tickmarkr 2.1.9 → 2.2.1

package/dist/run/journal.js

@@ -148,6 +148,40 @@ export function upheldFeedbackByTask(events) {
     }
     return upheld;
 }
+const CONSULT_ACTIONS = ["retry", "reroute", "decompose", "human"];
+const consultAction = (action) => typeof action === "string" && CONSULT_ACTIONS.includes(action)
+    ? action
+    : undefined;
+/**
+ * The newest structured consult prescription still open for this task. A consult park is only a
+ * pause: graph-changed revival can dispatch a fresh worker without a live `applyVerdict()` frame, so
+ * prompt-build re-derives the worker-facing bullets from the journal. Notes are deliberately excluded:
+ * they are audit prose, and OBS-37a says workers get only structured reason/guidance rendered by
+ * `renderRetryGuidance()`.
+ */
+export function outstandingConsultGuidance(events, taskId) {
+    let carry;
+    for (const e of events) {
+        if (e.taskId !== taskId)
+            continue;
+        if (e.event === "consult-verdict") {
+            const action = consultAction(e.data.action);
+            const reason = typeof e.data.reason === "string" && e.data.reason.trim() ? e.data.reason : undefined;
+            const guidance = typeof e.data.guidance === "string" && e.data.guidance.trim() ? e.data.guidance : undefined;
+            carry = action && (reason || guidance)
+                ? {
+                    action,
+                    ...(reason ? { reason } : {}),
+                    ...(guidance ? { guidance } : {}),
+                }
+                : undefined;
+        }
+        else if (e.event === "task-done" || e.event === "merge") {
+            carry = undefined;
+        }
+    }
+    return carry;
+}
 // Reserved for a finding whose OWN evidence names no path. Reporting a blank path a reader would take
 // for a resolved one is the silent-lie shape the gates exist to refuse, so the field says so outright.
 export const UNIDENTIFIED = "<unidentified>";
@@ -1360,16 +1394,27 @@ export class Journal {
         }
         return m;
     }
-    // OBS-130: gate satisfaction is authority, not an inferred daemon state. Only an explicit
-    // task-approved event with the typed release marker and a known gate enters this fold. A daemon-made
-    // gate-satisfied event, a prior pass/fail result, malformed data, or another task's approval is inert.
+    // OBS-130/OBS-571: gate satisfaction is authority, not an inferred daemon state. Only an explicit
+    // task-approved event with the typed release marker and a known gate enters this fold. Authority is
+    // scoped to that approval: any later approval supersedes it, and the worktree-recreation row written
+    // before the approved gate suffix runs consumes it at enactment. A daemon-made gate-satisfied event,
+    // a prior pass/fail result, malformed data, or another task's approval is inert.
     replaySatisfiedGates() {
         const satisfied = new Map();
         for (const e of this.read()) {
-            if (e.event !== "task-approved" || !e.taskId || e.data.release !== GATE_SATISFIED_RELEASE)
+            if (!e.taskId)
                 continue;
-            if (typeof e.data.gate === "string" && GATE_NAMES.includes(e.data.gate)) {
-                satisfied.set(e.taskId, e.data.gate);
+            if (e.event === "worktree-recreation") {
+                satisfied.delete(e.taskId);
+                continue;
+            }
+            if (e.event === "task-approved") {
+                satisfied.delete(e.taskId);
+                if (e.data.release === GATE_SATISFIED_RELEASE
+                    && typeof e.data.gate === "string"
+                    && GATE_NAMES.includes(e.data.gate)) {
+                    satisfied.set(e.taskId, e.data.gate);
+                }
             }
         }
         return satisfied;

