tickmarkr 2.4.0 → 2.4.1

package/dist/run/daemon.js

@@ -14,7 +14,7 @@ import { collateralHits } from "../compile/collateral.js";
 import { DEFAULT_DIFF_CAP, globalConfigDir, loadConfigWithMode, readOverlayFile, repoOverlayPath, } from "../config/config.js";
 import { DeliveryReadinessError } from "../drivers/herdr.js";
 import { driverEvidence } from "../drivers/index.js";
-import { herdrSealShellPrefix, SubprocessDriver } from "../drivers/subprocess.js";
+import { herdrSealShellPrefix, MAX_BUF, SubprocessDriver } from "../drivers/subprocess.js";
 import { formatOwnedName } from "../drivers/types.js";
 import { captureBaseline, detectGateCommands, detectVacuousOracles } from "../gates/baseline.js";
 import { runGates } from "../gates/run-gates.js";
@@ -347,6 +347,48 @@ export function resetNudgeTimingForTests() {
 const QUOTA_BANNER_SILENT_MS = 3 * 60_000;
 let quotaBannerSilentMs = QUOTA_BANNER_SILENT_MS;
 const WORKER_STARTUP_FAILURE_RE = /(?:not logged in|authentication(?:[ _-](?:required|failed|error))|401 unauthorized|model[_ -]?not[_ -]?found|(?:model|deployment)[^\n]{0,80}(?:not found|does not exist|is unavailable)|(?:404|not[_ -]?found)[^\n]{0,80}(?:model|deployment))/i;
+// A startup banner is evidence only while the process is starting. Applying this matcher to every
+// later poll let ordinary worker prose (including a diff that mentions model-not-found handling)
+// condemn a live attempt. Bound both dimensions: time prevents a late line from becoming startup
+// evidence, and bytes prevent a chatty launch from keeping an ever-growing classification surface.
+export const WORKER_STARTUP_WINDOW_MS = EARLY_LAUNCH_LIVENESS_MS;
+export const WORKER_STARTUP_WINDOW_BYTES = 64 * 1024;
+let workerStartupWindowMs = WORKER_STARTUP_WINDOW_MS;
+/** Test seam — exercises both sides of the startup boundary without a production-length fixture. */
+export function setWorkerStartupWindowMsForTests(ms) {
+    workerStartupWindowMs = ms;
+}
+export function resetWorkerStartupWindowMsForTests() {
+    workerStartupWindowMs = WORKER_STARTUP_WINDOW_MS;
+}
+function startupFailureInWindow(output, launchedAt) {
+    if (launchedAt === undefined || Date.now() - launchedAt > workerStartupWindowMs)
+        return false;
+    const bytes = Buffer.from(output);
+    const bounded = bytes.length <= WORKER_STARTUP_WINDOW_BYTES
+        ? output
+        : bytes.subarray(0, WORKER_STARTUP_WINDOW_BYTES).toString("utf8");
+    return WORKER_STARTUP_FAILURE_RE.test(stallSnapshotBannerRows(bounded));
+}
+// OBS-901/906: one daemon-owned writer for every execution surface. Drivers expose one retained
+// stream through read(); the daemon persists that exact surface before any close/reconcile can make
+// it disappear. MAX_BUF is the execution layer's existing two-MiB retention contract; truncate the
+// encoded bytes from the head so the completion/error tail is always the part that survives.
+async function captureWorkerStream(journalDir, taskId, attempt, driver, slot, fallback) {
+    let captured = fallback;
+    try {
+        captured = await driver.read(slot, PANE_READ_ROWS);
+    }
+    catch {
+        // Earlier successful reads are still a captured stream. Persist them rather than losing the
+        // only failure evidence because the pane vanished between its terminal read and this snapshot.
+    }
+    const bytes = Buffer.from(captured);
+    const tail = bytes.length > MAX_BUF ? bytes.subarray(bytes.length - MAX_BUF) : bytes;
+    const path = posix.join("prompts", `${taskId}-a${attempt}.out`);
+    writeFileSync(join(journalDir, path), tail);
+    return { path, output: captured };
+}
 /** Test seam — shrink the quota-banner silence gate without minute-long sleeps. */
 export function setQuotaBannerSilentMsForTests(ms) {
     quotaBannerSilentMs = ms;
@@ -2329,6 +2371,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                 // starts at 0 (fresh budget) instead of re-parking at the cap in the same tick.
                 let providerDeathRequeues = 0;
                 let providerDeathAttempt = -1;
+                // A completed attempt may keep its pane for gate-failure context, but once another worker is
+                // funded that context is superseded and — more importantly — must not remain a second writer on
+                // the same worktree. The next loop iteration retires it before reading/recreating the tree.
+                let supersededWorkerSlot;
                 attempts: for (let attempt = rs?.attempts ?? 0;; attempt++) {
                     if (attempt !== providerDeathAttempt) {
                         providerDeathRequeues = 0;
@@ -2343,6 +2389,20 @@ export async function runDaemon(repoRoot, opts = {}) {
                         await park(t, `attempt cap (${MAX_ATTEMPTS}) reached`, "attempt-cap", assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode);
                         return;
                     }
+                    if (supersededWorkerSlot && !keepForever) {
+                        const prior = supersededWorkerSlot;
+                        supersededWorkerSlot = undefined;
+                        const idx = keptSlots.indexOf(prior);
+                        if (idx >= 0)
+                            keptSlots.splice(idx, 1);
+                        try {
+                            await closeSlot(prior);
+                        }
+                        catch (error) {
+                            await park(t, `superseded worker could not be swept before dispatch: ${error instanceof Error ? error.message : String(error)}`, "stall", assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode);
+                            return;
+                        }
+                    }
                     // OBS-419: read the approval-carried ceiling at the funding boundary, after every escalation
