tickmarkr 2.1.6 → 2.1.8

package/dist/gates/run-gates.js

@@ -176,11 +176,11 @@ async function coveringTests(worktree, baseRef) {
         }
         const covering = tests.filter((t) => reachOf(t).has(file));
         if (!covering.length)
-            return undefined; // nothing covers this file — only the full suite can speak for it
+            continue; // nothing covers this file — keep every attributable selection already accumulated
         for (const t of covering)
             selected.add(t);
     }
-    return [...selected].sort();
+    return selected.size ? [...selected].sort() : undefined;
 }
 /**
  * The configured test command narrowed to these files. Mirrors testFiltered's `--` rule (acceptance.ts:104):
@@ -287,7 +287,7 @@ export async function runGates(task, ctx) {
         }
         return { results: sorted, commits };
     };
-    const toolGates = ["build", "test", "lint"].filter(enabled);
+    const toolGates = ["build", "lint"].filter(enabled);
     /**
      * v1.87 T5: the shell gates run their commands against the WORKING TREE, while evidence, scope,
      * the judged diff and the merge all read COMMITS. Uncommitted work is therefore visible to
@@ -337,28 +337,28 @@ export async function runGates(task, ctx) {
             + `Uncommitted at round end:\n${dirt}`,
         meta: { dirtyWorktree: true, dirtyAtRoundEnd: true },
     });
-    // build/test/lint vs the shared baseline
-    const runBattery = async (commands, selected) => {
-        if (!toolGates.length)
+    // shell tools vs the shared baseline
+    const runBattery = async (commands, selected, gates = toolGates) => {
+        if (!gates.length)
             return;
         if (!v185) {
-            // ponytail: compareToBaseline batches build/test/lint — their starts are emitted at iteration,
+            // ponytail: compareToBaseline batches adjacent tools — their starts are emitted at iteration,
             // not at true execution start. They are collectively sub-second (measured), so the debounce
             // suppresses them anyway; split compareToBaseline only if a tool gate ever gets slow.
-            // ponytail: legacy runs build/test/lint in ONE compareToBaseline call, so there is one interval
+            // ponytail: legacy runs adjacent tools in ONE compareToBaseline call, so there is one interval
             // to measure and each of its gates carries it. Split it only if this branch ever stops batching.
             const batchAt = Date.now();
             const batchLoadStart = loadProvider();
-            const toolResults = await compareToBaseline(ctx.worktree, commands, ctx.baseline, toolGates);
+            const toolResults = await compareToBaseline(ctx.worktree, commands, ctx.baseline, [...gates]);
             const batch = { durationMs: Date.now() - batchAt, load1Start: batchLoadStart, load1End: loadProvider() };
-            for (const g of toolGates)
+            for (const g of gates)
                 spans.set(g, batch);
             // The same refusal AFTER the commands, because a green command can dirty the tree the check
             // above just proved clean. Batched, legacy cannot say WHICH command did it, so the refusal
             // lands on the last gate that had one — the round dies there either way. A red battery is
             // reported as the red it is: the round already ends, and the command output is the better lead.
             const dirt = toolResults.every((r) => r.pass) ? await dirtyWorktree() : undefined;
-            const blame = dirt ? [...toolGates].reverse().find((g) => commands[g]) : undefined;
+            const blame = dirt ? [...gates].reverse().find((g) => commands[g]) : undefined;
             for (const r of toolResults) {
                 await emitStart(r.gate);
                 await record(r.gate === blame ? dirtyRefusal(blame, dirt, commands[blame]) : r);
@@ -366,8 +366,8 @@ export async function runGates(task, ctx) {
             return;
         }
         // T4 (OBS-265): one command at a time, stopping at the first red — a failed build no longer buys
-        // the full vitest suite before anyone reads its verdict.
-        for (const g of toolGates) {
+        // any later tool before anyone reads its verdict.
+        for (const g of gates) {
             await emitStart(g);
             const [r] = await measure(g, () => compareToBaseline(ctx.worktree, commands, ctx.baseline, [g]));
             // the screen's interval IS the test gate's first interval, so the split needs no second clock
@@ -437,9 +437,9 @@ export async function runGates(task, ctx) {
      * screen IS the round's verdict: what it produced is journaled (in the order it ran) and the round
      * ends there, so a drive-by out-of-scope edit costs <1s instead of the whole battery.
      *
-     * A green screen changes nothing downstream. The recorded sequence stays GATE_NAMES order, so the
-     * journal, `tickmarkr report`, the surfaces, and resume's GATE_NAMES walk over already-satisfied
-     * gates all keep reading exactly one order.
+     * A green screen changes nothing downstream. The returned record stays in GATE_NAMES order while
+     * the event stream reports the order gates actually ran; resume's GATE_NAMES walk over satisfied
+     * records therefore keeps declaration order without making the live stream lie about execution.
      *
      * ponytail: the price of that is re-reading two git checks (~40ms) in their canonical positions
      * rather than teaching every consumer of the gate stream a second order. Both reads see the same
@@ -447,7 +447,7 @@ export async function runGates(task, ctx) {
      * for. Charge it only when there IS a battery command to protect.
      */
     const screenBlocks = async () => {
-        if (!toolGates.some((g) => ctx.commands[g]))
+        if (!toolGates.some((g) => ctx.commands[g]) && !(enabled("test") && ctx.commands.test))
             return false;
         const screened = [];
         for (const [gate, compute] of [["evidence", evidenceResult], ["scope", scopeResult]]) {
@@ -626,12 +626,7 @@ export async function runGates(task, ctx) {
     }
     if (v185 && await screenBlocks())
         return done();
-    // A non-final round may run only the tests covering its own diff; the merge-candidate round below
-    // pays the full suite anyway, so a selection that misses costs a round and can never merge.
-    const selected = v185 && ctx.selectTests && enabled("test") && ctx.commands.test
-        ? await coveringTests(ctx.worktree, ctx.baseRef)
-        : undefined;
-    await runBattery(selected ? { ...ctx.commands, test: testCommandForFiles(ctx.commands.test, selected) } : ctx.commands, selected);
+    await runBattery(ctx.commands);
     if (failed())
         return done();
     if (enabled("evidence")) {
@@ -644,6 +639,14 @@ export async function runGates(task, ctx) {
         if (failed())
             return done();
     }
+    // A non-final round may run only the tests covering its own diff; the merge-candidate round below
+    // pays the full suite anyway, so a selection that misses costs a round and can never merge.
+    const selected = v185 && ctx.selectTests && enabled("test") && ctx.commands.test
+        ? await coveringTests(ctx.worktree, ctx.baseRef)
+        : undefined;
+    await runBattery(selected ? { ...ctx.commands, test: testCommandForFiles(ctx.commands.test, selected) } : ctx.commands, selected, enabled("test") ? ["test"] : []);
+    if (failed())
+        return done();
     if (v185 && (enabled("acceptance") || enabled("review"))) {
         // Judge and review are launched TOGETHER (96m of serialization over 5 runs). Enforcement is
         // unchanged — it is still the AND of both, both still fail closed, and neither reads the other's

