tickmarkr 2.2.0 → 2.3.0

package/dist/run/git.js

@@ -13,6 +13,7 @@ export { ROUTING_ENV_SEAMS };
 // Default to a modest cap through the environment so vitest honors it natively; never pass it
 // as argv (OBS-55) so child test oracles stay intact. The operator's own export wins.
 export const FORK_CAP_ENV = "VITEST_MAX_FORKS";
+export const SUITE_PARENT_ENV = "TICKMARKR_SUITE_PARENT";
 export const DEFAULT_FORK_CAP = "6";
 /**
  * The fork budget belongs to ONE run: how many gate suites can be in flight at once is exactly that
@@ -150,6 +151,9 @@ function shell(cmd, cwd, timeoutMs, login) {
     // OBS-110: apply the run's own fork cap only when the operator has not already set one.
     if (!(FORK_CAP_ENV in env))
         env[FORK_CAP_ENV] = resolvedForkCap();
+    // OBS-854: descendants can leave the checkout (nested fixture suites do), so cwd alone cannot
+    // attribute them. Every daemon shell exports the daemon pid as their durable parentage marker.
+    env[SUITE_PARENT_ENV] = String(process.pid);
     // T7: the capacity every result of this shell carries, read HERE — off the environment the child
     // is about to receive, after the precedence above has settled. An operator export is already in
     // `env`, so what gets recorded is the operator's number, which is the case a release was re-taken

package/dist/run/journal.d.ts

@@ -116,8 +116,21 @@ export declare function formatPriorFindingEvidence(evidence: PriorFindingEvidenc
 export declare function normalizeGateFailure(details: string): string;
 export declare const GATE_FINGERPRINT_CAP = 2;
 export declare function identicalGateFailures(events: JournalEvent[], taskId: string, gate: string, normalized: string): number;
-/** Repair attempts this engagement has already funded — journal-derived, so a resume inherits it. */
+/** What each funded repair's next battery actually reached. A repair spends its budget only
+ * when that battery reaches one of the gates it was funded to fix; an earlier red is evidence that
+ * this repair never got its funded turn, not a charge against the repair ladder. */
+export interface RepairReach {
+    repair: number;
+    funded: string[];
+    reached: string[];
+    diedAt?: string;
+    charged: boolean;
+}
+export declare function repairReachSinceApproval(events: JournalEvent[], taskId: string): RepairReach[];
+/** Repair slots actually spent this engagement — journal-derived, so a resume inherits it. */
 export declare function repairsSinceApproval(events: JournalEvent[], taskId: string): number;
+/** Recheck releases not yet enacted by a battery (or by a legacy worker launch). */
+export declare function pendingRechecks(events: JournalEvent[]): Set<string>;
 /**
  * Why the last attempt failed, one row per journaled cause, in the daemon's own `source: details`
  * shape. The daemon builds that brief in a loop-local variable, which dies with the process: a resumed
@@ -242,9 +255,9 @@ export declare const TelemetryRowSchema: z.ZodObject<{
     quotaFailover: z.ZodOptional<z.ZodLiteral<true>>;
     overrun: z.ZodOptional<z.ZodLiteral<true>>;
     retryMode: z.ZodOptional<z.ZodEnum<{
+        repair: "repair";
         resume: "resume";
         fresh: "fresh";
-        repair: "repair";
     }>>;
     signalQuality: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<0>, z.ZodLiteral<0.25>, z.ZodLiteral<0.5>, z.ZodLiteral<0.75>, z.ZodLiteral<1>]>>;
     signalBasis: z.ZodOptional<z.ZodEnum<{

