tickmarkr 2.5.1 → 2.5.3

package/dist/run/git.d.ts

@@ -4,6 +4,8 @@ export { ROUTING_ENV_SEAMS };
 export declare const FORK_CAP_ENV = "VITEST_MAX_FORKS";
 export declare const SUITE_PARENT_ENV = "TICKMARKR_SUITE_PARENT";
 export declare const DEFAULT_FORK_CAP = "6";
+/** Verification owns the serialized suite window; workers keep their concurrency budget. */
+export declare const runWithVerificationBudget: <T>(capacity: RunCapacity, fn: () => Promise<T>) => Promise<T>;
 /**
  * OBS-618: how many PROCESSES one vitest fork can hold at its peak — the fork, a daemon it spawns,
  * and that daemon's own `git` child. The previous formula counted FORKS and assumed one process
@@ -38,7 +40,7 @@ export declare const resolvedForkCap: () => string;
 /**
  * T7: the CAPACITY a suite verdict was measured under — the fork cap the command's child actually
  * received, and the core count that cap was divided from. Two verdicts are comparable only when both
- * numbers match: a run resumed at a different concurrency divides the same machine by a different
+ * numbers match: a run resumed at a different capacity divides the machine by a different
  * number, so a green measured in that other world is not evidence about this one.
  *
  * This pair is the WHOLE comparable identity, and the load averages a gate row already carries beside
@@ -77,7 +79,7 @@ export declare function sameCapacity(recorded: unknown, current: RunCapacity | u
 export declare const describeCapacity: (value: unknown) => string;
 /**
  * The capacity a child spawned on THIS async context would receive: the same precedence `shell`
- * applies below — an operator export of the cap wins over the run's own derived value — beside the
+ * applies below — the verification budget captures any operator export at run start — beside the
  * cores it was divided from. A caller holding a command's own result reads the capacity off THAT
  * result (`ShResult.capacity`, stamped where the child's environment was built); this is for the
  * decisions taken BEFORE any child exists — a cache hit, a reuse predicate.

package/dist/run/git.js

@@ -15,24 +15,11 @@ export { ROUTING_ENV_SEAMS };
 export const FORK_CAP_ENV = "VITEST_MAX_FORKS";
 export const SUITE_PARENT_ENV = "TICKMARKR_SUITE_PARENT";
 export const DEFAULT_FORK_CAP = "6";
-/**
- * The fork budget belongs to ONE run: how many gate suites can be in flight at once is exactly that
- * run's resolved concurrency, so the per-suite cap must divide the machine by THAT number and no
- * other. Two things rule out a module-level variable. A single Node process holds more than one
- * runDaemon call — the suites do it, and so does a supervisor driving two repositories — so a
- * captured-once global hands whichever run started first its cap to every other run, and only a
- * reset seam production never calls could hide it. And re-deriving the number at spawn time reads
- * whatever `process.argv` or the config overlay says NOW, not what the run resolved: `parseArgs`
- * settles `--concurrency 2 --concurrency 8` on the LAST occurrence, and an overlay is a mutable
- * file, so a re-derived cap can disagree with the concurrency the run is actually enforcing.
- *
- * AsyncLocalStorage is the stdlib answer to both. The store is entered once, around the run body,
- * from the single value `runDaemon` resolved; every shell that run spawns — baseline capture, gate
- * batteries, tip verify, worker environments — inherits it through the async context, and a
- * concurrent run's shells inherit their own. There is nothing to reset: leaving the run leaves
- * the store, so sequential runs cannot inherit each other either.
- */
+/** Worker concurrency is resolved once per run and isolated from other async runs. */
 const forkBudget = new AsyncLocalStorage();
+const verificationBudget = new AsyncLocalStorage();
+/** Verification owns the serialized suite window; workers keep their concurrency budget. */
+export const runWithVerificationBudget = (capacity, fn) => verificationBudget.run(capacity, fn);
 /**
  * OBS-618: how many PROCESSES one vitest fork can hold at its peak — the fork, a daemon it spawns,
  * and that daemon's own `git` child. The previous formula counted FORKS and assumed one process
@@ -102,12 +89,12 @@ export const describeCapacity = (value) => {
 };
 /**
  * The capacity a child spawned on THIS async context would receive: the same precedence `shell`
- * applies below — an operator export of the cap wins over the run's own derived value — beside the
+ * applies below — the verification budget captures any operator export at run start — beside the
  * cores it was divided from. A caller holding a command's own result reads the capacity off THAT
  * result (`ShResult.capacity`, stamped where the child's environment was built); this is for the
  * decisions taken BEFORE any child exists — a cache hit, a reuse predicate.
  */
-export const resolvedCapacity = () => ({
+export const resolvedCapacity = () => verificationBudget.getStore() ?? ({
     forkCap: Number(FORK_CAP_ENV in process.env ? process.env[FORK_CAP_ENV] : resolvedForkCap()),
     cores: availableParallelism(),
 });
@@ -151,9 +138,10 @@ function shell(cmd, cwd, timeoutMs, login) {
     const env = { ...process.env };
     for (const k of ROUTING_ENV_SEAMS)
         delete env[k];
-    // OBS-110: apply the run's own fork cap only when the operator has not already set one.
-    if (!(FORK_CAP_ENV in env))
-        env[FORK_CAP_ENV] = resolvedForkCap();
+    // A run freezes the operator override and cores at startup; admission can lower the round cap.
+    env[FORK_CAP_ENV] = verificationBudget.getStore()
+        ? String(resolvedCapacity().forkCap)
+        : env[FORK_CAP_ENV] ?? resolvedForkCap();
     // OBS-854: descendants can leave the checkout (nested fixture suites do), so cwd alone cannot
     // attribute them. Every daemon shell exports the daemon pid as their durable parentage marker.
     env[SUITE_PARENT_ENV] = String(process.pid);
@@ -163,7 +151,7 @@ function shell(cmd, cwd, timeoutMs, login) {
     // for; re-deriving the run's own budget after the command returned would stamp a cap no child ran
     // under. `Number` of an unparseable export is NaN, which every reader treats as malformed and
     // therefore fails closed — the honest direction when the cap in play cannot be stated.
-    const capacity = { forkCap: Number(env[FORK_CAP_ENV]), cores: availableParallelism() };
+    const capacity = { forkCap: Number(env[FORK_CAP_ENV]), cores: resolvedCapacity().cores };
     const attempt = () => new Promise((resolve) => {
         const startedAt = Date.now();
         // detached: bash gets its own process group so a timeout can kill the whole tree —

