tickmarkr 2.5.9 → 2.6.0

package/dist/run/git.d.ts

@@ -190,6 +190,16 @@ export declare function resolveIntegrationBranch(_repo: string, branch: string):
  */
 export declare function preserveWorktree(cwd: string): Promise<string | undefined>;
 export declare function createWorktree(repo: string, branch: string, baseRef: string): Promise<string>;
+export interface DependencyLink {
+    /** Package link, relative to node_modules (including @scope/name). */
+    link: string;
+    target: string;
+    classification: "worktree" | "node_modules" | "outside";
+}
+/** Inventory only package-level links; never descend into installed packages. */
+export declare function inventoryDependencyLinks(worktree: string): DependencyLink[];
+/** Shared pre-command refusal; unreadable inventories cannot establish isolation either. */
+export declare function dependencyLinkRefusal(worktree: string): string | undefined;
 export declare function linkNodeModules(repo: string, dir: string, { force }?: {
     force?: boolean | undefined;
 }): boolean;

package/dist/run/git.js

@@ -4,7 +4,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { execFileSync, spawn } from "node:child_process";
 import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import { availableParallelism, homedir, tmpdir } from "node:os";
-import { join, resolve } from "node:path";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { StringDecoder } from "node:string_decoder";
 import { shq } from "../adapters/types.js";
 import { tickmarkrDir } from "../graph/graph.js";
@@ -624,6 +624,54 @@ function excludeNodeModules(dir) {
     }
     catch { /* not a git checkout (bare tmpdir in tests) — never fail provisioning over the exclude */ }
 }
+/** Inventory only package-level links; never descend into installed packages. */
+export function inventoryDependencyLinks(worktree) {
+    const dependencyPath = join(worktree, "node_modules");
+    try {
+        lstatSync(dependencyPath);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+    const root = realpathSync(worktree);
+    const dependencies = realpathSync(dependencyPath);
+    const inside = (parent, target) => {
+        const rel = relative(parent, target);
+        return rel === "" || (!isAbsolute(rel) && rel !== ".." && !rel.startsWith(`..${sep}`));
+    };
+    const links = [];
+    const inspect = (link) => {
+        const path = join(dependencies, link);
+        if (!lstatSync(path).isSymbolicLink())
+            return;
+        const target = realpathSync(path);
+        links.push({ link, target, classification: inside(root, target) ? "worktree"
+                : inside(dependencies, target) ? "node_modules" : "outside" });
+    };
+    for (const entry of readdirSync(dependencies).sort()) {
+        inspect(entry);
+        if (entry.startsWith("@") && statSync(join(dependencies, entry)).isDirectory()) {
+            for (const child of readdirSync(join(dependencies, entry)).sort())
+                inspect(join(entry, child));
+        }
+    }
+    return links;
+}
+/** Shared pre-command refusal; unreadable inventories cannot establish isolation either. */
+export function dependencyLinkRefusal(worktree) {
+    try {
+        const outside = inventoryDependencyLinks(worktree).filter(link => link.classification === "outside");
+        if (!outside.length)
+            return undefined;
+        return "infra: OBS-1118 refusing verification: dependency links resolve outside the worktree and real node_modules:\n"
+            + outside.map(({ link, target }) => `node_modules/${link} -> ${target}`).join("\n");
+    }
+    catch (error) {
+        return `infra: OBS-1118 refusing verification: cannot inventory dependency links in ${worktree}: ${String(error)}`;
+    }
+}
 export function linkNodeModules(repo, dir, { force = false } = {}) {
     const src = join(repo, "node_modules");
     const dest = join(dir, "node_modules");

package/dist/run/journal.d.ts

@@ -437,7 +437,7 @@ export declare class Journal {
         assignment?: Assignment;
     } | null;
     replayResumeState(): Map<string, ResumeState>;
-    replaySatisfiedGates(): Map<string, GateName>;
+    replaySatisfiedGates(currentSubjects?: ReadonlyMap<string, string>): Map<string, GateName>;
     replayCurrentAttemptGateResults(): Map<string, CurrentAttemptGateReplay>;
     replayExcludedChannels(): Set<string>;
     telemetry(row: TelemetryRow): void;

