tickmarkr 2.5.6 → 2.5.7

package/dist/tui/cockpit/run-view.d.ts

@@ -83,6 +83,43 @@ export declare function applyRunViewKey(session: RunViewSession, event: RunViewK
  * a closed run whose record lacks a bucket says so rather than reading absence as empty.
  */
 export declare function runSummaryLine(s: OperatorSnapshot): string;
+/** One projected reading and the physical journal line it came from; no line means no row says it. */
+export interface ProjectionField {
+    readonly label: string;
+    readonly line?: number;
+}
+export interface TaskProjection {
+    readonly taskId: string;
+    readonly identity: ProjectionField;
+    readonly phase: ProjectionField;
+    readonly build: ProjectionField;
+    readonly blocker: ProjectionField;
+    readonly nextAction: ProjectionField;
+    /** OBS-1048: present only when the newest launched attempt has failed nudges, pages and no worker-result. */
+    readonly stalled?: ProjectionField;
+}
+export declare const STALL_MARKER = "\u26A0 stalled harvest suspected";
+/**
+ * The evidence-only projection status renders (run/activity.ts, run/operator-summary.ts), folded
+ * over the journal rows this view was handed, with the physical line each reading was taken from.
+ * Nothing is inferred from a title, a provider or a task id: an unrecorded field says so.
+ */
+export declare function projectRunTasks(snapshot: OperatorSnapshot, rows: readonly RunEvidenceRow[], graph: RunGraph | undefined, decisions: readonly RunDecision[], runId: string): readonly TaskProjection[];
+/** One wrapped line per task: every field with its line, and the stall marker when the harvest is suspect. */
+export declare const projectionLine: (p: TaskProjection) => string;
+export interface PaneLocator {
+    readonly status: "recorded" | "unavailable";
+    readonly reason: string;
+    /** The worker-launch row the reading stands on, when one exists. */
+    readonly line?: number;
+}
+/**
+ * Where the current attempt's pane is recorded — and only that. The reading is exact-name: the
+ * launch row's slot name must be the owned name of THIS task, attempt and run. No terminal is ever
+ * chosen by title, provider or task id; a missing, foreign, stale or ambiguous record reads
+ * unavailable with the rows it was read from, and reading never touches a host.
+ */
+export declare function paneLocator(task: OperatorTask, rows: readonly RunEvidenceRow[], runId: string): PaneLocator;
 /** The board's footer keys merged with the cockpit's own — every one of them handled by this view or the shell. */
 export declare const RUN_VIEW_KEYS: readonly string[];
 export interface RunViewProps {

package/dist/tui/cockpit/run-view.js

@@ -2,7 +2,11 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 import { Box } from "ink";
 import { useContext } from "react";
 import { GLYPHS } from "../../brand.js";
+import { formatOwnedName, parseOwnedName } from "../../drivers/types.js";
 import { GATE_NAMES } from "../../graph/schema.js";
+import { projectActivity } from "../../run/activity.js";
+import { projectOperatorSummary } from "../../run/operator-summary.js";
+import { trackJournalRows } from "../../run/protocol.js";
 import { normalizeGateOutcome } from "../../run/outcome.js";
 import { BOARD_KEYS, boardFooter, clipBoard, renderBoardLines } from "./board.js";
 import { BodyText, Panel, ShellTheme } from "./components.js";
@@ -172,6 +176,185 @@ export function runSummaryLine(s) {
 }
 const attemptLabel = (t) => (t.attempt !== undefined ? `attempt ${t.attempt}` : t.dispatches === 0 ? "never dispatched" : "attempt unknown");
 const parkOf = (t) => (t.state === "human" ? `human · ${t.parkKind ?? "unknown kind"}` : t.state);
+export const STALL_MARKER = "⚠ stalled harvest suspected";
+const ordinal = (v) => (typeof v === "number" && Number.isInteger(v) && v >= 0 ? v : undefined);
+const slotNameOf = (data) => {
+    const slot = data.slot;
+    return str(data.slotName) ?? (typeof slot === "object" && slot !== null ? str(slot.name) : str(slot));
+};
+const NO_ROW = "no journal row";
+const readLabel = (f) => `${f.label} ${f.line === undefined ? `(${NO_ROW})` : `#L${f.line}`}`;
+/**
+ * The evidence-only projection status renders (run/activity.ts, run/operator-summary.ts), folded
+ * over the journal rows this view was handed, with the physical line each reading was taken from.
+ * Nothing is inferred from a title, a provider or a task id: an unrecorded field says so.
