tickmarkr 2.1.7 → 2.1.9

package/dist/drivers/herdr.js

@@ -6,6 +6,7 @@ import { declaredInputBoxForWorkerName, matchesEmptyInputBox, matchesInputBox, m
 import { consumePaneLaunchIntent, PANE_IDENTITY_ENV, paneIdentityLine } from "../brand.js";
 import { createWorktree, sh } from "../run/git.js";
 import { Journal } from "../run/journal.js";
+import { readSupervision } from "../run/supervision.js";
 import { herdrSealShellPrefix } from "./subprocess.js";
 import { canonicalizeLegacyName, formatOwnedName, panesToClose, parseOwnedName } from "./types.js";
 // VIS-09 P43-03: adopted safety floor from 43-MEASUREMENT.md (narrowest safe 53 → floor 108).
@@ -194,6 +195,64 @@ export class HerdrDriver {
         // recovery to the file and the pipe while the operator's rail stays silent about it.
         Journal.open(repoRoot, owned.runId, this.narrate).append("dispatch-retry", owned.taskId, data);
     }
+    openRunJournal(runId) {
+        const roots = new Set(this.journalRoots.values());
+        roots.add(process.cwd());
+        for (const repoRoot of roots) {
+            try {
+                return { repoRoot, journal: Journal.open(repoRoot, runId, this.narrate) };
+            }
+            catch {
+                /* try the next known root */
+            }
+        }
+        return undefined;
+    }
+    liveSupervisionSeats(repoRoot) {
+        const seats = new Set();
+        for (const tier of readSupervision(repoRoot)) {
+            if (tier.state === "ARMED" && tier.seat)
+                seats.add(tier.seat);
+        }
+        return seats;
+    }
+    journalReconcile(handle, event, taskId, data) {
+        try {
+            handle?.journal.append(event, taskId, data);
+        }
+        catch {
+            /* reconcile remains cosmetic even when its audit row cannot be written */
+        }
+    }
+    paneReconcileData(pane, label, ownedName, sweeperRunId) {
+        return {
+            paneId: pane.paneId,
+            ...(pane.tabId !== undefined ? { tabId: pane.tabId } : {}),
+            label,
+            ownedName,
+            ownedRunId: ownedName.runId,
+            runId: sweeperRunId,
+            sweeperRunId,
+        };
+    }
+    parsePaneList(handle, runId, stdout, stage) {
+        try {
+            const panes = JSON.parse(stdout).result?.panes;
+            if (!Array.isArray(panes))
+                throw new Error("pane list returned no panes array");
+            return panes;
+        }
+        catch (error) {
+            this.journalReconcile(handle, "pane-reconcile-list-failed", undefined, {
+                runId,
+                sweeperRunId: runId,
+                stage,
+                error: error instanceof Error ? error.message : String(error),
+                stdout,
+            });
+            return null;
+        }
+    }
     /** v1.99 T2: bind this driver's own journal writes to the run's live narration sink. */
     narrateWith(narrate) {
         this.narrate = narrate;
@@ -1199,6 +1258,7 @@ export class HerdrDriver {
     // resume/end) run with nothing in flight and take them too. Cosmetic by contract: every failure —
     // herdr gone, pane vanished mid-sweep, unparseable listing — is swallowed; this method never throws.
     async reconcile(desired, runId, opts) {
+        const journalHandle = this.openRunJournal(runId);
         try {
             if (!this.ws)
                 return;
@@ -1206,25 +1266,96 @@ export class HerdrDriver {
             // panesToClose skips any pane whose label doesn't parse as tickmarkr-owned (orchestrator/operator
             // shells, undetected agents), so a fuller pane listing never widens the blast radius.
             const list = await this.herdr("pane list");
-            const panes = JSON.parse(list.stdout).result?.panes ?? [];
-            const toClose = panesToClose(panes.map((p) => ({ name: p.label, paneId: p.pane_id, tabId: p.tab_id, workspaceId: p.workspace_id })), desired, this.ws, runId, opts);
+            if (list.code !== 0) {
+                this.journalReconcile(journalHandle, "pane-reconcile-list-failed", undefined, {
+                    runId,
+                    sweeperRunId: runId,
+                    stage: "pre-close",
+                    exitCode: list.code,
+                    error: list.stderr || list.stdout || `exit ${list.code}`,
+                });
+                return;
+            }
+            const panes = this.parsePaneList(journalHandle, runId, list.stdout, "pre-close");
+            if (panes === null)
+                return;
