Set(), runId, { endedRunIds });
                             }
                             catch { /* cosmetic — visibility is never a gate */ }
                         }
@@ -1093,7 +1125,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // herdr's watches bookkeeping lives in close(), and a raw pane-close in the sweep would
                     // leave narrator() a stale cache) — the driver always sees it as desired; its lifecycle is
                     // decided here from the fold alone.
-                    await driver.reconcile?.(new Set([...desired, watchName]), runId, opts);
+                    await driver.reconcile?.(new Set([...desired, watchName]), runId, { ...opts, endedRunIds });
                     // OBS-103: when the fold retires the watch (run-end boundary), close the narrator. The
                     // decision keys on the run identity in the pane name — narrator() adopts a prior daemon
                     // instance's pane under the same owned name, so a stop→resume cycle's leftover narrator
@@ -1109,7 +1141,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                     /* cosmetic — visibility is never a gate */
                 }
             };
-            await reconcile(); // run start/resume boundary: nothing in flight — full sweep, incl. older runs' leftovers
+            // run start/resume boundary: nothing in flight, so the sweep takes this run's judge/review/consult
+            // panes too. OBS-777: the one startup snapshot lets it reclaim only older runs proven ended, while
+            // every live or unknown run remains spared.
+            await reconcile();
             // v1.4 self-reference guard: a random nonce on the worker trailer AND exit marker. Displayed
             // source/diffs (e.g. a worker editing tickmarkr's own prompt.ts/daemon.ts) can't know it, so an echoed
             // TICKMARKR_RESULT/TICKMARKR_EXIT literal can never premature-harvest the worker. Quote-split keeps the

package/dist/run/journal.js

@@ -7,6 +7,7 @@ import { stateDirName, taskContentDigest, tickmarkrDir } from "../graph/graph.js
 import { GATE_NAMES, TIERS } from "../graph/schema.js";
 import { buildProfile, classify } from "../route/profile.js";
 import { DecisionEventSchema, trackJournalRows, } from "./protocol.js";
+import { normalizeGateOutcome } from "./outcome.js";
 import { redactSecrets } from "./redact.js";
 export function phaseForGate(gate) {
     if (gate === "acceptance")
@@ -15,6 +16,23 @@ export function phaseForGate(gate) {
         return "review";
     return `gate:${gate}`;
 }
+/** The pipe projects the same normalized gate outcome as the TTY rail. The selected-test field only
+ * chooses the held outcome's operator noun after the accessor has classified it; it is not a second
+ * verdict read. */
+const journalGateDetail = (data) => {
+    if (typeof data.gate !== "string")
+        return undefined;
+    switch (normalizeGateOutcome(data).kind) {
+        case "passed":
+            return `${data.gate} passed`;
+        case "failed":
+            return `${data.gate} failed`;
+        case "held":
+            return Array.isArray(data.selectedTests) ? `${data.gate} selected-test screen` : `${data.gate} held`;
+        default:
+            return data.gate;
+    }
+};
 export function formatJournalNarration({ event, taskId, data }) {
     const assignment = data.assignment;
     const direct = [data.summary, data.reason, data.error, data.step, data.action, data.lint, data.branch, data.from]
@@ -26,7 +44,9 @@ export function formatJournalNarration({ event, taskId, data }) {
                 ? `${data.gate} failed${typeof data.lastMergedTask === "string" ? ` after ${data.lastMergedTask}` : ""}`
                 : event === "tip-verify"
                     ? `${data.gate} passed`
-                    : `${data.gate}${data.pass === true ? " passed" : data.pass === false ? " failed" : ""}`
+                    : event === "gate-result"
+                        ? journalGateDetail(data)
+                        : `${data.gate}`
             : typeof data.code === "number" ? `exit ${data.code}`
                 : typeof data.pid === "number" ? `pid ${data.pid}`
                     : typeof data.baseRef === "string" ? `base ${data.baseRef.slice(0, 12)}`

package/dist/run/outcome.js

@@ -88,7 +88,14 @@ export function normalizeGateOutcome(source) {
         return { kind: "unavailable", reason: `malformed gate result: expected an object, read ${shape}` };
     }
     const row = source;
-    // `kind` selects the canonical format. It must validate as exactly one canonical arm without any
+    // A gate-result data wrapper states its canonical verdict in `outcome`. Consumers may pass either
+    // the wrapper or the outcome itself; both must read the same kind even if stale bare fields remain.
+    if (hasOwn(row, "outcome")) {
+        if (isGateOutcome(row.outcome))
+            return row.outcome;
+        return { kind: "unavailable", reason: reasonOf(row, "malformed gate result: invalid explicit outcome") };
+    }
+    // `kind` selects the canonical outcome object. It must validate as exactly one canonical arm without any
     // legacy truth discriminator; otherwise continuing through the legacy branches could reinterpret a
     // contradictory dual-write as passed, failed or infra. Mixed and malformed canonical rows stay
     // explicitly unavailable, retaining any reason/details the producer did manage to state.