package/dist/run/journal.js

@@ -949,18 +949,27 @@ export function gateResultJournalData(gate, pass, details, meta = {}) {
     const signalBasis = deriveSignalBasis(gate, pass, details, meta);
     return { gate, pass, details, ...meta, signalBasis, signalQuality: signalQualityFromBasis(signalBasis) };
 }
-// T3 (Sol #2 / Fable F2): one canonical engagement identity, shared by status AND resume. The run-start
-// event records graphDefinitionHash (over compiled task definitions only — see graph.graphDefinitionHash);
-// this is the single field both consumers read, and the single comparator below is the single place the
-// journal↔graph join is decided. unbound (no recorded definition hash, e.g. a pre-v1.44 journal) and
+// T3 (Sol #2 / Fable F2) + OBS-978: one canonical engagement identity, shared by status, plan, the operator
+// fold AND resume. The run-start event records graphDefinitionHash (over compiled task definitions only — see
+// graph.graphDefinitionHash); each audited graph-rehash row (resume --graph-changed) then moves the identity to
+// its `to`, so the recorded hash is the last audited rehash, else run-start. A row is audited when its `from`
+// names the identity it replaced, or the run-start one (all pre-OBS-978 daemons wrote); a row auditing neither
+// binds nothing — the journal is unbound until a release from null. unbound (also a pre-v1.44 journal) and
 // mismatch are both not-comparable — status renders the notice either way; resume refuses either way and
 // distinguishes the reason only for its message and the --graph-changed release event.
 export function recordedGraphDefinitionHash(events) {
+    const start = events.find((e) => e.event === "run-start");
+    if (!start)
+        return undefined;
+    const origin = typeof start.data.graphDefinitionHash === "string" ? start.data.graphDefinitionHash : null;
+    let recorded = origin;
     for (const e of events) {
-        if (e.event === "run-start" && typeof e.data.graphDefinitionHash === "string")
-            return e.data.graphDefinitionHash;
+        if (e.event !== "graph-rehash")
+            continue;
+        const audited = e.data.from === recorded || e.data.from === origin;
+        recorded = audited && typeof e.data.to === "string" ? e.data.to : null;
     }
-    return undefined;
+    return recorded ?? undefined;
 }
 // THE shared comparator (criterion: status and resume decide through one comparator). status reads
 // .comparable; resume reads .comparable plus .reason/.recorded for its refusal message and the release.