package/dist/run/daemon.js

@@ -1,6 +1,6 @@
 import { createHash, randomBytes } from "node:crypto";
 import { shq } from "../adapters/types.js";
-import { appendFileSync, closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readlinkSync, readSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { appendFileSync, closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, readlinkSync, readSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { stringify } from "yaml";
@@ -15,7 +15,7 @@ import { herdrSealShellPrefix, SubprocessDriver } from "../drivers/subprocess.js
 import { formatOwnedName } from "../drivers/types.js";
 import { captureBaseline, detectGateCommands, detectVacuousOracles } from "../gates/baseline.js";
 import { runGates } from "../gates/run-gates.js";
-import { addEvidence, attributeBlocked, blockedTasks, getTask, graphDefinitionHash, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus, taskContentDigest } from "../graph/graph.js";
+import { addEvidence, attributeBlocked, blockedTasks, getTask, graphDefinitionHash, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus, taskContentDigest, tickmarkrDir } from "../graph/graph.js";
 import { GATE_NAMES } from "../graph/schema.js";
 import { augmentRetryBrief, consult, renderRetryGuidance } from "./consult.js";
 import { runEnvironment } from "./environment.js";
@@ -23,7 +23,7 @@ import { cleanupRunWorktrees, gitHead, linkNodeModules, npmDependencyInstallComm
 import { runInteractiveSeed } from "./interactive-seed.js";
 import { activeRetryBan, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingReviewFindings, pendingRepairFindings, phaseForGate, readPriorRunEvidence, recordedTaskFailureKind, renderStructuredReviewFinding, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, structuredFindings, upheldFeedbackByTask } from "./journal.js";
 import { isDiffCapPark } from "../gates/review.js";
-import { acquireApprovalSerialization, acquireRunLock, releaseRunLock } from "./lock.js";
+import { acquireApprovalSerialization, acquireRunLock, isPidLive, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, verifyIntegrationTip } from "./merge.js";
 import { nextChannel, route } from "../route/router.js";
 import { desiredPanes } from "./reconcile.js";
@@ -764,6 +764,37 @@ function recordFatalRunEnd(journal, runId, branch, err) {
         console.error(`tickmarkr ${runId}: run crashed — no terminal record written; journal sink unwritable at ${journalPath} (${retryErr instanceof Error ? retryErr.message : String(retryErr)}) — original error: ${original}`);
     }
 }
+// OBS-777: the fleet fold cannot distinguish an orphan from another repository's live worker. Give
+// it one repository-scoped snapshot instead: terminal journals are ended, and an open lifecycle is
+// ended only when the shared lock predicate can prove its last recorded daemon pid dead.
+function endedRunIdsForReconcile(repoRoot) {
+    const ended = new Set();
+    const dir = join(tickmarkrDir(repoRoot), "runs");
+    if (!existsSync(dir))
+        return ended;
+    let runIds;
+    try {
+        runIds = readdirSync(dir);
+    }
+    catch {
+        return ended;
+    }
+    for (const runId of runIds) {
+        try {
+            const events = Journal.open(repoRoot, runId).read();
+            if (runHasEnded(events)) {
+                ended.add(runId);
+                continue;
+            }
+            const lifecycle = [...events].reverse().find((event) => (event.event === "run-start" || event.event === "run-resume")
+                && Number.isInteger(event.data.pid) && event.data.pid > 0);
+            if (lifecycle && !isPidLive(lifecycle.data.pid))
+                ended.add(runId);
+        }
+        catch { /* incomplete or foreign run directory — it proves nothing */ }
+    }
+    return ended;
+}
 export async function runDaemon(repoRoot, opts = {}) {
     // v1.51 T2 / OBS-89 (v1.60): retired --quality env seam. Mode resolution owns premium routing;
     // route() no longer reads the retired env at all, so the old entrypoint scrub is gone with it.
@@ -781,6 +812,7 @@ export async function runDaemon(repoRoot, opts = {}) {
     // subprocess, so the optional-chain open below is a no-op there). Cosmetic-only: any failure is
     // swallowed (never affects the run); the operator closes a surviving watch pane.
     const lock = acquireRunLock(repoRoot, runId);
+    const endedRunIds = endedRunIdsForReconcile(repoRoot); // one snapshot for every sweep this caller makes
     // D10: the lock is this daemon's liveness record and already carries its pid; status prints that
     // identity beside the supervision row. The `orchestrator` tier belongs exclusively to the seated
     // supervisor, so a run never beats or stands down that seat's record on the daemon's behalf.
@@ -878,7 +910,7 @@ export async function runDaemon(repoRoot, opts = {}) {
             // Termination (SIGINT/SIGTERM): record the daemon-controlled exit before closing every live slot,
             // reconcile owned panes against an EMPTY
             // desired set (herdr panes not in memory; panesToClose spares foreign names, watch panes, and