package/dist/run/supervision.d.ts

@@ -3,6 +3,8 @@ export declare const SUPERVISION_BEAT_MS = 10000;
 /** Ceiling before a beat reads STALE: SIX beats, lock.ts's ratio — five may be missed before alarm. */
 export declare const SUPERVISION_STALE_MS: number;
 export declare const SUPERVISION_FUTURE_GRACE_MS = 1000;
+/** Context watchers act at 75% unless their invocation declares another threshold. */
+export declare const SUPERVISION_DEFAULT_THRESHOLD_PCT = 75;
 export declare const SUPERVISION_TIERS: readonly ["orchestrator", "orchestrator-context", "overseer", "overseer-context", "watch"];
 export type SupervisionTier = (typeof SUPERVISION_TIERS)[number];
 export declare const SUPERVISION_SEAT_TIERS: readonly ["orchestrator", "orchestrator-context", "overseer", "overseer-context"];
@@ -17,16 +19,28 @@ export interface TierLiveness {
     beatAgeMs?: number;
     /** The seat the record names, when it names one. Always present on a seat tier that is not ABSENT. */
     seat?: string;
+    /** The alarm's durable duty, orthogonal to whether its watcher is armed, stale or stood down. */
+    clearOwedSince?: string;
+    /** The latch exists but cannot be decoded; never mistaken for no duty owed. */
+    clearOwedUnreadable?: true;
+}
+/** A watcher observation that can raise or discharge the seat's clear obligation. */
+export interface SupervisionBeatObservation {
+    armId: string;
+    pct: number;
+    thresholdPct: number;
 }
 export declare const supervisionBeatPath: (repoRoot: string, tier: SupervisionTier) => string;
 /** Where a watcher records that it STOOD DOWN. Its own file: the beat keeps meaning only "alive". */
 export declare const supervisionStandDownPath: (repoRoot: string, tier: SupervisionTier) => string;
-export declare function beatSupervision(repoRoot: string, tier: SupervisionTier, seat?: string): void;
+export declare function beatSupervision(repoRoot: string, tier: SupervisionTier, seat?: string, observation?: SupervisionBeatObservation): void;
 /** Handle a watcher holds for as long as it is supervising; disarm stands it down and is idempotent. */
 export interface ArmedSupervision {
     disarm: () => void;
 }
 export declare function armSupervision(repoRoot: string, tier: SupervisionTier, beatMs?: number, seat?: string): ArmedSupervision;
+/** Arm the live status board's own tier through the normal supervision writer and lifecycle. */
+export declare function armWatchSupervision(repoRoot: string, beatMs?: number): ArmedSupervision;
 export declare function readTierLiveness(repoRoot: string, tier: SupervisionTier, now?: number): TierLiveness;
 export declare function supervisionStatus(repoRoot: string, tier: SupervisionTier, now?: number): TierLiveness;
 /** Every KNOWN tier, always — a tier omitted from this list would read as one that is fine. */