package/dist/tui/cockpit/setup-cockpit.d.ts

@@ -1,4 +1,5 @@
 import { type ReactElement } from "react";
+import { type ApprovalDisposition, type ApprovalRunOwner } from "../../cli/commands/approve.js";
 import { Journal } from "../../run/journal.js";
 import { type TickmarkrConfig } from "../../config/config.js";
 import { type ComponentState, type JournalRow } from "./components.js";
@@ -73,15 +74,8 @@ export type ParkedDecision = {
 };
 /** The parks a verb can release — the rows the surface draws live verbs on. */
 export declare function actionableDecisions(decisions: readonly ParkedDecision[]): readonly ParkedDecision[];
-/**
- * The decisions section's rows: one per task the journal's own status replay
- * leaves parked on a human, in the order the journal first named them. The
- * replay is the production one (`Journal.replayStatuses`) so this surface and
- * `tickmarkr status` can never disagree about what is parked.
- */
 export declare function deriveParkedDecisions(journal: Journal): readonly ParkedDecision[];
-/** The two decisions a parked task offers — the production command's two verbs. */
-export type SetupDecisionVerb = "approve" | "uphold";
+export type SetupDecisionVerb = "approve" | "waive" | "uphold" | "recheck";
 /** A decision the operator has named but not yet confirmed. */
 export type SetupDecisionCommand = {
     readonly verb: SetupDecisionVerb;
@@ -93,6 +87,7 @@ export type SetupDecisionWrite = {
     readonly verb: SetupDecisionVerb;
     /** The release marker read back from the recorded task-approved event. */
     readonly release: string | undefined;
+    readonly disposition: ApprovalDisposition;
     readonly by: string;
 };
 /**
@@ -120,6 +115,7 @@ export type SetupDecisionsKeyResult = {
  * inert and the keybar does not advertise it — the surface never promises a
  * decision the command must refuse.
  */
+export declare function setupDecisionVerbs(decision: ParkedDecision): readonly SetupDecisionVerb[];
 export declare function upholdAvailable(decision: ParkedDecision): boolean;
 /**
  * The decisions surface's whole key grammar: ↑↓ move, a approve, u uphold,
@@ -160,7 +156,7 @@ export declare function recordSetupDecisionOutcome(session: SetupDecisionsSessio
  * The confirm inset's lines: the task, the actor, the effect and the file,
  * stated before the single key that can write.
  */
-export declare function setupDecisionConfirmLines(command: SetupDecisionCommand, decision: ParkedDecision | undefined, actor: string, journalFile: string): readonly string[];
+export declare function setupDecisionConfirmLines(command: SetupDecisionCommand, decision: ParkedDecision | undefined, actor: string, journalFile: string, run: ApprovalRunOwner): readonly string[];
 /**
  * The decisions surface. Every row it draws — decisions, the confirm inset,
  * the pending writes region — is measured and clipped through the width
@@ -168,12 +164,14 @@ export declare function setupDecisionConfirmLines(command: SetupDecisionCommand,
  * neither overflow its row nor be cut mid-cluster. The one unclipped element
  * is `notice`: the production command's own words, verbatim.
  */
-export declare function SetupDecisionsSurface({ decisions, session, columns, actor, journalFile, }: {
+export declare function SetupDecisionsSurface({ decisions, session, columns, actor, journalFile, run, }: {
     decisions: readonly ParkedDecision[];
     session: SetupDecisionsSession;
     columns: number;
     actor: string;
     journalFile: string;
+    /** Who enacts a confirmed write — read from the run lock, never assumed. */
+    run: ApprovalRunOwner;
 }): ReactElement;
 /**
  * The setup decisions surface on a live engagement. This is the only cockpit

