tickmarkr 2.2.1 → 2.3.0

package/dist/tui/ink/init-app.js

@@ -5,13 +5,13 @@ import { ToggleMark } from "./components.js";
 import { clip, INK, inkInput, inkOutput, KeyBar, padCell, Pointer } from "./frame.js";
 const DRIVERS = ["auto", "herdr", "subprocess", "orca"];
 // One line per driver, shown for the value currently selected: four environments no longer fit on
-// a single description row at 80 columns (the shipped three already clipped), and orca is an
-// EXPLICIT choice — `auto` still means herdr-else-subprocess and never reaches for it.
+// a single description row at 80 columns (the shipped three already clipped). Auto identifies its
+// innermost host from environment markers only; outside an Orca terminal, Orca is named explicitly.
 const DRIVER_DESC = {
-    auto: "auto: herdr when HERDR_ENV=1, else subprocess — never orca",
+    auto: "auto: herdr when HERDR_ENV=1, else orca inside an Orca terminal, else subprocess",
     herdr: "herdr: every worker runs in a visible pane you can watch and unblock",
     subprocess: "subprocess: headless child processes — no cockpit, same fail-closed gates",
-    orca: "orca: visible terminals in the Orca app — an explicit choice, never auto's",
+    orca: "orca: visible terminals in the Orca app — picked by auto inside one; name it elsewhere",
 };
 const VISIBILITY = ["pane", "headless"];
 // Three fields, one toggle, one action — a descriptor array, deliberately not a forms framework.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.2.1",
+  "version": "2.3.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-overseer/SKILL.md

@@ -48,6 +48,15 @@ through brief lineage. **An executor choice nobody made is still an executor cho
    a watcher you know is alive. Earned 2026-08-25 (OBS-622): a handoff recorded *"artifact watcher armed"*
    over two live consult verdicts; at adopt the only `watch-artifacts.sh` on the machine belonged to a
    different repository, and nothing had been watching either file.
+   **WATCHER OWNERSHIP IS THE ARMING SEAT'S RECORDED PID, NEVER A NAME PATTERN.** Every bundled
+   `watch-*.sh` arm sets `TKR_ARMING_SEAT=<seat>` and writes its own pid under
+   `<state-dir>/overseer/pids/<arming-seat>-<script>-<pid>.pid`. A seat retires only watchers it armed,
+   by reading those files and killing the exact recorded pids; it never uses `pkill -f`, `pgrep -f`, or
+   any argv/path pattern. A journal path is shared by partner tiers and therefore cannot prove ownership.
+   Verify each executing pid in two process-table reads before acting, kill-by-pid, arm the replacement,
+   then verify its new pid in two process-table reads. A stand-down order inventories both sets: the
+   ordering seat's recorded pids to retire, and the partner's watchers armed on the ordering seat that
+   must survive it. This is the stand-down order of 222-11, not a best-effort sweep.
    **An adopted seat ANNOUNCES itself, in the same act as re-arming:** tell the adopted orchestrator the
    fresh seat is live (verified send: probe token + read-back). Through the gap its view of your tier read
    STALE, and a tier that believes it is unsupervised escalates into a file nobody is reading. Earned
@@ -289,8 +298,11 @@ on its owner being free is scheduled, not armed* — applies to itself:
 .claude/skills/tickmarkr-overseer/scripts/watch-contamination.sh <journal> <load-ceiling> <poll-s> <cap-s>
 ```
 
-It wakes on a new **failed** `gate-result` carrying an infrastructure fingerprint, or on sustained load
-above a ceiling, and prints one wake reason. **Two triggers, because one is provably not enough:** run
+It wakes on a new **failed runner `test`, `build`, or `lint`** `gate-result` carrying an infrastructure
+fingerprint in the runner-emitted failure lines, or on sustained load above a ceiling, and prints one
+wake reason. It deliberately ignores the same tokens inside review findings, acceptance prose, and the
+secondary fingerprint echo list: quoted discussion of contamination is not contamination. **Two triggers,
+because one is provably not enough:** run
 against the four reds above, the fingerprint trigger caught the `vitest-worker` timeout and correctly
 refused to launder either review rejection — and **missed** the 1-of-3074 case, whose text looks like an
 ordinary assertion failure. Only the load ceiling catches that one. A single-signal version reads as
@@ -323,7 +335,10 @@ when the run's own status text pushed the percentage off the statusline; and an
 The protocol, in both directions:
 
 1. **Overseer sees orch at ≥50%** → nudge it: write `HANDOFF-ORCH-<ver>.md`, then `/clear`, then re-read
-   its brief **and** its handoff, then **re-arm every watcher it listed** (a cleared session has none).
+   its brief **and** its handoff. **A same-process `/clear` keeps every background task alive**; it clears
+   conversation context, not processes. Re-arm is therefore a controlled replacement: read only this
+   seat's pid files, verify each pid in two process-table reads, kill those exact pids, arm replacements,
+   and verify every new pid in two reads. Never retire by pattern.
 2. **The returning orch, now fresh, checks the OVERSEER.** If the overseer is at ≥50%, it directs the
    overseer to write its handoff and clear, and **points it at `HANDOFF-OVERSEER-<ver>.md` by path**.