package/dist/run/supervision.js

@@ -14,8 +14,8 @@ import { stateDirName, tickmarkrDir } from "../graph/graph.js";
 //
 // SUP-02: the beat mtime is the ONLY input. Nothing here reads a process table and nothing matches a
 // process name — a poll-grep watcher carries `grep` in its own argv, so the filter that removes the
-// probing grep removes the watched one. The payload records a pid for an OPERATOR to read off a STALE
-// record; the derivation never consults it, so a reused, dead or unreadable pid changes no state.
+// probing grep removes the watched one. The payload's exitedWriterPid identifies the one-shot writer
+// for an OPERATOR reading a STALE record; no derivation consults it, so its value changes no state.
 // Zero new deps — node:fs stdlib, exactly as lock.ts.
 /** How often a watcher rewrites its own tier's beat. */
 export const SUPERVISION_BEAT_MS = 10_000;
@@ -27,6 +27,8 @@ export const SUPERVISION_STALE_MS = 6 * SUPERVISION_BEAT_MS;
 // millisecond into the future. A second of slack covers even a coarse filesystem. Anything past it
 // is SKEW, and skew is the one direction this instrument may not fail in: see readTierLiveness.
 export const SUPERVISION_FUTURE_GRACE_MS = 1_000;
+/** Context watchers act at 75% unless their invocation declares another threshold. */
+export const SUPERVISION_DEFAULT_THRESHOLD_PCT = 75;
 // The supervision seats this harness has. An unlisted tier is an INVISIBLE tier, which is the failure
 // mode itself — an auditor read "no watchers were ever armed" off a surface that named none. Adding a
 // seat means adding it here, and `status` then renders it whether or not it has ever beaten.
@@ -55,6 +57,8 @@ const supervisionDir = (repoRoot) => join(repoRoot, stateDirName(repoRoot), "sup
 export const supervisionBeatPath = (repoRoot, tier) => join(supervisionDir(repoRoot), `${tier}.beat`);
 /** Where a watcher records that it STOOD DOWN. Its own file: the beat keeps meaning only "alive". */
 export const supervisionStandDownPath = (repoRoot, tier) => join(supervisionDir(repoRoot), `${tier}.standdown`);
+/** The independent latch a stand-down cannot overwrite or remove. */
+const supervisionObligationPath = (repoRoot, tier) => join(supervisionDir(repoRoot), `${tier}.clear-owed`);
 // SUP-06: PRESENCE — one file per ARMED WATCHER, because a tier may legitimately have more than one.
 // Two boards watch one repo the moment an operator opens a second pane, and the tier is armed while
 // EITHER of them lives. The stand-down marker speaks for the whole tier, so the first board out
@@ -93,25 +97,102 @@ function stalePeersIfLast(repoRoot, tier, id, now = Date.now()) {
     }
     return stale;
 }
+/** Read the latch without creating, touching or repairing it. */
+function readClearObligation(repoRoot, tier) {
+    const p = supervisionObligationPath(repoRoot, tier);
+    let st;
+    try {
+        st = statSync(p);
+    }
+    catch (e) {
+        const code = e.code;
+        return code === "ENOENT" || code === "ENOTDIR" ? "NONE" : "UNREADABLE";
+    }
+    if (!st.isFile())
+        return "UNREADABLE";
+    try {
+        const rec = JSON.parse(readFileSync(p, "utf8"));
+        if (rec?.tier !== tier)
+            return "UNREADABLE";
+        if (typeof rec.clearOwedSince !== "string" || Number.isNaN(Date.parse(rec.clearOwedSince)))
+            return "UNREADABLE";
+        if (typeof rec.armId !== "string" || !rec.armId.trim())
+            return "UNREADABLE";
+        if (typeof rec.thresholdPct !== "number" || !Number.isFinite(rec.thresholdPct)
+            || rec.thresholdPct < 0 || rec.thresholdPct > 100)
+            return "UNREADABLE";
+        return { clearOwedSince: rec.clearOwedSince, armId: rec.armId, thresholdPct: rec.thresholdPct };
+    }
+    catch {
+        return "UNREADABLE";
+    }
+}
+/** Publish a crossing atomically; a firing replacement inherits the original duty's instant. */
+function raiseClearObligation(repoRoot, tier, armId, thresholdPct) {
+    const existing = readClearObligation(repoRoot, tier);
+    if (typeof existing === "object" && existing.armId === armId)
+        return;
+    if (existing === "UNREADABLE") {
+        throw new Error(`${tier} clear obligation is unreadable — refusing to overwrite a duty that may still be owed`);
+    }
+    const p = supervisionObligationPath(repoRoot, tier);
+    const tmp = `${p}.${process.pid}.${randomUUID()}.tmp`;
+    mkdirSync(dirname(p), { recursive: true });
+    writeFileSync(tmp, JSON.stringify({
+        tier, armId, thresholdPct,
+        clearOwedSince: typeof existing === "object" ? existing.clearOwedSince : new Date().toISOString(),
+    }) + "\n");
+    renameSync(tmp, p);
+}
+/** Only a different arm observed below the firing threshold proves the old seat was cleared. */
+function dischargeClearObligation(repoRoot, tier, observation) {
+    const existing = readClearObligation(repoRoot, tier);