package/dist/tui/cockpit/setup-cockpit.js

@@ -4,8 +4,8 @@ import { userInfo } from "node:os";
 import { join } from "node:path";
 import { cloneElement, createElement, useState, } from "react";
 import { parse } from "yaml";
-import { approve } from "../../cli/commands/approve.js";
-import { ATTEMPT_CAP_RELEASE, GATE_SATISFIED_RELEASE, Journal, REVIEW_UPHELD_RELEASE, } from "../../run/journal.js";
+import { approvalDispositionForRelease, approvalEnactment, approvalRunOwner, approve, } from "../../cli/commands/approve.js";
+import { ATTEMPT_CAP_RELEASE, GATE_SATISFIED_RELEASE, Journal, RECHECK_RELEASE, REVIEW_UPHELD_RELEASE, } from "../../run/journal.js";
 import { BANNER, GLYPHS, PLAIN_BANNER, } from "../../brand.js";
 import { DEFAULT_CONFIG, INTEGRITY_FLOOR_SHAPES, TIER_RANK, TickmarkrConfigSchema, unifiedYamlDiff, } from "../../config/config.js";
 import { GATE_NAMES, SHAPES } from "../../graph/schema.js";
@@ -560,6 +560,20 @@ export function actionableDecisions(decisions) {
  * replay is the production one (`Journal.replayStatuses`) so this surface and
  * `tickmarkr status` can never disagree about what is parked.
  */
+function failedGateForNewestPark(events, taskId, parkedIndex) {
+    for (let index = parkedIndex - 1; index >= 0; index -= 1) {
+        const event = events[index];
+        if (event.taskId !== taskId)
+            continue;
+        if (event.event === "task-approved" || event.event === "task-human" || event.event === "task-dispatch")
+            return undefined;
+        if (event.event === "gate-result" && event.data.pass === false
+            && typeof event.data.gate === "string" && GATE_NAMES.includes(event.data.gate)) {
+            return event.data.gate;
+        }
+    }
+    return undefined;
+}
 export function deriveParkedDecisions(journal) {
     const statuses = journal.replayStatuses();
     const events = journal.read();
@@ -579,12 +593,7 @@ export function deriveParkedDecisions(journal) {
                 parkedIndex = index;
         }
         const parked = parkedIndex >= 0 ? events[parkedIndex] : undefined;
-        // The same rule the production approve command applies: the newest failed
-        // gate-result before the newest task-human controls what approve records
-        // and whether uphold exists at all. Never inferred from the park's prose.
-        const failedGate = events.slice(0, Math.max(0, parkedIndex)).reverse().find((event) => event.event === "gate-result" && event.taskId === taskId && event.data.pass === false
-            && typeof event.data.gate === "string"
-            && GATE_NAMES.includes(event.data.gate))?.data.gate;
+        const failedGate = failedGateForNewestPark(events, taskId, parkedIndex);
         const kind = typeof parked?.data.kind === "string" ? parked.data.kind : "human-gate";
         const reason = typeof parked?.data.reason === "string" ? parked.data.reason : undefined;
         decisions.push({
@@ -610,8 +619,17 @@ export function initialSetupDecisionsSession() {
  * inert and the keybar does not advertise it — the surface never promises a
  * decision the command must refuse.
  */
+export function setupDecisionVerbs(decision) {
+    if (decision.tombstone)
+        return [];
+    if (decision.kind !== "gate-fail")
+        return ["approve"];
+    if (decision.failedGate === undefined)
+        return [];
+    return decision.failedGate === "review" ? ["waive", "uphold", "recheck"] : ["waive", "recheck"];
+}
 export function upholdAvailable(decision) {
-    return decision.failedGate === "review";
+    return setupDecisionVerbs(decision).includes("uphold");
 }
 /**
  * The decisions surface's whole key grammar: ↑↓ move, a approve, u uphold,
@@ -650,25 +668,30 @@ export function applySetupDecisionsKey(session, event, parked) {
             },
         };
     }
-    if (event.input === "a" || event.input === "u") {
+    const verb = { a: "approve", w: "waive", u: "uphold", r: "recheck" }[event.input ?? ""];
+    if (verb !== undefined) {
         const decision = decisions[selection];
-        if (decision === undefined)
-            return { session };
-        if (event.input === "u" && !upholdAvailable(decision))
+        if (decision === undefined || !setupDecisionVerbs(decision).includes(verb))
