tickmarkr 2.5.9 → 2.6.1

package/dist/tui/cockpit/live-runtime.js

@@ -132,10 +132,42 @@ export async function runConsolidatedCockpit(options) {
         let committedTargets = [];
         let revision = 0;
         const listeners = new Set();
-        const publish = () => { revision++; for (const listener of listeners)
+        // Every publish resyncs the key so a view switch never earns a second frame on the next tick.
+        const publish = () => { revision++; observed = observationKey(source.snapshot()); for (const listener of listeners)
             listener(); };
-        const unsubscribe = source.subscribe(publish);
+        let observed = "";
         const geometry = () => planShell(output.columns ?? 80, output.rows ?? 24, state.shortcutColumns);
+        // OBS-1132: the store publishes on every observation tick; the board only re-derives and
+        // re-renders when what it would draw changed. Lock and supervision observation continue
+        // regardless. Excluded on purpose: sequence, observedAt, metrics and beat ages, which move
+        // every tick without changing a visible cell.
+        // ponytail: mirrors board.ts `ago` buckets and its ≥118-cell "wide" header — the only clock reader,
+        // and only the Run view draws the board, so Home and Evidence never invalidate on the age.
+        // The lock is compared by what it says (owner, state, liveness), never by its file stamp: the
+        // daemon heartbeat re-touches graph.lock every 10 s without changing a visible cell. Its clock-derived
+        // `expired` flag is not drawn by any view either, so a lock ageing past STALE_MS earns no frame.
+        const visibleAge = (ms) => ms < 6e4 ? "just now" : ms < 3.6e6 ? `${Math.round(ms / 6e4)}m` : `${Math.round(ms / 3.6e6)}h`;
+        const observationKey = (snap) => {
+            const last = snap.operator.lastEventAt;
+            const clock = state.view === "run" && geometry().bodyColumns >= 118 && last ? visibleAge((options.now ?? Date.now)() - Date.parse(last)) : "";
+            return JSON.stringify([
+                snap.freshness, snap.actionsEnabled, snap.errors, snap.viewport, snap.inputSequence, clock,
+                snap.journal.generation, snap.journal.offset, snap.journal.status, snap.journal.malformedCount, snap.journal.backlogBytes, snap.journal.pending, snap.journal.error,
+                snap.graph.identity, snap.graph.status, snap.config.identity, snap.config.status, snap.cache.identity, snap.cache.status,
+                snap.lock.value, snap.lock.status, snap.lock.state, snap.lock.alive,
+                // D-383: supervision tier state is not drawn by any view; an ARMED→STALE transition earns no
+                // frame. Its UNREADABLE case already surfaces through snap.errors above.
+            ]);
+        };
+        observed = observationKey(source.snapshot());
+        const unsubscribe = source.subscribe(() => {
+            const next = observationKey(source.snapshot());
+            if (next !== observed) {
+                observed = next;
+                publish();
+            }
+        });
+        let frames = 0, derivations = 0;
         const openEvidence = (identity) => {
             evidenceNavigation++;
             selectedEvidence = identity;
@@ -484,7 +516,7 @@ export async function runConsolidatedCockpit(options) {
                     stop(e);
                     return false;
                 }
-            }, diagnostics: source.diagnostics, stage: edits => { state = { ...state, staged: [...edits] }; publish(); } };
+            }, diagnostics: source.diagnostics, stage: edits => { state = { ...state, staged: [...edits] }; publish(); }, frames: () => frames, derivations: () => derivations };
         options.onDelivery?.(delivery);
         options.onShellDelivery?.(delivery);
         resize = () => {
@@ -530,6 +562,7 @@ export async function runConsolidatedCockpit(options) {
         function App() {
             useSyncExternalStore(listener => { listeners.add(listener); return () => { listeners.delete(listener); }; }, () => revision);
             const stdinContext = useStdin();
+            useLayoutEffect(() => { frames++; });
             useLayoutEffect(() => {
                 const emitter = stdinContext.internal_eventEmitter;
                 leafInput = emitter;
@@ -565,6 +598,7 @@ export async function runConsolidatedCockpit(options) {
                     stop(error);
                 }
             });
+            derivations++;
             const snap = source.snapshot();
             const p = geometry();
             const nextDecisionsKey = `${snap.journal.generation}:${snap.journal.offset}:${snap.graph.identity}`;

package/dist/tui/cockpit/live-store.d.ts

@@ -2,6 +2,7 @@ import { type JournalEvent } from "../../run/journal.js";
 import { type OperatorRecord } from "../../run/operator-state.js";
 export declare const OBSERVATION_INTERVAL_MS = 1000;
 export declare const STORE_LIMITS: {
+    readonly graphBytes: number;
     readonly history: 256;
     readonly historyBytes: number;
     readonly recordBytes: number;
@@ -147,6 +148,7 @@ export declare function createLiveStore(options: LiveStoreOptions): {
                     kind: "fixture";
                     paths: string[];
                 })[] | undefined;
+                outOfScope?: string[] | undefined;
                 routingHints?: {
                     pin?: {
                         via: string;
@@ -248,6 +250,7 @@ export declare function createLiveStore(options: LiveStoreOptions): {
                     kind: "fixture";
                     paths: string[];
                 })[] | undefined;
+                outOfScope?: string[] | undefined;
                 routingHints?: {
                     pin?: {
                         via: string;