 3. Whichever seat is fresh performs the check. **Never both at once** — the run keeps one supervising tier
@@ -345,8 +360,9 @@ The protocol, in both directions:
    herdr pane run <my-pane> "/clear"
    #    read the pane back — a cleared claude session shows an empty prompt and a reset context gauge
    # 4. and only THEN, as a SEPARATE send, the re-orientation:
-   herdr pane run <my-pane> "You were cleared at <N>%. Read <handoff> and <brief>, re-arm EVERY watcher
-   they name — a cleared session has none — then confirm you are back."
+   herdr pane run <my-pane> "You were cleared at <N>%. Read <handoff> and <brief>. Same-process clear kept
+   every background task alive: retire only your recorded watcher pids, verify twice, kill-by-pid, arm,
+   verify every new pid twice, preserve the partner-owned watchers the stand-down lists, then confirm."
    ```
 
    ⚠ **Steps 3 and 4 are two sends, never one.** A pointer batched with the clear lands *during* it and is
@@ -507,7 +523,11 @@ they are left implicit:
   sleep 2–3s → send-keys Enter → read back (input empty / agent `working`). Never report "briefed" without
   the read-back. Long content goes in a brief file, never pane text. `scripts/seat-send.sh` encodes
   this whole path — size guard, atomic prompt, prompt-line read-back, optional interrupt — and never
-  auto-resends.
+  auto-resends. Each adapter declares its prompt glyph beside its input-box matchers; `seat-send.sh` reads
+  that declaration rather than assuming Claude's `❯`. **Probe the prompt line before writing:** if it
+  already holds a non-ghost draft, wait only the script's bounded window and return `SEND_DEFERRED`
+  without writing a byte. An unsubmitted post-send draft returns `SEND_UNSUBMITTED`. This protects both
+  Codex's `›` prompt and a HUMAN typing in a pane; delivery is never allowed to glue onto either draft.
   **PROBE THE READ-BACK WITH THE SHORTEST DISTINCTIVE TOKEN — a commit hash, a pid, an OBS id — NEVER a
   sentence.** A long phrase crosses the pane's render wrap boundary, so grepping for it returns zero on a
   message that arrived intact, and **a badly-probed successful send is byte-identical to a truncated one.**
@@ -802,12 +822,17 @@ nowhere.
 **The artifact watcher** — bundled, and keyed on the deliverable rather than the seat:
 
 ```bash
-.claude/skills/tickmarkr-overseer/scripts/watch-artifacts.sh <MARKER> <cap-s> <poll-s> <file>...
+TKR_ARMING_SEAT=<this-seat> .claude/skills/tickmarkr-overseer/scripts/watch-artifacts.sh \
+  [--changed-from <content-sha-or-now>] <MARKER> <cap-s> <poll-s> <file>...
 ```
 
 It wakes when every named file exists AND ends with its terminal marker, and on timeout it reports each
 file as READY / PARTIAL / ABSENT so a quiet arm still proves the watcher was alive. Tell each seat, in its
 brief, the exact marker its report must end with — you cannot watch for a marker you never demanded.
+**A re-arm over an artifact that already has its marker uses `--changed-from now` (or its captured SHA).**
+The existing marked bytes are the baseline, not a fresh delivery: the watcher fires only after content
+differs from that baseline and then stabilizes, once. Without the changed-from baseline, re-arm is an
+instant replay of old completion rather than observation of new work.
 **Arm on the marker YOU demanded, verified against the FILE — never on the seat's report of its own
 marker.** Measured 2026-08-17: a seat reported its sweep "ends `SWEEP-END`"; the file on disk ended
 `ORDER4-END`. A watcher armed on the reported marker never fires while the artifact sits COMPLETE, and
@@ -941,9 +966,18 @@ orchestrator turn boundary.
    filed a *different* finding as OBS-437, then repeated it as OBS-438 and OBS-439 — and a sweep of the
    ledger's history found **twelve** more. A duplicated id makes every citation ambiguous, and this project
    cites them in rulings, handoffs, memory entries and shipped source comments. **Allocate from the current
-   maximum and then VERIFY with `grep -o '^## OBS-[0-9]*' <ledger> | sort | uniq -d`, which must print
-   nothing** — allocation alone is a guess about what the other tier is doing, and only the check catches
-   you both guessing the same. Renumber the LATER entry and say so in its heading. **Never renumber a
+   maximum and then run the duplicate-id check against the committed historical baseline below; it must
+   print nothing NEW** — the raw `uniq -d` list is intentionally non-empty history and cannot be used as a
+   zero-output gate:
+
+   ```bash
+   comm -13 \
+     <(printf '%s\n' OBS-106 OBS-12 OBS-129 OBS-148 OBS-24 OBS-26 OBS-29 OBS-35 OBS-36 OBS-40 OBS-41 OBS-415 OBS-459 OBS-463 OBS-466 OBS-470 OBS-472 OBS-542 OBS-548 OBS-552 OBS-562 OBS-563 OBS-564 OBS-592 OBS-785 OBS-791 | sort -u) \
+     <(grep -o '^## OBS-[0-9]*' <ledger> | sed 's/^## //' | sort | uniq -d)
+   ```
+
+   Allocation alone is a guess about what the other tier is doing, and only this baseline-relative check
+   catches you both guessing the same. Renumber the LATER entry and say so in its heading. **Never renumber a
    historical id**: every record already citing it would then point at the wrong finding.