package/dist/run/journal.js

@@ -72,8 +72,8 @@ export const REVIEW_UPHELD_RELEASE = "review-upheld";
 // OBS-203: the third decision a gate-fail park needs. Plain approve WAIVES the failed gate (and every
 // gate before it — daemon.ts remainingGates), which is wrong when the gate failed against a stale task
 // DECLARATION rather than a bad diff: amend the spec's files[], recompile, and the gate now passes
-// honestly. This release re-dispatches with the whole gate suite intact and no gate marked satisfied,
-// so the corrected declaration is the thing that earns the green. Budget semantics match attempt-cap
+// honestly. This release runs the whole gate suite over the parked commit before any worker and
+// marks no gate satisfied: green merges directly, red returns to the ladder. Budget semantics match attempt-cap
 // (fresh attempts, tried survives) because the park cost the task its remaining budget.
 export const RECHECK_RELEASE = "recheck";
 // OBS-738: one authority for every recovery surface. The ref is accepted only from the row that
@@ -547,18 +547,65 @@ export function identicalGateFailures(events, taskId, gate, normalized) {
     }
     return n;
 }
-/** Repair attempts this engagement has already funded — journal-derived, so a resume inherits it. */
-export function repairsSinceApproval(events, taskId) {
-    let n = 0;
+export function repairReachSinceApproval(events, taskId) {
+    const repairs = [];
     for (const e of events) {
         if (e.taskId !== taskId)
             continue;
-        if (e.event === "task-approved")
-            n = 0;
-        else if (e.event === "repair-attempt")
-            n++;
+        if (e.event === "task-approved") {
+            repairs.length = 0;
+        }
+        else if (e.event === "repair-attempt") {
+            const funded = Array.isArray(e.data.gates)
+                ? e.data.gates.filter((gate) => typeof gate === "string")
+                : [];
+            repairs.push({
+                repair: typeof e.data.repair === "number" ? e.data.repair : repairs.length + 1,
+                funded,
+                reached: [],
+                charged: false,
+                launched: false,
+                closed: false,
+            });
+        }
+        else {
+            const repair = repairs.at(-1);
+            if (!repair || repair.closed)
+                continue;
+            if (e.event === "worker-launch") {
+                if (repair.launched)
+                    repair.closed = true;
+                else
+                    repair.launched = true;
+            }
+            else if (repair.launched && e.event === "gate-result" && typeof e.data.gate === "string") {
+                if (!repair.reached.includes(e.data.gate))
+                    repair.reached.push(e.data.gate);
+                if (e.data.pass === false && repair.diedAt === undefined)
+                    repair.diedAt = e.data.gate;
+                if (repair.funded.includes(e.data.gate))
+                    repair.charged = true;
+            }
+        }
     }
-    return n;
+    return repairs.map(({ launched: _launched, closed: _closed, ...repair }) => repair);
+}
+/** Repair slots actually spent this engagement — journal-derived, so a resume inherits it. */
+export function repairsSinceApproval(events, taskId) {
+    return repairReachSinceApproval(events, taskId).filter((repair) => repair.charged).length;
+}
+/** Recheck releases not yet enacted by a battery (or by a legacy worker launch). */
+export function pendingRechecks(events) {
+    const pending = new Set();
+    for (const e of events) {
+        if (!e.taskId)
+            continue;
+        if (e.event === "task-approved" && e.data.release === RECHECK_RELEASE)
+            pending.add(e.taskId);
+        else if (e.event === "recheck-battery" || e.event === "worker-launch")
+            pending.delete(e.taskId);
+    }
+    return pending;
 }
 // Both retry decisions below govern exactly ONE dispatch: the next one. So both are read back from the
 // journal at the moment that dispatch is built, never carried in a process variable — a stop between
@@ -695,8 +742,19 @@ export function pendingRepairFindings(events, taskId) {
  * a channel it is no longer using, and a later unrelated failure is not parked under a stale reason.
  */
 export function activeRetryBan(events, taskId, channel) {
-    const e = decisionForNextDispatch(events, taskId, "gate-fingerprint-cap");
-    return e && e.data.channel === channel && typeof e.data.gate === "string" ? e.data.gate : undefined;
+    let pending;
+    for (const e of events) {
+        if (e.taskId !== taskId)
+            continue;
+        if (e.event === "gate-fingerprint-cap")
+            pending = e;
+        else if (e.event === DECISION_SPENT
+            || (e.event === "task-approved" && e.data.release === RECHECK_RELEASE))
+            pending = undefined;
+    }
+    return pending && pending.data.channel === channel && typeof pending.data.gate === "string"
+        ? pending.data.gate
+        : undefined;
 }
 // Fail-closed shape for a dispatched assignment (journal.ts:75-90 posture): a malformed assignment in
 // one dispatch degrades that single task toward today's behavior — counts toward attempts, contributes

package/dist/run/supervision.d.ts

@@ -7,6 +7,12 @@ export declare const SUPERVISION_FUTURE_GRACE_MS = 1000;
 export declare const SUPERVISION_DEFAULT_THRESHOLD_PCT = 75;
 export declare const SUPERVISION_TIERS: readonly ["orchestrator", "orchestrator-context", "overseer", "overseer-context", "watch"];
 export type SupervisionTier = (typeof SUPERVISION_TIERS)[number];
+/**
+ * Resolve a one-shot supervision writer to the repository state it is claiming to supervise.
+ * The nearest state directory wins; reaching a git root without one is a refusal, not permission
+ * to create fresh state there or to wander into an enclosing repository. This function is read-only.
+ */
+export declare function resolveSupervisionRoot(cwd: string): string;
 export declare const SUPERVISION_SEAT_TIERS: readonly ["orchestrator", "orchestrator-context", "overseer", "overseer-context"];
 export type SeatTier = (typeof SUPERVISION_SEAT_TIERS)[number];
 /** Does this tier's record have to name the seat it speaks for? */