+    if (existing === "UNREADABLE") {
+        throw new Error(`${tier} clear obligation is unreadable — refusing to erase a duty that may still be owed`);
+    }
+    if (typeof existing === "object" && existing.armId !== observation.armId
+        && observation.pct < existing.thresholdPct) {
+        rmSync(supervisionObligationPath(repoRoot, tier), { force: true });
+    }
+}
+function validateObservation(observation) {
+    if (!observation.armId.trim())
+        throw new Error("a supervision observation needs a non-empty arm identity");
+    for (const [name, value] of [["pct", observation.pct], ["threshold-pct", observation.thresholdPct]]) {
+        if (!Number.isFinite(value) || value < 0 || value > 100) {
+            throw new Error(`--${name} must be a number from 0 through 100`);
+        }
+    }
+}
 // WRITER — a watcher's own call, on its own tier, every SUPERVISION_BEAT_MS. Never a reader's: the
 // purity fence (status --watch leaves the state dir byte-identical) is the test that catches a reader
 // that beats on the watcher's behalf, which would report every dead tier as healthy.
-function writeSupervisionBeat(repoRoot, tier, seat, armId) {
+function writeSupervisionBeat(repoRoot, tier, seat, armId, observation) {
     // A seat tier may not be armed anonymously, and the refusal belongs HERE rather than only in the
     // verb: any caller that could write a seatless record could arm a tier nobody occupies.
     if (isSeatTier(tier) && !seat?.trim()) {
         throw new Error(`${tier} is a per-seat tier — a beat must declare the seat identity it speaks for`);
     }
+    if (observation !== undefined)
+        validateObservation(observation);
     tickmarkrDir(repoRoot); // the write path DOES create — beats land inside the gitignored state dir
     const p = supervisionBeatPath(repoRoot, tier);
     mkdirSync(dirname(p), { recursive: true });
+    // Raise before the beat so a later beat failure cannot hide a duty; discharge only after the
+    // below-threshold observation exists on disk.
+    if (observation !== undefined && observation.pct >= observation.thresholdPct) {
+        raiseClearObligation(repoRoot, tier, observation.armId, observation.thresholdPct);
+    }
     writeFileSync(p, JSON.stringify({
         tier, ...(seat ? { seat } : {}), ...(armId ? { armId } : {}),
-        pid: process.pid, beatAt: new Date().toISOString(),
+        ...(observation !== undefined ? { pct: observation.pct, thresholdPct: observation.thresholdPct } : {}),
+        exitedWriterPid: process.pid, beatAt: new Date().toISOString(),
     }) + "\n");
+    if (observation !== undefined)
+        dischargeClearObligation(repoRoot, tier, observation);
 }
-export function beatSupervision(repoRoot, tier, seat) {
-    writeSupervisionBeat(repoRoot, tier, seat);
+export function beatSupervision(repoRoot, tier, seat, observation) {
+    writeSupervisionBeat(repoRoot, tier, seat, undefined, observation);
 }
 // THE WATCHER-FACING ENTRY POINT — the loop SUPERVISION_BEAT_MS actually drives. A supervising seat
 // calls this once at the top of its watch and holds the handle for the duration; a seat that dies,
@@ -138,7 +219,7 @@ export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS, sea
     }
     catch { /* uncleared: the reader validates the marker and a newer beat outranks it — never masked */ }
     // This watcher's own identity fences BOTH its presence and its stand-down against every later arm.
-    // pid alone collides between two boards in one host (and after pid reuse); a UUID never aliases the
+    // A process id alone collides between two boards in one host (and after reuse); a UUID never aliases the
     // stale presence of a killed process that a later last-one-out cleanup may already have observed.
     const id = `${process.pid}.${randomUUID()}`;
     const presence = supervisionPresencePath(repoRoot, tier, id);
@@ -146,7 +227,7 @@ export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS, sea
     const mark = () => {
         try {
             writeSupervisionBeat(repoRoot, tier, seat, id); // creates the directory presence is written into
-            writeFileSync(presence, JSON.stringify({ tier, pid: process.pid, id }) + "\n");
+            writeFileSync(presence, JSON.stringify({ tier, exitedWriterPid: process.pid, id }) + "\n");
         }
         catch { /* repo gone / disk full / no seat — the tier ages out rather than crashing its watcher */ }
     };
@@ -182,7 +263,7 @@ export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS, sea
                 mkdirSync(dirname(p), { recursive: true });
                 writeFileSync(tmp, JSON.stringify({
                     tier, ...(seat ? { seat } : {}), armId: id,
-                    pid: process.pid, disarmedAt: new Date().toISOString(),
+                    exitedWriterPid: process.pid, disarmedAt: new Date().toISOString(),