 7. **Every fix is evaluated for shipping.** The tarball is `files: [dist, schema, skills, fixtures]` — so
    `src/**` and `skills/**` reach users while `.overseer/**` and `.tickmarkr/**` reach nobody. Before
@@ -1029,6 +1063,29 @@ Distilled from a v1.86 spec-repair mission that produced 31 numbered rules, ~90
 errors authored by the supervising seat itself. **Every line below was earned by a defect, most of them
 twice.** They are mission-independent on purpose: nothing here names a task, a line number or a figure.
 
+**Five queue-and-handoff method laws — execute them; citing their OBS id is not execution:**
+
+1. **CITE-IS-NOT-READ.** A queue, handoff, finding, or brief that cites an observation does not prove its
+   author opened it. Before acting on a cited premise, open the primary record, quote the operative bytes,
+   and state the qualifier or falsifier the citation would otherwise hide.
+2. **EXECUTING-FORM PROBE.** Process ownership starts from the watcher pid file. Where legacy discovery is
+   unavoidable, match the executing form — interpreter plus exact script path and arguments — not a journal
+   path or name substring, resolve the candidate's cwd/parent, read the arm log for startup failure, then
+   require the same pid in two reads.
+3. **RESUME-AWARE CONTAMINATION.** Capture the current engagement boundary before watching a resumable
+   journal. Never terminate on a historical `run-end`: continue across `run-resume`, and stop only at the
+   cap or after current lock release proves no later engagement follows. Classify only runner-emitted lines
+   of new failed `test`, `build`, or `lint` gates; review prose and the secondary fingerprint echo list are
+   evidence about findings, not contamination occurrences.
+4. **THE QUEUE-INHERITANCE DIFF.** In the same act that opens a queue, extract observation ids from the
+   previous queue and the new queue, run `comm -23 <previous-queue-ids> <new-queue-ids>`, paste its output
+   into the new queue, and classify every row as queued, shipped, or no-ship with a falsifiable removal
+   condition. Reading the previous queue is not a diff.
+5. **RE-RUN A PREMISE.** Before inheriting any queue item or handoff conclusion, run its named positive and
+   negative controls on the current tree. For an executable premise, execute it with a negative control;
+   for a call-site premise, open the code line and read any rationale through its rejected alternatives.
+   Record the current output; if the premise dissolved, mark it superseded rather than carrying it forward.
+
 **Rot**
 
 1. **A quotation is exact bytes.** `grep` it before attributing it; if it does not hit, it is not a
@@ -1112,11 +1169,12 @@ twice.** They are mission-independent on purpose: nothing here names a task, a l
     owns it** — "watchers alive" is the one claim a seat cannot verify about itself. Measured 2026-08-06:
     an orchestrator sat `idle` through three merges and two dispatches with no journal watcher in the
     process table, while its own last report read *"daemon, board, sweeper, watcher all alive"* (OBS-366).
-    **STATE THE LIFETIME, because an unstated one is read as the mission's: a session-scoped watcher DIES
-    WITH THE SEAT THAT ARMED IT.** Every watcher a seat arms — journal, artifact, dialog, beat loop — is
-    session-scoped unless it was deliberately detached (`ppid 1`, the heartbeat form below), so `/clear`,
-    a crash, an adopt or a stand-down ends it, and **a handoff is the one moment the arming seat stops
-    existing** — which is exactly when its watchers are most likely to be believed. The inverse failure is
+    **STATE THE LIFETIME, because an unstated one is read as the mission's.** Every watcher a seat arms —
+    journal, artifact, dialog, beat loop — records its own pid and arming seat. **A same-process `/clear`
+    keeps every background task alive**; it does not retire even one watcher. A crash may orphan or kill
+    tasks according to how they were launched, while adopt and stand-down are explicit kill-by-recorded-pid
+    transitions. A handoff must therefore inventory real pids, not infer process lifetime from the context
+    lifecycle. The inverse failure is
     the same root read the other way: a DETACHED loop outlives its seat and holds a tier `ARMED` with
     nobody home (OBS-583). Neither direction may be assumed; the lifetime is a property of how the watcher
     was launched, and it belongs in writing next to every claim that one is armed.
@@ -1173,9 +1231,10 @@ twice.** They are mission-independent on purpose: nothing here names a task, a l
     The general rule: **an exclusion filter is exactly as
     dangerous as an over-broad inclusion filter, and it fails in the direction that reads as "not there" —
     which is the direction that gets acted on.**
-    Two corollaries: **re-arm a wake-and-exit watcher as the same turn's LAST act**, not the next turn's
-    first — the gap between them is unwatched and its width is however long the seat stays busy; and **a
-    handoff that re-arms one tier's watchers must say which tier's it did NOT re-arm.**
+    Two corollaries: **handling a fire-and-exit watcher's wake and re-arming it are the same act.** The wake
+    handling line is incomplete until it names the new recorded pid and two successful process-table reads;
+    never defer the arm to the turn's end. And **a handoff that re-arms one tier's watchers must say which
+    tier's it did NOT re-arm.**
     **That first corollary prescribes DISCIPLINE, and discipline is the wrong fix — measured 2026-08-06.**
     One orchestrator lapsed its journal tier **31 minutes**, then, after diagnosing it and fully intending
     to re-arm, lapsed it again for 3 minutes **while actively thinking about watchers**. Its own diagnosis

package/skills/tickmarkr-overseer/scripts/seat-send.sh

@@ -5,6 +5,7 @@
 # under load; this encodes the steps.
 #
 #   seat-send.sh <agent-name-or-pane> <message>
+#   TKR_ADAPTER=<id> supplies the adapter when a bare pane/name does not expose it in `agent get`.