                     // decision but before the sole task-dispatch below. Both interactive and headless worker-launch
                     // branches are dominated by this check, so no route can fund another worker without consulting it.
@@ -2657,11 +2717,17 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // between task-dispatch and this line — worktree recreation, setup, prompt write, slot allocation,
                     // the launch itself — can still die with no worker having seen the brief, and `--retry-failed`
                     // must then re-send that same brief rather than a fresh prompt on a possibly banned channel.
-                    const noteLaunched = async () => journal.append("worker-launch", t.id, {
-                        attempt,
-                        retryMode,
-                        ...(trackedDriver.describe ? await trackedDriver.describe(slot) : {}),
-                    });
+                    let workerLaunchedAt;
+                    const noteLaunched = async () => {
+                        // Startup evidence begins when the worker exists, not while prompt preparation, slot
+                        // allocation, or interactive readiness is still consuming the attempt wall clock.
+                        workerLaunchedAt ??= Date.now();
+                        journal.append("worker-launch", t.id, {
+                            attempt,
+                            retryMode,
+                            ...(trackedDriver.describe ? await trackedDriver.describe(slot) : {}),
+                        });
+                    };
                     const noteWorkerLiveness = (event, data) => journal.append(event, t.id, { ...data, source: trackedDriver.readSource ?? "driver.read" });
                     let cpuFlat;
                     let cpuAccountant;
@@ -2898,7 +2964,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             // latch, and the second is a no-op. A seed that answered is never re-answered by the loop.
                             if (seedResult?.trustAnswered)
                                 noteSeedTrustAnswered();
-                            startupFailure = WORKER_STARTUP_FAILURE_RE.test(stallSnapshotBannerRows(output));
+                            startupFailure = startupFailureInWindow(output, workerLaunchedAt);
                             if (seedResult?.seedFailed || startupFailure) {
                                 finished = false;
                             }
@@ -2942,6 +3008,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     const sliceStart = Date.now();
                                     const remaining = stallWindowMs - (sliceStart - lastProgressAt);
                                     let slice = Math.min(BLOCKED_POLL_MS, Math.max(100, Math.min(stallWindowMs / 2, remaining)));
+                                    const startupLeft = workerLaunchedAt === undefined
+                                        ? 0
+                                        : workerStartupWindowMs - (sliceStart - workerLaunchedAt);
+                                    if (startupLeft > 0)
+                                        slice = Math.min(slice, Math.max(1, startupLeft));
                                     if (!everHadOutput) {
                                         const earlyLeft = earlyLaunchLivenessMs - (sliceStart - attemptStart);
                                         if (earlyLeft > 0)
@@ -2961,6 +3032,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         const exit = exitRe.exec(output);
                                         if (finished || exit) {
                                             exitCode = exit ? Number(exit[1]) : null; // null ⇔ the TUI is still alive
+                                            processExited = exit !== null;
                                             await sampleContext(); // final poll-seam sample before leaving the wait
                                             break;
                                         }
@@ -3000,7 +3072,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     }
                                     if (paneText.length > 0)
                                         everHadOutput = true;
-                                    if (WORKER_STARTUP_FAILURE_RE.test(stallSnapshotBannerRows(paneText))) {
+                                    if (startupFailureInWindow(paneText, workerLaunchedAt)) {
                                         startupFailure = true;
                                         output = paneText;
                                         break;
@@ -3353,6 +3425,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         const exit = exitRe.exec(output);
                                         if (finished || exit) {
                                             exitCode = exit ? Number(exit[1]) : null;
+                                            processExited = exit !== null;
                                             await sampleContext();
                                             break;
                                         }
@@ -3398,6 +3471,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     finished = new RegExp(trailerPattern(nonce)).test(output);
                                     const exit = exitRe.exec(output);
                                     exitCode = exit ? Number(exit[1]) : null;
+                                    processExited = exit !== null;
                                 }
                                 if (finished) {
                                     await driver.waitAgentStatus(slot, "idle", 5_000); // settle, then re-harvest the final render
@@ -3444,7 +3518,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             // v1.76: same monotonic-progress measure as the interactive site; harvest stays raw.
