tickmarkr 2.6.0 → 2.6.2

package/skills/tickmarkr-loop/SKILL.md

@@ -112,8 +112,14 @@ enacts at its next task boundary; if a different live run owns the repository lo
 for that run to end before resuming this one.
 
 For a non-TTY decision, the same command is
-`tickmarkr approve <runId> T2 --by operator --reason 'ready to proceed'`; check its receipt
-and explicitly resume. Preserve resume refusals and repair the named source/config issue
+`tickmarkr approve <runId> T2 --park <line>@<ts> --by operator --reason 'ready to proceed'`,
+naming the park token `tickmarkr status <runId>` prints; check its receipt and explicitly
+resume. Every decision binds to one park (a waive also to its failed gate:
+`tickmarkr approve <runId> T2 --waive --park <line>@<ts> --gate review`); once a newer park
+opens, a stale token, unbound release or mismatched gate refuses — the daemon journals
+`approval-refused` and never waives the newer gate. A failed task keeps its recheck with its
+own bound failure token: status prints `failed — T3 — failure <line>@<ts>`, then
+`tickmarkr approve <runId> T3 --recheck --park <line>@<ts>` re-gates its landed commits. Preserve resume refusals and repair the named source/config issue
 (including deny/prefer conflicts); never edit the compiled graph to force a result. Resume
 makes CURRENT TIP PENDING; historical GATES RAN does not prove completion. The completed
 case has 3/3 recorded merges, a latest run-end, a nonfailed known tip result and empty