+ */
+export function projectRunTasks(snapshot, rows, graph, decisions, runId) {
+    const ordered = [...rows].filter((r) => r.event !== undefined).sort((a, b) => a.line - b.line);
+    const graphTask = (id) => graph?.tasks.find((t) => t.id === id);
+    const activityTasks = snapshot.tasks.map((t) => ({ id: t.id, gates: graphTask(t.id)?.gates ?? [...GATE_NAMES], deps: graphTask(t.id)?.deps ?? [], status: t.state }));
+    const tracked = trackJournalRows(runId, ordered.map((r) => ({ raw: r.event, sourceIndex: r.line })));
+    const activity = projectActivity(runId, tracked, activityTasks);
+    const byTask = (id) => ordered.filter((r) => r.event?.taskId === id);
+    const summaries = new Map(projectOperatorSummary(snapshot.tasks.map((t) => {
+        const own = byTask(t.id);
+        const responsibility = [...own].reverse().find((r) => str(r.event.data.role) !== undefined || str(r.event.data.agent) !== undefined);
+        // The summary's own vocabulary (derive.ts reads the graph status for an unmentioned task): a task the
+        // operator fold holds as blocked, or a graph task the journal never mentions, is pending on its prerequisites.
+        const status = t.state === "blocked" || (t.state === "unknown" && graphTask(t.id) !== undefined) ? "pending" : t.state;
+        return {
+            id: t.id, status, deps: graphTask(t.id)?.deps ?? [],
+            ...(own.length === 0 ? {} : { phase: activity.get(t.id)?.state, lastEvidenceAt: own.at(-1).event.ts }),
+            ...(responsibility ? { responsible: { role: str(responsibility.event.data.role), agent: str(responsibility.event.data.agent) } } : {}),
+        };
+    }), decisions.map((d) => ({ taskId: d.taskId, park: { kind: d.park.kind, tombstone: d.park.tombstone, ...(d.park.reason === undefined ? {} : { reason: d.park.reason }) }, verbs: d.verbs, ...(d.diagnostic === undefined ? {} : { diagnostic: d.diagnostic }) }))).map((s) => [s.taskId, s]));
+    return snapshot.tasks.map((t) => {
+        const own = byTask(t.id);
+        const act = activity.get(t.id);
+        const summary = summaries.get(t.id);
+        // identity: the newest row that recorded a role, an agent, an owned slot name or a dispatch assignment
+        const identityRow = [...own].reverse().find((r) => { const d = r.event.data; if (act?.attempt !== undefined && ordinal(d.attempt) !== undefined && ordinal(d.attempt) !== act.attempt)
+            return false; return str(d.role) !== undefined || str(d.agent) !== undefined || slotNameOf(d) !== undefined || (r.event.event === "task-dispatch" && d.assignment !== undefined); });
+        let identity = { label: "identity unrecorded" };
+        if (identityRow) {
+            const d = identityRow.event.data;
+            const name = slotNameOf(d);
+            const owned = name === undefined ? null : parseOwnedName(name);
+            const role = str(d.role) ?? owned?.role ?? (identityRow.event.event === "worker-launch" ? "worker" : "role unrecorded");
+            const a = d.assignment;
+            const agent = str(d.agent) ?? name ?? (typeof a?.adapter === "string" && typeof a.model === "string" ? `${a.adapter}:${a.model}` : "agent unrecorded");
+            identity = { label: `${role} ${agent}`, line: identityRow.line };
+        }
+        // Finding 2: the reference is the row whose acceptance CHANGED the projected value — a rejected
+        // receipt or a delayed old-attempt result changes nothing and so is never cited. The task's rows
+        // and the run-level resets are re-folded prefix by prefix through projectActivity itself.
+        // ponytail: O(k²) in the task's own rows; memoize the fold if journals reach thousands of rows per task.
+        const changes = acceptedChanges(runId, tracked, t.id, activityTasks.find((a) => a.id === t.id));
+        const phase = { label: `phase ${summary?.phase ?? act?.state ?? "unrecorded"}`, ...(own.length > 0 && changes.state !== undefined ? { line: changes.state } : {}) };
+        const b = act?.build;
+        const receipt = b !== undefined && "receipt" in b ? b.receipt : undefined;
+        const build = { label: `build ${b?.state ?? "start-unrecorded"}${receipt ? ` exit ${receipt.exitCode ?? "-"}` : ""}`, ...(changes.build !== undefined ? { line: changes.build } : {}) };
+        const decision = decisions.find((d) => d.taskId === t.id);
+        const blockerRow = decision ? { line: decision.park.line } : [...own].reverse().find((r) => r.event.event === "task-human" || r.event.event === "task-failed");
+        const blk = summary?.blocker;
+        const blocker = { label: `blocker ${blk ? `${blk.kind}${blk.diagnostic ? ` · ${blk.diagnostic}` : ""}` : "none"}`, ...(blk && blockerRow ? { line: blockerRow.line } : {}) };
+        const nextAction = { label: `next ${blk?.nextAction ?? "none"}`, ...(blk?.nextAction && blockerRow ? { line: blockerRow.line } : {}) };
+        // OBS-1048 harvest, chronological: the newest worker-launch opens the attempt; a later worker-result retires it.
+        let launched, launchedAttempt, returned = false;
+        const nudges = [], pages = [];
+        // Finding 1: only rows of the launched attempt count; a row without an attempt belongs to it (derive.ts attemptHarvests).