package/dist/run/journal.js

@@ -1734,26 +1734,62 @@ export class Journal {
         }
         return m;
     }
-    // OBS-130/OBS-571: gate satisfaction is authority, not an inferred daemon state. Only an explicit
-    // task-approved event with the typed release marker and a known gate enters this fold. Authority is
-    // scoped to that approval: any later approval supersedes it, and the worktree-recreation row written
-    // before the approved gate suffix runs consumes it at enactment. A daemon-made gate-satisfied event,
-    // a prior pass/fail result, malformed data, or another task's approval is inert.
-    replaySatisfiedGates() {
+    // OBS-130/OBS-571: only an explicit approval grants gate authority; recreation consumes
+    // its immediate enactment. OBS-1133: retain a review waiver's subject separately so a later
+    // recheck may carry it. Tool waivers never survive recheck. The daemon supplies the recreated
+    // subject before using a carried waiver; absent that, replay can only compare journaled subjects.
+    replaySatisfiedGates(currentSubjects) {
         const satisfied = new Map();
+        const reviewSubjects = new Map();
+        const subjects = new Map();
+        const reviewWaivers = new Map();
         for (const e of this.read()) {
             if (!e.taskId)
                 continue;
+            if (e.event === "task-dispatch") {
+                reviewSubjects.delete(e.taskId);
+                subjects.delete(e.taskId);
+                reviewWaivers.delete(e.taskId);
+                satisfied.delete(e.taskId);
+            }
+            if (e.event === "gate-result") {
+                const commit = typeof e.data.commit === "string" && e.data.commit ? e.data.commit : undefined;
+                if (commit)
+                    subjects.set(e.taskId, commit);
+                else
+                    subjects.delete(e.taskId);
+                if (reviewWaivers.has(e.taskId) && reviewWaivers.get(e.taskId) !== commit) {
+                    reviewWaivers.delete(e.taskId);
+                }
+                if (e.data.gate === "review") {
+                    if (commit && e.data.pass === false)
+                        reviewSubjects.set(e.taskId, commit);
+                    else
+                        reviewSubjects.delete(e.taskId);
+                }
+            }
             if (e.event === "worktree-recreation") {
                 satisfied.delete(e.taskId);
                 continue;
             }
             if (e.event === "task-approved") {
                 satisfied.delete(e.taskId);
+                if (e.data.release === RECHECK_RELEASE) {
+                    const waivedSubject = reviewWaivers.get(e.taskId);
+                    const subject = currentSubjects?.get(e.taskId) ?? subjects.get(e.taskId);
+                    if (waivedSubject && waivedSubject === subject)
+                        satisfied.set(e.taskId, "review");
+                    continue;
+                }
+                reviewWaivers.delete(e.taskId);
                 if (e.data.release === GATE_SATISFIED_RELEASE
                     && typeof e.data.gate === "string"
                     && GATE_NAMES.includes(e.data.gate)) {
                     satisfied.set(e.taskId, e.data.gate);
+                    const subject = reviewSubjects.get(e.taskId);
+                    if (e.data.gate === "review" && subject && subject === subjects.get(e.taskId)) {
+                        reviewWaivers.set(e.taskId, subject);
+                    }
                 }
             }
         }

package/dist/run/merge.d.ts

@@ -5,7 +5,7 @@ export interface TipVerifyResult {
     evidenceReceipt?: GateEvidenceReceipt;
     evidenceReceipts?: GateEvidenceReceipt[];
     evidenceAbsence?: "provenance-refused" | "not-started" | "historical-cache";
-    /** Absolute directory against which the original receipt artifact paths resolve. */
+    /** Directory the evidence setup returned; receipt artifact paths resolve against it. */
     originRunRoot?: string;
     nonce?: string;
     stdoutPath?: string;