 #
 #   TKR_INTERRUPT=1  end a `working` seat's turn first (Esc, at most twice, verified between) so the
 #                    directive is READ now instead of queued behind the turn. A message to a working
@@ -24,8 +25,8 @@
 # alone, or nothing — a decorative check beside a real one reads as corroboration.
 #
 # First output line is the machine-greppable verdict:
-#   DELIVERED_SUBMITTED | QUEUED_BEHIND_TURN | SEND_UNSUBMITTED | INTERRUPT_FAILED | TARGET_GONE
-#   | REFUSED_SIZE | REFUSED_BOX_OCCUPIED | SEND_UNVERIFIED | SEND_REFUSED | SEND_FAILED
+#   DELIVERED_SUBMITTED | QUEUED_BEHIND_TURN | SEND_UNSUBMITTED | SEND_DEFERRED
+#   | INTERRUPT_FAILED | TARGET_GONE | REFUSED_SIZE | SEND_UNVERIFIED | SEND_REFUSED | SEND_FAILED
 #
 # A success verdict names the surface that delivered when it was not the default one, so a fallback
 # is visible in the transcript rather than inferred (OBS-552).
@@ -36,6 +37,7 @@ set -u
 
 TARGET="${1:?usage: seat-send.sh <agent-name-or-pane> <message>}"
 MSG="${2:?message required}"
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 
 # PTY input front-truncates around 1KB and a truncated brief silently drops policy — the drop is at
 # the FRONT, so what survives still reads as a complete message. Long content goes in a FILE; the
@@ -57,9 +59,68 @@ pane_of() {
     | sed -n 's/.*"pane_id":"\([^"]*\)".*/\1/p' | head -1
 }
 
-# The rendered `❯` line — the only state that discriminates submitted from sitting. tail -1 takes
-# the LAST `❯` line, which is always the LIVE INPUT BOX: a wrapped draft's continuation lines carry
-# no `❯`, so the last one is still that draft's FIRST rendered line, i.e. a PREFIX of the draft —
+# Adapter identity comes from the worker name or Herdr's agent field; a caller targeting a bare pane
+# supplies TKR_ADAPTER. The glyph itself is never duplicated here: this parser reads the declaration
+# beside the input-box matchers in adapters/types.ts (or its built dist twin in an installed package).
+adapter_of() {
+  if [ -n "${TKR_ADAPTER:-}" ]; then printf '%s\n' "$TKR_ADAPTER"; return 0; fi
+  local record identity adapter
+  record=$(herdr agent get "$TARGET" 2>/dev/null)
+  identity=$(printf '%s\n' "$record" |
+    sed -n 's/.*"agent":"\([^"]*\)".*/\1/p; s/.*"name":"\([^"]*\)".*/\1/p' | head -1)
+  [ -n "$identity" ] || identity="$TARGET"
+  adapter=$(printf '%s\n' "$identity" |
+    sed -n 's/^.*-worker-\(.*\)-a[0-9][0-9]*-.*$/\1/p' | head -1)
+  [ -n "$adapter" ] || adapter="$identity"
+  case "$adapter" in claude) adapter="claude-code" ;; cursor) adapter="cursor-agent" ;; esac
+  printf '%s\n' "$adapter"
+}
+
+prompt_glyph_of() {
+  local adapter="$1" source glyph root tickmarkr_bin tickmarkr_entry
+  # The canonical script is <repo>/skills/.../scripts; the independently tracked installed copy is
+  # <repo>/.claude/skills/.../scripts. Search both ancestor shapes so identical bytes work from either
+  # shipped location. TKR_ADAPTER_TYPES remains the explicit consumer-install override.
+  for source in ${TKR_ADAPTER_TYPES:+"$TKR_ADAPTER_TYPES"}; do
+    [ -f "$source" ] || continue
+    glyph=$(awk -F'"' -v adapter="$adapter" '$2 == adapter && $3 ~ /^[[:space:]]*:[[:space:]]*$/ { print $4; exit }' "$source")
+    if [ -n "$glyph" ]; then printf '%s\n' "$glyph"; return 0; fi
+  done
+  for root in "$SCRIPT_DIR/../../.." "$SCRIPT_DIR/../../../.."; do
+    root=$(CDPATH= cd -- "$root" 2>/dev/null && pwd) || continue
+    for source in "$root/src/adapters/types.ts" "$root/dist/adapters/types.js"; do
+      [ -f "$source" ] || continue
+      glyph=$(awk -F'"' -v adapter="$adapter" '$2 == adapter && $3 ~ /^[[:space:]]*:[[:space:]]*$/ { print $4; exit }' "$source")
+      if [ -n "$glyph" ]; then printf '%s\n' "$glyph"; return 0; fi
+    done
+  done
+  # `tickmarkr init` copies this skill into a consumer repository, so neither ancestor above belongs
+  # to the package. The executable is shipped from <package>/dist/cli/index.js; resolve its symlink and
+  # read the adjacent compiled declaration. Node is already a runtime requirement of that executable.