+        const ofLaunched = (d) => launched !== undefined && (ordinal(d.attempt) ?? launchedAttempt) === launchedAttempt;
+        for (const r of own) {
+            const e = r.event;
+            switch (e.event) {
+                case "worker-launch":
+                    launched = r.line;
+                    launchedAttempt = ordinal(e.data.attempt);
+                    returned = false;
+                    nudges.length = 0;
+                    pages.length = 0;
+                    break;
+                case "worker-nudge-failed":
+                    if (ofLaunched(e.data))
+                        nudges.push(r.line);
+                    break;
+                case "operator-page":
+                    if (ofLaunched(e.data))
+                        pages.push(r.line);
+                    break;
+                case "worker-result":
+                    if (ofLaunched(e.data))
+                        returned = true;
+                    break;
+            }
+        }
+        const stalled = launched !== undefined && !returned && nudges.length > 0 && pages.length > 0
+            ? { label: `${STALL_MARKER} · launch #L${launched} · nudge failed ${nudges.map((l) => `#L${l}`).join(",")} · paged ${pages.map((l) => `#L${l}`).join(",")} · no worker-result`, line: launched }
+            : undefined;
+        return { taskId: t.id, identity, phase, build, blocker, nextAction, ...(stalled ? { stalled } : {}) };
+    });
+}
+/** The line at which each projected value last changed, folding the task's rows (and run-level resets) prefix by prefix. */
+function acceptedChanges(runId, tracked, taskId, task) {
+    const rows = tracked.filter((r) => { const raw = r.raw; return raw.taskId === taskId || (raw.taskId === undefined && (raw.event === "run-resume" || raw.event === "run-end")); });
+    const buildKey = (p) => `${p.build.state}|${"receipt" in p.build ? `${p.build.receipt.attribution.invocation}|${p.build.receipt.exitCode ?? ""}` : ""}`;
+    // Seeded from the empty fold: the initial reading is no row's doing, so only a change is cited.
+    const initial = projectActivity(runId, [], [task]).get(taskId);
+    let state = initial?.state, build = initial === undefined ? undefined : buildKey(initial);
+    const out = {};
+    for (let i = 0; i < rows.length; i++) {
+        const p = projectActivity(runId, rows.slice(0, i + 1), [task]).get(taskId);
+        if (!p)
+            continue;
+        const line = rows[i].sourceIndex;
+        if (p.state !== state) {
+            state = p.state;
+            out.state = line;
+        }
+        if (buildKey(p) !== build) {
+            build = buildKey(p);
+            out.build = line;
+        }
+    }
+    return out;
+}
+/** One wrapped line per task: every field with its line, and the stall marker when the harvest is suspect. */
+export const projectionLine = (p) => [p.taskId, readLabel(p.identity), readLabel(p.phase), readLabel(p.build), readLabel(p.blocker), readLabel(p.nextAction), ...(p.stalled ? [p.stalled.label] : [])].join(" · ");
+/**
+ * Where the current attempt's pane is recorded — and only that. The reading is exact-name: the
+ * launch row's slot name must be the owned name of THIS task, attempt and run. No terminal is ever
+ * chosen by title, provider or task id; a missing, foreign, stale or ambiguous record reads
+ * unavailable with the rows it was read from, and reading never touches a host.
+ */
+export function paneLocator(task, rows, runId) {
+    const ordered = [...rows].filter((r) => r.event !== undefined).sort((a, b) => a.line - b.line);
+    // The dispatch-recorded pane field stays reachable beside every reading, with the row it stands on.
+    const recorded = task.pane === undefined ? "" : ` · recorded pane ${task.pane}${task.evidence ? ` · evidence #L${task.evidence.line}` : ""}`;
+    if (task.attempt === undefined)
+        return { status: "unavailable", reason: `no recorded attempt${recorded}` };
+    const launches = ordered.filter((r) => r.event.event === "worker-launch" && r.event.taskId === task.id && ordinal(r.event.data.attempt) === task.attempt);
+    if (launches.length === 0)
+        return { status: "unavailable", reason: `no worker-launch for attempt ${task.attempt}${recorded}` };
+    const ids = new Set(launches.map((r) => { const s = r.event.data.slot; return str(s?.id) ?? `#L${r.line}`; }));
+    if (ids.size > 1)
+        return { status: "unavailable", reason: `ambiguous: ${launches.length} launches ${launches.map((r) => `#L${r.line}`).join(",")}${recorded}` };
+    const launch = launches.at(-1);
+    const d = launch.event.data;
+    const slot = d.slot;
+    const expected = formatOwnedName({ role: "worker", taskId: task.id, attempt: task.attempt, runId });
+    if (str(d.driver) === undefined || str(slot?.id) === undefined || str(slot?.cwd) === undefined)
+        return { status: "unavailable", reason: `launch #L${launch.line} lacks driver or slot identity${recorded}`, line: launch.line };
+    if (slot?.name !== expected)
+        return { status: "unavailable", reason: `launch #L${launch.line} names ${slotNameOf(d) ?? "no pane"}, not this attempt's owned pane${recorded}`, line: launch.line };
+    // Finding 3: only a host whose focus capability VERIFIES the recorded identity can ever confirm it —
+    // herdr needs the launch's workspace (HerdrDriver.focus rejects a target without one), orca verifies
+    // ownership but cannot focus, subprocess and unknown drivers verify nothing. Reading asks no host.