+            const liveSeats = journalHandle ? this.liveSupervisionSeats(journalHandle.repoRoot) : new Set();
+            for (const seat of opts?.liveSeats ?? [])
+                liveSeats.add(seat);
+            const toClose = panesToClose(panes.map((p) => ({ name: p.label, paneId: p.pane_id, tabId: p.tab_id, workspaceId: p.workspace_id })), desired, this.ws, runId, { ...opts, liveSeats });
+            const paneById = new Map(panes
+                .filter((p) => typeof p.pane_id === "string")
+                .map((p) => [p.pane_id, p]));
             const touched = new Set();
             for (const c of toClose) {
-                if (typeof c.tabId === "string")
-                    touched.add(c.tabId);
-                await this.herdr(`pane close ${shq(c.paneId)}`); // best-effort — a vanished pane is already reconciled
+                const listed = paneById.get(c.paneId);
+                const label = typeof listed?.label === "string" ? listed.label : "";
+                const ownedName = parseOwnedName(label);
+                if (!ownedName) {
+                    this.journalReconcile(journalHandle, "pane-reconcile-close-failed", undefined, {
+                        paneId: c.paneId,
+                        ...(c.tabId !== undefined ? { tabId: c.tabId } : {}),
+                        label,
+                        runId,
+                        sweeperRunId: runId,
+                        error: "pane selected for reconcile no longer has a parseable owned label",
+                    });
+                    continue;
+                }
+                const data = this.paneReconcileData(c, label, ownedName, runId);
+                const closed = await this.herdr(`pane close ${shq(c.paneId)}`);
+                if (closed.code === 0) {
+                    if (typeof c.tabId === "string")
+                        touched.add(c.tabId);
+                    this.journalReconcile(journalHandle, "pane-reconcile-close", ownedName.taskId, data);
+                }
+                else {
+                    this.journalReconcile(journalHandle, "pane-reconcile-close-failed", ownedName.taskId, {
+                        ...data,
+                        exitCode: closed.code,
+                        error: closed.stderr || closed.stdout || `exit ${closed.code}`,
+                    });
+                }
             }
             if (touched.size === 0)
                 return;
             // a tab our closes emptied was ours by construction (a tab with operator panes still has panes)
             const pl = await this.herdr("pane list");
-            const alive = new Set((JSON.parse(pl.stdout).result?.panes ?? []).map((p) => p.tab_id));
-            for (const tab of touched)
-                if (!alive.has(tab))
-                    await this.herdr(`tab close ${shq(tab)}`);
+            if (pl.code !== 0) {
+                this.journalReconcile(journalHandle, "pane-reconcile-list-failed", undefined, {
+                    runId,
+                    sweeperRunId: runId,
+                    stage: "post-close",
+                    exitCode: pl.code,
+                    error: pl.stderr || pl.stdout || `exit ${pl.code}`,
+                });
+                return;
+            }
+            const alivePanes = this.parsePaneList(journalHandle, runId, pl.stdout, "post-close");
+            if (alivePanes === null)
+                return;
+            const alive = new Set(alivePanes.map((p) => p.tab_id));
+            for (const tab of touched) {
+                if (alive.has(tab))
+                    continue;
+                const closed = await this.herdr(`tab close ${shq(tab)}`);
+                if (closed.code !== 0) {
+                    this.journalReconcile(journalHandle, "tab-reconcile-close-failed", undefined, {
+                        tabId: tab,
+                        runId,
+                        sweeperRunId: runId,
+                        exitCode: closed.code,
+                        error: closed.stderr || closed.stdout || `exit ${closed.code}`,
+                    });
+                }
+            }
         }
-        catch {
-            /* cosmetic — visibility hygiene never fails the run */
+        catch (error) {
+            this.journalReconcile(journalHandle, "pane-reconcile-failed", undefined, {
+                runId,
+                sweeperRunId: runId,
+                error: error instanceof Error ? error.message : String(error),
+            });
         }
     }
     async worktree(repo, branch, baseRef) {