-            // other runs' panes by construction), release the run lock, then exit. There is still no run-end,
+            // live/unknown other runs' panes by construction), release the run lock, then exit. There is still no run-end,
             // so stop-amend-resume keeps resuming; exit-cause distinguishes this deliberate stop from an
             // observer-classified abrupt death. keepPanes:"forever" (the
             // keep-everything debug override) preserves panes but still releases the lock and exits.
@@ -907,7 +939,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 catch { /* cosmetic — reconcile is the backstop */ }
                             }
                             try {
-                                await driver.reconcile?.(new Set(), runId);
+                                await driver.reconcile?.(new Set(), runId, { endedRunIds });
                             }
                             catch { /* cosmetic — visibility is never a gate */ }
                         }
@@ -1093,7 +1125,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // herdr's watches bookkeeping lives in close(), and a raw pane-close in the sweep would
                     // leave narrator() a stale cache) — the driver always sees it as desired; its lifecycle is
                     // decided here from the fold alone.
-                    await driver.reconcile?.(new Set([...desired, watchName]), runId, opts);
+                    await driver.reconcile?.(new Set([...desired, watchName]), runId, { ...opts, endedRunIds });
                     // OBS-103: when the fold retires the watch (run-end boundary), close the narrator. The
                     // decision keys on the run identity in the pane name — narrator() adopts a prior daemon
                     // instance's pane under the same owned name, so a stop→resume cycle's leftover narrator
@@ -1109,7 +1141,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                     /* cosmetic — visibility is never a gate */
                 }
             };
-            await reconcile(); // run start/resume boundary: nothing in flight — full sweep, incl. older runs' leftovers
+            // run start/resume boundary: nothing in flight, so the sweep takes this run's judge/review/consult
+            // panes too. OBS-777: the one startup snapshot lets it reclaim only older runs proven ended, while
+            // every live or unknown run remains spared.
+            await reconcile();
             // v1.4 self-reference guard: a random nonce on the worker trailer AND exit marker. Displayed
             // source/diffs (e.g. a worker editing tickmarkr's own prompt.ts/daemon.ts) can't know it, so an echoed
             // TICKMARKR_RESULT/TICKMARKR_EXIT literal can never premature-harvest the worker. Quote-split keeps the

package/dist/run/journal.js

@@ -7,6 +7,7 @@ import { stateDirName, taskContentDigest, tickmarkrDir } from "../graph/graph.js
 import { GATE_NAMES, TIERS } from "../graph/schema.js";
 import { buildProfile, classify } from "../route/profile.js";
 import { DecisionEventSchema, trackJournalRows, } from "./protocol.js";
+import { normalizeGateOutcome } from "./outcome.js";
 import { redactSecrets } from "./redact.js";
 export function phaseForGate(gate) {
     if (gate === "acceptance")
@@ -15,6 +16,23 @@ export function phaseForGate(gate) {
         return "review";
     return `gate:${gate}`;
 }
+/** The pipe projects the same normalized gate outcome as the TTY rail. The selected-test field only
+ * chooses the held outcome's operator noun after the accessor has classified it; it is not a second
+ * verdict read. */
+const journalGateDetail = (data) => {
+    if (typeof data.gate !== "string")
+        return undefined;
+    switch (normalizeGateOutcome(data).kind) {
+        case "passed":
+            return `${data.gate} passed`;
+        case "failed":
+            return `${data.gate} failed`;
+        case "held":
+            return Array.isArray(data.selectedTests) ? `${data.gate} selected-test screen` : `${data.gate} held`;
+        default:
+            return data.gate;
+    }
+};
 export function formatJournalNarration({ event, taskId, data }) {
     const assignment = data.assignment;
     const direct = [data.summary, data.reason, data.error, data.step, data.action, data.lint, data.branch, data.from]
@@ -26,7 +44,9 @@ export function formatJournalNarration({ event, taskId, data }) {
                 ? `${data.gate} failed${typeof data.lastMergedTask === "string" ? ` after ${data.lastMergedTask}` : ""}`
                 : event === "tip-verify"
                     ? `${data.gate} passed`
-                    : `${data.gate}${data.pass === true ? " passed" : data.pass === false ? " failed" : ""}`
+                    : event === "gate-result"
+                        ? journalGateDetail(data)
+                        : `${data.gate}`
             : typeof data.code === "number" ? `exit ${data.code}`
                 : typeof data.pid === "number" ? `pid ${data.pid}`
                     : typeof data.baseRef === "string" ? `base ${data.baseRef.slice(0, 12)}`