+    const driver = String(d.driver);
+    if (driver === "herdr" && str(d.workspace) === undefined)
+        return { status: "unavailable", reason: `launch #L${launch.line} records no workspace; herdr cannot verify the pane${recorded}`, line: launch.line };
+    if (driver !== "herdr" && driver !== "orca")
+        return { status: "unavailable", reason: `launch #L${launch.line} driver ${driver} cannot verify a pane${recorded}`, line: launch.line };
+    const stale = ordered.find((r) => {
+        if (r.line <= launch.line)
+            return false;
+        const event = r.event;
+        if (event.event === "run-resume" || event.event === "run-end")
+            return true;
+        if (event.taskId !== task.id)
+            return false;
+        if (event.event === "worker-result")
+            return (ordinal(event.data.attempt) ?? task.attempt) === task.attempt;
+        if (event.event === "pane-close")
+            return str(event.data.paneId) === str(slot?.id);
+        return event.event === "merge";
+    });
+    if (stale)
+        return { status: "unavailable", reason: `launch #L${launch.line} is stale: ${stale.event.event} #L${stale.line} followed it${recorded}`, line: launch.line };
+    // A journal launch is evidence of what was opened, not a live-host observation. This pure read
+    // deliberately performs no focus/list operation, so it cannot upgrade the locator to recorded:
+    // the pane may have been closed outside the journal. The explicit `o` action owns verification.
+    return { status: "unavailable", reason: `launch #L${launch.line} records ${driver} ${String(slot.id)}, but live host verification is required${recorded}`, line: launch.line };
+}
 /** The board's footer keys merged with the cockpit's own — every one of them handled by this view or the shell. */
 export const RUN_VIEW_KEYS = [...BOARD_KEYS.slice(0, 2), "←→ verdict gate", "PgUp/PgDn page", "x outcome", "a actions", "o pane", "Tab focus", "? keys", BOARD_KEYS[2]];
 /** The Run body: the approved board (BD-1) over the fold, then the selected task's detail panels. */
@@ -182,6 +365,10 @@ export function RunView({ snapshot, rows, page, graph, decisions, session, colum
     const fit = (text) => fitCells(text, inner);
     const decisionLines = (lines) => lines.flatMap((line) => wrapCells(line, inner));
     const lookup = evidenceLookup(rows, page);
+    const wrap = (text) => wrapCells(text, inner);
+    // The whole journal, not the retained tail: the projection and the locator read every row.
+    const allRows = lookup.later(0);
+    const projections = projectRunTasks(snapshot, allRows, graph, decisions, run.runId);
     const tasks = snapshot.tasks;
     const selection = Math.min(session.selection, Math.max(0, tasks.length - 1));
     const task = tasks[selection];
@@ -195,9 +382,9 @@ export function RunView({ snapshot, rows, page, graph, decisions, session, colum
     const { menu, confirming, receipt, notice } = session.decisions;
     const blocked = task === undefined ? [] : graph?.tasks.filter((g) => g.deps.includes(task.id)).map((g) => g.id) ?? decision?.blocks ?? [];
     const board = renderBoardLines({ runId: run.runId, snapshot, graph, now: now(), live: run.live, selection: task?.id, keys: false, colour }, width);
-    return (_jsxs(Box, { flexDirection: "column", width: columns, children: [_jsx(BodyText, { emphasis: "dim", children: fitCells(`RUN / ${snapshot.lifecycle} · ${runSummaryLine(snapshot)}`, width) }), board.map((line, i) => _jsx(BodyText, { children: line || " " }, `${i}:${line}`)), tasks.length === 0 && _jsx(BodyText, { children: fitCells("no tasks recorded — no plan", width) }), task !== undefined && (_jsxs(Panel, { title: `SELECTED / ${task.id}${task.title ? ` · ${task.title}` : ""}`, children: [_jsx(BodyText, { children: fit(`state ${parkOf(task)} · ${attemptLabel(task)} · dispatches ${task.dispatches} · path ${task.path ?? "unknown"} · pane ${task.pane ?? "unknown"} · alarm ${task.alarmMs === undefined ? "unknown" : `${task.alarmMs}ms`}${task.mergeEvidence ? ` · merged #L${task.mergeEvidence.line}` : ""}`) }), _jsx(BodyText, { emphasis: "dim", children: fit(`outcome filter ${session.outcomeFilter} (x cycles) · ${shown.length} of ${cells.length} gates shown`) }), shown.map((c) => (_jsx(BodyText, { children: fit(`${c.letter} ${c.gate.padEnd(10)} ${c.labels.join(" · ")}${c.line === undefined ? "" : ` · #L${c.line}`}`) }, c.gate)))] })), verdictCell !== undefined && (_jsxs(Panel, { title: `VERDICT / ${verdictCell.gate}${verdictCell.line === undefined ? "" : ` #L${verdictCell.line}`} · ${verdict.length === 0 ? "no verdict text" : `lines ${from + 1}–${from + window.length} of ${verdict.length}`}`, children: [window.map((line, i) => _jsx(BodyText, { children: fit(`${String(from + i + 1).padStart(4)} ${line}`) }, `${from + i}:${line}`)), _jsx(BodyText, { emphasis: "dim", children: fit("←→ gate · PageUp/PageDown page") })] })), task?.state === "human" && (_jsx(Panel, { title: `PARK / ${task.id}`, children: decision === undefined