                             const stallWindowMs = taskTimeoutMinutes * 60_000;
                             const initialPane = await driver.read(slot, 500);
-                            startupFailure = WORKER_STARTUP_FAILURE_RE.test(stallSnapshotBannerRows(initialPane));
+                            startupFailure = startupFailureInWindow(initialPane, workerLaunchedAt);
                             let everHadOutput = initialPane.length > 0;
                             const stallProgress = new StallProgressTracker();
                             stallProgress.observe({ paneText: initialPane, seedSubmitted: true, contextTokens });
@@ -3460,6 +3534,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                             while (!startupFailure && Date.now() - lastProgressAt < stallWindowMs) {
                                 const remaining = stallWindowMs - (Date.now() - lastProgressAt);
                                 let slice = Math.min(BLOCKED_POLL_MS, Math.max(100, Math.min(stallWindowMs / 2, remaining)));
+                                const startupLeft = workerLaunchedAt === undefined
+                                    ? 0
+                                    : workerStartupWindowMs - (Date.now() - workerLaunchedAt);
+                                if (startupLeft > 0)
+                                    slice = Math.min(slice, Math.max(1, startupLeft));
                                 if (!everHadOutput) {
                                     const earlyLeft = earlyLaunchLivenessMs - (Date.now() - attemptStart);
                                     if (earlyLeft > 0)
@@ -3474,7 +3553,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 const paneText = await driver.read(slot, 500);
                                 if (paneText.length > 0)
                                     everHadOutput = true;
-                                if (WORKER_STARTUP_FAILURE_RE.test(stallSnapshotBannerRows(paneText))) {
+                                if (startupFailureInWindow(paneText, workerLaunchedAt)) {
                                     startupFailure = true;
                                     break;
                                 }
@@ -3516,12 +3595,52 @@ export async function runDaemon(repoRoot, opts = {}) {
                     if (interactive && finished && !exitRe.test(output)) {
                         await driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, 2_000, { regex: true });
                     }
-                    // keepPanes retains visible context, not a timed-out subprocess tree. Close before consult/retry
-                    // can recreate the worktree; Herdr and subprocesses that reached their exit marker stay unchanged.
-                    if (keepOpen && (finished || processExited || driver.id !== "subprocess"))
+                    // Free availability reroutes deliberately reuse the charged-attempt ordinal. Stream artifacts
+                    // cannot: every dispatch owns bytes that must remain independently recoverable, so derive the
+                    // append-only dispatch ordinal from the journal instead of overwriting an earlier a<n>.out.
+                    const streamAttempt = journal.read().filter((event) => event.event === "task-dispatch" && event.taskId === t.id).length - 1;
+                    const capturedStream = await captureWorkerStream(journal.dir, t.id, streamAttempt, driver, slot, output);
+                    // An interactive settle already selected the bounded parse it is allowed to use. Every other
+                    // path parses the common final stream snapshot — notably envelope adapters whose trailer is
+                    // encoded and therefore invisible to the raw wait regex. Keep `output` bounded: every text
+                    // classifier below retains its pre-artifact tail surface.
+                    let result = settleParsed ?? adapter.parse(capturedStream.output, nonce);
+                    const adapterCause = result.cause;
+                    // Law 46: there is one completion fact. A classified adapter result with no parse-failure cause
+                    // means its decoder found the nonce-bound trailer even when the raw JSON envelope escaped it.
+                    const workerFinished = finished || adapterCause === undefined;
+                    finished = workerFinished;
+                    const adapterStartupFailure = adapterCause === "startup-failure";
+                    const workerCause = adapterStartupFailure
+                        ? "startup-failure"
+                        : startupFailure
+                            ? "startup-failure"
+                            : classifyWorkerResultCause({ output, ok: result.ok, finished: workerFinished, exitCode, summary: result.summary, timedOut, deadChannel: deadChannelKilled });
+                    // OBS-897/889(4): neither a timeout/quiet-harvest nor a trailer is a verdict on a tree while
+                    // its writer remains alive. Reap through the same driver lifecycle every execution surface
+                    // already implements, then (and only then) permit commitsAheadOf/gates below to read the tree.
+                    // A failed reap is a stall disposition, never permission to gate a moving branch.
+                    let reapFailure;
+                    if (!processExited && !deadWorkerPark) {
+                        try {
+                            await closeSlot(slot);
+                            if (!workerFinished) {
+                                journal.append("worker-reaped-before-harvest", t.id, {
+                                    slot: slot.name, attempt, cause: workerCause ?? "stall-timeout",
+                                });