+  tickmarkr_bin=$(command -v tickmarkr 2>/dev/null) || tickmarkr_bin=""
+  if [ -n "$tickmarkr_bin" ]; then
+    tickmarkr_entry=$(node -e 'try { process.stdout.write(require("fs").realpathSync(process.argv[1])) } catch {}' "$tickmarkr_bin" 2>/dev/null)
+    if [ -n "$tickmarkr_entry" ]; then
+      root=$(CDPATH= cd -- "$(dirname -- "$tickmarkr_entry")/../.." 2>/dev/null && pwd) || root=""
+      source="$root/dist/adapters/types.js"
+      if [ -n "$root" ] && [ -f "$source" ]; then
+        glyph=$(awk -F'"' -v adapter="$adapter" '$2 == adapter && $3 ~ /^[[:space:]]*:[[:space:]]*$/ { print $4; exit }' "$source")
+        if [ -n "$glyph" ]; then printf '%s\n' "$glyph"; return 0; fi
+      fi
+    fi
+  fi
+  return 1
+}
+
+ADAPTER=$(adapter_of)
+if ! PROMPT_GLYPH=$(prompt_glyph_of "$ADAPTER"); then
+  echo "SEND_UNVERIFIED $TARGET — adapter '$ADAPTER' has no prompt glyph declaration; nothing was typed"
+  exit 1
+fi
+
+# The adapter-declared prompt line is the only state that discriminates submitted from sitting.
+# tail -1 takes the LAST matching line: a wrapped draft's continuation lines carry no prompt glyph,
+# so the last one is still that draft's FIRST rendered line, i.e. a PREFIX of the draft —
 # callers compare prefixes, never whole sentences (OBS-396: a full-sentence match returns false on a
 # message that arrived intact).
 #
@@ -84,7 +145,11 @@ pane_of() {
 prompt_line() {
   herdr agent read "$TARGET" --source visible --lines 14 2>/dev/null \
     | sed '/↑ to edit/{/steer/d;}' \
-    | sed -n 's/^[[:space:]]*❯[[:space:]]*//p' | tail -1 | sed 's/[[:space:]]*$//'
+    | awk -v glyph="$PROMPT_GLYPH" '
+        { pos = index($0, glyph); if (!pos) next
+          prefix = substr($0, 1, pos - 1); gsub(/[[:space:]|]/, "", prefix); gsub(/│/, "", prefix)
+          if (prefix == "") print substr($0, pos + length(glyph)) }
+      ' | tail -1 | sed 's/^[[:space:]]*//; s/[[:space:]│|]*$//'
 }
 
 # STAGED-QUEUE DISCRIMINATOR (OBS-552 addendum, captured 2026-08-19 on a live kimi seat). After its
@@ -114,7 +179,7 @@ is_ours() {
 # wrapped in SGR dim; typed text renders default. A dim-wrapped line is rendering, not state.
 is_ghost() {
   herdr agent read "$TARGET" --source visible --lines 14 --format ansi 2>/dev/null \
-    | grep -F -- "❯" | grep -F -- "$1" | head -1 | grep -q "$(printf '\033')\[2m"
+    | grep -F -- "$PROMPT_GLYPH" | grep -F -- "$1" | head -1 | grep -q "$(printf '\033')\[2m"
 }
 
 S=$(status_of)
@@ -123,17 +188,22 @@ if [ -z "$S" ]; then
   exit 1
 fi
 
-# A pre-existing draft in the box is a decision, not an obstacle: `agent prompt` would APPEND to it
-# and submit both. Superseding someone else's text needs an author and the arrow form — refuse and
-# surface it rather than silently stomping it (D-206: an unattributed line in a box, origin never
-# resolved because it was cleared).
-PRE=$(prompt_line)
-if [ -n "$PRE" ] && ! is_ghost "$PRE"; then
-  echo "REFUSED_BOX_OCCUPIED $TARGET — input box already holds: $PRE"
-  echo "  ANSI-verify first (dim SGR = autosuggest ghost, ignorable). A real draft is superseded by a"
-  echo "  DECISION, not by this script: send the arrow form naming what you are overriding."
-  exit 2
-fi
+# Probe BEFORE writing: `agent prompt` and `pane run` both append to a live draft and submit the
+# concatenation. Give a human a short bounded window to finish or clear; if it remains, defer without
+# touching the pane. Re-running the receipt is the retry, so SEND_DEFERRED remains safe indefinitely.
+DRAFT_WAIT="${TKR_DRAFT_WAIT_S:-10}"
+DRAFT_POLL="${TKR_DRAFT_POLL_S:-1}"
+waited=0
+while :; do
+  PRE=$(prompt_line)
+  if [ -z "$PRE" ] || is_ghost "$PRE"; then break; fi
+  if [ "$waited" -ge "$DRAFT_WAIT" ] 2>/dev/null; then
+    echo "SEND_DEFERRED $TARGET — draft present; nothing was typed: $PRE"
+    exit 2
+  fi
+  sleep "$DRAFT_POLL"
+  waited=$((waited + DRAFT_POLL))
+done
 
 QUEUED=""
 if [ "$S" = "working" ]; then

package/skills/tickmarkr-overseer/scripts/watch-artifacts.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 # Wake the overseer when spawned seats have actually DELIVERED.