package/dist/drivers/types.d.ts

@@ -54,10 +54,12 @@ export interface FleetAgent {
     tabId?: string;
     workspaceId?: string;
 }
-export declare function panesToClose(agents: FleetAgent[], desired: Set<string>, ws: string, runId: string, opts?: {
+export interface PanesToCloseOpts {
     spareLiveLlm?: boolean;
     endedRunIds?: Set<string>;
-}): {
+    liveSeats?: Set<string>;
+}
+export declare function panesToClose(agents: FleetAgent[], desired: Set<string>, ws: string, runId: string, opts?: PanesToCloseOpts): {
     paneId: string;
     tabId?: string;
 }[];
@@ -80,8 +82,5 @@ export interface ExecutorDriver {
     narrateWith?(narrate: (event: JournalEvent) => void): void;
     worktree(repo: string, branch: string, baseRef: string): Promise<string>;
     narrator?: (cwd: string, command: string, runId?: string) => Promise<Slot>;
-    reconcile?: (desired: Set<string>, runId: string, opts?: {
-        spareLiveLlm?: boolean;
-        endedRunIds?: Set<string>;
-    }) => Promise<void>;
+    reconcile?: (desired: Set<string>, runId: string, opts?: PanesToCloseOpts) => Promise<void>;
 }

package/dist/drivers/types.js

@@ -20,54 +20,6 @@ export function parseOwnedName(name) {
 export function isForeignName(name) {
     return parseOwnedName(name) === null;
 }
-// v1.22b T1: workspace-aware fold over a fleet snapshot — decides which owned task panes are garbage
-// right now: the desired-set/spareLiveLlm sweep (OBS-17 T2), scoped to THIS RUN'S OWN panes (by runId,
-// OBS-772) in THIS RUN'S OWN WORKSPACE (OBS-769). Both conditions, and neither alone is the rule.
-// Watch panes are operator-owned after run end and are reclaimed by the next run; foreign names
-// (parseOwnedName fails) are never candidates.
-//
-// OBS-769 — WHY THE SWEEP STOPS AT THE WORKSPACE BOUNDARY. It used to close an owned pane carrying
-// any OTHER runId in any other workspace, unconditionally, as a "misplaced leftover". Two tickmarkr
-// runs in two repositories are lawful (the lock forbids two runs in ONE repository, not on one
-// machine) and herdr gives each its own workspace — so that branch made every pair of concurrent
-// runs kill each other's LIVE workers. Measured 2026-08-28: the run in w0 closed run ...2958's
-// panes at 23:42:40.351/.392, and 53s later ...2958's own task-human sweep closed w0's live codex
-// worker at 23:43:34.096. ...2958 ended 0/8. The death detector cannot see it: closing the pane
-// makes paneAbsent, processTree, confirmedProcessTree and worktreeDelta true by ONE cause, and a
-// closed pane can never accrue the CPU that the `cpu-accruing` hold reads.
-// The comment this replaces claimed "only run age marks a misplaced pane garbage" — there was no age
-// check in the code, and age is the wrong predicate anyway: w0's run STARTED EARLIER than ...2958,
-// so an age rule would have licensed exactly the kill that landed. Run age says nothing about
-// liveness, and a sweeping daemon cannot read another repository's run state. The workspace is the
-// only ownership boundary available without cross-repo I/O, so it is the one enforced.
-// Cost, named: an orphan pane from a dead run stranded in a workspace no later run opens is now left
-// for the operator. That is cosmetic (`reconcile` is cosmetic by contract — "visibility is never a
-// gate"), and a cosmetic cleanup must never be able to kill a live worker.
-// OBS-772 — WHY THE runId LINE EXISTS, AND WHY THE WORKSPACE LINE ALONE WAS NOT THE FIX. The first
-// repair was workspace-scoped only, and its own comment dismissed the residue — "two runs sharing one
-// workspace would still sweep each other" — as unreachable, on the reasoning that one workspace per run
-// is herdr's placement. That reasoned from ONE driver to the whole product. OrcaDriver has no workspace
-// dimension at all: orca.ts passes a single ORCA_SPACE as the workspaceId for EVERY checkout and as
-// `ws`, so `workspaceId !== ws` is never true there and every foreign pane fell straight through. Orca
-// users had zero protection while the defect read as fixed. The runId line is the real rule and it is
-// driver-agnostic: reconcile exists to clean up THIS RUN's panes, and a leftover from a dead run is
-// exactly what cannot be told from a live run's pane without liveness data this process does not have.
-// Both lines are kept — the workspace line preserves the pre-existing sparing of this run's own panes
-// in another workspace, which the runId line alone would not.
-// ⚠ WHAT THE runId LINE COST BEFORE OBS-777 — SUSPENDED, NOT NARROWED, and the price was larger than
-// it read. Sparing every other runId suspended OBS-17's FOUNDING use case: "a killed daemon can't
-// close its slots". This sweep was built to reclaim exactly those orphans, but could not reclaim ANY
-// previous run's panes. Three separate pins asserted the old behaviour (reconcile.test.ts,
-// orca-placement.test.ts,
-// reconcile-live.test.ts); all three were changed deliberately, and the third is why this paragraph
-// exists rather than a shorter one — two flipped pins is a trade, three is a pattern.
-// OBS-777 RESTORES that reclamation: the CALLER passes `opts.endedRunIds`, a Set the daemon computes
-// ONCE at run start from this repository's own `run-end` journals and dead lock holders. This fold
-// stays pure — it gains one optional field, not a repo root — a foreign repository's runId is never
-// resolvable and so stays spared by construction, and no driver learns about workspaces.
-// ponytail: two conditions, no geometry reasoning, nothing driver-specific. `reconcile` is cosmetic by
-// contract, and a cosmetic cleanup must never be able to kill a live worker — which is why the
-// ended-run authority is the only safe way to restore the sweep without reviving the cross-run kill.
 export function panesToClose(agents, desired, ws, runId, opts) {
     const out = [];
     for (const a of agents) {
@@ -76,6 +28,8 @@ export function panesToClose(agents, desired, ws, runId, opts) {
         const owned = parseOwnedName(a.name);
         if (!owned || owned.role === "watch")
             continue;
+        if (opts?.liveSeats?.has(a.name))
+            continue;
         if (owned.runId !== runId && !opts?.endedRunIds?.has(owned.runId))
             continue;
         if (a.workspaceId !== ws)