package/dist/run/merge.js

@@ -1,11 +1,11 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { join } from "node:path";
 import { shq } from "../adapters/types.js";
 import { beginGateEvidence, ceilingKillResult, classifyFreshRunnerOutput, classifyRunnerOutput, fileCountDeficit, waitForCalmWindow, effectiveCeilingMs, fingerprint, freshFailures, } from "../gates/baseline.js";
 import { evaluateManifestedTest, isVitestTestCommand } from "../gates/test-manifest.js";
 import { computeVerificationIdentity, formatReusedDetails, getVerdictStore, getWorktreeTree, resolveStateDir, isInfraResult, } from "../gates/cache.js";
 import { tickmarkrDir } from "../graph/graph.js";
-import { describeCapacity, gitHead, linkNodeModules, resolveIntegrationBranch, resolvedCapacity, sameCapacity, sh, shGit, shGitOk, WORKTREES_DIR } from "./git.js";
+import { dependencyLinkRefusal, describeCapacity, gitHead, linkNodeModules, resolveIntegrationBranch, resolvedCapacity, sameCapacity, sh, shGit, shGitOk, WORKTREES_DIR } from "./git.js";
 import { executionSignal } from "./execution-budget.js";
 // Diagnostic convenience logs are observational, just like receipt persistence.
 function writeTipLog(path, text) {
@@ -128,6 +128,16 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
     if (!commands.test && commands.tipTest) {
         gatesToRun.push(["test", commands.tipTest]);
     }
+    const dependencyRefusal = dependencyLinkRefusal(intWt);
+    if (dependencyRefusal) {
+        for (const [gate, cmd] of gatesToRun.length ? gatesToRun : [["build", ""]]) {
+            const artifact = join(runDir, `tip-verify-${gate}.log`);
+            writeTipLog(artifact, dependencyRefusal + "\n");
+            results.push({ gate, cmd, pass: false, exitCode: 1, fingerprints: [],
+                cause: "infra", details: dependencyRefusal, evidenceAbsence: "not-started", artifact });
+        }
+        return results;
+    }
     if (journalFound && hasRunEvidenceOrMalformed && runStartCommands === undefined) {
         for (const [gate, cmd] of gatesToRun) {
             const artifact = join(runDir, `tip-verify-${gate}.log`);
@@ -151,6 +161,8 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
     // Publish only after the entire verification completes. The daemon kills a cancelled
     // verifier process, so completed early gates must remain in memory until then.
     const pending = new Map();
+    // D-267 (1): each fresh receipt's origin is the root its own beginGateEvidence returned.
+    const evidenceRoots = new Map();
     for (const [gate, cmd] of gatesToRun) {
         if (runStartCommands !== undefined) {
             const expectedCmd = gate === "test"
@@ -226,13 +238,20 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
         // a detected vitest test command never reaches the stdout-count/file-count path below (this
         // gate's own manifest is always the FULL suite; verify has no selected screen to hold). A
         // scripted test command that is not the detected runner falls through unchanged.
+        const evidenceSetup = { artifactDir: runDir, runId: runDir, ...evidenceOptions };
         if (gate === "test" && isVitestTestCommand(cmd, intWt)) {
+            // D-267 (1): stamp the root the evidence setup returned, then give that exact root to every
+            // manifested invocation. Do not reconstruct it from the caller's options: the receipt's
+            // artifact paths are relative to the root returned by beginGateEvidence.
+            const evidence = beginGateEvidence(intWt, gate, cmd, evidenceSetup);
+            const manifestedEvidence = { ...evidenceSetup, artifactDir: evidence.root };
+            evidenceRoots.set(gate, evidence.root);
             const outcome = await evaluateManifestedTest(cmd, intWt, {
                 baselineDurations: entry?.fileDurations,
                 longestFile: entry?.longestFile,
                 overallCeilingMs: effectiveCeilingMs(entry),
                 artifactDir: runDir,
-                evidence: { artifactDir: runDir, runId: runDir, ...evidenceOptions },
+                evidence: manifestedEvidence,
             });
             const artifact = join(runDir, `tip-verify-${gate}.log`);
             if (!outcome.pass)
@@ -264,7 +283,8 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
         const ceilingMs = effectiveCeilingMs(entry);
         const evidenceReceipts = [];
         const execute = async () => {
-            const evidence = beginGateEvidence(intWt, gate, cmd, { artifactDir: runDir, runId: runDir, ...evidenceOptions });
+            const evidence = beginGateEvidence(intWt, gate, cmd, evidenceSetup);
+            evidenceRoots.set(gate, evidence.root);
             try {
                 const result = await sh(cmd, intWt, ceilingMs, { env: evidenceOptions.env, onReceipt: receipt => evidence.observe(receipt) });
                 evidenceReceipts.push(...evidence.history, evidence.finish(result.stdout, result.stderr));
@@ -372,8 +392,12 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
     // spawns in the daemon child, and a command that changed the tree invalidates reuse.
     const completedTree = pending.size ? await getWorktreeTree(intWt) : undefined;
     for (const result of results) {
-        if (!result.reused && result.evidenceReceipt)
-            result.originRunRoot = resolve(evidenceOptions.artifactDir ?? runDir);
+        if (!result.reused && result.evidenceReceipt) {
+            const evidenceRoot = evidenceRoots.get(result.gate);
+            if (evidenceRoot === undefined)
+                throw new Error(`tip verify receipt for ${result.gate} has no evidence root from its evidence setup`);
+            result.originRunRoot = evidenceRoot;
+        }
         const id = pending.get(result.gate);
         if (id && id.tree === completedTree && !isInfraResult(result)) {
             store.set(id, { ...result, meta: {