 #
-#   watch-artifacts.sh <marker> <cap-seconds> <poll-seconds> <file>...
+#   watch-artifacts.sh [--changed-from <sha|mtime|now>] <marker> <cap-seconds> <poll-seconds> <file>...
 #
 # Completion is the ARTIFACT plus its TERMINAL MARKER — never an agent's `done`, which is turn end and
 # fires the moment a seat finishes acknowledging you. Never file existence alone either: a seat killed
@@ -26,12 +26,29 @@ set -u
 # arm crashed before printing its reason — a watcher that dies without a wake reason is the exact failure
 # this script exists to prevent.
 
-MARKER="${1:?usage: watch-artifacts.sh <marker> <cap-seconds> <poll-seconds> <file>...}"
+CHANGED_FROM=""
+if [ "${1:-}" = "--changed-from" ]; then
+  CHANGED_FROM="${2:?--changed-from requires a sha, prior mtime, or 'now'}"
+  shift 2
+fi
+
+MARKER="${1:?usage: watch-artifacts.sh [--changed-from <sha|mtime|now>] <marker> <cap-seconds> <poll-seconds> <file>...}"
 CAP="${2:?}"
 POLL="${3:?}"
 shift 3
 [ "$#" -gt 0 ] || { echo "watch-artifacts: no files given" >&2; exit 2; }
 
+# OBS-848: ownership is a pid-file fact, never an argv/path pattern. Two tiers intentionally watch
+# the same artifacts, so the journal/file argument cannot identify which watcher a seat may retire.
+PID_DIR="${TKR_STATE_DIR:-.tickmarkr}/overseer/pids"
+PID_SEAT=$(printf '%s' "${TKR_ARMING_SEAT:-unattributed}" | sed 's/[^A-Za-z0-9_-]/_/g')
+PID_FILE="$PID_DIR/${PID_SEAT}-watch-artifacts-$$.pid"
+mkdir -p "$PID_DIR" && (umask 077; printf '%s\n' "$$" > "$PID_FILE") || {
+  echo "watch-artifacts: cannot record pid under $PID_DIR" >&2; exit 73;
+}
+clear_pid() { rm -f "$PID_FILE"; }
+trap clear_pid EXIT
+
 # Cap BELOW the host's background-job kill so every arm ends by PRINTING something. A job killed at the
 # limit carries no wake reason and is indistinguishable from a real wake until you read the output —
 # OBS-325, re-earned by a third watcher that had not been capped because the fix was applied only to the
@@ -74,6 +91,22 @@ END=$((SECONDS + CAP))
 # RUNTIME, where the arithmetic then errors, `done_file` returns 1 forever, and the watcher never wakes.
 # Caught by the drill below, not by the syntax check. A syntax check is not a positive control.
 PREV=()
+BASELINE=()
+i=0
+for f in "$@"; do
+  if [ -n "$CHANGED_FROM" ]; then
+    # A SHA is an explicit single-artifact baseline. Historical callers recorded mtimes; retain that
+    # spelling as the arming signal but capture content now, because equal-length rewrites and touches
+    # prove that mtime is not the property this watcher claims to read.
+    if printf '%s' "$CHANGED_FROM" | grep -qE '^[0-9a-fA-F]{40}$' && [ "$#" -eq 1 ]; then
+      BASELINE[$i]=$(printf '%s' "$CHANGED_FROM" | tr 'A-F' 'a-f')
+    else
+      BASELINE[$i]=$(shasum -a 1 "$f" 2>/dev/null | cut -d' ' -f1)
+    fi
+  fi
+  i=$((i + 1))
+done
+
 done_file() {                  # $1 = index into "$@", $2 = path
   local i="$1" f="$2" sig
   [ -s "$f" ] || return 1
@@ -85,6 +118,7 @@ done_file() {                  # $1 = index into "$@", $2 = path
   # catch. Hashing 48KB per poll costs nothing.
   sig=$(shasum -a 1 "$f" 2>/dev/null | cut -d' ' -f1)
   [ -n "$sig" ] || return 1
+  if [ -n "$CHANGED_FROM" ] && [ "${BASELINE[$i]:-}" = "$sig" ]; then return 1; fi
   if [ "${PREV[$i]:-}" = "$sig" ]; then return 0; fi
   PREV[$i]="$sig"              # marked but still moving — hold it one more poll
   return 1

package/skills/tickmarkr-overseer/scripts/watch-contamination.sh

@@ -21,8 +21,16 @@ LOAD_CEIL="${2:-24}"
 POLL="${3:-45}"
 CAP="${4:-14400}"
 
-STATE="$(dirname "$J")/.contamination.seen"
-: > "$STATE" 2>/dev/null || STATE="/tmp/.contamination.seen.$$"
+# OBS-848: the arming seat owns this pid, even when a partner watches the same journal. Never derive
+# retirement ownership from the script or journal argv: both are deliberately shared across tiers.