package/dist/gates/acceptance.d.ts

@@ -28,6 +28,19 @@ export interface VitestListedTest {
     file: string;
     projectName?: string;
 }
+export type VitestListResult = {
+    status: "listed";
+    tests: VitestListedTest[];
+} | {
+    status: "failed";
+    error: string;
+};
+export declare function listVitestTests(cwd: string): Promise<VitestListResult>;
+export interface NamedTestAudit {
+    criterion: string;
+    matches: VitestListedTest[];
+}
+export declare function auditNamedTestOracles(items: readonly AcceptanceItem[], listedTests: readonly VitestListedTest[]): NamedTestAudit[];
 export type AcceptanceCorpusAuditResult = {
     specPath: string;
     status: "parse-failed";

package/dist/gates/acceptance.js

@@ -98,6 +98,47 @@ export function testFiltered(testCmd, name) {
     const fwd = wrapped ? "-- " : "";
     return `${testCmd} ${fwd}-t ${shq(pattern)}`;
 }
+const VitestListedTestsSchema = z.array(z.object({
+    name: z.string(),
+    file: z.string(),
+    projectName: z.string().optional(),
+}));
+export async function listVitestTests(cwd) {
+    const result = await sh(`${shq(join(cwd, "node_modules/.bin/vitest"))} list --json`, cwd);
+    if (result.code !== 0) {
+        return { status: "failed", error: (result.stderr || result.stdout || `exit ${result.code}`).trim() };
+    }
+    try {
+        const start = result.stdout.indexOf("[");
+        if (start < 0)
+            return { status: "failed", error: "runner emitted no JSON test listing" };
+        const parsed = VitestListedTestsSchema.safeParse(JSON.parse(result.stdout.slice(start)));
+        return parsed.success
+            ? { status: "listed", tests: parsed.data }
+            : { status: "failed", error: z.prettifyError(parsed.error) };
+    }
+    catch (error) {
+        return { status: "failed", error: error instanceof Error ? error.message : String(error) };
+    }
+}
+export function auditNamedTestOracles(items, listedTests) {
+    const runnerNames = listedTests.map((listed) => ({
+        listed,
+        fullName: listed.name.split(" > ").join(" "),
+    }));
+    return items.flatMap((item) => {
+        if (typeof item !== "object" || item.oracle !== "test")
+            return [];
+        return [{
+                criterion: item.test,
+                // OBS-511: mirror the gate's leaf-anchored suffix rule — this denominator must count
+                // exactly the tests the shipped -t filter would select.
+                matches: runnerNames
+                    .filter(({ fullName }) => fullName === item.test || fullName.endsWith(` ${item.test}`))
+                    .map(({ listed }) => listed),
+            }];
+    });
+}
 function corpusSpecPaths(root) {
     const paths = [];
     const visit = (dir) => {
@@ -116,32 +157,18 @@ function corpusSpecPaths(root) {
 // listing. Every discovered path contributes either all parser-produced acceptance items or one named
 // parse failure; exceptions are evidence, never permission to shrink the corpus silently.
 export function auditAcceptanceCorpus(corpusRoot, listedTests) {
-    const runnerNames = listedTests.map((listed) => ({
-        listed,
-        fullName: listed.name.split(" > ").join(" "),
-    }));
     const results = [];
     for (const specPath of corpusSpecPaths(corpusRoot)) {
         try {
             const graph = compileNative(specPath);
             for (const task of graph.tasks) {
                 for (const item of task.acceptance) {
+                    const namedTest = auditNamedTestOracles([item], listedTests)[0];
                     results.push({
                         specPath,
                         status: "parsed",
                         item,
-                        ...(typeof item === "object" && item.oracle === "test"
-                            ? {
-                                namedTest: {
-                                    criterion: item.test,
-                                    // OBS-511: mirror the gate's leaf-anchored suffix rule — the audit's denominator
-                                    // must count exactly the tests the -t filter would select, or doctor and gate disagree.
-                                    matches: runnerNames
-                                        .filter(({ fullName }) => fullName === item.test || fullName.endsWith(` ${item.test}`))
-                                        .map(({ listed }) => listed),
-                                },
-                            }
-                            : {}),
+                        ...(namedTest ? { namedTest } : {}),
                     });
                 }
             }