+                            }
+                        }
+                        catch (error) {
+                            reapFailure = error instanceof Error ? error.message : String(error);
+                        }
+                    }
+                    else if (keepOpen && (workerFinished || processExited || driver.id !== "subprocess")) {
                         keptSlots.push(slot);
-                    else
+                        supersededWorkerSlot = slot;
+                    }
+                    else {
                         await closeSlot(slot);
+                    }
                     // SPEND-01: usage from the harness's own cwd-keyed structured store, read POST-HOC from disk —
                     // `wt` is this task's private worktree, so the path is unique; the read is sliced to records
                     // stamped at/after this attempt's dispatch instant. Never the harvested pane text, never the
@@ -3537,15 +3656,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                         await park(t, deadWorkerPark.reason, "stall", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode, { ref: deadWorkerPark.ref });
                         return;
                     }
-                    let result = settleParsed ?? adapter.parse(output, nonce);
-                    const workerFinished = finished;
-                    const workerCause = startupFailure
-                        ? "startup-failure"
-                        : classifyWorkerResultCause({ output, ok: result.ok, finished, exitCode, summary: result.summary, timedOut, deadChannel: deadChannelKilled });
                     journal.append("worker-result", t.id, {
                         ok: result.ok, summary: result.summary, deviations: result.deviations, finished: workerFinished, exitCode,
-                        mode: interactive ? "interactive" : "print", ...(workerCause ? { cause: workerCause } : {}),
+                        mode: interactive ? "interactive" : "print", stream: capturedStream.path,
+                        ...(workerCause ? { cause: workerCause } : {}),
                     });
+                    if (reapFailure) {
+                        await park(t, `worker could not be reaped before harvest: ${reapFailure}`, "stall", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode, { reapFailure });
+                        return;
+                    }
                     // T2 review (routing precedence): provider-death, quota and dead-channel classification
                     // derive from ONE rule — the worker's OWN outcome, workerFinished and this PRE-HARVEST
                     // parse — never from the synthesized result below. A worker that committed and then walled
@@ -3632,6 +3751,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     }
                                     catch { /* cosmetic — reconcile is the backstop */ }
                                 }
+                                if (supersededWorkerSlot === slot)
+                                    supersededWorkerSlot = undefined;
                             }
                             // v1.8 TEL-05 — FROM-channel attribution for mid-task quota failover: `assignment` is still the
                             // throttled-away-FROM channel here (before the reassign below). durationMs:0 marks this as a
@@ -3658,7 +3779,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // T2 review: classify the PRE-HARVEST parse — classifyDeadChannel bails on any ok:true
                     // result, so reading the synthesized harvest result would swallow auth-required /
                     // setup-required / provider-outage for every committed-but-walled attempt (in both modes).
-                    const dead = classifyDeadChannel(preHarvestResult) ?? (earlyLaunchDead || startupFailure ? "setup-required" : undefined);
+                    const dead = classifyDeadChannel({ ...preHarvestResult, raw: output })
+                        ?? (earlyLaunchDead || startupFailure || adapterStartupFailure ? "setup-required" : undefined);
                     if (dead) {
                         const from = channelKey(assignment);
                         demotedChannels.add(from); // excluded for later attempts AND later tasks in this run
@@ -3677,12 +3799,19 @@ export async function runDaemon(repoRoot, opts = {}) {
                                     }
                                     catch { /* cosmetic — reconcile is the backstop */ }
                                 }
+                                if (supersededWorkerSlot === slot)
+                                    supersededWorkerSlot = undefined;
                             }
                             assignment = next;
                             tried.push(channelKey(next));
+                            // Startup failures bought no worker turn: preserve the attempt ordinal/budget while the
+                            // verified-dead channel remains excluded for every later dispatch in this run.
+                            if (adapterStartupFailure || startupFailure)
+                                attempt--;
                             continue;
                         }
-                        await park(t, `dead channel (${dead}) and no eligible channel remains`, "reroute-exhausted", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
+                        const chargedAttempts = adapterStartupFailure || startupFailure ? attempt : attempt + 1;
+                        await park(t, `dead channel (${dead}) and no eligible channel remains`, "reroute-exhausted", assignment, chargedAttempts, startMs, gateFails, consults, tokens, metered, retryMode);
                         return;
                     }
                     if (!finished) {