package/dist/run/outcome.js

@@ -88,7 +88,14 @@ export function normalizeGateOutcome(source) {
         return { kind: "unavailable", reason: `malformed gate result: expected an object, read ${shape}` };
     }
     const row = source;
-    // `kind` selects the canonical format. It must validate as exactly one canonical arm without any
+    // A gate-result data wrapper states its canonical verdict in `outcome`. Consumers may pass either
+    // the wrapper or the outcome itself; both must read the same kind even if stale bare fields remain.
+    if (hasOwn(row, "outcome")) {
+        if (isGateOutcome(row.outcome))
+            return row.outcome;
+        return { kind: "unavailable", reason: reasonOf(row, "malformed gate result: invalid explicit outcome") };
+    }
+    // `kind` selects the canonical outcome object. It must validate as exactly one canonical arm without any
     // legacy truth discriminator; otherwise continuing through the legacy branches could reinterpret a
     // contradictory dual-write as passed, failed or infra. Mixed and malformed canonical rows stay
     // explicitly unavailable, retaining any reason/details the producer did manage to state.

package/dist/run/supervision.d.ts

@@ -3,6 +3,8 @@ export declare const SUPERVISION_BEAT_MS = 10000;
 /** Ceiling before a beat reads STALE: SIX beats, lock.ts's ratio — five may be missed before alarm. */
 export declare const SUPERVISION_STALE_MS: number;
 export declare const SUPERVISION_FUTURE_GRACE_MS = 1000;
+/** Context watchers act at 75% unless their invocation declares another threshold. */
+export declare const SUPERVISION_DEFAULT_THRESHOLD_PCT = 75;
 export declare const SUPERVISION_TIERS: readonly ["orchestrator", "orchestrator-context", "overseer", "overseer-context", "watch"];
 export type SupervisionTier = (typeof SUPERVISION_TIERS)[number];
 export declare const SUPERVISION_SEAT_TIERS: readonly ["orchestrator", "orchestrator-context", "overseer", "overseer-context"];
@@ -17,16 +19,28 @@ export interface TierLiveness {
     beatAgeMs?: number;
     /** The seat the record names, when it names one. Always present on a seat tier that is not ABSENT. */
     seat?: string;
+    /** The alarm's durable duty, orthogonal to whether its watcher is armed, stale or stood down. */
+    clearOwedSince?: string;
+    /** The latch exists but cannot be decoded; never mistaken for no duty owed. */
+    clearOwedUnreadable?: true;
+}
+/** A watcher observation that can raise or discharge the seat's clear obligation. */
+export interface SupervisionBeatObservation {
+    armId: string;
+    pct: number;
+    thresholdPct: number;
 }
 export declare const supervisionBeatPath: (repoRoot: string, tier: SupervisionTier) => string;
 /** Where a watcher records that it STOOD DOWN. Its own file: the beat keeps meaning only "alive". */
 export declare const supervisionStandDownPath: (repoRoot: string, tier: SupervisionTier) => string;
-export declare function beatSupervision(repoRoot: string, tier: SupervisionTier, seat?: string): void;
+export declare function beatSupervision(repoRoot: string, tier: SupervisionTier, seat?: string, observation?: SupervisionBeatObservation): void;
 /** Handle a watcher holds for as long as it is supervising; disarm stands it down and is idempotent. */
 export interface ArmedSupervision {
     disarm: () => void;
 }
 export declare function armSupervision(repoRoot: string, tier: SupervisionTier, beatMs?: number, seat?: string): ArmedSupervision;
+/** Arm the live status board's own tier through the normal supervision writer and lifecycle. */
+export declare function armWatchSupervision(repoRoot: string, beatMs?: number): ArmedSupervision;
 export declare function readTierLiveness(repoRoot: string, tier: SupervisionTier, now?: number): TierLiveness;
 export declare function supervisionStatus(repoRoot: string, tier: SupervisionTier, now?: number): TierLiveness;
 /** Every KNOWN tier, always — a tier omitted from this list would read as one that is fine. */