package/dist/gates/run-gates.js

@@ -176,11 +176,11 @@ async function coveringTests(worktree, baseRef) {
         }
         const covering = tests.filter((t) => reachOf(t).has(file));
         if (!covering.length)
-            return undefined; // nothing covers this file — only the full suite can speak for it
+            continue; // nothing covers this file — keep every attributable selection already accumulated
         for (const t of covering)
             selected.add(t);
     }
-    return [...selected].sort();
+    return selected.size ? [...selected].sort() : undefined;
 }
 /**
  * The configured test command narrowed to these files. Mirrors testFiltered's `--` rule (acceptance.ts:104):
@@ -287,7 +287,7 @@ export async function runGates(task, ctx) {
         }
         return { results: sorted, commits };
     };
-    const toolGates = ["build", "test", "lint"].filter(enabled);
+    const toolGates = ["build", "lint"].filter(enabled);
     /**
      * v1.87 T5: the shell gates run their commands against the WORKING TREE, while evidence, scope,
      * the judged diff and the merge all read COMMITS. Uncommitted work is therefore visible to
@@ -337,28 +337,28 @@ export async function runGates(task, ctx) {
             + `Uncommitted at round end:\n${dirt}`,
         meta: { dirtyWorktree: true, dirtyAtRoundEnd: true },
     });
-    // build/test/lint vs the shared baseline
-    const runBattery = async (commands, selected) => {
-        if (!toolGates.length)
+    // shell tools vs the shared baseline
+    const runBattery = async (commands, selected, gates = toolGates) => {
+        if (!gates.length)
             return;
         if (!v185) {
-            // ponytail: compareToBaseline batches build/test/lint — their starts are emitted at iteration,
+            // ponytail: compareToBaseline batches adjacent tools — their starts are emitted at iteration,
             // not at true execution start. They are collectively sub-second (measured), so the debounce
             // suppresses them anyway; split compareToBaseline only if a tool gate ever gets slow.
-            // ponytail: legacy runs build/test/lint in ONE compareToBaseline call, so there is one interval
+            // ponytail: legacy runs adjacent tools in ONE compareToBaseline call, so there is one interval
             // to measure and each of its gates carries it. Split it only if this branch ever stops batching.
             const batchAt = Date.now();
             const batchLoadStart = loadProvider();
-            const toolResults = await compareToBaseline(ctx.worktree, commands, ctx.baseline, toolGates);
+            const toolResults = await compareToBaseline(ctx.worktree, commands, ctx.baseline, [...gates]);
             const batch = { durationMs: Date.now() - batchAt, load1Start: batchLoadStart, load1End: loadProvider() };
-            for (const g of toolGates)
+            for (const g of gates)
                 spans.set(g, batch);
             // The same refusal AFTER the commands, because a green command can dirty the tree the check
             // above just proved clean. Batched, legacy cannot say WHICH command did it, so the refusal
             // lands on the last gate that had one — the round dies there either way. A red battery is
             // reported as the red it is: the round already ends, and the command output is the better lead.
             const dirt = toolResults.every((r) => r.pass) ? await dirtyWorktree() : undefined;
-            const blame = dirt ? [...toolGates].reverse().find((g) => commands[g]) : undefined;
+            const blame = dirt ? [...gates].reverse().find((g) => commands[g]) : undefined;
             for (const r of toolResults) {
                 await emitStart(r.gate);
                 await record(r.gate === blame ? dirtyRefusal(blame, dirt, commands[blame]) : r);
@@ -366,8 +366,8 @@ export async function runGates(task, ctx) {
             return;
         }