+    return (_jsxs(Box, { flexDirection: "column", width: columns, children: [_jsx(BodyText, { emphasis: "dim", children: fitCells(`RUN / ${snapshot.lifecycle} · ${runSummaryLine(snapshot)}`, width) }), board.map((line, i) => _jsx(BodyText, { children: line || " " }, `${i}:${line}`)), tasks.length === 0 && _jsx(BodyText, { children: fitCells("no tasks recorded — no plan", width) }), task !== undefined && (_jsxs(Panel, { title: `SELECTED / ${task.id}${task.title ? ` · ${task.title}` : ""}`, children: [wrap(`state ${parkOf(task)} · ${attemptLabel(task)} · dispatches ${task.dispatches} · path ${task.path ?? "unknown"} · pane ${task.pane ?? "unknown"} · alarm ${task.alarmMs === undefined ? "unknown" : `${task.alarmMs}ms`}${task.mergeEvidence ? ` · merged #L${task.mergeEvidence.line}` : ""} · locator ${(() => { const l = paneLocator(task, allRows, run.runId); return l.status === "recorded" ? `recorded ${l.reason}` : `unavailable — ${l.reason}`; })()}`).map((line, i) => _jsx(BodyText, { children: line }, `${i}:${line}`)), _jsx(BodyText, { emphasis: "dim", children: fit(`outcome filter ${session.outcomeFilter} (x cycles) · ${shown.length} of ${cells.length} gates shown`) }), shown.map((c) => (_jsx(BodyText, { children: fit(`${c.letter} ${c.gate.padEnd(10)} ${c.labels.join(" · ")}${c.line === undefined ? "" : ` · #L${c.line}`}`) }, c.gate)))] })), projections.length > 0 && (_jsx(Panel, { title: "PROJECTION / every task \u00B7 identity \u00B7 phase \u00B7 build \u00B7 blocker \u00B7 next action, each with its journal line", children: projections.flatMap((p) => wrap(projectionLine(p)).map((line, i) => _jsx(BodyText, { emphasis: p.stalled && i === 0 ? "strong" : "normal", children: line }, `${p.taskId}:${i}`))) })), verdictCell !== undefined && (_jsxs(Panel, { title: `VERDICT / ${verdictCell.gate}${verdictCell.line === undefined ? "" : ` #L${verdictCell.line}`} · ${verdict.length === 0 ? "no verdict text" : `lines ${from + 1}–${from + window.length} of ${verdict.length}`}`, children: [window.map((line, i) => _jsx(BodyText, { children: fit(`${String(from + i + 1).padStart(4)} ${line}`) }, `${from + i}:${line}`)), _jsx(BodyText, { emphasis: "dim", children: fit("←→ gate · PageUp/PageDown page") })] })), task?.state === "human" && (_jsx(Panel, { title: `PARK / ${task.id}`, children: decision === undefined
                     ? _jsx(BodyText, { children: fit("park evidence unavailable — refresh before deciding") })
-                    : (_jsxs(_Fragment, { children: [_jsx(BodyText, { children: fit(`#L${decision.park.line} ${decision.park.kind ?? "unknown kind"}${decision.park.failedGate ? ` · failed gate ${decision.park.failedGate}` : ""} · ${decision.park.reason ?? "no reason recorded"}`) }), _jsx(BodyText, { children: fit(`blocks ${blocked.length === 0 ? "nothing" : blocked.join(", ")} · attempts ${decision.attempts}`) }), _jsx(BodyText, { children: fit(decision.verbs.length === 0 ? `diagnostic: ${decision.diagnostic ?? "no verb"}` : `decisions: ${decision.verbs.join(" · ")} (a Actions)`) }), _jsx(BodyText, { emphasis: "dim", children: fit(run.live ? "matching live daemon enacts a release at its next task boundary" : run.blockingRunId ? `other live run ${run.blockingRunId} holds the lock; resume after it ends` : "no live owner: a release records permission; resume dispatches") })] })) })), menu !== null && (_jsx(Panel, { title: `ACTIONS / ${menu.taskId}`, focused: true, children: menu.verbs.length === 0
+                    : (_jsxs(_Fragment, { children: [wrap(`#L${decision.park.line} ${decision.park.kind ?? "unknown kind"}${decision.park.failedGate ? ` · failed gate ${decision.park.failedGate}` : ""} · ${decision.park.reason ?? "no reason recorded"}`).map((line, i) => _jsx(BodyText, { children: line }, `park:${i}`)), _jsx(BodyText, { children: fit(`blocks ${blocked.length === 0 ? "nothing" : blocked.join(", ")} · attempts ${decision.attempts}`) }), wrap(decision.verbs.length === 0 ? `diagnostic: ${decision.diagnostic ?? "no verb"}` : `decisions: ${decision.verbs.join(" · ")} (a Actions)`).map((line, i) => _jsx(BodyText, { children: line }, `verbs:${i}`)), _jsx(BodyText, { emphasis: "dim", children: fit(run.live ? "matching live daemon enacts a release at its next task boundary" : run.blockingRunId ? `other live run ${run.blockingRunId} holds the lock; resume after it ends` : "no live owner: a release records permission; resume dispatches") })] })) })), menu !== null && (_jsx(Panel, { title: `ACTIONS / ${menu.taskId}`, focused: true, children: menu.verbs.length === 0
                     ? _jsx(BodyText, { children: fit(`no decision — ${decision?.diagnostic ?? "no verb for this park"}`) })
                     : menu.verbs.map((verb, i) => _jsx(BodyText, { emphasis: i === menu.selection ? "strong" : "normal", children: fit(`${i === menu.selection ? `${GLYPHS.pointer} ` : "  "}${verb}`) }, verb)) })), confirming !== null && (_jsx(Panel, { title: `CONFIRM ${confirming.command.verb.toUpperCase()}`, focused: true, children: decisionLines(decisionConfirmLines(confirming)).map((line, i) => _jsx(BodyText, { children: line }, `${i}:${line}`)) })), receipt !== null && (_jsx(Panel, { title: receipt.ok ? "RECEIPT · appended" : "RECEIPT · refused", children: decisionLines(decisionReceiptLines(receipt)).map((line, i) => _jsx(BodyText, { children: line }, `${i}:${line}`)) })), notice !== null && _jsx(BodyText, { children: notice }), _jsx(BodyText, { emphasis: "dim", children: clipBoard(boardFooter([...RUN_VIEW_KEYS, decisionKeybar(session.decisions, decision)].filter(Boolean), colour), width) })] }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.5.6",