package/skills/tickmarkr-overseer/SKILL.md

@@ -18,6 +18,14 @@ Fleet/Bootstrap and Plan/Health remain follow-ons with existing CLI entries. A r
 1/3 merged, human T2, blocked T3 run is PARTIAL despite tip pass. The orchestrator owns
 the Run confirmation and read-back of the appended `task-approved` receipt after a ruling;
 permission is not dispatch, and a closed run needs explicit `tickmarkr resume <runId>`.
+A ruling is bound to the park it decides (OBS-1178): relay it with that park's token, e.g.
+`tickmarkr approve <runId> T2 --waive --park <line>@<ts> --gate review`, copied from `tickmarkr
+status <runId>` or the park notice. A standing order or queued ruling written
+against one park is refused once a newer park opens (the daemon journals `approval-refused`) — rule
+again on the new token; never re-issue the old one (D-470: an unbound approve waived a RED test
+gate). A failed task keeps its recheck with its bound failure token: status prints
+`failed — T3 — failure <line>@<ts>`, and `tickmarkr approve <runId> T3 --recheck --park <line>@<ts>`
+re-gates its landed commits with no worker.
 Manual UI retains the receipt; the daemon-owned board gracefully stands down only its own
 presence before closing its owned pane. Non-TTY supervision keeps `status`, `report` and
 default-watch line output (`--watch --plain` is also available on a TTY). Keep the canonical
@@ -140,11 +148,11 @@ through brief lineage. **An executor choice nobody made is still an executor cho
      with the task id and holding that task's worker plus its judge/review/consult panes (tickmarkr
      updates it). Never long context strings or ✓-chains.
    - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: Do not load the `herdr` skill and do not map a Herdr workspace. Work from the current Orca terminal context. Keep the overseer in the launching terminal, name it in the same act — `orca terminal rename --terminal "$ORCA_TERMINAL_HANDLE" --title "OVERSEER · <version>"` (tab title; see the seat-name law under Seat-spawn recipes) — and inspect terminals with `orca terminal list --json`. The daemon self-places the watch board as a horizontal split of the launching terminal (`ORCA_TERMINAL_HANDLE`).
-2. **Orchestrator**: Launch the orchestrator with your agent host.
-   - **On herdr (`HERDR_ENV=1`)**: Spawning on current herdr is two-step — the one-shot `agent start --cwd` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138): first create the pane with `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` and parse `result.root_pane.pane_id` from its JSON, then start the agent in it. For Claude Code, use `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions` (append `--model <m>` after the `--` if the operator has a policy). For Codex, use `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` (add `--model <m>` to specify a model). The unsandboxed flag is REQUIRED: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation — do not downgrade it. Workers you never spawn — tickmarkr spawns its own visible worker panes. Auxiliary agents you do spawn (consultants, reviewers, scouts) follow the same forms: never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions --settings '{"promptSuggestionEnabled":false}'`. **For a codex consultant, use `-a never --sandbox workspace-write` — NOT `--sandbox read-only`.** ⚠ **`--sandbox read-only` CONTRADICTS this skill's own completion protocol and will hang the seat.** Every seat you spawn is told to deliver an ARTIFACT ending in a terminal MARKER, because that is the only completion signal the artifact watcher can key on (`done` is turn end). A read-only sandbox cannot write that artifact, so codex blocks on `Would you like to make the following edits?` for its OWN report — and the report exists ONLY in the pending edit, so abandoning the prompt destroys the work rather than merely delaying it. Measured 2026-08-28: a consultant spawned `--sandbox read-only` finished a 14,604-byte verdict, sat blocked on the write, and the operator saw the prompt before the supervising tier did. `read-only` is correct ONLY for a seat that writes nothing at all — which, under the artifact+marker rule, is no seat this skill tells you to spawn. When the prompt does appear, answer **"Yes, and don't ask again for these files"** rather than plain yes: plain yes re-blocks on the next write of the same file. **That `--settings` pair is not cosmetic and it is not optional:** claude-code's AUTOSUGGEST renders context-plausible ghost text into an idle seat's prompt line that is BYTE-IDENTICAL to a typed draft in text-format reads (OBS-482), so a supervising tier cannot tell a seat's own unsent work from a rendering artifact without `agent read --format ansi`. Turning the suggester off at spawn removes the ambiguity at its source instead of paying for the discrimination at every read. Verified against the shipped binary: `claude --settings '{"promptSuggestionEnabled":false}' -p …` exits 0 with a real response, and the key appears in the binary's own settings schema. **For kimi, pass `-y`** (`herdr agent start <name> --kind kimi --pane <id> -- -y`) — the adapter already launches its own workers that way (`src/adapters/kimi.ts:204`), and a kimi seat spawned without it sits on an approval prompt having done nothing. **Herdr cannot see that state**: it reports a kimi pane as `agent_status: working` with `screen_detection_skipped: true` while the prompt is up, so the BLOCKED-STATE watcher below is blind on this vendor and the spawn flag is the ONLY control. Every vendor you spawn needs its auto-approve form named here; a vendor absent from this list is a seat that will hang.
+2. **Orchestrator**: First consume a successful `tickmarkr fleet --pick consult` in the seat repository, per the Fleet selection contract below; then launch the returned adapter/model with your agent host.
+   - **On herdr (`HERDR_ENV=1`)**: Spawning on current herdr is two-step — the one-shot `agent start --cwd` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138): first create the pane with `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` and parse `result.root_pane.pane_id` from its JSON, then start the agent in it. For Claude Code, use `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions` (append `--model <picked-model>` after the `--` from the Fleet receipt). For Codex, use `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` (add `--model <picked-model>` from the Fleet receipt). The unsandboxed flag is REQUIRED: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation — do not downgrade it. Workers you never spawn — tickmarkr spawns its own visible worker panes. Auxiliary agents you do spawn (consultants, reviewers, scouts) follow the same forms: never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions --settings '{"promptSuggestionEnabled":false}'`. **For a codex consultant, use `-a never --sandbox workspace-write` — NOT `--sandbox read-only`.** ⚠ **`--sandbox read-only` CONTRADICTS this skill's own completion protocol and will hang the seat.** Every seat you spawn is told to deliver an ARTIFACT ending in a terminal MARKER, because that is the only completion signal the artifact watcher can key on (`done` is turn end). A read-only sandbox cannot write that artifact, so codex blocks on `Would you like to make the following edits?` for its OWN report — and the report exists ONLY in the pending edit, so abandoning the prompt destroys the work rather than merely delaying it. Measured 2026-08-28: a consultant spawned `--sandbox read-only` finished a 14,604-byte verdict, sat blocked on the write, and the operator saw the prompt before the supervising tier did. `read-only` is correct ONLY for a seat that writes nothing at all — which, under the artifact+marker rule, is no seat this skill tells you to spawn. When the prompt does appear, answer **"Yes, and don't ask again for these files"** rather than plain yes: plain yes re-blocks on the next write of the same file. **That `--settings` pair is not cosmetic and it is not optional:** claude-code's AUTOSUGGEST renders context-plausible ghost text into an idle seat's prompt line that is BYTE-IDENTICAL to a typed draft in text-format reads (OBS-482), so a supervising tier cannot tell a seat's own unsent work from a rendering artifact without `agent read --format ansi`. Turning the suggester off at spawn removes the ambiguity at its source instead of paying for the discrimination at every read. Verified against the shipped binary: `claude --settings '{"promptSuggestionEnabled":false}' -p …` exits 0 with a real response, and the key appears in the binary's own settings schema. **For kimi, pass `-y`** (`herdr agent start <name> --kind kimi --pane <id> -- -y`) — the adapter already launches its own workers that way (`src/adapters/kimi.ts:204`), and a kimi seat spawned without it sits on an approval prompt having done nothing. **Herdr cannot see that state**: it reports a kimi pane as `agent_status: working` with `screen_detection_skipped: true` while the prompt is up, so the BLOCKED-STATE watcher below is blind on this vendor and the spawn flag is the ONLY control. Every vendor you spawn needs its auto-approve form named here; a vendor absent from this list is a seat that will hang.
    - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: Seats spawn with `orca terminal create` on a path worktree selector with a command:
      `orca terminal create --worktree path:<repo> --title "ORCH · <version>" --command "<agent-cmd>" --json`
-     For Claude Code: `orca terminal create --worktree path:<repo> --title "ORCH · <version>" --command "claude --permission-mode bypassPermissions" --json`. For Codex: `orca terminal create --worktree path:<repo> --title "ORCH · <version>" --command "codex --dangerously-bypass-approvals-and-sandbox" --json`. Parse `result.terminal.handle` from the create receipt.
+     For Claude Code: `orca terminal create --worktree path:<repo> --title "ORCH · <version>" --command "claude --model <picked-model> --permission-mode bypassPermissions --settings '{\"promptSuggestionEnabled\":false}'" --json`. For Codex: `orca terminal create --worktree path:<repo> --title "ORCH · <version>" --command "codex --model <picked-model> --dangerously-bypass-approvals-and-sandbox" --json`. Parse `result.terminal.handle` from the create receipt.
 3. **Standing instructions travel as a brief FILE, never as pane text** — PTY input truncates at ~1024B and a
    truncated brief silently drops policy. Write the full brief to `<repo>/.tickmarkr/overseer/ORCH-BRIEF.md`
    (inside the tickmarkr state dir — already self-gitignored, no exclude step needed), then announce the brief file:
@@ -202,9 +210,46 @@ Inventories retain the **full suite log**, not a tail or summary, and no one run
 