         // T4 (OBS-265): one command at a time, stopping at the first red — a failed build no longer buys
-        // the full vitest suite before anyone reads its verdict.
-        for (const g of toolGates) {
+        // any later tool before anyone reads its verdict.
+        for (const g of gates) {
             await emitStart(g);
             const [r] = await measure(g, () => compareToBaseline(ctx.worktree, commands, ctx.baseline, [g]));
             // the screen's interval IS the test gate's first interval, so the split needs no second clock
@@ -437,9 +437,9 @@ export async function runGates(task, ctx) {
      * screen IS the round's verdict: what it produced is journaled (in the order it ran) and the round
      * ends there, so a drive-by out-of-scope edit costs <1s instead of the whole battery.
      *
-     * A green screen changes nothing downstream. The recorded sequence stays GATE_NAMES order, so the
-     * journal, `tickmarkr report`, the surfaces, and resume's GATE_NAMES walk over already-satisfied
-     * gates all keep reading exactly one order.
+     * A green screen changes nothing downstream. The returned record stays in GATE_NAMES order while
+     * the event stream reports the order gates actually ran; resume's GATE_NAMES walk over satisfied
+     * records therefore keeps declaration order without making the live stream lie about execution.
      *
      * ponytail: the price of that is re-reading two git checks (~40ms) in their canonical positions
      * rather than teaching every consumer of the gate stream a second order. Both reads see the same
@@ -447,7 +447,7 @@ export async function runGates(task, ctx) {
      * for. Charge it only when there IS a battery command to protect.
      */
     const screenBlocks = async () => {
-        if (!toolGates.some((g) => ctx.commands[g]))
+        if (!toolGates.some((g) => ctx.commands[g]) && !(enabled("test") && ctx.commands.test))
             return false;
         const screened = [];
         for (const [gate, compute] of [["evidence", evidenceResult], ["scope", scopeResult]]) {
@@ -626,12 +626,7 @@ export async function runGates(task, ctx) {
     }
     if (v185 && await screenBlocks())
         return done();
-    // A non-final round may run only the tests covering its own diff; the merge-candidate round below
-    // pays the full suite anyway, so a selection that misses costs a round and can never merge.
-    const selected = v185 && ctx.selectTests && enabled("test") && ctx.commands.test
-        ? await coveringTests(ctx.worktree, ctx.baseRef)
-        : undefined;
-    await runBattery(selected ? { ...ctx.commands, test: testCommandForFiles(ctx.commands.test, selected) } : ctx.commands, selected);
+    await runBattery(ctx.commands);
     if (failed())
         return done();
     if (enabled("evidence")) {
@@ -644,6 +639,14 @@ export async function runGates(task, ctx) {
         if (failed())
             return done();
     }
+    // A non-final round may run only the tests covering its own diff; the merge-candidate round below
+    // pays the full suite anyway, so a selection that misses costs a round and can never merge.
+    const selected = v185 && ctx.selectTests && enabled("test") && ctx.commands.test
+        ? await coveringTests(ctx.worktree, ctx.baseRef)
+        : undefined;
+    await runBattery(selected ? { ...ctx.commands, test: testCommandForFiles(ctx.commands.test, selected) } : ctx.commands, selected, enabled("test") ? ["test"] : []);
+    if (failed())
+        return done();
     if (v185 && (enabled("acceptance") || enabled("review"))) {
         // Judge and review are launched TOGETHER (96m of serialization over 5 runs). Enforcement is
         // unchanged — it is still the AND of both, both still fail closed, and neither reads the other's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.1.7",
+  "version": "2.1.9",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-auto/SKILL.md