package/dist/run/git.d.ts

@@ -92,6 +92,8 @@ export interface ShResult {
     timedOut?: boolean;
     /** The shell exited, but descendants still held its process group and pipes past the grace. */
     reapedGroup?: boolean;
+    /** The grace reap's group kill failed with something other than ESRCH (for example EPERM). */
+    reapError?: string;
     durationMs?: number;
     /** T7: the capacity THIS child ran under, stamped where its environment was built (see `shell`). */
     capacity?: RunCapacity;

package/dist/run/git.js

@@ -174,6 +174,7 @@ function shell(cmd, cwd, timeoutMs, login) {
         const stdoutDecoder = new StringDecoder("utf8");
         const stderrDecoder = new StringDecoder("utf8");
         let timedOut = false, reapedGroup = false, done = false, started = false, outputSeen = false;
+        let reapError, exitedCode;
         let reapTimer;
         const finish = (code, err) => {
             if (done)
@@ -191,6 +192,7 @@ function shell(cmd, cwd, timeoutMs, login) {
                 durationMs: Date.now() - startedAt,
                 capacity,
                 ...(reapedGroup ? { reapedGroup: true } : {}),
+                ...(reapError ? { reapError } : {}),
             });
         };
         const timer = setTimeout(() => {
@@ -198,8 +200,15 @@ function shell(cmd, cwd, timeoutMs, login) {
             try {
                 process.kill(-p.pid, "SIGKILL");
             }
-            catch {
+            catch (error) {
+                const code = error?.code;
+                if (code !== "ESRCH") {
+                    reapError ??= `${code ?? "kill"}: ${error instanceof Error ? error.message : String(error)}`;
+                }
                 p.kill("SIGKILL");
+                // A failed group kill can leave inherited pipes open forever; the command ceiling still wins.
+                if (code !== "ESRCH")
+                    finish(exitedCode ?? 1);
             }
         }, timeoutMs);
         p.on("spawn", () => { started = true; }); // the command exists from here on — never retryable past it
@@ -233,8 +242,9 @@ function shell(cmd, cwd, timeoutMs, login) {
         // cannot hold this promise until the command ceiling. A real timeout wins first and is never
         // reclassified as a grace reap.
         p.on("exit", (code) => {
+            exitedCode = code ?? 1;
             if (timedOut) {
-                finish(code ?? 1);
+                finish(exitedCode);
                 return;
             }
             reapTimer = setTimeout(() => {
@@ -244,8 +254,12 @@ function shell(cmd, cwd, timeoutMs, login) {
                     process.kill(-p.pid, "SIGKILL");
                     reapedGroup = true;
                 }
-                catch {
-                    // The group closed between the shell's exit and the grace boundary; "close" owns finish.
+                catch (error) {
+                    // ESRCH means the group closed in the grace race; every other error must survive to the
+                    // result while the command timeout remains the explicit backstop.
+                    const code = error?.code;
+                    if (code !== "ESRCH")
+                        reapError = `${code ?? "kill"}: ${error instanceof Error ? error.message : String(error)}`;
                 }
             }, SHELL_REAP_GRACE_MS);
         });