package/dist/run/merge.d.ts

@@ -12,7 +12,7 @@ export interface TipVerifyResult {
     forgiven?: boolean;
     /**
      * OBS-534: what a nonzero exit is evidence OF, taken from the battery's own readers — `ceilingKillResult`
-     * for a kill, `classifyFailureOutput` for everything else. `infra` means nothing was verified.
+     * for a kill, the shared runner classifier for everything else. `infra` means nothing was verified.
      */
     cause?: FailureClassification;
 }

package/dist/run/merge.js

@@ -1,7 +1,7 @@
-import { existsSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { shq } from "../adapters/types.js";
-import { ceilingKillResult, classifyFailureOutput, effectiveCeilingMs, fingerprint, freshFailures, } from "../gates/baseline.js";
+import { ceilingKillResult, classifyFreshRunnerOutput, classifyRunnerOutput, fileCountDeficit, waitForCalmWindow, effectiveCeilingMs, fingerprint, freshFailures, } from "../gates/baseline.js";
 import { tickmarkrDir } from "../graph/graph.js";
 import { describeCapacity, gitHead, linkNodeModules, resolveIntegrationBranch, sameCapacity, sh, shGit, shGitOk, WORKTREES_DIR } from "./git.js";
 export function integrationBranch(cfg, runId) {
@@ -52,16 +52,121 @@ export async function mergeTask(intWt, taskBranch, message, gatedCommit) {
 // fingerprint, or output with no recognizable failure shape, → failed.
 export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
     const results = [];
+    let runStartCommands;
+    let journalFound = false;
+    let hasRunEvidenceOrMalformed = false;
+    const journalPath = join(runDir, "journal.jsonl");
+    if (existsSync(journalPath)) {
+        journalFound = true;
+        try {
+            const raw = readFileSync(journalPath, "utf8").trim();
+            if (!raw) {
+                hasRunEvidenceOrMalformed = true;
+            }
+            else {
+                const lines = raw.split("\n");
+                for (const line of lines) {
+                    if (!line.trim())
+                        continue;
+                    try {
+                        const parsed = JSON.parse(line);
+                        if (parsed.event === "run-start" && parsed.data?.commands) {
+                            runStartCommands = parsed.data.commands;
+                            break;
+                        }
+                        if (parsed.event && !parsed.event.startsWith("tip-verify")) {
+                            hasRunEvidenceOrMalformed = true;
+                        }
+                    }
+                    catch {
+                        // Recover valid rows: skip malformed rows while searching for run-start
+                        hasRunEvidenceOrMalformed = true;
+                    }
+                }
+            }
+        }
+        catch {
+            hasRunEvidenceOrMalformed = true;
+        }
+    }
+    const gatesToRun = [];
     for (const [gate, cmd] of Object.entries(commands)) {
-        const entry = baseline?.commands[gate];
+        if (gate === "tipTest")
+            continue;
+        if (gate === "test") {
+            gatesToRun.push(["test", commands.tipTest ?? cmd]);
+        }
+        else {
+            gatesToRun.push([gate, cmd]);
+        }
+    }
+    if (!commands.test && commands.tipTest) {
+        gatesToRun.push(["test", commands.tipTest]);
+    }
+    if (journalFound && hasRunEvidenceOrMalformed && runStartCommands === undefined) {
+        for (const [gate, cmd] of gatesToRun) {
+            const artifact = join(runDir, `tip-verify-${gate}.log`);
+            const details = `tip verify could not establish command provenance: run-start evidence missing or malformed in journal`;
+            writeFileSync(artifact, details + "\n");
+            results.push({
+                gate,
+                cmd,
+                pass: false,
+                exitCode: 1,
+                fingerprints: [],
+                details,
+                artifact,
+            });
+        }
+        return results;
+    }
+    for (const [gate, cmd] of gatesToRun) {
+        if (runStartCommands !== undefined) {
+            const expectedCmd = gate === "test"
+                ? (runStartCommands.tipTest ?? runStartCommands.test)
+                : runStartCommands[gate];
+            if (expectedCmd === undefined || cmd !== expectedCmd) {
+                const artifact = join(runDir, `tip-verify-${gate}.log`);
+                const details = `tip verify command "${cmd}" for gate "${gate}" was not named in run-start row`;
+                writeFileSync(artifact, details + "\n");
+                results.push({
+                    gate,
+                    cmd,
+                    pass: false,
+                    exitCode: 1,
+                    fingerprints: [],
+                    details,
+                    artifact,
+                });
+                continue;
+            }
+        }
+        // Leg-2 T3 M1 (RULING-230-15): the entry is chosen by the RECORDED identity — the same provenance the
+        // command was validated against above — never the current config. After a resume whose config task
+        // command converged on the recorded tip command, the current-config test read "no distinct tip" and
+        // forgave a tip red against the TASK entry. Only standalone verify (no run-start row) has no record.
+        const identity = runStartCommands ?? commands;