package/dist/tui/cockpit/live-store.js

@@ -1,4 +1,4 @@
-import { closeSync, fstatSync, openSync, readFileSync, readSync, statSync } from "node:fs";
+import { closeSync, fstatSync, openSync, readSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { graphPath, stateDirName } from "../../graph/graph.js";
 import { validateGraph } from "../../graph/schema.js";
@@ -7,7 +7,8 @@ import { isPidLive, STALE_MS } from "../../run/lock.js";
 import { readTierLiveness, SUPERVISION_TIERS } from "../../run/supervision.js";
 import { OperatorStateFold } from "../../run/operator-state.js";
 export const OBSERVATION_INTERVAL_MS = 1_000;
-export const STORE_LIMITS = { history: 256, historyBytes: 2 * 1024 * 1024, recordBytes: 1024 * 1024, readBytes: 1024 * 1024, subscribers: 64, metrics: 12, errors: 32 };
+// Graph declarations have a separate 16 MiB bound; journal retention remains unchanged.
+export const STORE_LIMITS = { graphBytes: 16 * 1024 * 1024, history: 256, historyBytes: 2 * 1024 * 1024, recordBytes: 1024 * 1024, readBytes: 1024 * 1024, subscribers: 64, metrics: 12, errors: 32 };
 const errorText = (e) => e instanceof Error ? e.message : String(e);
 const fileIdentity = (st) => `${st.dev}:${st.ino}`;
 const stamp = (st) => `${fileIdentity(st)}:${st.size}:${st.mtimeNs}:${st.ctimeNs}`;
@@ -192,10 +193,12 @@ export class JournalTail {
 class JsonSource {
     path;
     parse;
+    maxBytes;
     cached;
-    constructor(path, parse) {
+    constructor(path, parse, maxBytes = STORE_LIMITS.recordBytes) {
         this.path = path;
         this.parse = parse;
+        this.maxBytes = maxBytes;
     }
     read(now) {
         try {
@@ -203,9 +206,29 @@ class JsonSource {
             const id = stamp(st);
             if (this.cached?.identity === id && this.cached.status === "readable")
                 return this.cached = { ...this.cached, observedAt: now };
-            if (!st.isFile() || st.size > BigInt(STORE_LIMITS.recordBytes))
-                throw new Error("source is not a bounded regular file");
-            const value = this.parse(readFileSync(this.path, "utf8"));
+            if (!st.isFile())
+                throw new Error("source is not a regular file");
+            if (st.size > BigInt(this.maxBytes))
+                throw new Error(`source exceeds ${this.maxBytes} byte cap`);
+            // Bound the read itself too: a writer can grow the file after stat.
+            const fd = openSync(this.path, "r");
+            let value;
+            try {
+                const bytes = Buffer.alloc(Number(st.size) + 1);
+                let length = 0;
+                while (length < bytes.length) {
+                    const n = readSync(fd, bytes, length, bytes.length - length, length);
+                    if (!n)
+                        break;
+                    length += n;
+                }
+                if (length !== Number(st.size) || stamp(fstatSync(fd, { bigint: true })) !== id)
+                    throw new Error("source changed during read; retry observation");
+                value = this.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, length)));
+            }
+            finally {
+                closeSync(fd);
+            }
             return this.cached = { source: this.path, identity: id, value, status: "readable", observedAt: now };
         }
         catch (e) {
@@ -222,7 +245,7 @@ export function createLiveStore(options) {
     const tail = new JournalTail(join(state, "runs", parseRunId(options.runId), "journal.jsonl"), {
         reset: () => { fold = new OperatorStateFold(); }, record: record => fold.apply(record),
     });
-    const graph = new JsonSource(graphPath(options.cwd), raw => validateGraph(JSON.parse(raw)));
+    const graph = new JsonSource(graphPath(options.cwd), raw => validateGraph(JSON.parse(raw)), STORE_LIMITS.graphBytes);
     const config = new JsonSource(options.configPath ?? join(state, "config.yaml"), raw => raw);
     const cache = new JsonSource(options.cachePath ?? join(state, "doctor.json"), JSON.parse);
     const lock = new JsonSource(join(state, "graph.lock"), raw => {
@@ -256,7 +279,7 @@ export function createLiveStore(options) {
         const readable = journal.status === "readable" && journal.backlogBytes === 0;
         return {
             sequence: ++sequence, observedAt, delayed, freshness: errors.length ? "failed" : delayed ? "delayed" : "fresh",
-            operator: fold.snapshot({ graph: graphReading.status === "readable" ? graphReading.value : undefined, sequence, observedAt, readable }),
+            operator: fold.snapshot({ graph: graphReading.status === "readable" ? graphReading.value : undefined, sequence, observedAt, readable, graphAvailability: { status: graphReading.status, error: graphReading.error } }),
             journal, graph: graphReading, config: configReading, cache: cacheReading,
             lock: { ...owner, state: lockState, alive, expired: owner.identity ? observedAt - Number(owner.identity.split(":")[3]) / 1e6 > STALE_MS : undefined },
             supervision, errors, actionsEnabled: readable && !errors.length && !delayed,