@@ -83,7 +83,7 @@ After sending, **confirm delivery** by reading the target pane and verifying the
 1. **Prepare** — confirm the target list. Run the [binary preflight](#binary-preflight-before-compile-or-run). Check `git status`, confirm no tickmarkr run is active, and work from a non-main branch.
 2. **Compile** — run `tickmarkr compile <spec-or-directory>`. Fix source-spec defects instead of editing the generated graph.
 3. **Plan** — run `tickmarkr plan`. Review routes, capability-floor warnings, and human gates before execution.
-4. **Run** — run `tickmarkr run`. Watch the run journal for its terminal event rather than polling agents — a self-terminating poll (`until grep -q '"event":"run-end"' <state-dir>/runs/<runId>/journal.jsonl; do sleep 20; done`), never `tail -F | grep -m1` (wedges on the journal's final line) and never a pane-level done wait (turn-end flaps). Resolve blocked interactions in the relevant agent session.
+4. **Run** — run `tickmarkr run`. Watch the run journal for its terminal events rather than polling agents, using the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800` — which takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict` and grades the run-end summary against every green clause for you. Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the relevant agent session.
 5. **Verify and consolidate** — continue only after a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", and the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty — a run with a parked task is partial, not green. Tickmarkr consolidates accepted work on `tickmarkr/<runId>` and never signs off to the main branch. A human controls any later release merge.
 6. **Record** — write `tickmarkr report <runId> --md` beside the source spec and commit the execution record when the repository tracks those records.
 7. **Continue** — move to the next requested target. If a target fails or is parked, stop with the journal evidence rather than silently skipping it.

package/skills/tickmarkr-loop/SKILL.md

@@ -87,6 +87,6 @@ When spawning consultants (agents gathering synthesis input for decisions like S
 1. **Prepare** — start from the requested spec. Run the [binary preflight](#binary-preflight-before-compile-or-run). Check `git status`, confirm no tickmarkr run is active, and work from a non-main branch.
 2. **Compile** — run `tickmarkr compile <spec>`. Correct compilation errors in the spec, never in the generated graph.
 3. **Plan** — run `tickmarkr plan`. Review the routing table, capability-floor warnings, and every human gate, including work that each gate blocks.
-4. **Run** — run `tickmarkr run`. Watch the run journal for its terminal event rather than repeatedly polling agents. Use a self-terminating poll — `until grep -q '"event":"run-end"' <state-dir>/runs/<runId>/journal.jsonl; do sleep 20; done` — never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). Resolve blocked interactions in the agent session; do not turn them into proxy questions.
+4. **Run** — run `tickmarkr run`. Watch the run journal for its terminal events rather than polling agents, using the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800` — which takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict` and grades the run-end summary against every green clause for you. Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the agent session; do not turn them into proxy questions.
 5. **Verify and consolidate** — accept only a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", and the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty — a run with a parked task is partial, not green. Tickmarkr consolidates accepted task work on `tickmarkr/<runId>`; it never signs off to the main branch. A human may later merge that integration branch through the repository's normal release process.
 6. **Record** — write `tickmarkr report <runId> --md` beside the source spec and commit the execution record when the repository tracks those records. Then [stand down](#stand-down-mission-end-and-retirement).