+  "version": "2.5.7",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-overseer/SKILL.md

@@ -139,7 +139,7 @@ through brief lineage. **An executor choice nobody made is still an executor cho
      fraction (`ORCH · v1.19 4/5`, updated on every task-done); tickmarkr opens ONE TAB PER TASK, labelled
      with the task id and holding that task's worker plus its judge/review/consult panes (tickmarkr
      updates it). Never long context strings or ✓-chains.
-   - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: Do not load the `herdr` skill and do not map a Herdr workspace. Work from the current Orca terminal context. Keep the overseer in the launching terminal and inspect terminals with `orca terminal list --json`. The daemon self-places the watch board as a horizontal split of the launching terminal (`ORCA_TERMINAL_HANDLE`).
+   - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: Do not load the `herdr` skill and do not map a Herdr workspace. Work from the current Orca terminal context. Keep the overseer in the launching terminal, name it in the same act — `orca terminal rename --terminal "$ORCA_TERMINAL_HANDLE" --title "OVERSEER · <version>"` (tab title; see the seat-name law under Seat-spawn recipes) — and inspect terminals with `orca terminal list --json`. The daemon self-places the watch board as a horizontal split of the launching terminal (`ORCA_TERMINAL_HANDLE`).
 2. **Orchestrator**: Launch the orchestrator with your agent host.
    - **On herdr (`HERDR_ENV=1`)**: Spawning on current herdr is two-step — the one-shot `agent start --cwd` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138): first create the pane with `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` and parse `result.root_pane.pane_id` from its JSON, then start the agent in it. For Claude Code, use `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions` (append `--model <m>` after the `--` if the operator has a policy). For Codex, use `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` (add `--model <m>` to specify a model). The unsandboxed flag is REQUIRED: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation — do not downgrade it. Workers you never spawn — tickmarkr spawns its own visible worker panes. Auxiliary agents you do spawn (consultants, reviewers, scouts) follow the same forms: never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions --settings '{"promptSuggestionEnabled":false}'`. **For a codex consultant, use `-a never --sandbox workspace-write` — NOT `--sandbox read-only`.** ⚠ **`--sandbox read-only` CONTRADICTS this skill's own completion protocol and will hang the seat.** Every seat you spawn is told to deliver an ARTIFACT ending in a terminal MARKER, because that is the only completion signal the artifact watcher can key on (`done` is turn end). A read-only sandbox cannot write that artifact, so codex blocks on `Would you like to make the following edits?` for its OWN report — and the report exists ONLY in the pending edit, so abandoning the prompt destroys the work rather than merely delaying it. Measured 2026-08-28: a consultant spawned `--sandbox read-only` finished a 14,604-byte verdict, sat blocked on the write, and the operator saw the prompt before the supervising tier did. `read-only` is correct ONLY for a seat that writes nothing at all — which, under the artifact+marker rule, is no seat this skill tells you to spawn. When the prompt does appear, answer **"Yes, and don't ask again for these files"** rather than plain yes: plain yes re-blocks on the next write of the same file. **That `--settings` pair is not cosmetic and it is not optional:** claude-code's AUTOSUGGEST renders context-plausible ghost text into an idle seat's prompt line that is BYTE-IDENTICAL to a typed draft in text-format reads (OBS-482), so a supervising tier cannot tell a seat's own unsent work from a rendering artifact without `agent read --format ansi`. Turning the suggester off at spawn removes the ambiguity at its source instead of paying for the discrimination at every read. Verified against the shipped binary: `claude --settings '{"promptSuggestionEnabled":false}' -p …` exits 0 with a real response, and the key appears in the binary's own settings schema. **For kimi, pass `-y`** (`herdr agent start <name> --kind kimi --pane <id> -- -y`) — the adapter already launches its own workers that way (`src/adapters/kimi.ts:204`), and a kimi seat spawned without it sits on an approval prompt having done nothing. **Herdr cannot see that state**: it reports a kimi pane as `agent_status: working` with `screen_detection_skipped: true` while the prompt is up, so the BLOCKED-STATE watcher below is blind on this vendor and the spawn flag is the ONLY control. Every vendor you spawn needs its auto-approve form named here; a vendor absent from this list is a seat that will hang.
    - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: Seats spawn with `orca terminal create` on a path worktree selector with a command:
@@ -176,6 +176,12 @@ through brief lineage. **An executor choice nobody made is still an executor cho
 - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: Re-list terminals, re-read the
   recorded terminal handles and evidence files, and re-arm only file/journal watchers. Do not use a Herdr
   pane id, `agent start`, `pane run`, tab canon, or a name-keyed Herdr watcher on an Orca launch.
+  **Handles do not survive an Orca restart (OBS-1050, three gates lost to it in v2.5.6).** The restart
+  re-issues every terminal handle; a recorded one answers `terminal_handle_stale` and any watcher or gate
+  keyed to it is already dead. So: record every seat's handle in `pids/<seat>.handle` beside its title at
+  spawn; on `terminal_handle_stale`, re-list terminals and re-resolve the seat by TITLE, then rewrite the
+  handle file; and treat a stale handle as a dead seat until the read-back of the new handle proves
+  otherwise — a gate that was running in that seat has to be re-launched, never assumed to continue.
   When briefing a seat on either host, take its current address from the handoff file; never hardcode a pane id
   or terminal handle in a brief or command template.
 
@@ -199,7 +205,45 @@ Inventories retain the **full suite log**, not a tail or summary, and no one run
 - **On herdr (`HERDR_ENV=1`)**: Every mission to a Claude or Grok seat is delivered only with `herdr pane run <pane> "<message>"` and
   verified by reading the pane back; never use `agent prompt` for mission delivery. Launch a Grok seat with
   `herdr agent start <seat> --kind grok --pane <pane> -- -m grok-4.6`.
-- **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: Seats spawn with `orca terminal create --worktree path:<repo> --command "<cmd>" --json`. Brief delivery travels as a file announced by `orca terminal send --terminal <handle> --text "<announcement>" --enter --wait-submit 15 --json`. Read `result.send.prompt.stages` and treat the brief as delivered only when a `turn_started` stage is present; `accepted: true` proves input acceptance, not a started turn; never resend on `accepted` alone.
+- **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: Seats spawn with `orca terminal create --worktree path:<repo> --command "<cmd>" --json`.
+  **`--worktree path:` resolves only an Orca-MANAGED worktree** (`orca worktree list`); on any other checkout —
+  a `git worktree add` the overseer made for a spec branch, a throwaway clone — `terminal create` hangs and
+  returns "Timed out waiting for terminal handle after creation". The lawful form for such a checkout is a
+  terminal in a managed worktree with a cwd change in the command:
+  `orca terminal create --worktree path:<managed-repo> --title "ORCH · <version>" --command "cd <checkout> && <agent-cmd>" --json`.
+  **An Orca-hosted run's checkout is created by Orca** (`orca worktree create --repo id:<repo> --base-branch <spec-branch>`),
+  never by `git worktree add`: the orca driver asks `orca worktree current` from inside every task worktree and refuses
+  (`selector_not_found`) on an unmanaged checkout — every task fails pre-launch and the board cannot place (OBS-1061,
+  one abandoned run). **The overseer sits in the RUN's workspace**, in its own tab beside the orchestrator's, so the
+  run's card shows its supervision; records may live on another branch and are committed there by path.
+  **The orchestrator NEVER shares the overseer's tab.** Never spawn it with `orca terminal split` off the
+  overseer's own handle, even as a fallback: the daemon self-places its live board as a split of the
+  LAUNCHING terminal, so an orchestrator in the overseer's tab drags the board and every worker pane
+  into it (measured 2026-09-20: `terminal create` timed out on an unmanaged spec worktree, the overseer
+  split instead, and the run had to be re-seated before GO). Before delivering the brief, prove the seat
+  is in its own tab: `orca terminal list --json`, the new handle's `tabId` must differ from the
+  overseer's; if it does not, close the seat and create it again the lawful way. `split` is for seats
+  that BELONG beside another seat (consultant pairs, a reviewer beside its surgeon), never for the
+  orchestrator or a gate seat.