package/dist/tui/cockpit/run-cockpit.js

@@ -3,6 +3,7 @@ import { Box, useApp, useStdout } from "ink";
 import { cloneElement, createContext, useContext, useEffect, useInsertionEffect, useMemo, useRef, useSyncExternalStore, } from "react";
 import { GLYPHS, PLAIN_COMPACT_LOCKUP, } from "../../brand.js";
 import { allocateBandColumns, BandLines, BodyText, CockpitGrid, composeBandLine, JournalRowPanel, keyRosterLines, Panel, PANEL_CHROME_ROWS, ProgressMeter, Sparkline, StatTile, StatusStrip, } from "./components.js";
+import { authorsNote } from "../../run/operator-state.js";
 import { fieldReading } from "./derive.js";
 import { STALL_MARKER } from "./run-view.js";
 import { initialRunInteractionState, projectRunKeyEntries, reconcileRunInteraction, RUN_SIDE_RAIL_COLUMN_FLOOR, runPanelFocusOrder, runSideRailVisible, selectableRunViewRowIds, } from "./keys.js";
@@ -280,7 +281,7 @@ function promotedViewRows(data, viewId) {
             time: fieldReading(row.lastEventTime),
             ...(row.lastEventTimestamp === undefined ? {} : { timestamp: row.lastEventTimestamp }),
             state: taskRowState(row),
-            text: `${row.taskId} · ${fieldReading(row.state)} · ${runAttemptLabel(row.attempts)} · ${fieldReading(row.actor)}${row.title === undefined ? "" : ` · ${row.title}`} · ${taskProjectionText(row, data.journalRows)}`,
+            text: `${row.taskId} · ${fieldReading(row.state)} · ${runAttemptLabel(row.attempts)} · ${fieldReading(row.actor)}${authorsNote(row.authors, row.actor) === undefined ? "" : ` · ${authorsNote(row.authors, row.actor)}`}${row.title === undefined ? "" : ` · ${row.title}`} · ${taskProjectionText(row, data.journalRows)}`,
         }));
     }
     if (viewId === "gates") {

package/dist/tui/cockpit/run-view.d.ts

@@ -35,10 +35,8 @@ export interface RunGateCell {
     /** The verdict text the evidence row carries, split into lines for paging. */
     readonly verdict: readonly string[];
 }
-/**
- * The current attempt's seven cells in declaration order. `rows` supplies the later journal rows
- * that give a cell its inherited/satisfied label; only rows for this task after the evidence line count.
- */
+/** Current-attempt cells in declaration order; later task rows supply inherited/satisfied labels.
+ * Only rows after each cell's own evidence line count. */
 export declare function runGateCells(task: OperatorTask, evidence: EvidenceLookup, rows?: readonly RunEvidenceRow[]): readonly RunGateCell[];
 export declare const VERDICT_WINDOW = 10;
 export interface RunViewSession {