             return { session };
         return {
             session: {
                 ...session,
                 selection,
-                confirming: {
-                    verb: event.input === "a" ? "approve" : "uphold",
-                    taskId: decision.taskId,
-                },
+                confirming: { verb, taskId: decision.taskId },
             },
         };
     }
     return { session };
 }
+const decisionFlag = (verb) => {
+    if (verb === "waive")
+        return ["--waive"];
+    if (verb === "uphold")
+        return ["--uphold"];
+    if (verb === "recheck")
+        return ["--recheck"];
+    return [];
+};
 /**
  * THE write. It calls the production `approve` command — validation, fail-closed
  * refusals and the journal append are inherited, never re-implemented — and then
@@ -680,7 +703,7 @@ export async function executeSetupDecision(command, { cwd, runId, by }) {
         const message = await approve([
             runId,
             command.taskId,
-            ...(command.verb === "uphold" ? ["--uphold"] : []),
+            ...decisionFlag(command.verb),
             "--by",
             by,
         ], cwd);
@@ -693,11 +716,12 @@ export async function executeSetupDecision(command, { cwd, runId, by }) {
                 break;
             }
         }
+        const disposition = approvalDispositionForRelease(release);
         return {
             ok: true,
             command,
             message,
-            write: { taskId: command.taskId, verb: command.verb, release, by },
+            write: { taskId: command.taskId, verb: command.verb, release, disposition, by },
         };
     }
     catch (error) {
@@ -726,52 +750,58 @@ function decisionRowText(decision) {
  * append — the release markers are the command's own constants, so this text
  * cannot drift from the write. An effect the operator cannot read here is an
  * effect this surface does not have.
+ *
+ * WHO enacts it is the command's own sentence (`approvalEnactment`), read from
+ * the same run-owner fact: predicting "the next resume" over a LIVE run was
+ * true only while the daemon read approvals once at startup. It now sweeps them
+ * at every task boundary, so that prediction would send the operator to start a
+ * second run in this repository — forbidden — for work already scheduled.
  */
-function decisionEffectLines(command, decision) {
-    if (command.verb === "uphold") {
+function decisionEffectLines(command, decision, run) {
+    if (command.verb === "waive") {
+        const gate = decision?.failedGate;
+        return gate === undefined ? ["effect none — waive refuses without a failed gate"] : [
+            `effect disposition waive-gate; appends release ${GATE_SATISFIED_RELEASE} for gate ${gate}`,
+            `it marks gate ${gate} satisfied; it does NOT mark the task done`,
+            approvalEnactment("waive-gate", run),
+        ];
+    }
+    if (command.verb === "recheck") {
         return [
-            `effect appends one task-approved event with release ${REVIEW_UPHELD_RELEASE};`
-                + " the next resume funds one fixed attempt carrying the findings",
-            "it does NOT mark the task done or pass any gate",
+            `effect disposition re-dispatch; appends release ${RECHECK_RELEASE}`,
+            "it marks no gate satisfied",
+            approvalEnactment("re-dispatch", run),
         ];
     }
-    if (decision?.kind === "gate-fail") {
-        if (decision.failedGate === undefined) {
-            // The command's own refusal, predicted: no write is promised here.
-            return [
-                "effect none — the command refuses: parked on gate-fail"
-                    + " but no failed gate result is recorded",
-            ];
-        }
-        const gate = decision.failedGate;
+    if (command.verb === "uphold") {
         return [
-            `effect appends one task-approved event with release ${GATE_SATISFIED_RELEASE}`
-                + ` for gate ${gate}; the next resume continues past the approved gate`,
-            `it marks gate ${gate} satisfied; it does NOT mark the task done`,
+            `effect disposition fund-fixed-attempt; appends release ${REVIEW_UPHELD_RELEASE}`,
+            approvalEnactment("fund-fixed-attempt", run),