package/dist/run/supervision.js

@@ -1,6 +1,6 @@
 import { mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { randomUUID } from "node:crypto";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { stateDirName, tickmarkrDir } from "../graph/graph.js";
 // SUP-01: supervision liveness as FILE STATE, not as a report — lock.ts's proven shape, one file per
 // tier. A watcher beats its OWN file; every other seat derives that tier's state by stat()ing it. So
@@ -41,6 +41,34 @@ export const SUPERVISION_DEFAULT_THRESHOLD_PCT = 75;
 export const SUPERVISION_TIERS = [
     "orchestrator", "orchestrator-context", "overseer", "overseer-context", "watch",
 ];
+const pathKind = (path) => {
+    try {
+        return statSync(path).isDirectory() ? "directory" : "present";
+    }
+    catch {
+        return "absent";
+    }
+};
+/**
+ * Resolve a one-shot supervision writer to the repository state it is claiming to supervise.
+ * The nearest state directory wins; reaching a git root without one is a refusal, not permission
+ * to create fresh state there or to wander into an enclosing repository. This function is read-only.
+ */
+export function resolveSupervisionRoot(cwd) {
+    let current = resolve(cwd);
+    for (;;) {
+        if (pathKind(join(current, stateDirName(current))) === "directory")
+            return current;
+        if (pathKind(join(current, ".git")) !== "absent") {
+            throw new Error(`missing ${stateDirName(current)}/ state dir at repository root ${current}`);
+        }
+        const parent = dirname(current);
+        if (parent === current) {
+            throw new Error(`missing ${stateDirName(current)}/ state dir — no tickmarkr repository found from ${resolve(cwd)}`);
+        }
+        current = parent;
+    }
+}
 // The tiers whose records must NAME the seat behind them. A one-shot `tickmarkr beat` records a pid
 // that has already exited by the time anyone reads it, and an instant — nothing a reader can attribute
 // to a seat. Measured 2026-08-26: a consult seat of another tier ran the documented beat loop and the

package/dist/tui/ink/init-app.js

@@ -5,13 +5,13 @@ import { ToggleMark } from "./components.js";
 import { clip, INK, inkInput, inkOutput, KeyBar, padCell, Pointer } from "./frame.js";
 const DRIVERS = ["auto", "herdr", "subprocess", "orca"];
 // One line per driver, shown for the value currently selected: four environments no longer fit on
-// a single description row at 80 columns (the shipped three already clipped), and orca is an
-// EXPLICIT choice — `auto` still means herdr-else-subprocess and never reaches for it.
+// a single description row at 80 columns (the shipped three already clipped). Auto identifies its
+// innermost host from environment markers only; outside an Orca terminal, Orca is named explicitly.
 const DRIVER_DESC = {
-    auto: "auto: herdr when HERDR_ENV=1, else subprocess — never orca",
+    auto: "auto: herdr when HERDR_ENV=1, else orca inside an Orca terminal, else subprocess",
     herdr: "herdr: every worker runs in a visible pane you can watch and unblock",
     subprocess: "subprocess: headless child processes — no cockpit, same fail-closed gates",
-    orca: "orca: visible terminals in the Orca app — an explicit choice, never auto's",
+    orca: "orca: visible terminals in the Orca app — picked by auto inside one; name it elsewhere",
 };
 const VISIBILITY = ["pane", "headless"];
 // Three fields, one toggle, one action — a descriptor array, deliberately not a forms framework.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-loop/SKILL.md

@@ -29,6 +29,7 @@ Outside a multi-agent terminal environment, run the loop directly.
 - Do not edit the compiled graph to force an outcome; fix the source spec and compile again.
 - Gates verify commits, diffs, acceptance criteria, and reviews independently. Never trust a worker's claim that work is complete.
 - Treat missing or unparseable machine results and verdicts as failures. Do not release, resume, or merge around failed gates.
+- A task changing what the daemon DOES must own every surface that TELLS the operator what the daemon does.
 