package/dist/run/journal.d.ts

@@ -196,7 +196,7 @@ export declare const PARK_KINDS: readonly ["human-gate", "ladder-exhausted", "at
 export type ParkKind = (typeof PARK_KINDS)[number];
 export declare const RETRY_MODES: readonly ["resume", "fresh", "repair"];
 export type RetryMode = (typeof RETRY_MODES)[number];
-export declare const WORKER_RESULT_CAUSES: readonly ["provider-death", "dead-channel", "stall-timeout", "malformed-trailer", "clean-exit-no-trailer"];
+export declare const WORKER_RESULT_CAUSES: readonly ["provider-death", "dead-channel", "stall-timeout", "malformed-trailer", "clean-exit-no-trailer", "startup-failure"];
 export type WorkerResultCause = (typeof WORKER_RESULT_CAUSES)[number];
 export declare function isQualityFailureParkKind(kind: ParkKind): boolean;
 export declare function classifyTaskFailure(taskEvents: JournalEvent[]): ParkKind;

package/dist/run/journal.js

@@ -782,7 +782,7 @@ export const RETRY_MODES = ["resume", "fresh", "repair"];
 // concludes a worker while the rolling stall window still has most of its time left, so labelling it
 // stall-timeout points every downstream reader — the repair brief, the consult — at a mechanism that
 // cannot have fired.
-export const WORKER_RESULT_CAUSES = ["provider-death", "dead-channel", "stall-timeout", "malformed-trailer", "clean-exit-no-trailer"];
+export const WORKER_RESULT_CAUSES = ["provider-death", "dead-channel", "stall-timeout", "malformed-trailer", "clean-exit-no-trailer", "startup-failure"];
 // Status consumes the routing profile's existing quality split directly: verified park kinds classify
 // to 0, while availability/recovery noise classifies to null. Keep the synthetic row here at the
 // run↔route seam so presentation code never grows a second list of "bad" park kinds.

package/dist/run/lock.d.ts

@@ -9,6 +9,10 @@ export interface Inspection {
     mtimeMs: number;
     ino: number;
 }
+export type RunLineEvent = {
+    event: string;
+    ts: string;
+};
 export declare function shouldRefuse(i: Pick<Inspection, "garbage" | "dead">): boolean;
 export declare function isPidLive(pid: number): boolean;
 export declare function acquireRunLock(repoRoot: string, runId: string): {
@@ -29,6 +33,8 @@ export declare function runLockOwner(repoRoot: string): {
     runId?: string;
     live: boolean;
 } | undefined;
+export declare function runLockRunId(repoRoot: string): string | undefined;
+export declare function runStatusLine(repoRoot: string, runId: string, events: readonly RunLineEvent[]): string | null;
 export declare function isRunLockLive(repoRoot: string): boolean;
 export declare function unlockRun(repoRoot: string): {
     held: false;