package/dist/tui/cockpit/run-view.js

@@ -53,7 +53,7 @@ export function evidenceLookup(rows, page) {
     return lookup;
 }
 export const GATE_CELL_LETTERS = {
-    passed: "P", failed: "F", running: "R", "not-run": "-", disabled: "D", unknown: "?",
+    passed: "P", failed: "F", queued: "Q", running: "R", "not-run": "-", disabled: "D", unknown: "?",
 };
 /** The outcome selector's vocabulary — a classification of the row, never a word search. */
 export const OUTCOME_FILTERS = ["all", "infra failure", "work failure", "pass", "unknown"];
@@ -81,10 +81,8 @@ function outcomeLabel(outcome) {
         case "unavailable": return `unknown — ${outcome.reason}`;
     }
 }
-/**
- * The current attempt's seven cells in declaration order. `rows` supplies the later journal rows
- * that give a cell its inherited/satisfied label; only rows for this task after the evidence line count.
- */
+/** Current-attempt cells in declaration order; later task rows supply inherited/satisfied labels.
+ * Only rows after each cell's own evidence line count. */
 export function runGateCells(task, evidence, rows = []) {
     return GATE_NAMES.map((gate) => {
         const cell = task.gates[gate] ?? { state: "unknown" };
@@ -94,12 +92,15 @@ export function runGateCells(task, evidence, rows = []) {
         const labels = [];
         let outcome;
         if (data === undefined) {
-            labels.push(line === undefined ? { "not-run": "not run", disabled: "disabled by policy", running: "running", unknown: "unknown", passed: "passed", failed: "failed" }[cell.state] : `evidence #L${line} unavailable`);
+            labels.push(line === undefined ? { "not-run": "not run", disabled: "disabled by policy", queued: "queued", running: "running", unknown: "unknown", passed: "passed", failed: "failed" }[cell.state] : `evidence #L${line} unavailable`);
+        }
+        else if (cell.state === "queued") {
+            labels.push(`queued — ${row?.event?.event ?? "wait"}${typeof data.count === "number" ? ` (${data.count} suites)` : ""}`);
         }
         else if (data.disabled === true) {
             labels.push("disabled by policy");
         }
-        else if (row?.event?.event === "gate-start") {
+        else if (["gate-start", "gate-phase-start", "phase-start"].includes(row?.event?.event ?? "")) {
             labels.push("running");
         }
         else {
@@ -124,7 +125,7 @@ export function runGateCells(task, evidence, rows = []) {
             if (e.event === "task-approved" && e.data.release === "gate-satisfied" && e.data.gate === gate)
                 labels.push(`satisfied by approval #L${later.line}`);
         }
-        const verdict = typeof data?.details === "string" ? data.details.split("\n") : [];
+        const verdict = row?.event?.event === "gate-result" && typeof data?.details === "string" ? data.details.split("\n") : [];
         return { gate, state: cell.state, letter: GATE_CELL_LETTERS[cell.state], ...(line === undefined ? {} : { line }), ...(outcome ? { outcome } : {}), outcomeClass: outcomeClassOf(outcome, cell.state), labels, verdict };
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.5.9",
+  "version": "2.6.1",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/schema/rungraph.schema.json

@@ -255,6 +255,13 @@
               ]
             }
           },
+          "outOfScope": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "minLength": 1
+            }
+          },
           "gates": {
             "default": [
               "build",