+        const hasTipCommand = Boolean(identity.tipTest && identity.tipTest !== identity.test);
+        const entry = gate === "test" && (hasTipCommand || (!identity.test && identity.tipTest))
+            ? baseline?.commands.tipTest
+            : baseline?.commands[gate];
         // OBS-534: the ceiling is the BATTERY's, derived by effectiveCeilingMs from the same baseline entry
         // this loop already reads for forgiveness two lines down — never the flat DEFAULT_SHELL_TIMEOUT_MS
         // `sh` defaults to. A suite whose capture measured 600007ms carries a recorded 1800021ms ceiling;
         // running it under 600000ms here SIGKILLed a green tip three times while every per-task gate passed.
         const ceilingMs = effectiveCeilingMs(entry);
-        const r = await sh(cmd, intWt, ceilingMs);
-        const raw = r.stdout + "\n" + r.stderr;
-        const stripped = raw.split(intWt).join("");
+        let r = await sh(cmd, intWt, ceilingMs);
+        let raw = r.stdout + "\n" + r.stderr;
+        let stripped = raw.split(intWt).join("");
+        let rerun;
+        if (gate === "test" && !r.timedOut && !fileCountDeficit(entry, stripped)
+            && classifyFreshRunnerOutput(entry, stripped, r.code) === "infra") {
+            const waitedMs = await waitForCalmWindow();
+            rerun = `runner-infra rerun after waiting ${waitedMs}ms for a calm load window`;
+            r = await sh(cmd, intWt, ceilingMs);
+            raw = r.stdout + "\n" + r.stderr;
+            stripped = raw.split(intWt).join("");
+        }
         const artifact = join(runDir, `tip-verify-${gate}.log`);
         // Battery parity on the ceiling too (baseline.ts Q24): the kill is read BEFORE the exit code is
         // interpreted at all. A SIGKILLed battery never returned a verdict, so no line of its partial
@@ -76,14 +181,16 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
                 pass: false,
                 exitCode: r.code,
                 fingerprints: [],
-                details: killed.details,
+                details: `${rerun ? `infra; ${rerun}: ` : ""}${killed.details}`,
                 cause: killed.meta?.classification,
                 artifact,
             });
             continue;
         }
         const { failing, unreadable } = freshFailures(entry, stripped);
-        const cause = r.code === 0 ? undefined : classifyFailureOutput(stripped);
+        const deficit = fileCountDeficit(entry, stripped);
+        const cause = deficit ? "infra" : classifyFreshRunnerOutput(entry, stripped, r.code);
+        const greenTeardown = classifyRunnerOutput(stripped, r.code) === "green-teardown";
         // `?? 1` is the battery's own default (baseline.ts compareToBaseline): an exitCode-less legacy
         // entry reads as red-at-baseline there, so it must read the same here or old baselines silently
         // lose forgiveness. OBS-534 (T2): a capture killed at its ceiling now records a CAUSE and no
@@ -106,7 +213,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
         const comparable = sameCapacity(entry?.capacity, r.capacity);
         const forgiven = r.code !== 0 && baselineRed && failing.length === 0 && !unreadable && cause !== "infra"
             && comparable;
-        const pass = r.code === 0 || forgiven;
+        const pass = !deficit && (r.code === 0 || greenTeardown || forgiven);
         if (!pass)
             writeFileSync(artifact, raw);
         results.push({
@@ -114,15 +221,16 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
             cmd,
             pass,
             exitCode: r.code,
-            fingerprints: r.code !== 0 ? fingerprint(stripped) : [],
-            details: r.code === 0 ? "exit 0"
-                : forgiven ? `exit ${r.code} but only baseline-recorded failures (forgiven vs baseline)`
-                    : !comparable && baselineRed && failing.length === 0
-                        ? `exit ${r.code}; every failure is baseline-recorded, but that capture ran under `
-                            + `${describeCapacity(entry?.capacity)} and this verification ran under ${describeCapacity(r.capacity)} `
-                            + `— forgiveness across a changed capacity is not evidence`
-                        : `exit ${r.code}`,
-            ...(forgiven ? { forgiven: true } : {}),
+            fingerprints: r.code !== 0 && !greenTeardown ? fingerprint(stripped) : [],
+            details: `${cause === "infra" ? "infra; " : ""}${rerun ? `${rerun}: ` : ""}` + (deficit?.replace(/^infra; /, "") ?? (r.code === 0 ? "exit 0"
+                : greenTeardown ? `exit ${r.code} after a green suite summary; only the runner's teardown fingerprint followed it`
+                    : forgiven ? `exit ${r.code} but only baseline-recorded failures (forgiven vs baseline)`
+                        : !comparable && baselineRed && failing.length === 0
+                            ? `exit ${r.code}; every failure is baseline-recorded, but that capture ran under `
+                                + `${describeCapacity(entry?.capacity)} and this verification ran under ${describeCapacity(r.capacity)} `
+                                + `— forgiveness across a changed capacity is not evidence`
+                            : `exit ${r.code}`)),
+            ...(forgiven && !deficit ? { forgiven: true } : {}),
             ...(cause ? { cause } : {}),
             ...(pass ? {} : { artifact }),
         });