 ### Seat-spawn and Leg-2 recipes
 
+**Fleet selection contract (OBS-1165), on BOTH hosts:** Before every supervisor-opened seat,
+including every respawn, replacement, delegated spawn and Leg-2 dispatch, run the applicable
+`tickmarkr fleet --pick <role>` in that seat's repository. Never reuse a prior pick at respawn.
+The purpose-to-role mapping is explicit:
+
+| Seat purpose | Fleet role | Vendor exclusions |
+| --- | --- | --- |
+| orchestrator | consult | Any vendors excluded for this mission |
+| records | consult | Any vendors excluded for this mission |
+| author (including planner, executor and scout) | consult | Any vendors excluded for this mission |
+| consultant | consult | Any vendors excluded for this mission or consultation round |
+| lab-rater | consult | Any vendors excluded for this rating round |
+| independent reviewer (including checker and verifier) | review | Author vendor plus every vendor already used by independent reviewers in this round, and mission exclusions |
+
+For example, an independent reviewer runs
+`tickmarkr fleet --pick review --exclude-vendor <author-vendor> --exclude-vendor <prior-reviewer-vendor>`;
+omit the prior-reviewer argument only for the first reviewer. Repeat `--exclude-vendor <vendor>`
+for every applicable exclusion on either role. Track the author's actual vendor and each reviewer's
+returned vendor in the seat record; if the author vendor is unknown, stop before review selection.
+Unknown seat purposes require an explicit mapping decision; never silently map them to consult.
+
+Consume only exit status zero and one complete JSON identity with `role`, `adapter`, `model`, `vendor`
+and `channel`. Validate the role and exclusions against the request and record this receipt with the
+seat. A nonzero refusal (including missing `<role>.prefer`, exhausted eligible preferences, or stale
+probe data) stops the spawn: report the named reason, never invent a default, auto-write preferences,
+or fall back to a remembered model. `fleet --print` and a preference list are not a resolved pick.
+
+Build the launch command from the returned `adapter` and `model`, shell-quoting the model as one
+argument: `claude-code` maps to executable/kind `claude` with `--model <picked-model>`, `codex` to
+`codex --model <picked-model>`, `kimi` to `kimi --model <picked-model>`, and `grok` to
+`grok -m <picked-model>`. Select only the matching adapter recipe below; examples do not choose
+models. If the returned adapter has no documented visible TUI recipe and approval flags, stop and
+report that transport limitation rather than substitute another adapter. Preserve the existing
+visible-seat transport safeguards: named interactive TUI seats, host-specific create receipts,
+orchestrator tab isolation, role-specific sandbox/approval flags, Claude prompt suggestions disabled,
+Kimi `-y`, artifact plus terminal marker, and verified file-brief delivery. Fleet pick never starts a seat.
+
 - **On herdr (`HERDR_ENV=1`)**: Every mission to a Claude or Grok seat is delivered only with `herdr pane run <pane> "<message>"` and
   verified by reading the pane back; never use `agent prompt` for mission delivery. Launch a Grok seat with
-  `herdr agent start <seat> --kind grok --pane <pane> -- -m grok-4.6`.
+  `herdr agent start <seat> --kind grok --pane <pane> -- -m <picked-model>`.
 - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: Seats spawn with `orca terminal create --worktree path:<repo> --command "<cmd>" --json`.
   **`--worktree path:` resolves only an Orca-MANAGED worktree** (`orca worktree list`); on any other checkout —
   a `git worktree add` the overseer made for a spec branch, a throwaway clone — `terminal create` hangs and
@@ -707,6 +752,40 @@ number — an unmeasured budget is not a small budget.
 
 Write the handoff and announce it with `orca terminal send --terminal <handle> --text "Read <handoff> and <brief>" --enter --wait-submit 15 --json`. Require observed submission (`result.send.prompt.stages.includes("turn_started")`) and inspect `orca terminal read --terminal <handle> --screen --json` before and after clearing. Arm file/journal and context evidence watchers for both seats.
 