 ## Act by default
 

package/skills/tickmarkr-overseer/SKILL.md

@@ -48,6 +48,15 @@ through brief lineage. **An executor choice nobody made is still an executor cho
    a watcher you know is alive. Earned 2026-08-25 (OBS-622): a handoff recorded *"artifact watcher armed"*
    over two live consult verdicts; at adopt the only `watch-artifacts.sh` on the machine belonged to a
    different repository, and nothing had been watching either file.
+   **WATCHER OWNERSHIP IS THE ARMING SEAT'S RECORDED PID, NEVER A NAME PATTERN.** Every bundled
+   `watch-*.sh` arm sets `TKR_ARMING_SEAT=<seat>` and writes its own pid under
+   `<state-dir>/overseer/pids/<arming-seat>-<script>-<pid>.pid`. A seat retires only watchers it armed,
+   by reading those files and killing the exact recorded pids; it never uses `pkill -f`, `pgrep -f`, or
+   any argv/path pattern. A journal path is shared by partner tiers and therefore cannot prove ownership.
+   Verify each executing pid in two process-table reads before acting, kill-by-pid, arm the replacement,
+   then verify its new pid in two process-table reads. A stand-down order inventories both sets: the
+   ordering seat's recorded pids to retire, and the partner's watchers armed on the ordering seat that
+   must survive it. This is the stand-down order of 222-11, not a best-effort sweep.
    **An adopted seat ANNOUNCES itself, in the same act as re-arming:** tell the adopted orchestrator the
    fresh seat is live (verified send: probe token + read-back). Through the gap its view of your tier read
    STALE, and a tier that believes it is unsupervised escalates into a file nobody is reading. Earned
@@ -289,8 +298,11 @@ on its owner being free is scheduled, not armed* — applies to itself:
 .claude/skills/tickmarkr-overseer/scripts/watch-contamination.sh <journal> <load-ceiling> <poll-s> <cap-s>
 ```
 
-It wakes on a new **failed** `gate-result` carrying an infrastructure fingerprint, or on sustained load
-above a ceiling, and prints one wake reason. **Two triggers, because one is provably not enough:** run
+It wakes on a new **failed runner `test`, `build`, or `lint`** `gate-result` carrying an infrastructure
+fingerprint in the runner-emitted failure lines, or on sustained load above a ceiling, and prints one
+wake reason. It deliberately ignores the same tokens inside review findings, acceptance prose, and the
+secondary fingerprint echo list: quoted discussion of contamination is not contamination. **Two triggers,
+because one is provably not enough:** run
 against the four reds above, the fingerprint trigger caught the `vitest-worker` timeout and correctly
 refused to launder either review rejection — and **missed** the 1-of-3074 case, whose text looks like an
 ordinary assertion failure. Only the load ceiling catches that one. A single-signal version reads as
@@ -323,7 +335,10 @@ when the run's own status text pushed the percentage off the statusline; and an
 The protocol, in both directions:
 
 1. **Overseer sees orch at ≥50%** → nudge it: write `HANDOFF-ORCH-<ver>.md`, then `/clear`, then re-read
-   its brief **and** its handoff, then **re-arm every watcher it listed** (a cleared session has none).
+   its brief **and** its handoff. **A same-process `/clear` keeps every background task alive**; it clears
+   conversation context, not processes. Re-arm is therefore a controlled replacement: read only this
+   seat's pid files, verify each pid in two process-table reads, kill those exact pids, arm replacements,
+   and verify every new pid in two reads. Never retire by pattern.
 2. **The returning orch, now fresh, checks the OVERSEER.** If the overseer is at ≥50%, it directs the
    overseer to write its handoff and clear, and **points it at `HANDOFF-OVERSEER-<ver>.md` by path**.
 3. Whichever seat is fresh performs the check. **Never both at once** — the run keeps one supervising tier
@@ -345,8 +360,9 @@ The protocol, in both directions:
    herdr pane run <my-pane> "/clear"
    #    read the pane back — a cleared claude session shows an empty prompt and a reset context gauge
    # 4. and only THEN, as a SEPARATE send, the re-orientation:
-   herdr pane run <my-pane> "You were cleared at <N>%. Read <handoff> and <brief>, re-arm EVERY watcher
-   they name — a cleared session has none — then confirm you are back."
+   herdr pane run <my-pane> "You were cleared at <N>%. Read <handoff> and <brief>. Same-process clear kept
+   every background task alive: retire only your recorded watcher pids, verify twice, kill-by-pid, arm,
+   verify every new pid twice, preserve the partner-owned watchers the stand-down lists, then confirm."
    ```
 
    ⚠ **Steps 3 and 4 are two sends, never one.** A pointer batched with the clear lands *during* it and is
@@ -507,7 +523,11 @@ they are left implicit:
   sleep 2–3s → send-keys Enter → read back (input empty / agent `working`). Never report "briefed" without
   the read-back. Long content goes in a brief file, never pane text. `scripts/seat-send.sh` encodes
   this whole path — size guard, atomic prompt, prompt-line read-back, optional interrupt — and never
-  auto-resends.
+  auto-resends. Each adapter declares its prompt glyph beside its input-box matchers; `seat-send.sh` reads
+  that declaration rather than assuming Claude's `❯`. **Probe the prompt line before writing:** if it
+  already holds a non-ghost draft, wait only the script's bounded window and return `SEND_DEFERRED`
+  without writing a byte. An unsubmitted post-send draft returns `SEND_UNSUBMITTED`. This protects both
+  Codex's `›` prompt and a HUMAN typing in a pane; delivery is never allowed to glue onto either draft.
   **PROBE THE READ-BACK WITH THE SHORTEST DISTINCTIVE TOKEN — a commit hash, a pid, an OBS id — NEVER a
   sentence.** A long phrase crosses the pane's render wrap boundary, so grepping for it returns zero on a
   message that arrived intact, and **a badly-probed successful send is byte-identical to a truncated one.**
@@ -755,6 +775,10 @@ once** — an overseer ran nine hours at 86% unable to read its own number. Arm
 Herdr's `agent_status`, which is unreliable for vendors whose screen detection is skipped (kimi) — for
 those, the spawn-time auto-approve flag is the control, not this watcher.
 
+For `consult`, `surgeon`, and `reviewer` seats, the CONTEXT watcher is wake-only: arm it with
+`TKR_AUTO_CLEAR=0 .claude/skills/tickmarkr-overseer/scripts/watch-context.sh <consult|surgeon|reviewer>
+<agent|pane> 50 50 <handoff-file>`. Only `orchestrator` and `overseer` seats may use auto-clear.
+
 ```bash
 .claude/skills/tickmarkr-overseer/scripts/watch-pending-input.sh <agent|pane> [poll-s] [cap-s] [confirm-polls]
 ```
@@ -798,12 +822,17 @@ nowhere.
 **The artifact watcher** — bundled, and keyed on the deliverable rather than the seat:
 