                 }) + "\n");
                 renameSync(tmp, p);
             }
@@ -198,6 +279,10 @@ export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS, sea
         },
     };
 }
+/** Arm the live status board's own tier through the normal supervision writer and lifecycle. */
+export function armWatchSupervision(repoRoot, beatMs = SUPERVISION_BEAT_MS) {
+    return armSupervision(repoRoot, "watch", beatMs);
+}
 // BEAT DERIVATION — pure, and the only thing that reads the beat. One statSync: never creates,
 // touches or reaps the record it reports on, and never creates the directory that holds it. ONLY a
 // missing path is ABSENT: ENOENT (no beat file) and ENOTDIR (nothing that could hold one) mean no
@@ -206,7 +291,7 @@ export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS, sea
 // never silently ARMED. Callers wanting the TIER's state want supervisionStatus below; this answers
 // the narrower question "does the beat say alive", which is all a beat can ever say.
 export function readTierLiveness(repoRoot, tier, now = Date.now()) {
-    return beatLiveness(tier, readBeat(repoRoot, tier), now);
+    return withClearObligation(repoRoot, tier, beatLiveness(tier, readBeat(repoRoot, tier), now));
 }
 // The beat's inode, or why there is no age to derive from it. Split out so the stand-down ranking below
 // reads the SAME mtime this derivation does rather than a second, later stat of a moving record.
@@ -266,6 +351,15 @@ function beatLiveness(tier, beat, now) {
     const beatAgeMs = Math.max(0, age); // inside the grace: the two clocks' resolutions, not skew
     return { tier, state: beatAgeMs > SUPERVISION_STALE_MS ? "STALE" : "ARMED", beatAgeMs, ...named };
 }
+/** Add the independent duty without replacing or reinterpreting the watcher's state. */
+function withClearObligation(repoRoot, tier, liveness) {
+    const obligation = readClearObligation(repoRoot, tier);
+    if (obligation === "NONE")
+        return liveness;
+    return obligation === "UNREADABLE"
+        ? { ...liveness, clearOwedUnreadable: true }
+        : { ...liveness, clearOwedSince: obligation.clearOwedSince };
+}
 // A stand-down is only what a watcher RECORDED, so the record has to READ as one: a regular file whose
 // payload names this tier and the instant it stood down. Path existence is not proof — a directory, a
 // torn write or a stray file at that path says nothing about any watcher, and calling one of those a
@@ -317,15 +411,17 @@ export function supervisionStatus(repoRoot, tier, now = Date.now()) {
     const beat = readBeat(repoRoot, tier);
     const standDown = readStandDown(repoRoot, tier);
     if (standDown === "UNREADABLE")
-        return { tier, state: "UNREADABLE" };
+        return withClearObligation(repoRoot, tier, { tier, state: "UNREADABLE" });
     const beatOutranksStandDown = standDown !== "NONE" && typeof beat === "object" && (beat.mtimeMs > standDown.mtimeMs || (now - beat.mtimeMs <= SUPERVISION_STALE_MS &&
         beat.armId !== undefined && standDown.armId !== undefined && beat.armId !== standDown.armId));
     if (standDown !== "NONE" && !beatOutranksStandDown) {
         // the seat that stood down is named by the marker, falling back to whatever its last beat named
         const seat = standDown.seat ?? (typeof beat === "object" ? beat.seat : undefined);
-        return { tier, state: "DISARMED", ...(seat !== undefined ? { seat } : {}) };
+        return withClearObligation(repoRoot, tier, {
+            tier, state: "DISARMED", ...(seat !== undefined ? { seat } : {}),
+        });
     }
-    return beatLiveness(tier, beat, now);
+    return withClearObligation(repoRoot, tier, beatLiveness(tier, beat, now));
 }
 /** Every KNOWN tier, always — a tier omitted from this list would read as one that is fine. */
 export const readSupervision = (repoRoot, now = Date.now()) => SUPERVISION_TIERS.map((tier) => supervisionStatus(repoRoot, tier, now));
@@ -333,4 +429,6 @@ export const readSupervision = (repoRoot, now = Date.now()) => SUPERVISION_TIERS
 // The seat is rendered BESIDE the state, never instead of it: `overseer-context ARMED (w3:p2)` says
 // both that something is beating and who is behind it, which is the pair an operator needs to act. A
 // row with no seat to name renders exactly as it always did.
-export const supervisionText = (tiers, divider = " · ") => `supervision: ${tiers.map((t) => `${t.tier} ${t.state}${t.seat ? ` (${t.seat})` : ""}`).join(divider)}`;
+export const supervisionText = (tiers, divider = " · ") => `supervision: ${tiers.map((t) => `${t.tier} ${t.state}${t.seat ? ` (${t.seat})` : ""}` +
+    `${t.clearOwedSince ? ` CLEAR-OWED since ${t.clearOwedSince}` : ""}` +
+    `${t.clearOwedUnreadable ? " CLEAR-OWED unreadable" : ""}`).join(divider)}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.1.6",
+  "version": "2.1.7",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-auto/SKILL.md