package/dist/run/supervision.js

@@ -14,8 +14,8 @@ import { stateDirName, tickmarkrDir } from "../graph/graph.js";
 //
 // SUP-02: the beat mtime is the ONLY input. Nothing here reads a process table and nothing matches a
 // process name — a poll-grep watcher carries `grep` in its own argv, so the filter that removes the
-// probing grep removes the watched one. The payload records a pid for an OPERATOR to read off a STALE
-// record; the derivation never consults it, so a reused, dead or unreadable pid changes no state.
+// probing grep removes the watched one. The payload's exitedWriterPid identifies the one-shot writer
+// for an OPERATOR reading a STALE record; no derivation consults it, so its value changes no state.
 // Zero new deps — node:fs stdlib, exactly as lock.ts.
 /** How often a watcher rewrites its own tier's beat. */
 export const SUPERVISION_BEAT_MS = 10_000;
@@ -27,6 +27,8 @@ export const SUPERVISION_STALE_MS = 6 * SUPERVISION_BEAT_MS;
 // millisecond into the future. A second of slack covers even a coarse filesystem. Anything past it
 // is SKEW, and skew is the one direction this instrument may not fail in: see readTierLiveness.
 export const SUPERVISION_FUTURE_GRACE_MS = 1_000;
+/** Context watchers act at 75% unless their invocation declares another threshold. */
+export const SUPERVISION_DEFAULT_THRESHOLD_PCT = 75;
 // The supervision seats this harness has. An unlisted tier is an INVISIBLE tier, which is the failure
 // mode itself — an auditor read "no watchers were ever armed" off a surface that named none. Adding a
 // seat means adding it here, and `status` then renders it whether or not it has ever beaten.
@@ -55,6 +57,8 @@ const supervisionDir = (repoRoot) => join(repoRoot, stateDirName(repoRoot), "sup
 export const supervisionBeatPath = (repoRoot, tier) => join(supervisionDir(repoRoot), `${tier}.beat`);
 /** Where a watcher records that it STOOD DOWN. Its own file: the beat keeps meaning only "alive". */
 export const supervisionStandDownPath = (repoRoot, tier) => join(supervisionDir(repoRoot), `${tier}.standdown`);
+/** The independent latch a stand-down cannot overwrite or remove. */
+const supervisionObligationPath = (repoRoot, tier) => join(supervisionDir(repoRoot), `${tier}.clear-owed`);
 // SUP-06: PRESENCE — one file per ARMED WATCHER, because a tier may legitimately have more than one.
 // Two boards watch one repo the moment an operator opens a second pane, and the tier is armed while
 // EITHER of them lives. The stand-down marker speaks for the whole tier, so the first board out
@@ -93,25 +97,102 @@ function stalePeersIfLast(repoRoot, tier, id, now = Date.now()) {
     }
     return stale;
 }
+/** Read the latch without creating, touching or repairing it. */
+function readClearObligation(repoRoot, tier) {
+    const p = supervisionObligationPath(repoRoot, tier);
+    let st;
+    try {
+        st = statSync(p);
+    }
+    catch (e) {
+        const code = e.code;
+        return code === "ENOENT" || code === "ENOTDIR" ? "NONE" : "UNREADABLE";
+    }
+    if (!st.isFile())
+        return "UNREADABLE";
+    try {
+        const rec = JSON.parse(readFileSync(p, "utf8"));
+        if (rec?.tier !== tier)
+            return "UNREADABLE";
+        if (typeof rec.clearOwedSince !== "string" || Number.isNaN(Date.parse(rec.clearOwedSince)))
+            return "UNREADABLE";
+        if (typeof rec.armId !== "string" || !rec.armId.trim())
+            return "UNREADABLE";
+        if (typeof rec.thresholdPct !== "number" || !Number.isFinite(rec.thresholdPct)
+            || rec.thresholdPct < 0 || rec.thresholdPct > 100)
+            return "UNREADABLE";
+        return { clearOwedSince: rec.clearOwedSince, armId: rec.armId, thresholdPct: rec.thresholdPct };
+    }
+    catch {
+        return "UNREADABLE";
+    }
+}
+/** Publish a crossing atomically; a firing replacement inherits the original duty's instant. */
+function raiseClearObligation(repoRoot, tier, armId, thresholdPct) {
+    const existing = readClearObligation(repoRoot, tier);
+    if (typeof existing === "object" && existing.armId === armId)
+        return;
+    if (existing === "UNREADABLE") {
+        throw new Error(`${tier} clear obligation is unreadable — refusing to overwrite a duty that may still be owed`);
+    }
+    const p = supervisionObligationPath(repoRoot, tier);
+    const tmp = `${p}.${process.pid}.${randomUUID()}.tmp`;
+    mkdirSync(dirname(p), { recursive: true });
+    writeFileSync(tmp, JSON.stringify({
+        tier, armId, thresholdPct,
+        clearOwedSince: typeof existing === "object" ? existing.clearOwedSince : new Date().toISOString(),
+    }) + "\n");
+    renameSync(tmp, p);
+}
+/** Only a different arm observed below the firing threshold proves the old seat was cleared. */
+function dischargeClearObligation(repoRoot, tier, observation) {
+    const existing = readClearObligation(repoRoot, tier);