package/dist/run/operator-state.d.ts

@@ -57,7 +57,7 @@ export declare class OperatorStateFold {
     private tasks;
     private start?;
     private startEvent?;
-    private latestGraphRehash?;
+    private rehashes;
     private end?;
     private active;
     private approved;

package/dist/run/operator-state.js

@@ -10,7 +10,7 @@ export class OperatorStateFold {
     tasks = new Map();
     start;
     startEvent;
-    latestGraphRehash;
+    rehashes = [];
     end;
     active = false;
     approved = false;
@@ -34,7 +34,7 @@ export class OperatorStateFold {
             this.tipFailed = false;
         }
         if (e.event === "graph-rehash")
-            this.latestGraphRehash = { ...e, data: { from: e.data.from, to: e.data.to } };
+            this.rehashes = [...this.rehashes, { ...e, data: { from: e.data.from, to: e.data.to } }];
         if (e.event === "tip-verify-failed" || (e.event === "tip-verify" && e.data.pass === false))
             this.tipFailed = true;
         if (e.event === "run-end") {
@@ -146,13 +146,9 @@ export class OperatorStateFold {
     comparableTo(hash) {
         if (!hash)
             return false;
-        const events = [this.startEvent, this.latestGraphRehash].filter((e) => e !== undefined);
-        const baseline = engagementComparable(events, hash);
-        if (this.latestGraphRehash) {
-            const from = baseline.comparable ? baseline.recorded : baseline.reason === "mismatch" ? baseline.recorded : null;
-            return this.latestGraphRehash.data.to === hash && this.latestGraphRehash.data.from === from;
-        }
-        return baseline.comparable;
+        // The shared comparator audits the rehash chain; the fold keeps only the rows it reads.
+        const events = [this.startEvent, ...this.rehashes].filter((e) => e !== undefined);
+        return engagementComparable(events, hash).comparable;
     }
 }
 /** C1/C6 share this pure reader; callers supply the same observation and journal snapshot. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.5.1",
+  "version": "2.5.3",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-auto/SKILL.md

@@ -92,7 +92,7 @@ After sending, **confirm delivery** by reading the target pane and verifying the
 1. **Prepare** — confirm the target list. Run the [binary preflight](#binary-preflight-before-compile-or-run). Check `git status`, confirm no tickmarkr run is active, and work from a non-main branch.
 2. **Compile** — run `tickmarkr compile <spec-or-directory>`. Fix source-spec defects instead of editing the generated graph.
 3. **Plan** — run `tickmarkr plan`. Review routes, capability-floor warnings, and human gates before execution.
-4. **Run** — run `tickmarkr run`. Watch the run journal for its terminal events rather than polling agents, using the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800` — which takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict` and grades the run-end summary against every green clause for you. Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the relevant agent session.
+4. **Run** — run `tickmarkr run`. A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for the run's terminal events — the shipped watcher below, or a foreground `until grep` on the run's terminal events — and ensure it is re-armed at most every twenty minutes. Never rely on a `Monitor`-only wake. Watch the run journal rather than polling agents, using the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800` — which takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict` and grades the run-end summary against every green clause for you. Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the relevant agent session.
 5. **Verify and consolidate** — continue only after a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", and the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty — a run with a parked task is partial, not green. Tickmarkr consolidates accepted work on `tickmarkr/<runId>` and never signs off to the main branch. A human controls any later release merge.
 6. **Record** — `tickmarkr report <runId> --md` prints Markdown to stdout; redirect explicitly beside the spec (for example `tickmarkr report <runId> --md > feature.record.md`) and commit the execution record when the repository tracks those records.
 7. **Continue** — move to the next requested target. If a target fails or is parked, stop with the journal evidence rather than silently skipping it.

package/skills/tickmarkr-loop/SKILL.md

@@ -88,7 +88,7 @@ When spawning consultants (agents gathering synthesis input for decisions like S
 1. **Prepare** — start from the requested spec. Run the [binary preflight](#binary-preflight-before-compile-or-run). Check `git status`, confirm no tickmarkr run is active, and work from a non-main branch.
 2. **Compile** — run `tickmarkr compile <spec>`. Correct compilation errors in the spec, never in the generated graph.
 3. **Plan** — run `tickmarkr plan`. Review the routing table, capability-floor warnings, and every human gate, including work that each gate blocks.
-4. **Run** — run `tickmarkr run`. Watch the run journal for its terminal events rather than polling agents, using the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800` — which takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict` and grades the run-end summary against every green clause for you. Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the agent session; do not turn them into proxy questions.
+4. **Run** — run `tickmarkr run`. A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for the run's terminal events — the shipped watcher below, or a foreground `until grep` on the run's terminal events — and ensure it is re-armed at most every twenty minutes. Never rely on a `Monitor`-only wake. Watch the run journal rather than polling agents, using the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800` — which takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict` and grades the run-end summary against every green clause for you. Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the agent session; do not turn them into proxy questions.
 5. **Verify and consolidate** — accept only a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", and the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty — a run with a parked task is partial, not green. Tickmarkr consolidates accepted task work on `tickmarkr/<runId>`; it never signs off to the main branch. A human may later merge that integration branch through the repository's normal release process.
 6. **Record** — `tickmarkr report <runId> --md` prints Markdown to stdout. Redirect it explicitly beside the source spec (for example `tickmarkr report <runId> --md > feature.record.md`) and commit the execution record when the repository tracks those records. Then [stand down](#stand-down-mission-end-and-retirement).
 