+#### Opt-in Claude context sidecar — a Claude seat's `%` from disk (OBS-1122)
+
+A Claude seat's fill can also be read from a file instead of off its screen. It is opt-in, per seat,
+Claude only, and fully reversible. Claude has ONE `statusLine` slot and it belongs to the operator, so
+`scripts/context-statusline.sh` never takes it over: it **chains the operator's existing status
+command** — runs it with the same stdin and returns its stdout and exit status unchanged — and only as a
+side effect writes the payload's `context_window.used_percentage` (nothing else) to
+`.tickmarkr/overseer/context/<seat>.json` under the launch-supplied root, atomically (temp file +
+rename).
+
+1. **Record the operator's current `statusLine.command` verbatim in the brief** — it is the reversal.
+2. **The operator wraps it; this skill never edits their home configuration.** The wrapped command is
+   `<repo>/.claude/skills/tickmarkr-overseer/scripts/context-statusline.sh '<existing statusLine command>'`,
+   set in the same settings file, or in that one seat's launch `--settings` JSON so it ends with the seat.
+   With no existing command, omit the argument; the collector then prints nothing.
+3. **The launch recipe names the seat and its root:** start the Claude seat with
+   `TKR_CONTEXT_SEAT=<seat>` and `TKR_CONTEXT_ROOT=<absolute repo path>` in its environment. Only a safe
+   basename (`[A-Za-z0-9][A-Za-z0-9._-]{0,63}`) and an absolute root are accepted; anything else writes
+   nothing — never a sanitized name that could land in another seat's file — and a seat launched without
+   either collects nothing while its statusline still chains. The root never comes from the payload or
+   the seat's cwd: both can differ from the last valid payload's directory, which would let a malformed
+   payload's invalidation land in another tree while the stale number stayed readable.
+4. **Read:** `context-statusline.sh --read <seat> [<root>]` prints the percentage, or `unknown` when the
+   file is absent, malformed, attributed to another seat, older than 120 seconds, or the payload carried
+   no percentage. A malformed payload overwrites the seat's last number with no percentage, so a stale
+   good reading never outlives it. **`unknown` is never 0 %** — it sends you back to the screen read,
+   never to headroom.
+5. **Reverse:** restore the recorded command in the settings it came from, then remove
+   `.tickmarkr/overseer/context/`.
+
+**Codex seats stay screen-read.** The collector reads Claude's statusLine payload only, so it measures
+nothing about a Codex seat — its `--read` stays `unknown` — and a Codex seat's fill is read off its screen
+exactly as above.
+
 ### A GO has a deadline — arm the launch observer in the same act as the GO
 
 #### On herdr (`HERDR_ENV=1`) — launch watcher
@@ -790,14 +869,14 @@ they are left implicit:
    stall watcher to catch — silent-time equals lifetime. Standing operator rule since 2026-07-13:
    consults and one-off LLM calls run as the CLI's real interactive TUI in a visible named pane.
    Headless is for exit-code probes — a quota check that wants `rc`, never work anyone must watch.
-3. **Buy seat diversity from the live capability matrix, at every dispatch.** When one vendor's model
+3. **Buy seat diversity through Fleet, at every dispatch and respawn.** Resolve authors with `tickmarkr fleet --pick consult` and independent checkers/verifiers with `tickmarkr fleet --pick review --exclude-vendor <author-vendor>`, adding every applicable vendor exclusion under the Fleet selection contract. Consume the successful JSON adapter/model before using the visible-seat recipes; never select directly from doctor data. When one vendor's model
    quota collapses, the reflex is to collapse every seat onto the surviving model and hold the
    cross-vendor CLI back for a late probe — P97 ran planner, checker and verifier as one family that
    way, and three same-family passes confirmed one wrong anchored conclusion with the refuting fact in
    the room. `<state-dir>/doctor.json` already lists every installed+authed adapter and its models (nine
    were authed on 2026-08-17 while every seat ran claude). Priority when independence is scarce:
    **verifier > checker > planner > executors**.
-   - **On herdr (`HERDR_ENV=1`)** the independent seat goes cross-vendor with `herdr agent start … --kind codex`;
+   - **On herdr (`HERDR_ENV=1`)** the independent seat uses its Fleet-selected adapter kind and model with `herdr agent start … --kind <picked-kind> -- …`;
    - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)** it uses the Orca terminal-create
    seat recipe. The choice is ruled at dispatch, never debated under time pressure.
    **A codex seat inside a git WORKTREE cannot commit and cannot write outside the worktree** (OBS-824, measured