+    if (existing === "UNREADABLE") {
+        throw new Error(`${tier} clear obligation is unreadable — refusing to erase a duty that may still be owed`);
+    }
+    if (typeof existing === "object" && existing.armId !== observation.armId
+        && observation.pct < existing.thresholdPct) {
+        rmSync(supervisionObligationPath(repoRoot, tier), { force: true });
+    }
+}
+function validateObservation(observation) {
+    if (!observation.armId.trim())
+        throw new Error("a supervision observation needs a non-empty arm identity");
+    for (const [name, value] of [["pct", observation.pct], ["threshold-pct", observation.thresholdPct]]) {
+        if (!Number.isFinite(value) || value < 0 || value > 100) {
+            throw new Error(`--${name} must be a number from 0 through 100`);
+        }
+    }
+}
 // WRITER — a watcher's own call, on its own tier, every SUPERVISION_BEAT_MS. Never a reader's: the
 // purity fence (status --watch leaves the state dir byte-identical) is the test that catches a reader
 // that beats on the watcher's behalf, which would report every dead tier as healthy.
-function writeSupervisionBeat(repoRoot, tier, seat, armId) {
+function writeSupervisionBeat(repoRoot, tier, seat, armId, observation) {
     // A seat tier may not be armed anonymously, and the refusal belongs HERE rather than only in the
     // verb: any caller that could write a seatless record could arm a tier nobody occupies.
     if (isSeatTier(tier) && !seat?.trim()) {
         throw new Error(`${tier} is a per-seat tier — a beat must declare the seat identity it speaks for`);
     }
+    if (observation !== undefined)
+        validateObservation(observation);
     tickmarkrDir(repoRoot); // the write path DOES create — beats land inside the gitignored state dir
     const p = supervisionBeatPath(repoRoot, tier);
     mkdirSync(dirname(p), { recursive: true });
+    // Raise before the beat so a later beat failure cannot hide a duty; discharge only after the
+    // below-threshold observation exists on disk.
+    if (observation !== undefined && observation.pct >= observation.thresholdPct) {
+        raiseClearObligation(repoRoot, tier, observation.armId, observation.thresholdPct);
+    }
     writeFileSync(p, JSON.stringify({
         tier, ...(seat ? { seat } : {}), ...(armId ? { armId } : {}),
-        pid: process.pid, beatAt: new Date().toISOString(),
+        ...(observation !== undefined ? { pct: observation.pct, thresholdPct: observation.thresholdPct } : {}),
+        exitedWriterPid: process.pid, beatAt: new Date().toISOString(),
     }) + "\n");
+    if (observation !== undefined)
+        dischargeClearObligation(repoRoot, tier, observation);
 }
-export function beatSupervision(repoRoot, tier, seat) {
-    writeSupervisionBeat(repoRoot, tier, seat);
+export function beatSupervision(repoRoot, tier, seat, observation) {
+    writeSupervisionBeat(repoRoot, tier, seat, undefined, observation);
 }
 // THE WATCHER-FACING ENTRY POINT — the loop SUPERVISION_BEAT_MS actually drives. A supervising seat
 // calls this once at the top of its watch and holds the handle for the duration; a seat that dies,
@@ -138,7 +219,7 @@ export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS, sea
     }
     catch { /* uncleared: the reader validates the marker and a newer beat outranks it — never masked */ }
     // This watcher's own identity fences BOTH its presence and its stand-down against every later arm.
-    // pid alone collides between two boards in one host (and after pid reuse); a UUID never aliases the
+    // A process id alone collides between two boards in one host (and after reuse); a UUID never aliases the
     // stale presence of a killed process that a later last-one-out cleanup may already have observed.
     const id = `${process.pid}.${randomUUID()}`;
     const presence = supervisionPresencePath(repoRoot, tier, id);
@@ -146,7 +227,7 @@ export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS, sea
     const mark = () => {
         try {
             writeSupervisionBeat(repoRoot, tier, seat, id); // creates the directory presence is written into
-            writeFileSync(presence, JSON.stringify({ tier, pid: process.pid, id }) + "\n");
+            writeFileSync(presence, JSON.stringify({ tier, exitedWriterPid: process.pid, id }) + "\n");
         }
         catch { /* repo gone / disk full / no seat — the tier ages out rather than crashing its watcher */ }
     };
@@ -182,7 +263,7 @@ export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS, sea
                 mkdirSync(dirname(p), { recursive: true });
                 writeFileSync(tmp, JSON.stringify({
                     tier, ...(seat ? { seat } : {}), armId: id,
-                    pid: process.pid, disarmedAt: new Date().toISOString(),
+                    exitedWriterPid: process.pid, disarmedAt: new Date().toISOString(),
                 }) + "\n");