 ```bash
-.claude/skills/tickmarkr-overseer/scripts/watch-artifacts.sh <MARKER> <cap-s> <poll-s> <file>...
+TKR_ARMING_SEAT=<this-seat> .claude/skills/tickmarkr-overseer/scripts/watch-artifacts.sh \
+  [--changed-from <content-sha-or-now>] <MARKER> <cap-s> <poll-s> <file>...
 ```
 
 It wakes when every named file exists AND ends with its terminal marker, and on timeout it reports each
 file as READY / PARTIAL / ABSENT so a quiet arm still proves the watcher was alive. Tell each seat, in its
 brief, the exact marker its report must end with — you cannot watch for a marker you never demanded.
+**A re-arm over an artifact that already has its marker uses `--changed-from now` (or its captured SHA).**
+The existing marked bytes are the baseline, not a fresh delivery: the watcher fires only after content
+differs from that baseline and then stabilizes, once. Without the changed-from baseline, re-arm is an
+instant replay of old completion rather than observation of new work.
 **Arm on the marker YOU demanded, verified against the FILE — never on the seat's report of its own
 marker.** Measured 2026-08-17: a seat reported its sweep "ends `SWEEP-END`"; the file on disk ended
 `ORDER4-END`. A watcher armed on the reported marker never fires while the artifact sits COMPLETE, and
@@ -937,9 +966,18 @@ orchestrator turn boundary.
    filed a *different* finding as OBS-437, then repeated it as OBS-438 and OBS-439 — and a sweep of the
    ledger's history found **twelve** more. A duplicated id makes every citation ambiguous, and this project
    cites them in rulings, handoffs, memory entries and shipped source comments. **Allocate from the current
-   maximum and then VERIFY with `grep -o '^## OBS-[0-9]*' <ledger> | sort | uniq -d`, which must print
-   nothing** — allocation alone is a guess about what the other tier is doing, and only the check catches
-   you both guessing the same. Renumber the LATER entry and say so in its heading. **Never renumber a
+   maximum and then run the duplicate-id check against the committed historical baseline below; it must
+   print nothing NEW** — the raw `uniq -d` list is intentionally non-empty history and cannot be used as a
+   zero-output gate:
+
+   ```bash
+   comm -13 \
+     <(printf '%s\n' OBS-106 OBS-12 OBS-129 OBS-148 OBS-24 OBS-26 OBS-29 OBS-35 OBS-36 OBS-40 OBS-41 OBS-415 OBS-459 OBS-463 OBS-466 OBS-470 OBS-472 OBS-542 OBS-548 OBS-552 OBS-562 OBS-563 OBS-564 OBS-592 OBS-785 OBS-791 | sort -u) \
+     <(grep -o '^## OBS-[0-9]*' <ledger> | sed 's/^## //' | sort | uniq -d)
+   ```
+
+   Allocation alone is a guess about what the other tier is doing, and only this baseline-relative check
+   catches you both guessing the same. Renumber the LATER entry and say so in its heading. **Never renumber a
    historical id**: every record already citing it would then point at the wrong finding.
 7. **Every fix is evaluated for shipping.** The tarball is `files: [dist, schema, skills, fixtures]` — so
    `src/**` and `skills/**` reach users while `.overseer/**` and `.tickmarkr/**` reach nobody. Before
@@ -953,6 +991,13 @@ orchestrator turn boundary.
    leave clean state after a version is shipped"***. Every line below is a defect that actually happened
    on the release that produced this rule.
 
+   - **RUN BOTH RELEASE PROOFS BEFORE STANDING DOWN.** The first is the exported-tree suite, which
+     maintainers run from the private repo with its `verify:export` script — that tooling is deliberately
+     not part of this package, so the command does not exist in a public checkout; it must install,
+     build, and run the suite in the exported tree; then
+     `TICKMARKR_E2E=1 npx vitest run tests/e2e/orca-smoke.e2e.test.ts` must exercise the installed-Orca
+     smoke. A skipped smoke is not proof. Record both results before declaring the release complete.
+
    - **REWRITE THE MEMORY INDEX FIRST, and read it back.** Minutes after `2.1.1` hit npm, the index line
      a fresh session loads still read *"⛔ 2.1.1 CANNOT ship from run …2011"* — true when written, and by
      then the exact opposite of the truth. **The index is what everyone loads and the body is what nobody
@@ -1018,6 +1063,29 @@ Distilled from a v1.86 spec-repair mission that produced 31 numbered rules, ~90
 errors authored by the supervising seat itself. **Every line below was earned by a defect, most of them
 twice.** They are mission-independent on purpose: nothing here names a task, a line number or a figure.
 