package/skills/tickmarkr-overseer/SKILL.md

@@ -149,6 +149,14 @@ through brief lineage. **An executor choice nobody made is still an executor cho
    guidance belongs in the memory file or the shipped docs.
 4. Arm the watcher and your own supervision beat (Supervision). Report the hierarchy map (pane ids + names) to the user.
 
+### Seat-spawn and Leg-2 recipes
+
+Every mission to a Claude or Grok seat is delivered only with `herdr pane run <pane> "<message>"` and
+verified by reading the pane back; never use `agent prompt` for mission delivery. Launch a Grok seat with
+`herdr agent start <seat> --kind grok --pane <pane> -- -m grok-4.6`. For Leg-2, a Codex reviewer under
+`workspace-write` must be briefed with an in-worktree verdict path such as
+`<repo>/.tickmarkr/overseer/verdicts/<task>.md`, and its verdict must be written there before it is read.
+
 ## Supervising tickmarkr as the executor — WHO DOES WHAT
 
 When the mission runs `/tickmarkr-auto` (tickmarkr dispatches the workers), supervision changes shape —
@@ -204,6 +212,9 @@ journal tail to decide what happens next, or sweeping orphans — you have taken
 - **The journal is the source of truth**, not panes. Watchers go on `run-end` / `task-human` /
   `task-failed` / `consult-verdict`; never sleep-poll inside an agent turn. **Never key a watcher on an
   agent's `done`** — that is turn end and fires the moment a seat finishes acknowledging you.
+  A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for those terminal
+  events — the shipped watcher below, or a foreground `until grep` on the run's terminal events — and
+  ensure it is re-armed at most every twenty minutes. Never rely on a `Monitor`-only wake.
   **All four are covered by one shipped instrument** — `scripts/watch-journal.sh <runs-dir> [poll] [cap]
   [events-csv]` — which arms on a line baseline, wakes once, and grades a `run-end` against every green
   clause. `scripts/watch-parks.sh` stays the park-specific wake for THIS seat (it counts parks and speaks
@@ -476,6 +487,52 @@ number — an unmeasured budget is not a small budget.
 .claude/skills/tickmarkr-overseer/scripts/watch-context.sh overseer <overseer-agent-or-pane> 50 50 <handoff-file>
 ```
 
+### A GO has a deadline — arm `watch-launch.sh` in the same act as the GO
+
+A GO that produces no run is a silent failure until someone notices; on 2026-09-11 an orchestrator's codex
+sandbox was rooted at the main repo, the spec worktree was outside its writable roots, it stopped at the
+denial without reporting, the overseer's 10-minute wake expired un-re-armed, and three hours passed.
+Two rules close that hole:
+
+- **Every orchestrator seat is sandbox-rooted at the worktree it will run in** (`cd <worktree>` before
+  `herdr agent start … --sandbox workspace-write`), and its brief says: *a denied path or refused command
+  is reported to the overseer pane within 60 s — never a silent stop.*
+- **The overseer arms the launch watcher in the SAME act as the GO**, with the lock path the run will
+  create, and treats `LAUNCH_OVERDUE` as a first-class event (read the orchestrator pane, fix the seat,
+  re-issue the GO):
+
+```bash
+.claude/skills/tickmarkr-overseer/scripts/watch-launch.sh <worktree>/.tickmarkr/graph.lock 900 <overseer-pane> &
+```
+
+It prints `LAUNCH_OK` with the lock's contents when the run starts (exit 0) and, past the deadline, delivers
+`LAUNCH OVERDUE …` to the overseer pane AND as an OS notification (exit 3). Any wake you arm yourself with
+a cap (a background `until` loop) must be RE-ARMED on every expiry; an expired wake is not a watch.
+
+
+### A GO has a deadline — arm `watch-launch.sh` in the same act as the GO
+
+A GO that produces no run is a silent failure until someone notices; on 2026-09-11 an orchestrator's codex
+sandbox was rooted at the main repo, the spec worktree was outside its writable roots, it stopped at the
+denial without reporting, the overseer's 10-minute wake expired un-re-armed, and three hours passed.
+Two rules close that hole:
+
+- **Every orchestrator seat is sandbox-rooted at the worktree it will run in** (`cd <worktree>` before