@@ -45,7 +45,8 @@ Before `tickmarkr compile` or `tickmarkr run`, compare the installed binary agai
 
 1. Run `tickmarkr version` (one line, machine-parseable).
 2. Read the `version` field from the repository's `package.json`.
-3. If the binary and repository do not **agree on the entire version** (including the patch; e.g. binary `2.1.0` vs repo `2.1.1`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`) or link the repo binary. Do not compile, plan, or run on hope.
+3. If the binary and repository do not **agree on the entire version** (including the patch; e.g. binary `2.1.0` vs repo `2.1.1`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`), or to install this repository's build as a REAL COPY — `npm pack`, then `npm i -g ./<tarball>`. Do not compile, plan, or run on hope.
+   > ⚠ **Never `npm i -g .` on the repository directory, and never link it.** npm SYMLINKS a directory install, which makes the working tree itself the machine-wide binary: every later build — including a gate's own `npm run build` — silently hot-swaps the CLI for every repository on the machine, with no version change to notice it by. Measured 2026-08-29: a verify build gate rewrote the shared binary while another repository's daemon was mid-run against it, and a positive control that rebuilds at a pre-fix ref would have installed the very defect it was proving fixed, machine-wide (OBS-771). Verify an install by comparing the global and repo **inodes** — they must DIFFER — never by `tickmarkr version`, which cannot go red when nothing is bumped.
 
 A stale binary silently skips daemon gates shipped in newer releases — the v1.38 run exposed this when a global `1.36.0` binary missed the daemon tip-verify gate entirely (OBS-38). Preflight failure is always stop-and-report; never proceed-and-hope.
 

package/skills/tickmarkr-loop/SKILL.md

@@ -40,7 +40,8 @@ Before `tickmarkr compile` or `tickmarkr run`, compare the installed binary agai
 
 1. Run `tickmarkr version` (one line, machine-parseable).
 2. Read the `version` field from the repository's `package.json`.
-3. If the binary and repository do not **agree on the entire version** (including the patch; e.g. binary `2.1.0` vs repo `2.1.1`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`) or link the repo binary. Do not compile, plan, or run on hope.
+3. If the binary and repository do not **agree on the entire version** (including the patch; e.g. binary `2.1.0` vs repo `2.1.1`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`), or to install this repository's build as a REAL COPY — `npm pack`, then `npm i -g ./<tarball>`. Do not compile, plan, or run on hope.
+   > ⚠ **Never `npm i -g .` on the repository directory, and never link it.** npm SYMLINKS a directory install, which makes the working tree itself the machine-wide binary: every later build — including a gate's own `npm run build` — silently hot-swaps the CLI for every repository on the machine, with no version change to notice it by. Measured 2026-08-29: a verify build gate rewrote the shared binary while another repository's daemon was mid-run against it, and a positive control that rebuilds at a pre-fix ref would have installed the very defect it was proving fixed, machine-wide (OBS-771). Verify an install by comparing the global and repo **inodes** — they must DIFFER — never by `tickmarkr version`, which cannot go red when nothing is bumped.
 
 A stale binary silently skips daemon gates shipped in newer releases — the v1.38 run exposed this when a global `1.36.0` binary missed the daemon tip-verify gate entirely (OBS-38). Preflight failure is always stop-and-report; never proceed-and-hope.
 

package/skills/tickmarkr-overseer/SKILL.md

@@ -60,6 +60,11 @@ through brief lineage. **An executor choice nobody made is still an executor cho
    OPERATOR LAYOUT/CONVENTION rather than a shipped milestone — names like `*-discipline`, `*-drill`,
    `*-parity`, `*-least-permission`, `context-reset-*`, `consults-*`, `agent-*`, `*-tab-layout`,
    `*-visible-*`, `*-panes*`, `user-tabs-*`.
+   **A standing instruction carries its revocation premise.** Every standing rule you lift from memory,
+   handoff or a live correction states the premise that makes it true and the concrete observation that
+   would falsify that premise and revoke the rule. If you cannot name the falsifier, you have written a
+   preference, not standing supervision law. When the falsifier arrives, retire or amend the rule in the
+   shipped skill in the same act; do not leave successors to obey a rule whose reason is already false.
    **Earned 2026-08-04, expensively.** That directory held `…-falsification-drill-discipline.md`, written
    three weeks earlier: *"a gate or grep-pin is assumed WRONG until a falsification drill proves it bites…
    run the drill that should redden it and SEE the red before trusting green."* That is Evidence discipline
@@ -565,6 +570,10 @@ cleared, re-briefed, or replaced keeps beating that tier's file forever. Measure
 **three-hour window in which no orchestrator was alive**, and it would have silently re-armed a
 recorded stand-down within 10 seconds. On the same sweep the overseer tier had **three** beat loops,
 one owned by an unrelated session. So:
+- **Split the liveness reads.** A tier's liveness is read from beat freshness in the repository status
+  path; a loop's liveness is read from the live process payload that is emitting that beat (`tickmarkr
+  beat <tier> --seat <seat>` in this repo). Neither liveness claim is read from a recorded pid: a pid
+  recorded earlier can be stale, reused, or detached from the beat now holding the tier green.
 - **At every adopt, clear, or re-brief, sweep for pre-existing loops on YOUR tier before arming one**
   (`pgrep -f "tickmarkr beat <tier>"`), trace each to its parent session, and kill the **loop only**
   — never the parent — then verify the parent survived.