package/dist/tui/cockpit/live-runtime.d.ts

@@ -22,6 +22,10 @@ export interface ShellDelivery {
     diagnostics: LiveStore["diagnostics"];
     stage: (edits: readonly string[]) => void;
     geometry: () => ShellCommit | undefined;
+    /** Application render commits since mount (OBS-1132: an idle board adds none). */
+    frames: () => number;
+    /** Model derivations (the App body) since mount. */
+    derivations: () => number;
 }
 export interface ConsolidatedOptions {
     input: NodeJS.ReadStream;

package/dist/tui/cockpit/live-runtime.js

@@ -132,10 +132,42 @@ export async function runConsolidatedCockpit(options) {
         let committedTargets = [];
         let revision = 0;
         const listeners = new Set();
-        const publish = () => { revision++; for (const listener of listeners)
+        // Every publish resyncs the key so a view switch never earns a second frame on the next tick.
+        const publish = () => { revision++; observed = observationKey(source.snapshot()); for (const listener of listeners)
             listener(); };
-        const unsubscribe = source.subscribe(publish);
+        let observed = "";
         const geometry = () => planShell(output.columns ?? 80, output.rows ?? 24, state.shortcutColumns);
+        // OBS-1132: the store publishes on every observation tick; the board only re-derives and
+        // re-renders when what it would draw changed. Lock and supervision observation continue
+        // regardless. Excluded on purpose: sequence, observedAt, metrics and beat ages, which move
+        // every tick without changing a visible cell.
+        // ponytail: mirrors board.ts `ago` buckets and its ≥118-cell "wide" header — the only clock reader,
+        // and only the Run view draws the board, so Home and Evidence never invalidate on the age.
+        // The lock is compared by what it says (owner, state, liveness), never by its file stamp: the
+        // daemon heartbeat re-touches graph.lock every 10 s without changing a visible cell. Its clock-derived
+        // `expired` flag is not drawn by any view either, so a lock ageing past STALE_MS earns no frame.
+        const visibleAge = (ms) => ms < 6e4 ? "just now" : ms < 3.6e6 ? `${Math.round(ms / 6e4)}m` : `${Math.round(ms / 3.6e6)}h`;
+        const observationKey = (snap) => {
+            const last = snap.operator.lastEventAt;
+            const clock = state.view === "run" && geometry().bodyColumns >= 118 && last ? visibleAge((options.now ?? Date.now)() - Date.parse(last)) : "";
+            return JSON.stringify([
+                snap.freshness, snap.actionsEnabled, snap.errors, snap.viewport, snap.inputSequence, clock,
+                snap.journal.generation, snap.journal.offset, snap.journal.status, snap.journal.malformedCount, snap.journal.backlogBytes, snap.journal.pending, snap.journal.error,
+                snap.graph.identity, snap.graph.status, snap.config.identity, snap.config.status, snap.cache.identity, snap.cache.status,
+                snap.lock.value, snap.lock.status, snap.lock.state, snap.lock.alive,
+                // D-383: supervision tier state is not drawn by any view; an ARMED→STALE transition earns no