package/skills/tickmarkr-overseer/SKILL.md

@@ -62,7 +62,7 @@ through brief lineage. **An executor choice nobody made is still an executor cho
    - **On herdr (`HERDR_ENV=1`)**: Every bundled `watch-*.sh` arm, including `watch-artifacts.sh`, sets `TKR_ARMING_SEAT=<seat>` and writes its own pid under
      `<state-dir>/overseer/pids/<arming-seat>-<script>-<pid>.pid`. A seat retires only watchers it armed,
      by reading those files and killing the exact recorded pids; it never uses `pkill -f`, `pgrep -f`, or
-     any argv/path pattern. A journal path is shared by partner tiers and therefore cannot prove ownership.
+     any argv/path pattern. The pre-arm beat probe lists unowned writers and is reconciled in the beat section; retiring a watcher this seat armed stays kill-by-recorded-pid and never that probe. A journal path is shared by partner tiers and therefore cannot prove ownership.
      Verify each executing pid in two process-table reads before acting, kill-by-pid, arm the replacement,
      then verify its new pid in two process-table reads. A stand-down order inventories both sets: the
      ordering seat's recorded pids to retire, and the partner's watchers armed on the ordering seat that
@@ -72,7 +72,7 @@ through brief lineage. **An executor choice nobody made is still an executor cho
      and nothing had been watching either file.
    - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: File and journal watchers record
      owner pid and arm id beside the evidence files; a seat retires only watchers it armed, by those
-     recorded pids. It never uses `pkill -f`, `pgrep -f`, or any argv/path pattern. Verify each executing
+     recorded pids. It never uses `pkill -f`, `pgrep -f`, or any argv/path pattern. The pre-arm beat probe lists unowned writers and is reconciled in the beat section; retiring a watcher this seat armed stays kill-by-recorded-pid and never that probe. Verify each executing
      pid in two process-table reads before acting. A stand-down inventories this seat's recorded pids
      and the partner's watchers that must survive it.
    **An adopted seat ANNOUNCES itself, in the same act as re-arming:** tell the adopted orchestrator the
@@ -140,11 +140,11 @@ through brief lineage. **An executor choice nobody made is still an executor cho
      with the task id and holding that task's worker plus its judge/review/consult panes (tickmarkr
      updates it). Never long context strings or ✓-chains.
    - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: Do not load the `herdr` skill and do not map a Herdr workspace. Work from the current Orca terminal context. Keep the overseer in the launching terminal, name it in the same act — `orca terminal rename --terminal "$ORCA_TERMINAL_HANDLE" --title "OVERSEER · <version>"` (tab title; see the seat-name law under Seat-spawn recipes) — and inspect terminals with `orca terminal list --json`. The daemon self-places the watch board as a horizontal split of the launching terminal (`ORCA_TERMINAL_HANDLE`).
-2. **Orchestrator**: Launch the orchestrator with your agent host.
-   - **On herdr (`HERDR_ENV=1`)**: Spawning on current herdr is two-step — the one-shot `agent start --cwd` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138): first create the pane with `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` and parse `result.root_pane.pane_id` from its JSON, then start the agent in it. For Claude Code, use `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions` (append `--model <m>` after the `--` if the operator has a policy). For Codex, use `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` (add `--model <m>` to specify a model). The unsandboxed flag is REQUIRED: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation — do not downgrade it. Workers you never spawn — tickmarkr spawns its own visible worker panes. Auxiliary agents you do spawn (consultants, reviewers, scouts) follow the same forms: never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions --settings '{"promptSuggestionEnabled":false}'`. **For a codex consultant, use `-a never --sandbox workspace-write` — NOT `--sandbox read-only`.** ⚠ **`--sandbox read-only` CONTRADICTS this skill's own completion protocol and will hang the seat.** Every seat you spawn is told to deliver an ARTIFACT ending in a terminal MARKER, because that is the only completion signal the artifact watcher can key on (`done` is turn end). A read-only sandbox cannot write that artifact, so codex blocks on `Would you like to make the following edits?` for its OWN report — and the report exists ONLY in the pending edit, so abandoning the prompt destroys the work rather than merely delaying it. Measured 2026-08-28: a consultant spawned `--sandbox read-only` finished a 14,604-byte verdict, sat blocked on the write, and the operator saw the prompt before the supervising tier did. `read-only` is correct ONLY for a seat that writes nothing at all — which, under the artifact+marker rule, is no seat this skill tells you to spawn. When the prompt does appear, answer **"Yes, and don't ask again for these files"** rather than plain yes: plain yes re-blocks on the next write of the same file. **That `--settings` pair is not cosmetic and it is not optional:** claude-code's AUTOSUGGEST renders context-plausible ghost text into an idle seat's prompt line that is BYTE-IDENTICAL to a typed draft in text-format reads (OBS-482), so a supervising tier cannot tell a seat's own unsent work from a rendering artifact without `agent read --format ansi`. Turning the suggester off at spawn removes the ambiguity at its source instead of paying for the discrimination at every read. Verified against the shipped binary: `claude --settings '{"promptSuggestionEnabled":false}' -p …` exits 0 with a real response, and the key appears in the binary's own settings schema. **For kimi, pass `-y`** (`herdr agent start <name> --kind kimi --pane <id> -- -y`) — the adapter already launches its own workers that way (`src/adapters/kimi.ts:204`), and a kimi seat spawned without it sits on an approval prompt having done nothing. **Herdr cannot see that state**: it reports a kimi pane as `agent_status: working` with `screen_detection_skipped: true` while the prompt is up, so the BLOCKED-STATE watcher below is blind on this vendor and the spawn flag is the ONLY control. Every vendor you spawn needs its auto-approve form named here; a vendor absent from this list is a seat that will hang.