+  **Seat names on Orca are TAB titles, and a tab title HOLDS; the pane title is the agent's and drifts.**
+  Orca keeps two titles per seat. The TAB title is owned: `orca terminal create --title` and
+  `orca terminal rename --terminal <handle> --title "<seat>"` set it, and nothing a process writes to
+  its pty changes it — measured 2026-09-20 (OBS-1063) on a scratch terminal writing an OSC title every
+  2 s: the PANE title flipped to the OSC text within 8 s, the TAB title stayed, and the operator's tab
+  strip renders the TAB title. The pane title is whatever the process last wrote (oh-my-zsh, Claude
+  Code's turn summary, Codex's last prompt) and is NOT the seat's name. This is vendor-neutral by
+  construction — no per-vendor env var, no agent command, no launch-form ritual — which is what makes
+  it the same law as Herdr's tab label. So: **the overseer names its OWN seat at Setup 1** with
+  `orca terminal rename --terminal "$ORCA_TERMINAL_HANDLE" --title "OVERSEER · <version>"` (the seat
+  it was invoked in is the one seat nobody else launches), every seat it spawns is named by
+  `create --title`, and a live-label change (progress fraction, hot-state token) is `rename` again.
+  **Prove a name by the field that holds:** `tabs[].title` in
+  `orca terminal list --include-visual-layouts --json`, never the plain `list`'s `title` — that one is
+  the pane title and reads as drift on every agent seat, which is how three sessions "proved" a
+  failure that was a misread (`src/drivers/orca.ts:27-42` keys worker identity on the owned tab title
+  for the same reason). The earlier three-part launch form (`DISABLE_AUTO_TITLE` + `printf` +
+  `CLAUDE_CODE_DISABLE_TERMINAL_TITLE=1`) is withdrawn: it silenced one vendor's pane title and named
+  nothing the tab did not already hold. Brief delivery travels as a file announced by `orca terminal send --terminal <handle> --text "<announcement>" --enter --wait-submit 15 --json`. Read `result.send.prompt.stages` and treat the brief as delivered only when a `turn_started` stage is present; `accepted: true` proves input acceptance, not a started turn; never resend on `accepted` alone.
 For Leg-2 (both hosts), a Codex reviewer under `workspace-write` must be briefed with an in-worktree verdict path such as
 `<repo>/.tickmarkr/overseer/verdicts/<task>.md`, and its verdict must be written there before it is read.
 ## Supervising tickmarkr as the executor — WHO DOES WHAT
@@ -656,6 +700,14 @@ they are left implicit:
    fail-closed verdict, no daemon, no retries. A per-lane grep gate re-implements a weaker version of
    this and passes on source text the screen never renders, which is exactly the class the acceptance
    judge exists to reject. One command per lane, named in the lane's own brief.
+   Fix-leg laws learned the hard way (v2.5.6 R25/R26/R34):
+   - A `test:` criterion for a fix leg is written FROM the landed test's title, verbatim, never before the
+     test exists — the acceptance oracle runs the sentence as vitest `-t` and a paraphrase matches zero tests.
+   - Every fix-leg verify carries `--author <the seat that wrote it>`; without it the author is HUMAN, every
+     vendor stays eligible, and a same-vendor approval is not the cross-vendor review the criterion names.
+   - A grader change is proved on a captured REAL job log, never on a synthetic one.
+   - A public-CI red is classified in a throttled Linux container first (`docker run --cpus=2 node:22`),
+     by measurement: starvation on the base tree is not a defect on the branch.
 
 ## Pane mechanics that bite
 
@@ -1029,7 +1081,7 @@ orchestrator turn boundary.
 
 ### On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`) — supervision instruments
 
-At seat spawn, arm file/journal watchers for artifact completion, run events, missing progress and context evidence. Record each watcher owner and bounded expiry; renew on every wake and stop on stand-down. Read `orca terminal read --terminal <handle> --screen --json` on each wake to detect blocked or pending input. For a human gate, write a checkpoint evidence file and announce it through verified terminal send. Use Orca notifications only when the installed host advertises a notification capability; the current CLI has no `notification` command, so the file and terminal receipt remain the delivery path. A notification or accepted input alone never proves delivery or completion.
+At seat spawn, arm file/journal watchers for artifact completion, run events, missing progress and context evidence. Record each watcher owner and bounded expiry; renew on every wake and stop on stand-down. Read `orca terminal read --terminal <handle> --screen --json` on each wake to detect blocked or pending input. For a human gate, write a checkpoint evidence file and announce it through verified terminal send. Use Orca notifications only when the installed host advertises a notification capability; the current CLI has no `notification` command, so the file and terminal receipt remain the delivery path. A notification or accepted input alone never proves delivery or completion. A seat-liveness watcher on the ORCHESTRATOR handle is mandatory, not optional: poll `orca terminal read --terminal <handle> --screen --json` on a bounded interval, treat `terminal_handle_stale` or a missing terminal as seat death, and re-resolve by title before re-arming (OBS-1050 — the orchestrator seat exited silently and the daemon ran unsupervised to a PARTIAL run-end).
 
 ## Specialist pipeline rules