+                // frame. Its UNREADABLE case already surfaces through snap.errors above.
+            ]);
+        };
+        observed = observationKey(source.snapshot());
+        const unsubscribe = source.subscribe(() => {
+            const next = observationKey(source.snapshot());
+            if (next !== observed) {
+                observed = next;
+                publish();
+            }
+        });
+        let frames = 0, derivations = 0;
         const openEvidence = (identity) => {
             evidenceNavigation++;
             selectedEvidence = identity;
@@ -484,7 +516,7 @@ export async function runConsolidatedCockpit(options) {
                     stop(e);
                     return false;
                 }
-            }, diagnostics: source.diagnostics, stage: edits => { state = { ...state, staged: [...edits] }; publish(); } };
+            }, diagnostics: source.diagnostics, stage: edits => { state = { ...state, staged: [...edits] }; publish(); }, frames: () => frames, derivations: () => derivations };
         options.onDelivery?.(delivery);
         options.onShellDelivery?.(delivery);
         resize = () => {
@@ -530,6 +562,7 @@ export async function runConsolidatedCockpit(options) {
         function App() {
             useSyncExternalStore(listener => { listeners.add(listener); return () => { listeners.delete(listener); }; }, () => revision);
             const stdinContext = useStdin();
+            useLayoutEffect(() => { frames++; });
             useLayoutEffect(() => {
                 const emitter = stdinContext.internal_eventEmitter;
                 leafInput = emitter;
@@ -565,6 +598,7 @@ export async function runConsolidatedCockpit(options) {
                     stop(error);
                 }
             });
+            derivations++;
             const snap = source.snapshot();
             const p = geometry();
             const nextDecisionsKey = `${snap.journal.generation}:${snap.journal.offset}:${snap.graph.identity}`;

package/dist/tui/cockpit/live-store.d.ts

@@ -147,6 +147,7 @@ export declare function createLiveStore(options: LiveStoreOptions): {
                     kind: "fixture";
                     paths: string[];
                 })[] | undefined;
+                outOfScope?: string[] | undefined;
                 routingHints?: {
                     pin?: {
                         via: string;
@@ -248,6 +249,7 @@ export declare function createLiveStore(options: LiveStoreOptions): {
                     kind: "fixture";
                     paths: string[];
                 })[] | undefined;
+                outOfScope?: string[] | undefined;
                 routingHints?: {
                     pin?: {
                         via: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.5.9",
+  "version": "2.6.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/schema/rungraph.schema.json

@@ -255,6 +255,13 @@
               ]
             }
           },
+          "outOfScope": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "minLength": 1
+            }
+          },
           "gates": {
             "default": [
               "build",