+2. **Orchestrator**: First consume a successful `tickmarkr fleet --pick consult` in the seat repository, per the Fleet selection contract below; then launch the returned adapter/model with your agent host.
+   - **On herdr (`HERDR_ENV=1`)**: Spawning on current herdr is two-step — the one-shot `agent start --cwd` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138): first create the pane with `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` and parse `result.root_pane.pane_id` from its JSON, then start the agent in it. For Claude Code, use `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions` (append `--model <picked-model>` after the `--` from the Fleet receipt). For Codex, use `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` (add `--model <picked-model>` from the Fleet receipt). The unsandboxed flag is REQUIRED: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation — do not downgrade it. Workers you never spawn — tickmarkr spawns its own visible worker panes. Auxiliary agents you do spawn (consultants, reviewers, scouts) follow the same forms: never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions --settings '{"promptSuggestionEnabled":false}'`. **For a codex consultant, use `-a never --sandbox workspace-write` — NOT `--sandbox read-only`.** ⚠ **`--sandbox read-only` CONTRADICTS this skill's own completion protocol and will hang the seat.** Every seat you spawn is told to deliver an ARTIFACT ending in a terminal MARKER, because that is the only completion signal the artifact watcher can key on (`done` is turn end). A read-only sandbox cannot write that artifact, so codex blocks on `Would you like to make the following edits?` for its OWN report — and the report exists ONLY in the pending edit, so abandoning the prompt destroys the work rather than merely delaying it. Measured 2026-08-28: a consultant spawned `--sandbox read-only` finished a 14,604-byte verdict, sat blocked on the write, and the operator saw the prompt before the supervising tier did. `read-only` is correct ONLY for a seat that writes nothing at all — which, under the artifact+marker rule, is no seat this skill tells you to spawn. When the prompt does appear, answer **"Yes, and don't ask again for these files"** rather than plain yes: plain yes re-blocks on the next write of the same file. **That `--settings` pair is not cosmetic and it is not optional:** claude-code's AUTOSUGGEST renders context-plausible ghost text into an idle seat's prompt line that is BYTE-IDENTICAL to a typed draft in text-format reads (OBS-482), so a supervising tier cannot tell a seat's own unsent work from a rendering artifact without `agent read --format ansi`. Turning the suggester off at spawn removes the ambiguity at its source instead of paying for the discrimination at every read. Verified against the shipped binary: `claude --settings '{"promptSuggestionEnabled":false}' -p …` exits 0 with a real response, and the key appears in the binary's own settings schema. **For kimi, pass `-y`** (`herdr agent start <name> --kind kimi --pane <id> -- -y`) — the adapter already launches its own workers that way (`src/adapters/kimi.ts:204`), and a kimi seat spawned without it sits on an approval prompt having done nothing. **Herdr cannot see that state**: it reports a kimi pane as `agent_status: working` with `screen_detection_skipped: true` while the prompt is up, so the BLOCKED-STATE watcher below is blind on this vendor and the spawn flag is the ONLY control. Every vendor you spawn needs its auto-approve form named here; a vendor absent from this list is a seat that will hang.
    - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: Seats spawn with `orca terminal create` on a path worktree selector with a command:
      `orca terminal create --worktree path:<repo> --title "ORCH · <version>" --command "<agent-cmd>" --json`
-     For Claude Code: `orca terminal create --worktree path:<repo> --title "ORCH · <version>" --command "claude --permission-mode bypassPermissions" --json`. For Codex: `orca terminal create --worktree path:<repo> --title "ORCH · <version>" --command "codex --dangerously-bypass-approvals-and-sandbox" --json`. Parse `result.terminal.handle` from the create receipt.
+     For Claude Code: `orca terminal create --worktree path:<repo> --title "ORCH · <version>" --command "claude --model <picked-model> --permission-mode bypassPermissions --settings '{\"promptSuggestionEnabled\":false}'" --json`. For Codex: `orca terminal create --worktree path:<repo> --title "ORCH · <version>" --command "codex --model <picked-model> --dangerously-bypass-approvals-and-sandbox" --json`. Parse `result.terminal.handle` from the create receipt.
 3. **Standing instructions travel as a brief FILE, never as pane text** — PTY input truncates at ~1024B and a
    truncated brief silently drops policy. Write the full brief to `<repo>/.tickmarkr/overseer/ORCH-BRIEF.md`
    (inside the tickmarkr state dir — already self-gitignored, no exclude step needed), then announce the brief file:
@@ -202,9 +202,46 @@ Inventories retain the **full suite log**, not a tail or summary, and no one run
 