package/dist/run/lock.js

@@ -2,6 +2,7 @@ import { linkSync, readFileSync, statSync, unlinkSync, utimesSync, writeFileSync
 import { join } from "node:path";
 import { z } from "zod";
 import { tickmarkrDir, stateDirName } from "../graph/graph.js";
+import { parseRunId } from "./journal.js";
 // HARD-01/02: coarse per-run advisory lock over .tickmarkr/graph.json. LOCK-02: the lock is created by
 // the link(2) idiom — write the full payload to graph.lock.<pid>.tmp, then linkSync(tmp, lockPath),
 // which is atomic and throws EEXIST if the lock already exists (the mutual-exclusion primitive).
@@ -238,7 +239,7 @@ export async function acquireApprovalSerialization(repoRoot, runId) {
 export function runLockOwner(repoRoot) {
     let insp;
     try {
-        insp = inspect(lockPath(repoRoot));
+        insp = inspect(join(repoRoot, stateDirName(repoRoot), "graph.lock"));
     }
     catch {
         return undefined;
@@ -247,6 +248,45 @@ export function runLockOwner(repoRoot) {
     // REPOSITORY-wide, so a live pid here is not proof it is running the run the caller cares about.
     return { pid: insp.pid, runId: insp.runId, live: shouldRefuse(insp) };
 }
+export function runLockRunId(repoRoot) {
+    const runId = runLockOwner(repoRoot)?.runId;
+    if (runId === undefined)
+        return undefined;
+    try {
+        return parseRunId(runId);
+    }
+    catch {
+        return undefined;
+    }
+}
+export function runStatusLine(repoRoot, runId, events) {
+    let parsedRunId;
+    try {
+        parsedRunId = parseRunId(runId);
+    }
+    catch {
+        return null;
+    }
+    const owner = runLockOwner(repoRoot);
+    const ownerRunId = owner?.runId === undefined ? undefined : (() => {
+        try {
+            return parseRunId(owner.runId);
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    if (owner && ownerRunId === parsedRunId) {
+        if (owner.live)
+            return `run ${parsedRunId} active`;
+        return owner.pid === undefined
+            ? `run ${parsedRunId} stale lock`
+            : `run ${parsedRunId} stale lock naming dead holder pid ${owner.pid}`;
+    }
+    if (events.some((event) => event.event === "run-end"))
+        return null;
+    return `run ${parsedRunId} abandoned since ${events.at(-1)?.ts ?? "unknown"}`;
+}
 // Read-only predicate: true iff a lock exists that the decision table would REFUSE on (alive,
 // EPERM, or ANY garbage). A provably-dead holder (ESRCH) reads not-live (LOCK-02/OBS-05). Never
 // mutates the lock. compile now acquires via acquireRunLock; this remains for drift oracles/tests.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-overseer/SKILL.md

@@ -165,6 +165,21 @@ overseer holds the mission's judgment. A tier collapse is therefore a context le
 **The tell, and you will not notice it from inside:** if you are typing `tickmarkr resume`, or reading a
 journal tail to decide what happens next, or sweeping orphans — you have taken the loop. Hand it back.
 
+### Pre-run checklist — install these laws in the brief before `compile` / `plan` / `run`
+
+1. **Run the files[]-versus-oracle pin sweep (RULING-222-36).** Read every acceptance item and enumerate
+   the PINS its satisfaction must move: implementation files, callers, fixtures, tests, snapshots and
+   documentation assertions. Put every pin in that task's `files[]` before compile. A criterion that
+   forces a file its scope forbids is a plan defect; repair the plan before dispatch, never spend a
+   worker's repair ladder on the scope/test catch-22.
+2. **Install the live-run command boundary (RULING-222-28 §5 and 222-29 §3).** While a run is live, run
+   no `vitest` probe of any size — the daemon's `suite-wait` guard counts it. During that same window the
+   runner's name never enters a shell argv: not reason text, a heredoc, `pgrep -f`, or a commit subject.
+   Write records containing the word through an editor, and wait for run-end before probing.
+3. **Gate a mid-run fix at the base, not at a summary (law 47 / OBS-909).** A fix landed on main while a
+   run is live is proved with `tickmarkr verify --base <main>`, never with a suite summary copied from a
+   different tree. A release proof runs every CI-ordered step — including lint — before its suite.
+
 ### What the ORCHESTRATOR does, and what you require of it
 
 - **The live surface arrives with the run.** `tickmarkr run` is stdout-silent until run-end by design;
@@ -358,7 +373,7 @@ The protocol, in both directions:
    herdr pane run <partner> "I am at <N>%. Clear me: send /clear to <my-pane>, then point me at <my-handoff>."
    # 3. the PARTNER sends the clear, then VERIFIES before pointing:
    herdr pane run <my-pane> "/clear"
-   #    read the pane back — a cleared claude session shows an empty prompt and a reset context gauge
+   #    read the pane back — a cleared claude session shows an empty prompt and a LOWER context percentage
    # 4. and only THEN, as a SEPARATE send, the re-orientation:
    herdr pane run <my-pane> "You were cleared at <N>%. Read <handoff> and <brief>. Same-process clear kept
    every background task alive: retire only your recorded watcher pids, verify twice, kill-by-pid, arm,
@@ -367,7 +382,9 @@ The protocol, in both directions:
 