+PID_DIR="${TKR_STATE_DIR:-.tickmarkr}/overseer/pids"
+PID_SEAT=$(printf '%s' "${TKR_ARMING_SEAT:-unattributed}" | sed 's/[^A-Za-z0-9_-]/_/g')
+PID_FILE="$PID_DIR/${PID_SEAT}-watch-contamination-$$.pid"
+mkdir -p "$PID_DIR" && (umask 077; printf '%s\n' "$$" > "$PID_FILE") || {
+  echo "watch-contamination: cannot record pid under $PID_DIR" >&2; exit 73;
+}
+clear_pid() { rm -f "$PID_FILE"; }
+trap clear_pid EXIT
 
 # Fingerprints of a harness collapse rather than a real regression. Deliberately narrow: a genuine
 # assertion failure must NOT match, or the watcher launders real defects into "infra".
@@ -35,11 +43,8 @@ load1() { uptime | sed 's/.*load averages*: *//' | awk '{print $1}' | tr -d ',';
 vitest_n() { ps -axo comm,command 2>/dev/null | grep -Ec 'node_modules/(\.bin/)?[v]itest|[v]itest/dist/|\([v]itest [0-9]+\)'; }
 
 # Seed the seen-set so we wake on what happens NEXT, not on history already ruled on.
-if [ -f "$J" ]; then
-  grep -c '' "$J" > "$STATE" 2>/dev/null || echo 0 > "$STATE"
-else
-  echo 0 > "$STATE"
-fi
+if [ -f "$J" ]; then seen=$(grep -c '' "$J" 2>/dev/null); else seen=0; fi
+[ -n "$seen" ] || seen=0
 
 elapsed=0
 while [ "$elapsed" -lt "$CAP" ]; do
@@ -54,18 +59,34 @@ while [ "$elapsed" -lt "$CAP" ]; do
   Li=$(printf %s "$L" | sed "s/[^0-9].*//"); [ -z "$Li" ] && Li=0
 
   if [ -f "$J" ]; then
-    seen=$(cat "$STATE" 2>/dev/null); [ -z "$seen" ] && seen=0
     now=$(grep -c '' "$J" 2>/dev/null); [ -z "$now" ] && now=0
     if [ "$now" -gt "$seen" ]; then
       newrows=$(tail -n "$((now - seen))" "$J" 2>/dev/null)
-      echo "$now" > "$STATE"
-      hit=$(printf '%s\n' "$newrows" \
-        | grep '"event":"gate-result"' \
-        | grep '"pass":false' \
-        | grep -E "$INFRA_RE" | head -1)
+      seen="$now"
+      # A fingerprint in arbitrary JSON details is prose, not an occurrence. Parse the event shape,
+      # admit only runner gates, and stop before the baseline classifier's secondary echo list. Review
+      # findings and acceptance prose are deliberately outside this instrument's claim.
+      hit=$(printf '%s\n' "$newrows" | python3 -c '
+import json, re, sys
+infra = re.compile(sys.argv[1], re.I)
+for raw in sys.stdin:
+    try: row = json.loads(raw)
+    except Exception: continue
+    data = row.get("data") or {}
+    gate = data.get("gate")
+    if row.get("event") != "gate-result" or data.get("pass") is not False or gate not in {"test", "build", "lint"}: continue
+    details = str(data.get("details") or "")
+    runner = re.split(r"(?im)^new failure fingerprints vs baseline \(secondary\):[ \t]*$", details, maxsplit=1)[0]
+    match = infra.search(runner)
+    if match:
+        end = runner.find("\n", match.end())
+        line = runner[runner.rfind("\n", 0, match.start()) + 1:end if end >= 0 else len(runner)]
+        print("%s\t%s\t%s" % (row.get("taskId", ""), gate, line))
+        break
+' "$INFRA_RE")
       if [ -n "$hit" ]; then
-        task=$(printf '%s' "$hit" | sed -n 's/.*"taskId":"\([^"]*\)".*/\1/p')
-        gate=$(printf '%s' "$hit" | sed -n 's/.*"gate":"\([^"]*\)".*/\1/p')
+        task=$(printf '%s' "$hit" | cut -f1)
+        gate=$(printf '%s' "$hit" | cut -f2)
         echo "CONTAMINATED_VERDICT task=$task gate=$gate load=$L vitest=$V"
         echo "  an infra fingerprint appeared in a FAILED gate — this red is not evidence about the diff"
         echo "  ruling owed: is the attempt chargeable? (OBS-426: infra failures are not)"

package/skills/tickmarkr-overseer/scripts/watch-context.sh

@@ -63,6 +63,15 @@ case "$ROLE" in
 esac
 TIER="${ROLE}-context"
 
+# A shared target does not identify its watcher owner. The arming seat records this exact pid under
+# the repository state dir; retirement reads that file and never matches a script/target name pattern.