 ### Seat-spawn and Leg-2 recipes
 
+**Fleet selection contract (OBS-1165), on BOTH hosts:** Before every supervisor-opened seat,
+including every respawn, replacement, delegated spawn and Leg-2 dispatch, run the applicable
+`tickmarkr fleet --pick <role>` in that seat's repository. Never reuse a prior pick at respawn.
+The purpose-to-role mapping is explicit:
+
+| Seat purpose | Fleet role | Vendor exclusions |
+| --- | --- | --- |
+| orchestrator | consult | Any vendors excluded for this mission |
+| records | consult | Any vendors excluded for this mission |
+| author (including planner, executor and scout) | consult | Any vendors excluded for this mission |
+| consultant | consult | Any vendors excluded for this mission or consultation round |
+| lab-rater | consult | Any vendors excluded for this rating round |
+| independent reviewer (including checker and verifier) | review | Author vendor plus every vendor already used by independent reviewers in this round, and mission exclusions |
+
+For example, an independent reviewer runs
+`tickmarkr fleet --pick review --exclude-vendor <author-vendor> --exclude-vendor <prior-reviewer-vendor>`;
+omit the prior-reviewer argument only for the first reviewer. Repeat `--exclude-vendor <vendor>`
+for every applicable exclusion on either role. Track the author's actual vendor and each reviewer's
+returned vendor in the seat record; if the author vendor is unknown, stop before review selection.
+Unknown seat purposes require an explicit mapping decision; never silently map them to consult.
+
+Consume only exit status zero and one complete JSON identity with `role`, `adapter`, `model`, `vendor`
+and `channel`. Validate the role and exclusions against the request and record this receipt with the
+seat. A nonzero refusal (including missing `<role>.prefer`, exhausted eligible preferences, or stale
+probe data) stops the spawn: report the named reason, never invent a default, auto-write preferences,
+or fall back to a remembered model. `fleet --print` and a preference list are not a resolved pick.
+
+Build the launch command from the returned `adapter` and `model`, shell-quoting the model as one
+argument: `claude-code` maps to executable/kind `claude` with `--model <picked-model>`, `codex` to
+`codex --model <picked-model>`, `kimi` to `kimi --model <picked-model>`, and `grok` to
+`grok -m <picked-model>`. Select only the matching adapter recipe below; examples do not choose
+models. If the returned adapter has no documented visible TUI recipe and approval flags, stop and
+report that transport limitation rather than substitute another adapter. Preserve the existing
+visible-seat transport safeguards: named interactive TUI seats, host-specific create receipts,
+orchestrator tab isolation, role-specific sandbox/approval flags, Claude prompt suggestions disabled,
+Kimi `-y`, artifact plus terminal marker, and verified file-brief delivery. Fleet pick never starts a seat.
+
 - **On herdr (`HERDR_ENV=1`)**: Every mission to a Claude or Grok seat is delivered only with `herdr pane run <pane> "<message>"` and
   verified by reading the pane back; never use `agent prompt` for mission delivery. Launch a Grok seat with
-  `herdr agent start <seat> --kind grok --pane <pane> -- -m grok-4.6`.
+  `herdr agent start <seat> --kind grok --pane <pane> -- -m <picked-model>`.
 - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: Seats spawn with `orca terminal create --worktree path:<repo> --command "<cmd>" --json`.
   **`--worktree path:` resolves only an Orca-MANAGED worktree** (`orca worktree list`); on any other checkout —
   a `git worktree add` the overseer made for a spec branch, a throwaway clone — `terminal create` hangs and
@@ -790,14 +827,14 @@ they are left implicit:
    stall watcher to catch — silent-time equals lifetime. Standing operator rule since 2026-07-13:
    consults and one-off LLM calls run as the CLI's real interactive TUI in a visible named pane.
    Headless is for exit-code probes — a quota check that wants `rc`, never work anyone must watch.
-3. **Buy seat diversity from the live capability matrix, at every dispatch.** When one vendor's model
+3. **Buy seat diversity through Fleet, at every dispatch and respawn.** Resolve authors with `tickmarkr fleet --pick consult` and independent checkers/verifiers with `tickmarkr fleet --pick review --exclude-vendor <author-vendor>`, adding every applicable vendor exclusion under the Fleet selection contract. Consume the successful JSON adapter/model before using the visible-seat recipes; never select directly from doctor data. When one vendor's model
    quota collapses, the reflex is to collapse every seat onto the surviving model and hold the
    cross-vendor CLI back for a late probe — P97 ran planner, checker and verifier as one family that
    way, and three same-family passes confirmed one wrong anchored conclusion with the refuting fact in
    the room. `<state-dir>/doctor.json` already lists every installed+authed adapter and its models (nine
    were authed on 2026-08-17 while every seat ran claude). Priority when independence is scarce:
    **verifier > checker > planner > executors**.
-   - **On herdr (`HERDR_ENV=1`)** the independent seat goes cross-vendor with `herdr agent start … --kind codex`;
+   - **On herdr (`HERDR_ENV=1`)** the independent seat uses its Fleet-selected adapter kind and model with `herdr agent start … --kind <picked-kind> -- …`;
    - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)** it uses the Orca terminal-create
    seat recipe. The choice is ruled at dispatch, never debated under time pressure.
    **A codex seat inside a git WORKTREE cannot commit and cannot write outside the worktree** (OBS-824, measured
@@ -806,6 +843,12 @@ they are left implicit:
    report INSIDE the worktree and to commit nothing — the overseer commits from the main checkout — or give the work to a
    claude seat, or to a throwaway CLONE (a real `.git` directory). A brief that tells a codex-in-worktree seat to commit
    buys a stall, not a commit.
+
+   **Every one-shot `codex exec` from an agent shell closes stdin (D-307-pre).** This skill has no
+   `codex exec` recipe — cross-vendor seats are spawned interactive — and the seat's ad-hoc one-shot
+   did not close stdin on that command. The agent shell left stdin open, and `codex exec` then
+   blocks on reading additional input from stdin (`Reading additional input from stdin…`) until the
+   pipe ends (42 minutes, measured). Run it as `codex exec … < /dev/null`.
 4. **Gate every exec lane with the shipped battery, not hand-rolled greps.**
    `tickmarkr verify --base <ref> --criteria <file>` is the standalone form of the engine's own gates —
    build/test/lint diffed against a recorded baseline, evidence, scope, plus the semantic judges — one
@@ -826,8 +869,13 @@ they are left implicit:
 - **Verified send protocol**:
   - **On herdr (`HERDR_ENV=1`)**: `herdr agent send` writes WITHOUT Enter, and `pane run`'s Enter can be swallowed
     by bracketed-paste on long payloads. Robust sequence: read the pane (bare prompt required) → send-text →
-    sleep 2–3s → send-keys Enter → read back (input empty / agent `working`). Never report "briefed" without
-    the read-back. Long content goes in a brief file, never pane text. `scripts/seat-send.sh` encodes
+    sleep 2–3s → read back. Send `send-keys Enter` only when that read-back shows the staged text on the
+    composer and no permission prompt or numbered choice holds focus — an Enter sent onto an active prompt
+    approves it or picks a choice instead of submitting the brief (OBS-1119). When a prompt or choice holds
+    focus instead, resolve it first, then re-read before retrying. After a submitted Enter, read back once
+    more and confirm the composer is empty or the agent shows `working` — the pre-Enter read only proved
+    Enter was safe to send, not that the brief was submitted. Never report "briefed" without
+    both read-backs. Long content goes in a brief file, never pane text. `scripts/seat-send.sh` encodes
     this whole path — size guard, atomic prompt, prompt-line read-back, optional interrupt — and never
     auto-resends. Each adapter declares its prompt glyph beside its input-box matchers; `seat-send.sh` reads
     that declaration rather than assuming Claude's `❯`.
@@ -1009,7 +1057,7 @@ the repo root as its own `run_in_background` Bash call:
 
 ```bash
 cd <repo> && tickmarkr beat overseer --seat <overseer-agent-or-pane> --loop
-tickmarkr beat overseer --seat <overseer-agent-or-pane> --stand-down  # deliberately hand off; --loop exits
+cd <repo> && tickmarkr beat overseer --seat <overseer-agent-or-pane> --stand-down  # deliberately hand off; --loop exits
 ```
 