package/skills/tickmarkr-overseer/scripts/watch-context.sh

@@ -20,15 +20,15 @@
 # than absent. Four rules the shipped version broke, each of which made the tier lie:
 #   1. BEAT ON THE SUPERVISION CADENCE, NOT ON THE POLL. Beats gap by TICK (below), never by POLL, so a
 #      poll interval above the supervision beat interval cannot leave the tier stale half of every cycle.
-#   2. BEAT ONLY AFTER A SUCCESSFUL READ. A watcher that cannot see its seat's percentage is not
-#      watching it; beating anyway reports coverage it is not providing, and the tier must age out.
+#   2. BEAT AFTER EVERY SUCCESSFUL SCREEN READ. A missing percentage is an explicit UNREADABLE
+#      observation: it must keep the live watcher armed but can never reach warn or act. Only a failed
+#      screen read withholds the beat, because then the watcher cannot see its seat at all.
 #   3. WARN DOES NOT EXIT. Warn precedes act, so exiting at warn meant the act was never reached and the
 #      last beat aged into a permanent stale — gradual growth never reached the auto-clear path at all.
 #   4. EVERY TERMINAL EXIT STANDS THE TIER DOWN, so a watcher that finished reads DISARMED, not dead.
 #      Only a killed watcher reads STALE, which is exactly what STALE means.
-#   5. A BLIND READ ALARMS (OBS-739). Ageing the tier is visible only to someone already reading the beat
-#      table; the seat that armed this watcher must be TOLD its instrument went blind. Silence and health
-#      must never look alike.
+#   5. AN UNREADABLE FIELD REPORTS ITSELF (OBS-739/780). Silence, health and a trustworthy percentage
+#      are three different states. UNREADABLE stays supervised but never authorises a destructive act.
 #
 # usage: watch-context.sh <role-slug> <agent|pane> <warn-pct> <act-pct> [handoff-file] [poll-s] [cap-s]
 #   <role-slug> is ANY seat role — orchestrator, overseer, surgeon, consult — and names the tier
@@ -63,8 +63,8 @@ TIER="${ROLE}-context"
 
 
 # The supervision beat interval (SUPERVISION_BEAT_MS = 10s). The loop ticks at the beat cadence or the
-# caller's poll, whichever is SHORTER: a beat may only follow a successful read (rule 2), so the read
-# cadence is the floor on the beat cadence, and the tier's freshness is never the caller's to widen.
+# caller's poll, whichever is SHORTER. Every successful screen read beats; its result is either a
+# percentage safe to compare or the explicit UNREADABLE state.
 BEAT_EVERY=5
 TICK=$(( POLL < BEAT_EVERY ? POLL : BEAT_EVERY ))
 [ "$TICK" -ge 1 ] 2>/dev/null || TICK=1   # a zero or junk poll would spin, not watch
@@ -100,16 +100,18 @@ stand_down() { tickmarkr beat "$TIER" --stand-down --seat "$SEAT" >/dev/null 2>&
 # record the hand-off. A killed watcher never runs it, which is the one case that must read STALE.
 trap stand_down EXIT
 
-# The seat's own rendered truth. Prefer a line carrying a context marker so a percentage elsewhere on
-# screen cannot be mistaken for the gauge — but NEVER require one: the ✳ marker the shipped version
-# anchored on is rendered by a single vendor, so every other seat read empty, beat anyway and slept to
-# its cap while its tier claimed coverage. The last percentage in the statusline window is the fallback.
+# The seat's rendered truth lives on the model banner. Select that line first, then read a percentage
+# only from it: a bare numeric search across the visible window can borrow an old N% from scrollback
+# when a long live-run segment pushes the real field past the pane's visible width (OBS-780).
 context_pct() {
-  local screen marked
+  local screen banner pct
   screen=$(herdr agent read "$TARGET" --source visible --lines 8 2>/dev/null) || return 1
-  marked=$(printf '%s\n' "$screen" | grep -iE '✳|context' | grep -oE '[0-9]+%' | tail -1 | tr -d '%')
-  [ -n "$marked" ] && { printf '%s\n' "$marked"; return 0; }
-  printf '%s\n' "$screen" | grep -oE '[0-9]+%' | tail -1 | tr -d '%'
+  banner=$(printf '%s\n' "$screen" |
+    grep -Ei '(^|[^[:alnum:]])(claude|opus|sonnet|haiku|gpt|gemini|glm|kimi|grok|composer|openai|zai)[[:alnum:]_./-]*([[:space:]]|$)' |
+    tail -1)
+  [ -n "$banner" ] || { printf 'UNREADABLE\n'; return 0; }
+  pct=$(printf '%s\n' "$banner" | grep -oE '[0-9]+%' | tail -1 | tr -d '%')
+  [ -n "$pct" ] && printf '%s\n' "$pct" || printf 'UNREADABLE\n'
 }
 