package/skills/tickmarkr-overseer/scripts/classify-vitest-log.sh

@@ -0,0 +1,88 @@
+#!/bin/bash
+# classify-vitest-log.sh <log> — the ONE strict Vitest log classifier (OBS-1184). The public CI
+# wrapper (scripts/run-ci-vitest.sh) and grade-ci.sh both call it, so the badge and the grade cannot
+# disagree. Reads a raw Vitest log or a gh job log (gh's "job<TAB>step<TAB>timestamp " prefix and ANSI
+# styling — the raw ESC byte and gh's `^[` rendering of it — are stripped) and prints ONE line:
+#   VITEST_LOG verdict=<CLEAN|RPC_ONLY|RED> reason=<why> summaries=S passed=P skipped=K failed=F
+#     timedout=T unhandled=U runner_rpc_timeouts=R coverage_misses=C signals=G terminal_errors=E
+# unhandled counts the unhandled errors that are NOT runner RPC timeouts. Exit 0 CLEAN or RPC_ONLY, 1 RED.
+#
+# RED unless every Vitest summary is complete (Test Files, Tests and Duration lines, and every
+# "Unhandled Errors" block closed by the summary that follows it — a cut-off log is RED), with no
+# failed file or test, no timed-out test or hook, no coverage-threshold ERROR, no npm signal line,
+# no unhandled error other than a vitest-worker RPC timeout, and no terminal error: a structural
+# "Unhandled Error", "Startup Error" or "Collect Error" banner outside Vitest's counted block — how
+# Vitest reports an exception thrown after the summary, such as a coverage-reporting failure, before it
+# exits 1 (terminal_errors counts them; an RPC timeout never offsets one). RPC_ONLY means unhandled
+# errors were present and EVERY one is such a timeout (OBS-1058: the starved 2-core runner talking,
+# not a test).
+#
+# Which timeouts count: only one that is ITSELF an unhandled entry — the first payload line under a
+# per-error header, nothing later. The header is Vitest's own structural line — a run of ⎯ on each side
+# of "Unhandled Error", nothing else on the line — so prose that merely contains the words never opens
+# a window, and the payload must be Vitest's whole line (`Error: [vitest-worker]: Timeout calling
+# "<method>"`), so an assertion quoting it stays RED. Per-error headers are honoured only inside
+# Vitest's own block — after its structural "Unhandled Errors" line and "Vitest caught N" tally, until
+# the file summary — and each block's count never exceeds its N, so a test that prints a header and a
+# timeout to stdout forges nothing. The tallies must also sum to the summaries' own "Errors N" lines
+# (Vitest prints both from one list), so a forged or a missing block is RED as well.
+set -u
+
+log=${1:?log path required}
+fields='summaries=0 passed=0 skipped=0 failed=0 timedout=0 unhandled=0 runner_rpc_timeouts=0 coverage_misses=0 signals=0 terminal_errors=0'
+if [ ! -s "$log" ] || [ ! -r "$log" ]; then
+  echo "VITEST_LOG verdict=RED reason=unreadable $fields"
+  exit 1
+fi
+
+esc=$(printf '\033')
+awk -v esc="$esc" '
+  function num(s, word) { return match(s, "[0-9]+ " word) ? substr(s, RSTART, RLENGTH) + 0 : 0 }
+  function close_block() { rpc += (found < cap ? found : cap); armed = 0; pending = 0 }
+  {
+    line = $0
+    gsub(/\^\[\[[0-9;]*m/, "", line); gsub(esc "\\[[0-9;]*m", "", line)
+    sub(/^[^\t]*\t[^\t]*\t[0-9T:.-]+Z[ ]?/, "", line)
+  }
+  line ~ /Test timed out|Error: Hook timed out/ { timedout++ }
+  line ~ /ERROR: Coverage for .* does not meet .*threshold/ { coverage++ }
+  line ~ /^npm (error|ERR!) signal / { signals++ }
+  line ~ /^(⎯)+ Unhandled Errors (⎯)+[ \t]*$/ { if (armed) close_block(); opening = 1; next }
+  opening && line !~ /[^ \t]/ { next }
+  opening {
+    opening = 0
+    if (line ~ /^Vitest caught [0-9]+ unhandled error/) { armed = 1; found = 0; cap = num(line, "unhandled"); tally += cap }
+    else untallied++
+  }
+  line ~ /^[ \t]*Test Files[ \t]/ {
+    if (armed) close_block()
+    summaries++; in_summary = 1; saw_tests = 0
+    failed += num(line, "failed"); passed += num(line, "passed"); skipped += num(line, "skipped")
+    next
+  }
+  in_summary && line ~ /^[ \t]*Tests[ \t]/ { saw_tests = 1; failed_tests += num(line, "failed"); next }
+  in_summary && line ~ /^[ \t]*Errors[ \t]+[0-9]+ error/ { summary_errors += num(line, "error"); next }
+  in_summary && line ~ /^[ \t]*Duration[ \t]/ { if (saw_tests) complete++; in_summary = 0; next }
+  armed && line ~ /^(⎯)+ Unhandled Error (⎯)+[ \t]*$/ { pending = 1; next }
+  line ~ /^(⎯)+ (Unhandled|Startup|Collect) Error (⎯)+[ \t]*$/ { terminal++; next }
+  pending && line ~ /[^ \t]/ { pending = 0; if (line ~ /^Error: \[vitest-worker\]: Timeout calling "[A-Za-z]+"[ \t]*$/) found++ }
+  END {
+    unhandled = tally + untallied
+    if (summary_errors > unhandled) unhandled = summary_errors
+    other = unhandled - rpc
+    if (summaries == 0) reason = "no-summary"
+    else if (complete != summaries || opening || armed) reason = "truncated"
+    else if (failed || failed_tests) reason = "failed"
+    else if (timedout) reason = "timed-out"
+    else if (coverage) reason = "coverage-threshold"
+    else if (signals) reason = "signal"
+    else if (terminal) reason = "terminal-error"
+    else if (other > 0) reason = "unhandled-error"
+    else if (tally + untallied != summary_errors) reason = "unhandled-mismatch"
+    verdict = reason != "" ? "RED" : (unhandled > 0 ? "RPC_ONLY" : "CLEAN")
+    if (reason == "") reason = "none"
+    printf "VITEST_LOG verdict=%s reason=%s summaries=%d passed=%d skipped=%d failed=%d timedout=%d unhandled=%d runner_rpc_timeouts=%d coverage_misses=%d signals=%d terminal_errors=%d\n", \
+      verdict, reason, summaries, passed, skipped, failed, timedout, other, rpc, coverage, signals, terminal
+    exit (verdict == "RED")
+  }
+' "$log"