+PID_DIR="${TKR_STATE_DIR:-.tickmarkr}/overseer/pids"
+PID_SEAT=$(printf '%s' "${TKR_ARMING_SEAT:-unattributed}" | sed 's/[^A-Za-z0-9_-]/_/g')
+PID_FILE="$PID_DIR/${PID_SEAT}-watch-context-$$.pid"
+mkdir -p "$PID_DIR" && (umask 077; printf '%s\n' "$$" > "$PID_FILE") || {
+  echo "watch-context: cannot record pid under $PID_DIR" >&2; exit 73;
+}
+clear_pid() { rm -f "$PID_FILE"; }
 
 # The supervision beat interval (SUPERVISION_BEAT_MS = 10s). The loop ticks at the beat cadence or the
 # caller's poll, whichever is SHORTER. Every successful screen read beats; its result is either a
@@ -100,7 +109,8 @@ beat() {
 stand_down() { tickmarkr beat "$TIER" --stand-down --seat "$SEAT" >/dev/null 2>&1; return 0; }
 # EVERY terminal exit — act, unsafe-act, cap — leaves through here, so none of them can forget to
 # record the hand-off. A killed watcher never runs it, which is the one case that must read STALE.
-trap stand_down EXIT
+cleanup() { stand_down; clear_pid; }
+trap cleanup EXIT
 
 # ── WHERE THE NUMBER COMES FROM, and this is the whole 2.1.7-series lesson ────────────────────────────
 # The shipped version read a TERMINAL RENDERING and nothing else. Every context-measurement failure of
@@ -189,15 +199,31 @@ print(int(round(fill * 100.0 / window)))
 ' "$CTX_JSONL" "$CTX_WINDOW" 2>/dev/null
 }
 
-# The banner path stays as the FALLBACK, unchanged: select the model line first, then read a percentage
-# only from it, so a bare numeric search cannot borrow an old N% from scrollback (OBS-780).
+# The banner path stays as the FALLBACK, and it now selects by POSITION (OBS-865). A seat's statusline
+# renders BELOW the input box's horizontal rule, so the only rows that can carry THIS seat's fill are the
+# rows after the LAST rule line in the window. A tip, a transcript row, or a decoy quoting another seat's
+# percentage sits ABOVE that rule and can no longer be chosen. The previous selector took the last
+# vendor-word line ANYWHERE in the window: on a Fable seat that was `Tip: Ask Claude ...` (UNREADABLE,
+# duty silently dead), and a quoted `opus 12%` would have been read as this seat's fill. The model
+# vocabulary survives only as a SANITY CHECK on the already-chosen row, never as the selector (OBS-780).
 banner_pct() {
   local screen banner pct
   screen=$(herdr agent read "$TARGET" --source visible --lines 8 2>/dev/null) || return 1
-  banner=$(printf '%s\n' "$screen" |
-    grep -Ei '(^|[^[:alnum:]])(claude|opus|sonnet|haiku|gpt|gemini|glm|kimi|grok|composer|openai|zai)[[:alnum:]_./-]*([[:space:]]|$)' |
-    tail -1)
+  # The rule glyph is passed IN, never written as an escape: this host's awk (BWK 20200816) does not
+  # honour \xNN, and an unsupported escape matches nothing — the selector would find no rule line and
+  # report UNREADABLE on every real pane while staying green against any fixture that skipped awk.
+  banner=$(printf '%s\n' "$screen" | awk -v rule='─' '
+    { line[NR] = $0
+      bare = $0; gsub(/[[:space:]]/, "", bare)
+      stripped = bare; gsub(rule, "", stripped)
+      if (bare != "" && stripped == "") last = NR }
+    END { if (last) for (i = last + 1; i <= NR; i++) if (line[i] ~ /[0-9]+%/) print line[i] }
+  ' | tail -1)
+  # No rule line in the window, or no percentage below it: say so out loud rather than guess.
   [ -n "$banner" ] || { printf 'UNREADABLE\n'; return 0; }
+  printf '%s\n' "$banner" |
+    grep -Eqi '(^|[^[:alnum:]])(claude|opus|sonnet|haiku|fable|gpt|gemini|glm|kimi|grok|composer|openai|zai)[[:alnum:]_./-]*([[:space:]]|$)' ||
+    { printf 'UNREADABLE\n'; return 0; }
   pct=$(printf '%s\n' "$banner" | grep -oE '[0-9]+%' | tail -1 | tr -d '%')
   [ -n "$pct" ] && printf '%s\n' "$pct" || printf 'UNREADABLE\n'
 }
@@ -224,7 +250,7 @@ act_on() {
     if [ "${TKR_AUTO_CLEAR:-0}" = "1" ] && { [ "$ROLE" = "orchestrator" ] || [ "$ROLE" = "overseer" ]; }; then
       herdr agent prompt "$TARGET" "/clear" >/dev/null 2>&1
       sleep "$SETTLE"
-      herdr agent prompt "$TARGET" "Read ${REBRIEF} and continue exactly where it says. Your context was cleared at ${P}% against that handoff; it is current as of $(date '+%H:%M'). Do not reconstruct from memory — everything you need is on disk." >/dev/null 2>&1
+      herdr agent prompt "$TARGET" "Read ${REBRIEF} and continue exactly where it says. Your context was cleared at ${P}% against that handoff; it is current as of $(date '+%H:%M'). The same-process clear kept every background task alive: kill only this seat's recorded watcher pids first, verify the process table twice, then re-arm. Do not reconstruct from memory — everything you need is on disk." >/dev/null 2>&1
       echo "CONTEXT_CLEARED $TARGET at ${P}% — handoff fresh, re-briefed from ${REBRIEF}"
       exit 0
     fi