package/skills/tickmarkr-overseer/SKILL.md

@@ -62,7 +62,7 @@ through brief lineage. **An executor choice nobody made is still an executor cho
    - **On herdr (`HERDR_ENV=1`)**: Every bundled `watch-*.sh` arm, including `watch-artifacts.sh`, sets `TKR_ARMING_SEAT=<seat>` and writes its own pid under
      `<state-dir>/overseer/pids/<arming-seat>-<script>-<pid>.pid`. A seat retires only watchers it armed,
      by reading those files and killing the exact recorded pids; it never uses `pkill -f`, `pgrep -f`, or
-     any argv/path pattern. A journal path is shared by partner tiers and therefore cannot prove ownership.
+     any argv/path pattern. The pre-arm beat probe lists unowned writers and is reconciled in the beat section; retiring a watcher this seat armed stays kill-by-recorded-pid and never that probe. A journal path is shared by partner tiers and therefore cannot prove ownership.
      Verify each executing pid in two process-table reads before acting, kill-by-pid, arm the replacement,
      then verify its new pid in two process-table reads. A stand-down order inventories both sets: the
      ordering seat's recorded pids to retire, and the partner's watchers armed on the ordering seat that
@@ -72,7 +72,7 @@ through brief lineage. **An executor choice nobody made is still an executor cho
      and nothing had been watching either file.
    - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: File and journal watchers record
      owner pid and arm id beside the evidence files; a seat retires only watchers it armed, by those
-     recorded pids. It never uses `pkill -f`, `pgrep -f`, or any argv/path pattern. Verify each executing
+     recorded pids. It never uses `pkill -f`, `pgrep -f`, or any argv/path pattern. The pre-arm beat probe lists unowned writers and is reconciled in the beat section; retiring a watcher this seat armed stays kill-by-recorded-pid and never that probe. Verify each executing
      pid in two process-table reads before acting. A stand-down inventories this seat's recorded pids
      and the partner's watchers that must survive it.
    **An adopted seat ANNOUNCES itself, in the same act as re-arming:** tell the adopted orchestrator the
@@ -806,6 +806,12 @@ they are left implicit:
    report INSIDE the worktree and to commit nothing — the overseer commits from the main checkout — or give the work to a
    claude seat, or to a throwaway CLONE (a real `.git` directory). A brief that tells a codex-in-worktree seat to commit
    buys a stall, not a commit.
+
+   **Every one-shot `codex exec` from an agent shell closes stdin (D-307-pre).** This skill has no
+   `codex exec` recipe — cross-vendor seats are spawned interactive — and the seat's ad-hoc one-shot
+   did not close stdin on that command. The agent shell left stdin open, and `codex exec` then
+   blocks on reading additional input from stdin (`Reading additional input from stdin…`) until the
+   pipe ends (42 minutes, measured). Run it as `codex exec … < /dev/null`.
 4. **Gate every exec lane with the shipped battery, not hand-rolled greps.**
    `tickmarkr verify --base <ref> --criteria <file>` is the standalone form of the engine's own gates —
    build/test/lint diffed against a recorded baseline, evidence, scope, plus the semantic judges — one
@@ -826,8 +832,13 @@ they are left implicit:
 - **Verified send protocol**:
   - **On herdr (`HERDR_ENV=1`)**: `herdr agent send` writes WITHOUT Enter, and `pane run`'s Enter can be swallowed
     by bracketed-paste on long payloads. Robust sequence: read the pane (bare prompt required) → send-text →
-    sleep 2–3s → send-keys Enter → read back (input empty / agent `working`). Never report "briefed" without
-    the read-back. Long content goes in a brief file, never pane text. `scripts/seat-send.sh` encodes
+    sleep 2–3s → read back. Send `send-keys Enter` only when that read-back shows the staged text on the
+    composer and no permission prompt or numbered choice holds focus — an Enter sent onto an active prompt
+    approves it or picks a choice instead of submitting the brief (OBS-1119). When a prompt or choice holds
+    focus instead, resolve it first, then re-read before retrying. After a submitted Enter, read back once
+    more and confirm the composer is empty or the agent shows `working` — the pre-Enter read only proved
+    Enter was safe to send, not that the brief was submitted. Never report "briefed" without
+    both read-backs. Long content goes in a brief file, never pane text. `scripts/seat-send.sh` encodes
     this whole path — size guard, atomic prompt, prompt-line read-back, optional interrupt — and never
     auto-resends. Each adapter declares its prompt glyph beside its input-box matchers; `seat-send.sh` reads
     that declaration rather than assuming Claude's `❯`.
@@ -1009,7 +1020,7 @@ the repo root as its own `run_in_background` Bash call:
 
 ```bash
 cd <repo> && tickmarkr beat overseer --seat <overseer-agent-or-pane> --loop
-tickmarkr beat overseer --seat <overseer-agent-or-pane> --stand-down  # deliberately hand off; --loop exits
+cd <repo> && tickmarkr beat overseer --seat <overseer-agent-or-pane> --stand-down  # deliberately hand off; --loop exits
 ```
 