+  `herdr agent start … --sandbox workspace-write`), and its brief says: *a denied path or refused command
+  is reported to the overseer pane within 60 s — never a silent stop.*
+- **The overseer arms the launch watcher in the SAME act as the GO**, with the lock path the run will
+  create, and treats `LAUNCH_OVERDUE` as a first-class event (read the orchestrator pane, fix the seat,
+  re-issue the GO):
+
+```bash
+.claude/skills/tickmarkr-overseer/scripts/watch-launch.sh <worktree>/.tickmarkr/graph.lock 900 <overseer-pane> &
+```
+
+It prints `LAUNCH_OK` with the lock's contents when the run starts (exit 0) and, past the deadline, delivers
+`LAUNCH OVERDUE …` to the overseer pane AND as an OS notification (exit 3). Any wake you arm yourself with
+a cap (a background `until` loop) must be RE-ARMED on every expiry; an expired wake is not a watch.
+
+
 The first argument chooses the closed per-seat tier (`orchestrator-context` or `overseer-context`),
 and every beat names the second argument as that tier's seat. The watcher beats only after reading a
 rendered percentage, keeps beating on the supervision cadence even when its requested poll is slower,
@@ -580,9 +637,9 @@ they are left implicit:
   Send only when the seat is idle and the ANSI prompt line is empty or dim-only (the Esc/SGR discriminator
   separates an autosuggest ghost from typed input), then read back activity or an ACK; presence is not
   delivery. If a stale draft must be replaced, supersede it explicitly with
-  `agent prompt " <-- disregard … ACTUAL: …"` instead of stacking another instruction behind it.
+  `herdr pane run <pane> "<-- disregard … ACTUAL: …"` instead of stacking another instruction behind it.
 - **A MESSAGE TO A WORKING SEAT IS A QUEUED MESSAGE, AND THE QUEUE DRAINS ONLY AT TURN BOUNDARIES.**
-  Delivery is not arrival: `agent prompt` to a `working` claude seat lands in its queue (`Press up to
+  Delivery is not arrival: a message sent to a `working` claude seat lands in its queue (`Press up to
   edit queued messages` on the seat's prompt line is the tell) and is READ only when the current turn
   ends — and with in-process teammates a turn runs 20–40 minutes, so steering latency equals subagent
   runtime. Measured 2026-08-17/18 (P98 leg 1): a FREEZE HOLD and a checker-release directive stacked
@@ -622,7 +679,7 @@ they are left implicit:
 - **AGENT NAMES ARE GLOBAL ACROSS WORKSPACES — verify a seat you spawned by PANE ID, never by name.**
   Names must be unique among live agents *everywhere*, not within your workspace, so another workspace can
   already hold `opus`, `sol`, `reviewer` or `orch`. When it does, your `agent start` **fails**, your pane
-  is left a bare shell, and `agent list` / `agent read` / `agent prompt` for that name then resolve to the
+  is left a bare shell, and `agent list` / `agent read` for that name then resolve to the
   **stranger's seat**. Measured 2026-08-06 (OBS-392): a spawn of `fable` collided with a live seat in
   another workspace; `agent list` reported `fable -> blocked` and it was read as *this* seat coming up
   blocked. It was an operator research session sitting on a *"Resume full session?"* prompt. One more
@@ -644,7 +701,7 @@ they are left implicit:
   Re-arm name-keyed watchers in the same act as the rename; file-keyed artifact watchers are
   unaffected (one more reason to prefer them).
 - Stale typed input is unclearable via CLI — supersede it:
-  `pane run "<-- disregard everything before this arrow (stale draft). ACTUAL: <message>"`.
+  `herdr pane run <pane> "<-- disregard everything before this arrow (stale draft). ACTUAL: <message>"`.
   **But DISCRIMINATE before you supersede or file it: text on an idle seat's prompt line has FOUR
   authors** — the seat's own draft, an operator, another agent's `agent send` (writes WITHOUT Enter),
   and claude-code's AUTOSUGGEST, which renders context-plausible ghost text BYTE-IDENTICAL to a typed

package/skills/tickmarkr-overseer/scripts/watch-context.sh

@@ -220,17 +220,20 @@ banner_pct() {
       stripped = bare; gsub(rule, "", stripped)
       if (bare != "" && stripped == "") last = NR }
     END { labelled = 0