package/skills/tickmarkr-overseer/scripts/context-statusline.sh

@@ -0,0 +1,81 @@
+#!/bin/bash
+# context-statusline.sh — opt-in Claude statusLine sidecar: a seat's context % on disk (OBS-1122).
+#
+# Claude has ONE statusLine slot and it is the operator's. This collector never takes it over: it CHAINS
+# the operator's existing command — same stdin, its stdout and exit status returned unchanged — and only
+# as a side effect writes the payload's `context_window.used_percentage` to
+# `$TKR_CONTEXT_ROOT/.tickmarkr/overseer/context/<seat>.json`, atomically (temp file + rename).
+# Nothing else from the payload is kept. A malformed payload still writes the seat's record — with no
+# percentage — so the last good number is invalidated, never left standing. The destination never
+# depends on the payload or the process cwd: a malformed payload names no directory, and a cwd can drift,
+# so either would let the invalidation land in another tree while the stale number stays readable.
+# Every collector failure is swallowed: the operator's statusline must never break because the sidecar did.
+#
+# Seat AND root come ONLY from the seat's launch recipe: TKR_CONTEXT_SEAT must be a safe basename
+# ([A-Za-z0-9][A-Za-z0-9._-]{0,63}) and TKR_CONTEXT_ROOT an absolute path. Either unset or unsafe means
+# nothing is written — never a sanitized name, which could land in another seat's file.
+#
+# Reading is fail-closed to `unknown`, NEVER 0: absent, malformed, attributed to another seat, older than
+# 120 s (or dated in the future), or a payload that carried no percentage all read `unknown`. Claude only:
+# a Codex seat has no such payload and stays screen-read.
+#
+# usage:
+#   statusLine command:  TKR_CONTEXT_SEAT=<seat> TKR_CONTEXT_ROOT=<abs repo> in the seat's env, then
+#                        context-statusline.sh '<existing statusLine command>'   (no argument: prints nothing)
+#   read:                context-statusline.sh --read <seat> [<project-dir>]       → <pct> | unknown
+set -u
+
+PY='
+import json, os, re, sys, tempfile, time
+MAX_AGE_S = 120
+mode, seat, root = sys.argv[1], sys.argv[2], sys.argv[3]
+if not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9._-]{0,63}", seat) or not os.path.isabs(root):
+    sys.exit(1)
+ctx = os.path.join(root, ".tickmarkr", "overseer", "context")
+def pct_of(value):
+    ok = isinstance(value, (int, float)) and not isinstance(value, bool) and 0 <= value <= 100
+    return value if ok else None
+def field(obj, *keys):
+    for key in keys:
+        obj = obj.get(key) if isinstance(obj, dict) else None
+    return obj
+if mode == "collect":
+    try:
+        payload = json.load(sys.stdin)
+    except Exception:
+        payload = None  # malformed: still recorded below, as no percentage
+    pct = pct_of(field(payload, "context_window", "used_percentage"))
+    os.makedirs(ctx, exist_ok=True)
+    fd, tmp = tempfile.mkstemp(dir=ctx, prefix="." + seat + ".", suffix=".tmp")
+    try:
+        with os.fdopen(fd, "w") as f:
+            json.dump({"seat": seat, "pct": pct, "ts": time.time()}, f)
+        os.replace(tmp, os.path.join(ctx, seat + ".json"))
+    except BaseException:
+        os.unlink(tmp)
+        raise
+else:
+    with open(os.path.join(ctx, seat + ".json")) as f:
+        record = json.load(f)
+    ts, pct = record.get("ts"), pct_of(record.get("pct"))
+    age = time.time() - ts if isinstance(ts, (int, float)) and not isinstance(ts, bool) else None
+    if record.get("seat") != seat or pct is None or age is None or not -5 <= age <= MAX_AGE_S:
+        sys.exit(1)
+    print(int(pct) if pct == int(pct) else pct)
+'
+
+if [ "${1:-}" = "--read" ]; then
+  python3 -c "$PY" read "${2:-}" "${3:-$PWD}" 2>/dev/null || echo unknown
+  exit 0
+fi
+
+# $(...) strips trailing newlines; the sentinel keeps stdin byte-for-byte
+# ponytail: bash drops NUL bytes, which a JSON statusLine payload never carries
+payload=$(cat; printf .)
+payload=${payload%.}
+if [ -n "${TKR_CONTEXT_SEAT:-}" ] && [ -n "${TKR_CONTEXT_ROOT:-}" ]; then
+  printf '%s' "$payload" | python3 -c "$PY" collect "$TKR_CONTEXT_SEAT" "$TKR_CONTEXT_ROOT" >/dev/null 2>&1
+fi
+[ $# -eq 0 ] && exit 0
+# the operator's command runs exactly as Claude ran it (a shell string), so its output and status are its own
+printf '%s' "$payload" | /bin/sh -c "$*"

package/skills/tickmarkr-overseer/scripts/grade-ci.sh

@@ -7,6 +7,7 @@ set -u
 run=${1:?run id required}
 expected=${2:?expected tracked test-file count required}
 tag=${3:-$run}
+here=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 repo=${TKR_GRADE_CI_REPO:-alzahrani-khalid/tickmarkr}
 out_dir=${TKR_GRADE_CI_DIR:-${TKR_STATE_DIR:-.tickmarkr}/overseer/diag}
 mkdir -p "$out_dir" || { echo "UNREADABLE: cannot create log directory $out_dir"; exit 2; }
@@ -14,6 +15,7 @@ mkdir -p "$out_dir" || { echo "UNREADABLE: cannot create log directory $out_dir"
 verdict=0
 mark_unreadable() { verdict=2; }
 mark_red() { [ "$verdict" -eq 0 ] && verdict=1; }
+field() { printf '%s\n' "$classified" | sed -n "s/^VITEST_LOG.* $1=\([^ ]*\).*/\1/p"; }
 