         ];
     }
+    if (decision?.kind === "gate-fail") {
+        return ["effect none — approve is not offered on gate-fail parks; choose waive, recheck or uphold"];
+    }
     if (decision?.kind === ATTEMPT_CAP_RELEASE) {
         return [
-            `effect appends one task-approved event with release ${ATTEMPT_CAP_RELEASE};`
-                + ` the next resume dispatches ${command.taskId} with a fresh attempt budget`,
-            "it does NOT mark the task done or pass any gate",
+            `effect disposition fresh-budget; appends release ${ATTEMPT_CAP_RELEASE}`,
+            approvalEnactment("fresh-budget", run),
         ];
     }
     return [
-        "effect appends one task-approved event with no release;"
-            + ` the next resume dispatches ${command.taskId}`,
-        "it does NOT mark the task done or pass any gate",
+        `effect disposition dispatch; appends one task-approved event with no release`,
+        approvalEnactment("dispatch", run),
     ];
 }
 /**
  * The confirm inset's lines: the task, the actor, the effect and the file,
  * stated before the single key that can write.
  */
-export function setupDecisionConfirmLines(command, decision, actor, journalFile) {
+export function setupDecisionConfirmLines(command, decision, actor, journalFile, run) {
     return [
         `task   ${command.taskId}${decision === undefined ? "" : ` · ${decision.kind} · attempt ${decision.attempts}`}`,
         `actor  ${actor}`,
-        ...decisionEffectLines(command, decision),
+        ...decisionEffectLines(command, decision, run),
         `file   ${journalFile} · append only`,
         `y ${command.verb} · n cancel`,
     ];
@@ -783,8 +813,13 @@ function setupDecisionsKeybar(session, decisions) {
     if (decisions.length === 0)
         return "q Quit";
     const selected = Math.min(session.selection, decisions.length - 1);
-    const uphold = upholdAvailable(decisions[selected]) ? " · u Uphold" : "";
-    return `↑↓ Move · a Approve${uphold} · q Quit`;
+    const verbs = setupDecisionVerbs(decisions[selected]).map((verb) => ({
+        approve: "a Approve",
+        waive: "w Waive",
+        uphold: "u Uphold",
+        recheck: "r Recheck",
+    })[verb]).join(" · ");
+    return `↑↓ Move · ${verbs} · q Quit`;
 }
 /**
  * What the tab is, drawn on the tab it names. The operator's v1.83 UAT read
@@ -793,7 +828,7 @@ function setupDecisionsKeybar(session, decisions) {
  * keybar hint also draw.
  */
 const DECISIONS_TAB_LINE = `tab ${DECISIONS_TAB_HINT} · journal-parked human decisions`
-    + " · approve and uphold are its only writes";
+    + " · approve waive uphold and recheck are its only writes";
 /**
  * What the section says when no park needs the operator. It names its own
  * trigger and both verbs, so an operator who arrives at a quiet surface learns
@@ -801,8 +836,8 @@ const DECISIONS_TAB_LINE = `tab ${DECISIONS_TAB_HINT} · journal-parked human de
  */
 const DECISIONS_EMPTY_STATE = [
     "nothing needs you now — no task is parked on a human gate",
-    "a task that parks on one appears here with its two decisions —"
-        + " approve releases it, uphold sides with the reviewer",
+    "a task that parks on one appears here with its decisions —"
+        + " approve dispatches, waive accepts a gate, uphold funds a fix, recheck re-runs",
 ];
 /**
  * The decisions surface. Every row it draws — decisions, the confirm inset,
@@ -811,15 +846,16 @@ const DECISIONS_EMPTY_STATE = [
  * neither overflow its row nor be cut mid-cluster. The one unclipped element
  * is `notice`: the production command's own words, verbatim.
  */
-export function SetupDecisionsSurface({ decisions, session, columns, actor, journalFile, }) {
+export function SetupDecisionsSurface({ decisions, session, columns, actor, journalFile, run, }) {
     const inner = Math.max(1, Math.floor(columns) - 4);
     const actionable = actionableDecisions(decisions);
     const tombstones = decisions.filter((decision) => decision.tombstone);
     const selected = Math.min(session.selection, Math.max(0, actionable.length - 1));
     const confirming = session.confirming;