                 renameSync(tmp, p);
             }
@@ -198,6 +279,10 @@ export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS, sea
         },
     };
 }
+/** Arm the live status board's own tier through the normal supervision writer and lifecycle. */
+export function armWatchSupervision(repoRoot, beatMs = SUPERVISION_BEAT_MS) {
+    return armSupervision(repoRoot, "watch", beatMs);
+}
 // BEAT DERIVATION — pure, and the only thing that reads the beat. One statSync: never creates,
 // touches or reaps the record it reports on, and never creates the directory that holds it. ONLY a
 // missing path is ABSENT: ENOENT (no beat file) and ENOTDIR (nothing that could hold one) mean no
@@ -206,7 +291,7 @@ export function armSupervision(repoRoot, tier, beatMs = SUPERVISION_BEAT_MS, sea
 // never silently ARMED. Callers wanting the TIER's state want supervisionStatus below; this answers
 // the narrower question "does the beat say alive", which is all a beat can ever say.
 export function readTierLiveness(repoRoot, tier, now = Date.now()) {
-    return beatLiveness(tier, readBeat(repoRoot, tier), now);
+    return withClearObligation(repoRoot, tier, beatLiveness(tier, readBeat(repoRoot, tier), now));
 }
 // The beat's inode, or why there is no age to derive from it. Split out so the stand-down ranking below
 // reads the SAME mtime this derivation does rather than a second, later stat of a moving record.
@@ -266,6 +351,15 @@ function beatLiveness(tier, beat, now) {
     const beatAgeMs = Math.max(0, age); // inside the grace: the two clocks' resolutions, not skew
     return { tier, state: beatAgeMs > SUPERVISION_STALE_MS ? "STALE" : "ARMED", beatAgeMs, ...named };
 }
+/** Add the independent duty without replacing or reinterpreting the watcher's state. */
+function withClearObligation(repoRoot, tier, liveness) {
+    const obligation = readClearObligation(repoRoot, tier);
+    if (obligation === "NONE")
+        return liveness;
+    return obligation === "UNREADABLE"
+        ? { ...liveness, clearOwedUnreadable: true }
+        : { ...liveness, clearOwedSince: obligation.clearOwedSince };
+}
 // A stand-down is only what a watcher RECORDED, so the record has to READ as one: a regular file whose
 // payload names this tier and the instant it stood down. Path existence is not proof — a directory, a
 // torn write or a stray file at that path says nothing about any watcher, and calling one of those a
@@ -317,15 +411,17 @@ export function supervisionStatus(repoRoot, tier, now = Date.now()) {
     const beat = readBeat(repoRoot, tier);
     const standDown = readStandDown(repoRoot, tier);
     if (standDown === "UNREADABLE")
-        return { tier, state: "UNREADABLE" };
+        return withClearObligation(repoRoot, tier, { tier, state: "UNREADABLE" });
     const beatOutranksStandDown = standDown !== "NONE" && typeof beat === "object" && (beat.mtimeMs > standDown.mtimeMs || (now - beat.mtimeMs <= SUPERVISION_STALE_MS &&
         beat.armId !== undefined && standDown.armId !== undefined && beat.armId !== standDown.armId));
     if (standDown !== "NONE" && !beatOutranksStandDown) {
         // the seat that stood down is named by the marker, falling back to whatever its last beat named
         const seat = standDown.seat ?? (typeof beat === "object" ? beat.seat : undefined);
-        return { tier, state: "DISARMED", ...(seat !== undefined ? { seat } : {}) };
+        return withClearObligation(repoRoot, tier, {
+            tier, state: "DISARMED", ...(seat !== undefined ? { seat } : {}),
+        });
     }
-    return beatLiveness(tier, beat, now);
+    return withClearObligation(repoRoot, tier, beatLiveness(tier, beat, now));
 }
 /** Every KNOWN tier, always — a tier omitted from this list would read as one that is fine. */
 export const readSupervision = (repoRoot, now = Date.now()) => SUPERVISION_TIERS.map((tier) => supervisionStatus(repoRoot, tier, now));
@@ -333,4 +429,6 @@ export const readSupervision = (repoRoot, now = Date.now()) => SUPERVISION_TIERS
 // The seat is rendered BESIDE the state, never instead of it: `overseer-context ARMED (w3:p2)` says
 // both that something is beating and who is behind it, which is the pair an operator needs to act. A
 // row with no seat to name renders exactly as it always did.
-export const supervisionText = (tiers, divider = " · ") => `supervision: ${tiers.map((t) => `${t.tier} ${t.state}${t.seat ? ` (${t.seat})` : ""}`).join(divider)}`;
+export const supervisionText = (tiers, divider = " · ") => `supervision: ${tiers.map((t) => `${t.tier} ${t.state}${t.seat ? ` (${t.seat})` : ""}` +
+    `${t.clearOwedSince ? ` CLEAR-OWED since ${t.clearOwedSince}` : ""}` +
+    `${t.clearOwedUnreadable ? " CLEAR-OWED unreadable" : ""}`).join(divider)}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.1.6",
+  "version": "2.1.8",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-auto/SKILL.md