 **The legacy wrapper loop, `while :; do tickmarkr beat overseer --seat <pane>; sleep 10; done`, is the
@@ -1043,9 +1054,10 @@ had three beat writers, one owned by an unrelated session. The shipped `--loop`
 but its process ownership still needs a live check. So:
 
 - **Split the liveness reads.** A tier's liveness is read from beat freshness in the repository status
-  path; the loop's liveness is read from the live process payload (`tickmarkr beat <tier> --seat <seat>
-  --loop` in this repo). Neither liveness claim is read from a recorded pid: a pid
-  recorded earlier can be stale, reused, or detached from the beat now holding the tier green.
+  path. The loop's liveness is read from the live process payload of both arm forms: the loop arm
+  (`tickmarkr beat <tier> --seat <seat> --loop` in this repo) and the legacy wrapper
+  (`while :; do tickmarkr beat <tier> --seat <seat>; sleep 10; done`). Neither liveness claim is read from a recorded pid:
+  a pid recorded earlier can be stale, reused, or detached from the beat now holding the tier green.
 - **At every adopt, clear, or re-brief, sweep for pre-existing beat writers on YOUR tier before
   arming one** (`pgrep -f "tickmarkr beat <tier>"`, **read twice and intersected** — this exact probe
   returned its own shell as pid 14680 on 2026-08-31). **The PRIMARY target is the legacy
@@ -1053,6 +1065,11 @@ but its process ownership still needs a live check. So:
   a `--loop` exits by itself once your new arm replaces its own, but the wrapper's bare tick beats
   whatever arm is on disk, so it survives your re-arm and never exits on its own. Trace each survivor
   to its parent session. Stop an unowned writer only — never its parent — then verify the parent survived.
+  **Reconcile this probe with the recorded-pid ownership rule.** That rule retires watchers this seat
+  armed by the exact recorded pid, and it never uses `pkill -f`, `pgrep -f`, or an argv pattern. This
+  probe is the listing of unowned legacy writers that have no pid file; the pattern stays
+  `pgrep -f "tickmarkr beat <tier>"` with no `--loop` qualifier. A stop is kill-by-pid of an unowned
+  survivor after the two reads. The probe does not retire a recorded pid.
 - **`ARMED (<seat>)` is an attributable claim, not proof that the named seat is still alive.** Before
   trusting it, ask whose session owns the beater; a still-running `--loop` can keep naming a departed
   seat (rule 11's outliving-its-trigger failure, in beat form).
@@ -1547,6 +1564,14 @@ twice.** They are mission-independent on purpose: nothing here names a task, a l
     the same root read the other way: a DETACHED loop outlives its seat and holds a tier `ARMED` with
     nobody home (OBS-583). Neither direction may be assumed; the lifetime is a property of how the watcher
     was launched, and it belongs in writing next to every claim that one is armed.
+    **A seat's background tasks are bound to the seat's life (D-302 add.3).** An ad-hoc background task —
+    an analysis heredoc, a one-shot shell — dies with the seat that launched it. Record its pid and kill
+    that pid at stand-down, the same recorded-pid act as any other task this seat owns. Leave it attached
+    to the seat so it is not reparented to pid 1 and left running after the seat is gone. A watcher this
+    skill explicitly labels detached, with its heartbeat file, is the process that may outlive the seat.
+    **Forbid the home-wide recursive glob by name:** `glob.glob('~/**/.tickmarkr/runs/*/journal.jsonl', recursive=True)`.
+    That heredoc walked the whole home (`~/**`, every worktree, `node_modules`, Library) and ran orphaned
+    for 30 hours at 100% CPU after its seat was gone. No seat glob starts at `~` or `$HOME`.
     **And EVERY process-table probe has an idiom that defeats it, so the rule above needs the one test
     that survives all of them. Lead with this; it is not the last resort, it is the first move:**