-    return (_jsxs(Box, { flexDirection: "column", width: columns, children: [_jsxs(Panel, { title: `${DECISIONS_TAB_TITLE} · ${decisions.length} parked`, focused: true, children: [_jsx(BodyText, { emphasis: "dim", children: fitCells(DECISIONS_TAB_LINE, inner) }), actionable.map((decision, index) => (_jsx(BodyText, { emphasis: index === selected ? "strong" : "normal", children: fitCells(`${index === selected ? `${GLYPHS.pointer} ` : "  "}${decisionRowText(decision)}`, inner) }, decision.taskId))), actionable.length === 0 && DECISIONS_EMPTY_STATE.map((line) => (_jsx(BodyText, { children: fitCells(line, inner) }, line))), tombstones.map((decision) => (_jsx(BodyText, { emphasis: "dim", children: fitCells(`  read-only · permanent by design · ${decisionRowText(decision)}`, inner) }, decision.taskId)))] }), confirming !== null && (_jsx(Panel, { title: `CONFIRM ${confirming.verb.toUpperCase()}`, focused: true, children: setupDecisionConfirmLines(confirming, decisions.find((decision) => decision.taskId === confirming.taskId), actor, journalFile).map((line) => (_jsx(BodyText, { children: fitCells(line, inner) }, line))) })), session.notice !== null && _jsx(BodyText, { children: session.notice }), _jsx(Panel, { title: "PENDING WRITES", children: session.writes.length === 0
+    return (_jsxs(Box, { flexDirection: "column", width: columns, children: [_jsxs(Panel, { title: `${DECISIONS_TAB_TITLE} · ${decisions.length} parked`, focused: true, children: [_jsx(BodyText, { emphasis: "dim", children: fitCells(DECISIONS_TAB_LINE, inner) }), actionable.map((decision, index) => (_jsx(BodyText, { emphasis: index === selected ? "strong" : "normal", children: fitCells(`${index === selected ? `${GLYPHS.pointer} ` : "  "}${decisionRowText(decision)}`, inner) }, decision.taskId))), actionable.length === 0 && DECISIONS_EMPTY_STATE.map((line) => (_jsx(BodyText, { children: fitCells(line, inner) }, line))), tombstones.map((decision) => (_jsx(BodyText, { emphasis: "dim", children: fitCells(`  read-only · permanent by design · ${decisionRowText(decision)}`, inner) }, decision.taskId)))] }), confirming !== null && (_jsx(Panel, { title: `CONFIRM ${confirming.verb.toUpperCase()}`, focused: true, children: setupDecisionConfirmLines(confirming, decisions.find((decision) => decision.taskId === confirming.taskId), actor, journalFile, run).map((line) => (_jsx(BodyText, { children: fitCells(line, inner) }, line))) })), session.notice !== null && _jsx(BodyText, { children: session.notice }), _jsx(Panel, { title: "PENDING WRITES", children: session.writes.length === 0
                     ? _jsx(BodyText, { children: fitCells("nothing written this session", inner) })
-                    : session.writes.map((write) => (_jsx(BodyText, { children: fitCells(`${write.verb} ${write.taskId} · release ${write.release ?? "none"} · by ${write.by}`, inner) }, `${write.verb}:${write.taskId}`))) }), _jsx(BodyText, { emphasis: "dim", children: fitCells(setupDecisionsKeybar(session, actionable), Math.max(1, Math.floor(columns))) })] }));
+                    : session.writes.map((write) => (_jsx(BodyText, { children: fitCells(`${write.verb} ${write.taskId} · disposition ${write.disposition}`
+                            + ` · release ${write.release ?? "none"} · by ${write.by}`, inner) }, `${write.verb}:${write.taskId}`))) }), _jsx(BodyText, { emphasis: "dim", children: fitCells(setupDecisionsKeybar(session, actionable), Math.max(1, Math.floor(columns))) })] }));
 }
 function SetupDecisionsApp({ cwd, runId, actor, }) {
     const { exit } = useApp();
@@ -846,7 +882,10 @@ function SetupDecisionsApp({ cwd, runId, actor, }) {
             });
         }
     });
-    return (_jsx(SetupDecisionsSurface, { decisions: decisions, session: session, columns: stdout.columns ?? 80, actor: actor, journalFile: join(stateDirName(cwd), "runs", runId, "journal.jsonl") }));
+    return (_jsx(SetupDecisionsSurface, { decisions: decisions, session: session, columns: stdout.columns ?? 80, actor: actor, journalFile: join(stateDirName(cwd), "runs", runId, "journal.jsonl"), 
+        // read per render, not once at mount: a daemon can start or end while the
+        // operator is deciding, and the inset must not promise the wrong enactor.
+        run: approvalRunOwner(cwd, runId) }));
 }
 /**
  * The setup decisions surface on a live engagement. This is the only cockpit