@@ -45,7 +45,8 @@ Before `tickmarkr compile` or `tickmarkr run`, compare the installed binary agai
 
 1. Run `tickmarkr version` (one line, machine-parseable).
 2. Read the `version` field from the repository's `package.json`.
-3. If the binary and repository do not **agree on the entire version** (including the patch; e.g. binary `2.1.0` vs repo `2.1.1`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`) or link the repo binary. Do not compile, plan, or run on hope.
+3. If the binary and repository do not **agree on the entire version** (including the patch; e.g. binary `2.1.0` vs repo `2.1.1`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`), or to install this repository's build as a REAL COPY — `npm pack`, then `npm i -g ./<tarball>`. Do not compile, plan, or run on hope.
+   > ⚠ **Never `npm i -g .` on the repository directory, and never link it.** npm SYMLINKS a directory install, which makes the working tree itself the machine-wide binary: every later build — including a gate's own `npm run build` — silently hot-swaps the CLI for every repository on the machine, with no version change to notice it by. Measured 2026-08-29: a verify build gate rewrote the shared binary while another repository's daemon was mid-run against it, and a positive control that rebuilds at a pre-fix ref would have installed the very defect it was proving fixed, machine-wide (OBS-771). Verify an install by comparing the global and repo **inodes** — they must DIFFER — never by `tickmarkr version`, which cannot go red when nothing is bumped.
 
 A stale binary silently skips daemon gates shipped in newer releases — the v1.38 run exposed this when a global `1.36.0` binary missed the daemon tip-verify gate entirely (OBS-38). Preflight failure is always stop-and-report; never proceed-and-hope.
 

package/skills/tickmarkr-loop/SKILL.md

@@ -40,7 +40,8 @@ Before `tickmarkr compile` or `tickmarkr run`, compare the installed binary agai
 
 1. Run `tickmarkr version` (one line, machine-parseable).
 2. Read the `version` field from the repository's `package.json`.
-3. If the binary and repository do not **agree on the entire version** (including the patch; e.g. binary `2.1.0` vs repo `2.1.1`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`) or link the repo binary. Do not compile, plan, or run on hope.
+3. If the binary and repository do not **agree on the entire version** (including the patch; e.g. binary `2.1.0` vs repo `2.1.1`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`), or to install this repository's build as a REAL COPY — `npm pack`, then `npm i -g ./<tarball>`. Do not compile, plan, or run on hope.
+   > ⚠ **Never `npm i -g .` on the repository directory, and never link it.** npm SYMLINKS a directory install, which makes the working tree itself the machine-wide binary: every later build — including a gate's own `npm run build` — silently hot-swaps the CLI for every repository on the machine, with no version change to notice it by. Measured 2026-08-29: a verify build gate rewrote the shared binary while another repository's daemon was mid-run against it, and a positive control that rebuilds at a pre-fix ref would have installed the very defect it was proving fixed, machine-wide (OBS-771). Verify an install by comparing the global and repo **inodes** — they must DIFFER — never by `tickmarkr version`, which cannot go red when nothing is bumped.
 
 A stale binary silently skips daemon gates shipped in newer releases — the v1.38 run exposed this when a global `1.36.0` binary missed the daemon tip-verify gate entirely (OBS-38). Preflight failure is always stop-and-report; never proceed-and-hope.
 

package/skills/tickmarkr-overseer/SKILL.md

@@ -60,6 +60,11 @@ through brief lineage. **An executor choice nobody made is still an executor cho
    OPERATOR LAYOUT/CONVENTION rather than a shipped milestone — names like `*-discipline`, `*-drill`,
    `*-parity`, `*-least-permission`, `context-reset-*`, `consults-*`, `agent-*`, `*-tab-layout`,
    `*-visible-*`, `*-panes*`, `user-tabs-*`.
+   **A standing instruction carries its revocation premise.** Every standing rule you lift from memory,
+   handoff or a live correction states the premise that makes it true and the concrete observation that
+   would falsify that premise and revoke the rule. If you cannot name the falsifier, you have written a
+   preference, not standing supervision law. When the falsifier arrives, retire or amend the rule in the
+   shipped skill in the same act; do not leave successors to obey a rule whose reason is already false.
    **Earned 2026-08-04, expensively.** That directory held `…-falsification-drill-discipline.md`, written
    three weeks earlier: *"a gate or grep-pin is assumed WRONG until a falsification drill proves it bites…
    run the drill that should redden it and SEE the red before trusting green."* That is Evidence discipline
@@ -565,6 +570,10 @@ cleared, re-briefed, or replaced keeps beating that tier's file forever. Measure
 **three-hour window in which no orchestrator was alive**, and it would have silently re-armed a
 recorded stand-down within 10 seconds. On the same sweep the overseer tier had **three** beat loops,
 one owned by an unrelated session. So:
+- **Split the liveness reads.** A tier's liveness is read from beat freshness in the repository status
+  path; a loop's liveness is read from the live process payload that is emitting that beat (`tickmarkr
+  beat <tier> --seat <seat>` in this repo). Neither liveness claim is read from a recorded pid: a pid
+  recorded earlier can be stale, reused, or detached from the beat now holding the tier green.
 - **At every adopt, clear, or re-brief, sweep for pre-existing loops on YOUR tier before arming one**
   (`pgrep -f "tickmarkr beat <tier>"`), trace each to its parent session, and kill the **loop only**
   — never the parent — then verify the parent survived.