 handoff_fresh() {
@@ -144,35 +146,47 @@ act_on() {
 
 warned=0
 elapsed=0
-blind=0            # seconds in the current unreadable spell (OBS-739)
+blind=0            # seconds in the current failed-read spell (OBS-739)
 blind_alarmed=0
+unreadable_reported=0
 BLIND_ALARM_S="${TKR_BLIND_ALARM_S:-120}"
 while [ "$elapsed" -lt "$CAP" ]; do
-  P=$(context_pct)
+  if ! P=$(context_pct); then P=""; fi
   if [ -z "$P" ]; then
-    # Rule 2: no reading, no beat. The tier ages to STALE and a supervisor comes looking, which is the
-    # truth about a watcher that cannot see the seat it was armed on.
-    #
-    # Rule 5 (OBS-739): ALARM ON THE BLIND READ. Ageing a tier is not enough — it is only visible to
-    # someone already reading the beat table, and the measured failure was a watcher ALIVE AND BLIND for
-    # hours because the run's own status text pushed the percentage off the statusline. An instrument
-    # that cannot report its own absence is worse than none: the seat believes it has coverage and stops
-    # looking. So say so on stdout, where the supervising seat is actually woken. Once per blind spell,
-    # not every tick — a repeating alarm trains the reader to ignore it.
+    # The screen read itself failed: no observation, no beat. The tier ages to STALE and the watcher
+    # alarms once, because an instrument that cannot see its seat must never look healthy.
+    unreadable_reported=0
     blind=$((blind + TICK))
     if [ "$blind" -ge "$BLIND_ALARM_S" ] && [ "$blind_alarmed" -eq 0 ]; then
       blind_alarmed=1
-      echo "CONTEXT_BLIND $TARGET — no percentage readable for ${blind}s; tier ${TIER} is ALIVE AND BLIND"
-      echo "  this watcher is NOT providing coverage: read the seat by hand and re-arm on a clear statusline"
-      echo "  do NOT substitute the token total — '∑ Nk tok' is cumulative SPEND, not context fill"
+      echo "CONTEXT_BLIND $TARGET — screen unreadable for ${blind}s; tier ${TIER} is ALIVE AND BLIND"
+      echo "  this watcher is NOT providing coverage: read the seat by hand and repair the screen read"
     fi
     sleep "$TICK"; elapsed=$((elapsed + TICK)); continue
   fi
-  # a successful read closes the blind spell and re-arms the alarm for the next one
+
+  if [ "$P" = "UNREADABLE" ]; then
+    # The screen read succeeded, so keep the watcher armed. The absent field is still not a number:
+    # report it once per spell and never let it flow into warn or act.
+    if [ "$blind_alarmed" -eq 1 ]; then
+      echo "CONTEXT_BLIND_CLEARED $TARGET — screen readable again after ${blind}s blind"
+    fi
+    blind=0; blind_alarmed=0
+    beat
+    if [ "$unreadable_reported" -eq 0 ]; then
+      unreadable_reported=1
+      echo "CONTEXT_UNREADABLE $TARGET — model banner has no visible percentage; no warn or act authorised"
+    fi
+    sleep "$TICK"; elapsed=$((elapsed + TICK)); continue
+  fi
+
+  if [ "$unreadable_reported" -eq 1 ]; then
+    echo "CONTEXT_UNREADABLE_CLEARED $TARGET — percentage readable again at ${P}%"
+  fi
   if [ "$blind_alarmed" -eq 1 ]; then
     echo "CONTEXT_BLIND_CLEARED $TARGET — percentage readable again at ${P}% after ${blind}s blind"
   fi
-  blind=0; blind_alarmed=0
+  blind=0; blind_alarmed=0; unreadable_reported=0
   beat
 
   if [ "$P" -ge "$ACT" ] 2>/dev/null; then
@@ -190,4 +204,4 @@ while [ "$elapsed" -lt "$CAP" ]; do
   sleep "$TICK"; elapsed=$((elapsed + TICK))
 done
 
-echo "WATCH_CAP_REACHED $TARGET context=$(context_pct)% — no threshold crossed in ${CAP}s"
+echo "WATCH_CAP_REACHED $TARGET — no threshold crossed in ${CAP}s"