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.1.9",
+  "version": "2.2.1",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-loop/SKILL.md

@@ -29,6 +29,7 @@ Outside a multi-agent terminal environment, run the loop directly.
 - Do not edit the compiled graph to force an outcome; fix the source spec and compile again.
 - Gates verify commits, diffs, acceptance criteria, and reviews independently. Never trust a worker's claim that work is complete.
 - Treat missing or unparseable machine results and verdicts as failures. Do not release, resume, or merge around failed gates.
+- A task changing what the daemon DOES must own every surface that TELLS the operator what the daemon does.
 
 ## Act by default
 

package/skills/tickmarkr-overseer/SKILL.md

@@ -487,6 +487,12 @@ they are left implicit:
    were authed on 2026-08-17 while every seat ran claude). Priority when independence is scarce:
    **verifier > checker > planner > executors** — the independent seat goes cross-vendor
    (`herdr agent start … --kind codex`), ruled at dispatch, never debated under time pressure.
+   **A codex seat inside a git WORKTREE cannot commit and cannot write outside the worktree** (OBS-824, measured
+   twice on 2026-09-01): its sandbox pins writes to the worktree's own path, and a worktree's `.git` is a FILE pointing
+   at the main repository's object store, so every `git commit` from inside it is refused. Brief such a seat to leave its
+   report INSIDE the worktree and to commit nothing — the overseer commits from the main checkout — or give the work to a
+   claude seat, or to a throwaway CLONE (a real `.git` directory). A brief that tells a codex-in-worktree seat to commit
+   buys a stall, not a commit.
 4. **Gate every exec lane with the shipped battery, not hand-rolled greps.**
    `tickmarkr verify --base <ref> --criteria <file>` is the standalone form of the engine's own gates —
    build/test/lint diffed against a recorded baseline, evidence, scope, plus the semantic judges — one
@@ -749,6 +755,10 @@ once** — an overseer ran nine hours at 86% unable to read its own number. Arm
 Herdr's `agent_status`, which is unreliable for vendors whose screen detection is skipped (kimi) — for
 those, the spawn-time auto-approve flag is the control, not this watcher.
 
+For `consult`, `surgeon`, and `reviewer` seats, the CONTEXT watcher is wake-only: arm it with
+`TKR_AUTO_CLEAR=0 .claude/skills/tickmarkr-overseer/scripts/watch-context.sh <consult|surgeon|reviewer>
+<agent|pane> 50 50 <handoff-file>`. Only `orchestrator` and `overseer` seats may use auto-clear.
+
 ```bash
 .claude/skills/tickmarkr-overseer/scripts/watch-pending-input.sh <agent|pane> [poll-s] [cap-s] [confirm-polls]
 ```
@@ -947,6 +957,13 @@ orchestrator turn boundary.
    leave clean state after a version is shipped"***. Every line below is a defect that actually happened
    on the release that produced this rule.
 
+   - **RUN BOTH RELEASE PROOFS BEFORE STANDING DOWN.** The first is the exported-tree suite, which
+     maintainers run from the private repo with its `verify:export` script — that tooling is deliberately
+     not part of this package, so the command does not exist in a public checkout; it must install,
+     build, and run the suite in the exported tree; then
+     `TICKMARKR_E2E=1 npx vitest run tests/e2e/orca-smoke.e2e.test.ts` must exercise the installed-Orca
+     smoke. A skipped smoke is not proof. Record both results before declaring the release complete.
+
    - **REWRITE THE MEMORY INDEX FIRST, and read it back.** Minutes after `2.1.1` hit npm, the index line
      a fresh session loads still read *"⛔ 2.1.1 CANNOT ship from run …2011"* — true when written, and by
      then the exact opposite of the truth. **The index is what everyone loads and the body is what nobody

package/skills/tickmarkr-overseer/scripts/watch-context.sh

@@ -33,7 +33,7 @@
 # usage: watch-context.sh <role-slug> <agent|pane> <warn-pct> <act-pct> [handoff-file] [poll-s] [cap-s]
 #   <role-slug> is ANY seat role — orchestrator, overseer, surgeon, consult — and names the tier
 #   `<role>-context`. It is deliberately NOT a closed set: see OBS-730 at the guard below.
-#   TKR_AUTO_CLEAR=1   at act-pct WITH a fresh handoff, send /clear and re-brief instead of waking.
+#   TKR_AUTO_CLEAR=1   at act-pct WITH a fresh handoff, auto-clear orchestrator/overseer; other roles wake only.
 #   TKR_REBRIEF=<path> the file the re-briefed seat is told to read (defaults to the handoff).
 #   TKR_HANDOFF_MAX_AGE_S  how fresh "fresh" is (default 900).
 #   TKR_CLEAR_SETTLE_S     seconds to let a cleared seat settle before the re-brief (default 6).
@@ -221,7 +221,7 @@ handoff_fresh() {
 act_on() {
   local P="$1"
   if handoff_fresh; then
-    if [ "${TKR_AUTO_CLEAR:-0}" = "1" ]; then
+    if [ "${TKR_AUTO_CLEAR:-0}" = "1" ] && { [ "$ROLE" = "orchestrator" ] || [ "$ROLE" = "overseer" ]; }; then
       herdr agent prompt "$TARGET" "/clear" >/dev/null 2>&1
       sleep "$SETTLE"
       herdr agent prompt "$TARGET" "Read ${REBRIEF} and continue exactly where it says. Your context was cleared at ${P}% against that handoff; it is current as of $(date '+%H:%M'). Do not reconstruct from memory — everything you need is on disk." >/dev/null 2>&1