+**Five queue-and-handoff method laws — execute them; citing their OBS id is not execution:**
+
+1. **CITE-IS-NOT-READ.** A queue, handoff, finding, or brief that cites an observation does not prove its
+   author opened it. Before acting on a cited premise, open the primary record, quote the operative bytes,
+   and state the qualifier or falsifier the citation would otherwise hide.
+2. **EXECUTING-FORM PROBE.** Process ownership starts from the watcher pid file. Where legacy discovery is
+   unavoidable, match the executing form — interpreter plus exact script path and arguments — not a journal
+   path or name substring, resolve the candidate's cwd/parent, read the arm log for startup failure, then
+   require the same pid in two reads.
+3. **RESUME-AWARE CONTAMINATION.** Capture the current engagement boundary before watching a resumable
+   journal. Never terminate on a historical `run-end`: continue across `run-resume`, and stop only at the
+   cap or after current lock release proves no later engagement follows. Classify only runner-emitted lines
+   of new failed `test`, `build`, or `lint` gates; review prose and the secondary fingerprint echo list are
+   evidence about findings, not contamination occurrences.
+4. **THE QUEUE-INHERITANCE DIFF.** In the same act that opens a queue, extract observation ids from the
+   previous queue and the new queue, run `comm -23 <previous-queue-ids> <new-queue-ids>`, paste its output
+   into the new queue, and classify every row as queued, shipped, or no-ship with a falsifiable removal
+   condition. Reading the previous queue is not a diff.
+5. **RE-RUN A PREMISE.** Before inheriting any queue item or handoff conclusion, run its named positive and
+   negative controls on the current tree. For an executable premise, execute it with a negative control;
+   for a call-site premise, open the code line and read any rationale through its rejected alternatives.
+   Record the current output; if the premise dissolved, mark it superseded rather than carrying it forward.
+
 **Rot**
 
 1. **A quotation is exact bytes.** `grep` it before attributing it; if it does not hit, it is not a
@@ -1101,11 +1169,12 @@ twice.** They are mission-independent on purpose: nothing here names a task, a l
     owns it** — "watchers alive" is the one claim a seat cannot verify about itself. Measured 2026-08-06:
     an orchestrator sat `idle` through three merges and two dispatches with no journal watcher in the
     process table, while its own last report read *"daemon, board, sweeper, watcher all alive"* (OBS-366).
-    **STATE THE LIFETIME, because an unstated one is read as the mission's: a session-scoped watcher DIES
-    WITH THE SEAT THAT ARMED IT.** Every watcher a seat arms — journal, artifact, dialog, beat loop — is
-    session-scoped unless it was deliberately detached (`ppid 1`, the heartbeat form below), so `/clear`,
-    a crash, an adopt or a stand-down ends it, and **a handoff is the one moment the arming seat stops
-    existing** — which is exactly when its watchers are most likely to be believed. The inverse failure is
+    **STATE THE LIFETIME, because an unstated one is read as the mission's.** Every watcher a seat arms —
+    journal, artifact, dialog, beat loop — records its own pid and arming seat. **A same-process `/clear`
+    keeps every background task alive**; it does not retire even one watcher. A crash may orphan or kill
+    tasks according to how they were launched, while adopt and stand-down are explicit kill-by-recorded-pid
+    transitions. A handoff must therefore inventory real pids, not infer process lifetime from the context
+    lifecycle. The inverse failure is
     the same root read the other way: a DETACHED loop outlives its seat and holds a tier `ARMED` with
     nobody home (OBS-583). Neither direction may be assumed; the lifetime is a property of how the watcher
     was launched, and it belongs in writing next to every claim that one is armed.
@@ -1162,9 +1231,10 @@ twice.** They are mission-independent on purpose: nothing here names a task, a l
     The general rule: **an exclusion filter is exactly as
     dangerous as an over-broad inclusion filter, and it fails in the direction that reads as "not there" —
     which is the direction that gets acted on.**
-    Two corollaries: **re-arm a wake-and-exit watcher as the same turn's LAST act**, not the next turn's
-    first — the gap between them is unwatched and its width is however long the seat stays busy; and **a