 jobs=$(gh run view "$run" --repo "$repo" --json jobs \
   --jq '.jobs[] | [.databaseId, .name, .status, (.conclusion // "")] | @tsv') \
@@ -46,45 +48,45 @@ while IFS=$'\t' read -r id name status conclusion; do
 
   oracle=$(grep -oE 'COUNT_ORACLE [A-Z]+ expected=[0-9A-Z]+ actual=[0-9A-Z]+' "$log" | tail -1)
   files=$(grep -oE 'Test Files .*' "$log" | sed 's/[[:space:]]*$//')
-  passed=$(printf '%s\n' "$files" | grep -oE '[0-9]+ passed' | awk '{s+=$1} END{print s+0}')
-  skipped=$(printf '%s\n' "$files" | grep -oE '[0-9]+ skipped' | awk '{s+=$1} END{print s+0}')
-  failed=$(printf '%s\n' "$files" | grep -oE '[0-9]+ failed' | awk '{s+=$1} END{print s+0}')
-  timedout=$(grep -cE 'Test timed out|Error: Hook timed out' "$log" || true)
-  # Vitest reports errors thrown outside any test (unhandled rejections, worker crashes) in an
-  # "Unhandled Errors" block that leaves the file summary green and the count oracle satisfied;
-  # its own tally line names how many. Any unhandled error is RED, never a green suite.
-  unhandled=$(grep -oE 'Vitest caught [0-9]+ unhandled error' "$log" | grep -oE '[0-9]+' | awk '{s+=$1} END{print s+0}')
-  if [ "$unhandled" -eq 0 ]; then
-    unhandled=$(grep -cE 'Unhandled Errors' "$log" || true)
-  fi
-  # OBS-1058 (RULING-231-17 precedent, v2.5.5 close R115 add.7): a vitest-worker RPC timeout
-  # ("Timeout calling \"onTaskUpdate\"") is the starved runner talking, not a test — every green
-  # release run has carried one. Only a timeout that is ITSELF an unhandled entry counts: the first
-  # payload line under a per-error header, nothing later. The header is Vitest's own structural line —
-  # a run of ⎯ on each side of "Unhandled Error", ANSI stripped (both the raw ESC byte and gh's `^[` rendering of it), nothing else on the line — so prose that
-  # merely contains the words never opens a window — and the payload must be Vitest's whole line
-  # (`Error: [vitest-worker]: Timeout calling "<method>"`), so an assertion quoting it stays RED. Per-error headers are honoured only inside Vitest's own block —
-  # after its structural "Unhandled Errors" line and "Vitest caught N" tally, until the file summary — and
-  # the count never exceeds N, so a test that prints a header and a timeout to stdout forges nothing. A stray diagnostic elsewhere in the log never
-  # offsets a real unhandled error; anything else under a header stays RED.
-  esc=$(printf '\033')
-  rpc=$(awk -v esc="$esc" '{ line = $0; gsub(/\^\[\[[0-9;]*m/, "", line); gsub(esc "\\[[0-9;]*m", "", line); sub(/^[^\t]*\t[^\t]*\t[0-9T:.-]+Z[ ]?/, "", line) }
-             line ~ /^(⎯)+ Unhandled Errors (⎯)+[ \t]*$/ { opening = 1; next }
-             opening && line !~ /[^ \t]/ { next }
-             opening { opening = 0; if (line ~ /^Vitest caught [0-9]+ unhandled error/) { armed = 1; cap = line; sub(/^Vitest caught /, "", cap); sub(/ .*$/, "", cap) } }
-             armed && line ~ /^[ \t]*Test Files / { armed = 0 }
-             armed && line ~ /^(⎯)+ Unhandled Error (⎯)+[ \t]*$/ { pending = 1; next }
-             pending && line ~ /[^ \t]/ { pending = 0; if (line ~ /^Error: \[vitest-worker\]: Timeout calling "[A-Za-z]+"[ \t]*$/) n++ }
-             END { if (n > cap + 0) n = cap + 0; print n + 0 }' "$log")
-  if [ "$rpc" -gt 0 ] && [ "$unhandled" -ge "$rpc" ]; then unhandled=$((unhandled - rpc)); fi
+  # OBS-1184: the log verdict comes from the ONE classifier the public CI wrapper also uses
+  # (scripts/run-ci-vitest.sh), so the badge and this grade cannot disagree. Its rules — complete
+  # summaries, failed/timed-out tests, coverage-threshold misses, and the RPC-timeout-only exception
+  # to "any unhandled error is RED" (OBS-1058) — live in classify-vitest-log.sh, stated once there.
+  classified=$(bash "$here/classify-vitest-log.sh" "$log" 2>&1)
+  log_verdict=$(field verdict)
+  passed=$(field passed); skipped=$(field skipped); failed=$(field failed); timedout=$(field timedout)
+  unhandled=$(field unhandled); rpc=$(field runner_rpc_timeouts); coverage=$(field coverage_misses)
   errors=$(grep -oE '##\[error\].*' "$log" | sort | uniq -c | sed 's/^ *//' | tr '\n' ';')
+  # The commands' own outcomes stand, as in the wrapper: GREEN needs a success conclusion with no step
+  # exit annotation, or a failure explained ONLY by steps that exited exactly 1 on a log of their own
+  # (gh's step column) that the classifier calls RPC_ONLY — the one exception run-ci-vitest.sh grants
+  # (a pre-wrapper run concludes failure on it). Any other code (2, a signal's 137), an unexplained
+  # failure, or a cancelled, timed-out or missing conclusion is RED.
+  exits=$(grep -E '##\[error\]Process completed with exit code [0-9]+' "$log")
+  case "$conclusion" in
+    success) outcome=ok ;;
+    failure) if [ -n "$exits" ]; then outcome=ok; else outcome=unexplained-failure; fi ;;
+    *) outcome="conclusion-${conclusion:-none}" ;;
+  esac
+  if [ -n "$exits" ]; then
+    while IFS= read -r exit_line; do
+      code=$(printf '%s\n' "$exit_line" | sed -E 's/.*Process completed with exit code ([0-9]+).*/\1/')
+      if [ "$code" != 1 ]; then outcome="exit-$code"; break; fi
+      step=$(printf '%s\n' "$exit_line" | awk -F'\t' 'NF >= 3 { print $2 }')
+      awk -F'\t' -v s="$step" 'NF >= 3 && $2 == s' "$log" > "$log.step"
+      case $(bash "$here/classify-vitest-log.sh" "$log.step" 2>&1) in
+        "VITEST_LOG verdict=RPC_ONLY "*) ;;
+        *) outcome="exit-1-not-rpc-only"; break ;;
+      esac
+    done <<< "$exits"
+  fi
 