    ⚠ **Steps 3 and 4 are two sends, never one.** A pointer batched with the clear lands *during* it and is
    lost with the context it was meant to survive. Verify the clear landed by reading the prompt line
-   before sending the pointer — the same read-back every other send in this skill requires.
+   and re-reading the banner percentage below its pre-clear value before sending the pointer — the same
+   read-back every other send in this skill requires. A working seat or a typed prompt defers the act;
+   neither authorises a queued `/clear`.
    ⚠ **The partner must not clear itself in the same window.** One supervising tier stays live at all
    times; the seat holding the endgame goes second.
    ⚠ **Step 4 must state an EXPECTED-RETURN DEADLINE**, e.g. *"confirm you are back within 10 minutes."*
@@ -451,7 +468,9 @@ The first argument chooses the closed per-seat tier (`orchestrator-context` or `
 and every beat names the second argument as that tier's seat. The watcher beats only after reading a
 rendered percentage, keeps beating on the supervision cadence even when its requested poll is slower,
 continues past WARN to ACT, and records a stand-down on each controlled exit. A killed watcher alone
-leaves its last beat to age into `STALE`.
+leaves its last beat to age into `STALE`. Auto-clear waits for `idle` plus an empty or dim-only ANSI
+prompt line, prints `CONTEXT_ACT_DEFERRED` while that gate is closed, and emits `CONTEXT_CLEARED` only
+after a banner read-back proves the percentage dropped; only then does it send the re-brief.
 **Every handoff's re-arm list ends with the announce step from Setup 0** — inform the surviving
 orchestrator the fresh seat is live — or the next seat re-arms silently beside a tier that still
 believes it is alone.
@@ -545,6 +564,11 @@ they are left implicit:
   that discriminates** — text sitting on `❯` is exactly what will not run — and a delivery report
   is prompt-line state alone, or nothing: a decorative check beside a real one reads as
   corroboration (two greens, one of which was never capable of disagreeing).
+  **Law 50 applies to every handoff, including `/clear`: a seat-send to a WORKING seat leaves a DRAFT.**
+  Send only when the seat is idle and the ANSI prompt line is empty or dim-only (the Esc/SGR discriminator
+  separates an autosuggest ghost from typed input), then read back activity or an ACK; presence is not
+  delivery. If a stale draft must be replaced, supersede it explicitly with
+  `agent prompt " <-- disregard … ACTUAL: …"` instead of stacking another instruction behind it.
 - **A MESSAGE TO A WORKING SEAT IS A QUEUED MESSAGE, AND THE QUEUE DRAINS ONLY AT TURN BOUNDARIES.**
   Delivery is not arrival: `agent prompt` to a `working` claude seat lands in its queue (`Press up to
   edit queued messages` on the seat's prompt line is the tell) and is READ only when the current turn
@@ -994,10 +1018,21 @@ orchestrator turn boundary.
    - **RUN BOTH RELEASE PROOFS BEFORE STANDING DOWN.** The first is the exported-tree suite, which
      maintainers run from the private repo with its `verify:export` script — that tooling is deliberately
      not part of this package, so the command does not exist in a public checkout; it must install,
-     build, and run the suite in the exported tree; then
+     build, lint, and only then run the suite in the exported tree; then
      `TICKMARKR_E2E=1 npx vitest run tests/e2e/orca-smoke.e2e.test.ts` must exercise the installed-Orca
      smoke. A skipped smoke is not proof. Record both results before declaring the release complete.
 
+   - **GRADE PUBLIC CI FROM JOB LOGS AT RUN-END ONLY (law 48).** A badge is not the grade, and
+     `gh run view --job --log` is empty while the run is in progress. At run-end execute
+     `scripts/grade-ci.sh <run-id> <expected-count> <tag>` and require GREEN from both jobs; its
+     UNREADABLE state is a hard stop, not a green default. Derive the expected glob pathspec count with
+     `git ls-files ':(glob)tests/**/*.test.ts'` (including the `.tsx` sibling where present), never a bare
+     `tests/**/*.test.ts`: bare `**` is not a git glob (law 49).
+
+   - **RE-READ THE REGISTRY BEFORE RULING (law 51).** A successful Release run and the first
+     `npm view` are separate observations: registry propagation can briefly return the prior version.
+     Read `npm view tickmarkr version` again and verify provenance before recording the publish verdict.
+
    - **REWRITE THE MEMORY INDEX FIRST, and read it back.** Minutes after `2.1.1` hit npm, the index line
      a fresh session loads still read *"⛔ 2.1.1 CANNOT ship from run …2011"* — true when written, and by
      then the exact opposite of the truth. **The index is what everyone loads and the body is what nobody