-    handoff that re-arms one tier's watchers must say which tier's it did NOT re-arm.**
+    Two corollaries: **handling a fire-and-exit watcher's wake and re-arming it are the same act.** The wake
+    handling line is incomplete until it names the new recorded pid and two successful process-table reads;
+    never defer the arm to the turn's end. And **a handoff that re-arms one tier's watchers must say which
+    tier's it did NOT re-arm.**
     **That first corollary prescribes DISCIPLINE, and discipline is the wrong fix — measured 2026-08-06.**
     One orchestrator lapsed its journal tier **31 minutes**, then, after diagnosing it and fully intending
     to re-arm, lapsed it again for 3 minutes **while actively thinking about watchers**. Its own diagnosis

package/skills/tickmarkr-overseer/scripts/seat-send.sh

@@ -5,6 +5,7 @@
 # under load; this encodes the steps.
 #
 #   seat-send.sh <agent-name-or-pane> <message>
+#   TKR_ADAPTER=<id> supplies the adapter when a bare pane/name does not expose it in `agent get`.
 #
 #   TKR_INTERRUPT=1  end a `working` seat's turn first (Esc, at most twice, verified between) so the
 #                    directive is READ now instead of queued behind the turn. A message to a working
@@ -24,8 +25,8 @@
 # alone, or nothing — a decorative check beside a real one reads as corroboration.
 #
 # First output line is the machine-greppable verdict:
-#   DELIVERED_SUBMITTED | QUEUED_BEHIND_TURN | SEND_UNSUBMITTED | INTERRUPT_FAILED | TARGET_GONE
-#   | REFUSED_SIZE | REFUSED_BOX_OCCUPIED | SEND_UNVERIFIED | SEND_REFUSED | SEND_FAILED
+#   DELIVERED_SUBMITTED | QUEUED_BEHIND_TURN | SEND_UNSUBMITTED | SEND_DEFERRED
+#   | INTERRUPT_FAILED | TARGET_GONE | REFUSED_SIZE | SEND_UNVERIFIED | SEND_REFUSED | SEND_FAILED
 #
 # A success verdict names the surface that delivered when it was not the default one, so a fallback
 # is visible in the transcript rather than inferred (OBS-552).
@@ -36,6 +37,7 @@ set -u
 
 TARGET="${1:?usage: seat-send.sh <agent-name-or-pane> <message>}"
 MSG="${2:?message required}"
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 
 # PTY input front-truncates around 1KB and a truncated brief silently drops policy — the drop is at
 # the FRONT, so what survives still reads as a complete message. Long content goes in a FILE; the
@@ -57,9 +59,68 @@ pane_of() {
     | sed -n 's/.*"pane_id":"\([^"]*\)".*/\1/p' | head -1
 }
 
-# The rendered `❯` line — the only state that discriminates submitted from sitting. tail -1 takes
-# the LAST `❯` line, which is always the LIVE INPUT BOX: a wrapped draft's continuation lines carry
-# no `❯`, so the last one is still that draft's FIRST rendered line, i.e. a PREFIX of the draft —
+# Adapter identity comes from the worker name or Herdr's agent field; a caller targeting a bare pane
+# supplies TKR_ADAPTER. The glyph itself is never duplicated here: this parser reads the declaration
+# beside the input-box matchers in adapters/types.ts (or its built dist twin in an installed package).
+adapter_of() {
+  if [ -n "${TKR_ADAPTER:-}" ]; then printf '%s\n' "$TKR_ADAPTER"; return 0; fi
+  local record identity adapter
+  record=$(herdr agent get "$TARGET" 2>/dev/null)
+  identity=$(printf '%s\n' "$record" |
+    sed -n 's/.*"agent":"\([^"]*\)".*/\1/p; s/.*"name":"\([^"]*\)".*/\1/p' | head -1)
+  [ -n "$identity" ] || identity="$TARGET"
+  adapter=$(printf '%s\n' "$identity" |
+    sed -n 's/^.*-worker-\(.*\)-a[0-9][0-9]*-.*$/\1/p' | head -1)
+  [ -n "$adapter" ] || adapter="$identity"
+  case "$adapter" in claude) adapter="claude-code" ;; cursor) adapter="cursor-agent" ;; esac
+  printf '%s\n' "$adapter"
+}
+
+prompt_glyph_of() {
+  local adapter="$1" source glyph root tickmarkr_bin tickmarkr_entry
+  # The canonical script is <repo>/skills/.../scripts; the independently tracked installed copy is
+  # <repo>/.claude/skills/.../scripts. Search both ancestor shapes so identical bytes work from either
+  # shipped location. TKR_ADAPTER_TYPES remains the explicit consumer-install override.
+  for source in ${TKR_ADAPTER_TYPES:+"$TKR_ADAPTER_TYPES"}; do
+    [ -f "$source" ] || continue
+    glyph=$(awk -F'"' -v adapter="$adapter" '$2 == adapter && $3 ~ /^[[:space:]]*:[[:space:]]*$/ { print $4; exit }' "$source")
+    if [ -n "$glyph" ]; then printf '%s\n' "$glyph"; return 0; fi
+  done
+  for root in "$SCRIPT_DIR/../../.." "$SCRIPT_DIR/../../../.."; do
+    root=$(CDPATH= cd -- "$root" 2>/dev/null && pwd) || continue
+    for source in "$root/src/adapters/types.ts" "$root/dist/adapters/types.js"; do