-          for (i = 1; i <= NR; i++) if (line[i] ~ /Context [0-9]+% used/) { print line[i]; labelled = 1 }
+          for (i = 1; i <= NR; i++) if (line[i] ~ /Context [0-9]+% used/ || line[i] ~ /ctx [0-9]+%/) { print line[i]; labelled = 1 }
           if (!labelled && last) for (i = last + 1; i <= NR; i++) if (line[i] ~ /[0-9]+%/) print line[i] }
   ' | tail -1)
   # No rule line in the window, or no percentage below it: say so out loud rather than guess.
   [ -n "$banner" ] || { printf 'UNREADABLE\n'; return 0; }
+  # OBS-964 add.6: a claude-code statusline plugin (Graft) can replace the model row with a self-labelled
+  # `ctx N%` row; the label IS the selector, so no model name is required on that row.
+  printf '%s\n' "$banner" | grep -Eq 'ctx [0-9]+%' ||
   printf '%s\n' "$banner" |
     grep -Eqi '(^|[^[:alnum:]])(claude|opus|sonnet|haiku|fable|gpt|gemini|glm|kimi|grok|composer|openai|zai)[[:alnum:]_./-]*([[:space:]]|$)' ||
     { printf 'UNREADABLE\n'; return 0; }
   # OBS-964: a codex banner carries TWO percentages ("Context 16% used · weekly 96% left"); the LAST one is the
   # quota, not the fill. Prefer the labelled context figure; fall back to the last bare % (claude-code banner).
-  pct=$(printf '%s\n' "$banner" | grep -oE 'Context [0-9]+% used' | grep -oE '[0-9]+' | head -1)
+  pct=$(printf '%s\n' "$banner" | grep -oE '(Context [0-9]+% used|ctx [0-9]+%)' | grep -oE '[0-9]+' | head -1)
   # OBS-964 add.3: a codex footer while WORKING drops the labelled figure but keeps `weekly N% left`; strip the
   # quota phrase before the bare-% fallback so a quota can never be read as fill.
   [ -n "$pct" ] || pct=$(printf '%s\n' "$banner" | sed -E 's/weekly [0-9]+% left//g' | grep -oE '[0-9]+%' | tail -1 | tr -d '%')

package/skills/tickmarkr-overseer/scripts/watch-launch.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# watch-launch.sh — a GO that produced no run is a silent failure until someone notices. This watcher
+# notices. Arm it in the SAME act as the GO (orchestrator briefed to compile → plan → run) and it waits
+# for the run's lock; when the lock has not appeared by the deadline it delivers LAUNCH OVERDUE to the
+# overseer's pane AND as an OS notification, so the wake reaches a seat instead of a log nobody reads.
+#
+# Why it exists (2026-09-11): an orchestrator's codex sandbox was rooted at the main repo, the spec
+# worktree was outside its writable roots, it stopped at the denial without reporting, and the overseer's
+# own 10-minute wake expired un-re-armed. Three hours passed before anyone looked. A launch has a
+# deadline; silence past it is the event.
+#
+# usage: watch-launch.sh <lock-path> <deadline-s> <overseer-pane> [poll-s]
+#   <lock-path>      the run's .tickmarkr/graph.lock in the worktree the run will be launched in
+#   <deadline-s>     seconds from now by which the lock must exist (a compile+plan+launch takes minutes,
+#                    never hours; 900 is a generous default for a 7-task spec)
+#   <overseer-pane>  the pane that must hear about it (herdr pane id), e.g. wZ:p18S
+#   [poll-s]         poll interval, default 15
+# exit 0 LAUNCH_OK (lock seen; prints its contents) · exit 3 LAUNCH_OVERDUE (delivered) · exit 64 usage
+set -u
+LOCK="${1:-}"; DEADLINE="${2:-}"; PANE="${3:-}"; POLL="${4:-15}"
+[ -n "$LOCK" ] && [ -n "$DEADLINE" ] && [ -n "$PANE" ] || { echo "usage: watch-launch.sh <lock-path> <deadline-s> <overseer-pane> [poll-s]" >&2; exit 64; }
+start=$(date +%s)
+while :; do
+  if [ -f "$LOCK" ]; then
+    printf 'LAUNCH_OK %s %s\n' "$(date -u +%H:%M:%SZ)" "$(cat "$LOCK" 2>/dev/null | tr -d '\n')"
+    exit 0
+  fi
+  now=$(date +%s)
+  if [ $((now - start)) -ge "$DEADLINE" ]; then
+    msg="LAUNCH OVERDUE $(date -u +%H:%M:%SZ): no lock at $LOCK after ${DEADLINE}s — read the orchestrator pane NOW (sandbox denial? preflight refusal? unsubmitted GO?)"
+    echo "LAUNCH_OVERDUE $msg"
+    # Both deliveries, always: a pane the overseer reads AND a notification the operator sees.
+    herdr pane run "$PANE" "$msg" >/dev/null 2>&1 || echo "  (pane delivery failed — the notification is the only path)"
+    herdr notification show "$msg" >/dev/null 2>&1 || true
+    exit 3
+  fi
+  sleep "$POLL"
+done