-  echo "$name: oracle=[${oracle:-MISSING}] files=[$(printf '%s' "$files" | tr '\n' '|')] passed=$passed skipped=$skipped failed=$failed timedout=$timedout unhandled=$unhandled runner_rpc_timeouts=${rpc:-0} errors=[$errors]"
-  if [ -z "$oracle" ] || [ -z "$files" ]; then
+  echo "$name: oracle=[${oracle:-MISSING}] files=[$(printf '%s' "$files" | tr '\n' '|')] passed=$passed skipped=$skipped failed=$failed timedout=$timedout unhandled=$unhandled runner_rpc_timeouts=$rpc coverage_misses=$coverage log=[$(field reason)] outcome=[$outcome] errors=[$errors]"
+  if [ -z "$oracle" ] || [ -z "$files" ] || [ -z "$log_verdict" ]; then
     echo "$name: UNREADABLE"
     mark_unreadable
   elif [ "$oracle" = "COUNT_ORACLE GREEN expected=$expected actual=$expected" ] \
-       && [ "$failed" -eq 0 ] && [ "$timedout" -eq 0 ] && [ "$unhandled" -eq 0 ] \
+       && { [ "$log_verdict" = CLEAN ] || [ "$log_verdict" = RPC_ONLY ]; } && [ "$outcome" = ok ] \
        && [ $((passed + skipped)) -eq "$expected" ]; then
     echo "$name: GREEN"
   else

package/skills/tickmarkr-overseer/scripts/watch-journal.sh

@@ -72,7 +72,8 @@ field() { printf '%s' "$2" | sed -n "s/.*\"$1\":\"\([^\"]*\)\".*/\1/p" | head -1
 bucket() { printf '%s' "$2" | sed -n "s/.*\"$1\":\[\([^]]*\)\].*/\1/p" | head -1; }
 
 report() {
-  local line="$1" run="$2" ev
+  # $3 is the row's physical journal line: with its ts it is the token a decision binds to (OBS-1178)
+  local line="$1" run="$2" at="${3:-}" ev
   ev=$(field event "$line")
   case "$ev" in
     run-end)
@@ -98,12 +99,13 @@ report() {
     task-human)
       echo "TASK_HUMAN $(field taskId "$line") — $run"
       echo "  $(printf '%s' "$line" | sed -n 's/.*"reason":"\([^"]\{0,160\}\).*/\1/p')"
-      echo "  a park waits for a DECISION; read the gate evidence, then \`tickmarkr approve $run $(field taskId "$line")\` or re-scope"
+      echo "  a park waits for a DECISION; read the gate evidence, then \`tickmarkr approve $run $(field taskId "$line") --park $at@$(field ts "$line")\` (bound to THIS park; refused once a newer one opens) or re-scope"
       ;;
     task-failed)
       echo "TASK_FAILED $(field taskId "$line") — $run"
       echo "  $(printf '%s' "$line" | sed -n 's/.*"error":"\([^"]\{0,160\}\).*/\1/p')"
       echo "  the run may continue on independent tasks; this task did not deliver"
+      echo "  landed commits re-gate with \`tickmarkr approve $run $(field taskId "$line") --recheck --park $at@$(field ts "$line")\` (its bound failure token)"
       ;;
     consult-verdict)
       echo "CONSULT_VERDICT $(field taskId "$line") action=$(field action "$line") — $run"
@@ -127,9 +129,9 @@ while [ "$elapsed" -lt "$CAP" ]; do
   # A new run resets the baseline — its whole journal is unseen by definition.
   if [ "$J" != "$seen_run" ]; then seen_run="$J"; base=0; fi
 
-  hit=$(since_arm "$J" | grep -E "$PAT" | head -1)
+  hit=$(since_arm "$J" | grep -n -E "$PAT" | head -1)
   if [ -n "$hit" ]; then
-    report "$hit" "$(basename "$(dirname "$J")")"
+    report "${hit#*:}" "$(basename "$(dirname "$J")")" "$((base + ${hit%%:*}))"
     exit 0
   fi
 done