+      [ -f "$source" ] || continue
+      glyph=$(awk -F'"' -v adapter="$adapter" '$2 == adapter && $3 ~ /^[[:space:]]*:[[:space:]]*$/ { print $4; exit }' "$source")
+      if [ -n "$glyph" ]; then printf '%s\n' "$glyph"; return 0; fi
+    done
+  done
+  # `tickmarkr init` copies this skill into a consumer repository, so neither ancestor above belongs
+  # to the package. The executable is shipped from <package>/dist/cli/index.js; resolve its symlink and
+  # read the adjacent compiled declaration. Node is already a runtime requirement of that executable.
+  tickmarkr_bin=$(command -v tickmarkr 2>/dev/null) || tickmarkr_bin=""
+  if [ -n "$tickmarkr_bin" ]; then
+    tickmarkr_entry=$(node -e 'try { process.stdout.write(require("fs").realpathSync(process.argv[1])) } catch {}' "$tickmarkr_bin" 2>/dev/null)
+    if [ -n "$tickmarkr_entry" ]; then
+      root=$(CDPATH= cd -- "$(dirname -- "$tickmarkr_entry")/../.." 2>/dev/null && pwd) || root=""
+      source="$root/dist/adapters/types.js"
+      if [ -n "$root" ] && [ -f "$source" ]; then
+        glyph=$(awk -F'"' -v adapter="$adapter" '$2 == adapter && $3 ~ /^[[:space:]]*:[[:space:]]*$/ { print $4; exit }' "$source")
+        if [ -n "$glyph" ]; then printf '%s\n' "$glyph"; return 0; fi
+      fi
+    fi
+  fi
+  return 1
+}
+
+ADAPTER=$(adapter_of)
+if ! PROMPT_GLYPH=$(prompt_glyph_of "$ADAPTER"); then
+  echo "SEND_UNVERIFIED $TARGET — adapter '$ADAPTER' has no prompt glyph declaration; nothing was typed"
+  exit 1
+fi
+
+# The adapter-declared prompt line is the only state that discriminates submitted from sitting.
+# tail -1 takes the LAST matching line: a wrapped draft's continuation lines carry no prompt glyph,
+# so the last one is still that draft's FIRST rendered line, i.e. a PREFIX of the draft —
 # callers compare prefixes, never whole sentences (OBS-396: a full-sentence match returns false on a
 # message that arrived intact).
 #
@@ -84,7 +145,11 @@ pane_of() {
 prompt_line() {
   herdr agent read "$TARGET" --source visible --lines 14 2>/dev/null \
     | sed '/↑ to edit/{/steer/d;}' \
-    | sed -n 's/^[[:space:]]*❯[[:space:]]*//p' | tail -1 | sed 's/[[:space:]]*$//'
+    | awk -v glyph="$PROMPT_GLYPH" '
+        { pos = index($0, glyph); if (!pos) next
+          prefix = substr($0, 1, pos - 1); gsub(/[[:space:]|]/, "", prefix); gsub(/│/, "", prefix)
+          if (prefix == "") print substr($0, pos + length(glyph)) }
+      ' | tail -1 | sed 's/^[[:space:]]*//; s/[[:space:]│|]*$//'
 }
 
 # STAGED-QUEUE DISCRIMINATOR (OBS-552 addendum, captured 2026-08-19 on a live kimi seat). After its
@@ -114,7 +179,7 @@ is_ours() {
 # wrapped in SGR dim; typed text renders default. A dim-wrapped line is rendering, not state.
 is_ghost() {
   herdr agent read "$TARGET" --source visible --lines 14 --format ansi 2>/dev/null \
-    | grep -F -- "❯" | grep -F -- "$1" | head -1 | grep -q "$(printf '\033')\[2m"
+    | grep -F -- "$PROMPT_GLYPH" | grep -F -- "$1" | head -1 | grep -q "$(printf '\033')\[2m"
 }
 
 S=$(status_of)
@@ -123,17 +188,22 @@ if [ -z "$S" ]; then
   exit 1
 fi
 
-# A pre-existing draft in the box is a decision, not an obstacle: `agent prompt` would APPEND to it
-# and submit both. Superseding someone else's text needs an author and the arrow form — refuse and
-# surface it rather than silently stomping it (D-206: an unattributed line in a box, origin never
-# resolved because it was cleared).
-PRE=$(prompt_line)
-if [ -n "$PRE" ] && ! is_ghost "$PRE"; then
-  echo "REFUSED_BOX_OCCUPIED $TARGET — input box already holds: $PRE"
-  echo "  ANSI-verify first (dim SGR = autosuggest ghost, ignorable). A real draft is superseded by a"
-  echo "  DECISION, not by this script: send the arrow form naming what you are overriding."
-  exit 2
-fi
+# Probe BEFORE writing: `agent prompt` and `pane run` both append to a live draft and submit the
+# concatenation. Give a human a short bounded window to finish or clear; if it remains, defer without
+# touching the pane. Re-running the receipt is the retry, so SEND_DEFERRED remains safe indefinitely.
+DRAFT_WAIT="${TKR_DRAFT_WAIT_S:-10}"
+DRAFT_POLL="${TKR_DRAFT_POLL_S:-1}"
+waited=0
+while :; do
+  PRE=$(prompt_line)
+  if [ -z "$PRE" ] || is_ghost "$PRE"; then break; fi
+  if [ "$waited" -ge "$DRAFT_WAIT" ] 2>/dev/null; then
+    echo "SEND_DEFERRED $TARGET — draft present; nothing was typed: $PRE"
+    exit 2
+  fi
+  sleep "$DRAFT_POLL"
+  waited=$((waited + DRAFT_POLL))
+done
 
 QUEUED=""
 if [ "$S" = "working" ]; then