 **The legacy wrapper loop, `while :; do tickmarkr beat overseer --seat <pane>; sleep 10; done`, is the
@@ -1043,9 +1091,10 @@ had three beat writers, one owned by an unrelated session. The shipped `--loop`
 but its process ownership still needs a live check. So:
 
 - **Split the liveness reads.** A tier's liveness is read from beat freshness in the repository status
-  path; the loop's liveness is read from the live process payload (`tickmarkr beat <tier> --seat <seat>
-  --loop` in this repo). Neither liveness claim is read from a recorded pid: a pid
-  recorded earlier can be stale, reused, or detached from the beat now holding the tier green.
+  path. The loop's liveness is read from the live process payload of both arm forms: the loop arm
+  (`tickmarkr beat <tier> --seat <seat> --loop` in this repo) and the legacy wrapper
+  (`while :; do tickmarkr beat <tier> --seat <seat>; sleep 10; done`). Neither liveness claim is read from a recorded pid:
+  a pid recorded earlier can be stale, reused, or detached from the beat now holding the tier green.
 - **At every adopt, clear, or re-brief, sweep for pre-existing beat writers on YOUR tier before
   arming one** (`pgrep -f "tickmarkr beat <tier>"`, **read twice and intersected** — this exact probe
   returned its own shell as pid 14680 on 2026-08-31). **The PRIMARY target is the legacy
@@ -1053,6 +1102,11 @@ but its process ownership still needs a live check. So:
   a `--loop` exits by itself once your new arm replaces its own, but the wrapper's bare tick beats
   whatever arm is on disk, so it survives your re-arm and never exits on its own. Trace each survivor
   to its parent session. Stop an unowned writer only — never its parent — then verify the parent survived.
+  **Reconcile this probe with the recorded-pid ownership rule.** That rule retires watchers this seat
+  armed by the exact recorded pid, and it never uses `pkill -f`, `pgrep -f`, or an argv pattern. This
+  probe is the listing of unowned legacy writers that have no pid file; the pattern stays
+  `pgrep -f "tickmarkr beat <tier>"` with no `--loop` qualifier. A stop is kill-by-pid of an unowned
+  survivor after the two reads. The probe does not retire a recorded pid.
 - **`ARMED (<seat>)` is an attributable claim, not proof that the named seat is still alive.** Before
   trusting it, ask whose session owns the beater; a still-running `--loop` can keep naming a departed
   seat (rule 11's outliving-its-trigger failure, in beat form).
@@ -1547,6 +1601,14 @@ twice.** They are mission-independent on purpose: nothing here names a task, a l
     the same root read the other way: a DETACHED loop outlives its seat and holds a tier `ARMED` with
     nobody home (OBS-583). Neither direction may be assumed; the lifetime is a property of how the watcher
     was launched, and it belongs in writing next to every claim that one is armed.
+    **A seat's background tasks are bound to the seat's life (D-302 add.3).** An ad-hoc background task —
+    an analysis heredoc, a one-shot shell — dies with the seat that launched it. Record its pid and kill
+    that pid at stand-down, the same recorded-pid act as any other task this seat owns. Leave it attached
+    to the seat so it is not reparented to pid 1 and left running after the seat is gone. A watcher this
+    skill explicitly labels detached, with its heartbeat file, is the process that may outlive the seat.
+    **Forbid the home-wide recursive glob by name:** `glob.glob('~/**/.tickmarkr/runs/*/journal.jsonl', recursive=True)`.
+    That heredoc walked the whole home (`~/**`, every worktree, `node_modules`, Library) and ran orphaned
+    for 30 hours at 100% CPU after its seat was gone. No seat glob starts at `~` or `$HOME`.
     **And EVERY process-table probe has an idiom that defeats it, so the rule above needs the one test
     that survives all of them. Lead with this; it is not the last resort, it is the first move:**