tickmarkr 2.6.4 → 2.6.5

package/dist/tui/cockpit/live-store.d.ts

@@ -1,5 +1,5 @@
 import { type JournalEvent } from "../../run/journal.js";
-import { type OperatorRecord } from "../../run/operator-state.js";
+import { type OperatorRecord, type OwedAuthority } from "../../run/operator-state.js";
 export declare const OBSERVATION_INTERVAL_MS = 1000;
 /** Stat-to-fstat observations one poll spends on a journal a writer keeps appending to. */
 export declare const APPEND_RACE_OBSERVATIONS = 3;
@@ -27,9 +27,12 @@ export interface JournalLine extends Omit<OperatorRecord, "event"> {
     endOffset: number;
 }
 export interface TailSnapshot {
+    /** `digest` (I2): sha256 of every byte the tail consumed, [0, offset) — the bytes its fold was built from. */
     source: string;
     generation: number;
     identity?: string;
+    version?: string;
+    digest: string;
     offset: number;
     lines: number;
     history: readonly JournalLine[];
@@ -64,11 +67,17 @@ export declare class JournalTail {
     private lastSuccessfulReadAt?;
     private failure?;
     private stale;
+    private hash;
+    private invalid;
     constructor(source: string, hooks?: {
         record?: (record: OperatorRecord) => void;
         reset?: () => void;
     });
     private reset;
+    /** I2: the consumed prefix was found rewritten (an in-place rewrite then growth reads as an append), so the
+     * next poll treats the file as replaced and refolds it from its first byte. */
+    invalidate(): void;
+    get invalidated(): boolean;
     /** A same-inode append between stat and fstat is retried; exhaustion keeps the last good snapshot, pending. */
     poll(now?: number): TailSnapshot;
     /** One stat-to-fstat observation. False when an append raced it; nothing was consumed or reset. */
@@ -86,6 +95,18 @@ export interface CachedSource<T = unknown> {
     error?: string;
     observedAt: number;
 }
+/** I2: the journal basis an owed-check fold read — the observed file version, its generation and the bytes consumed. */
+export declare const journalBasis: (journal: TailSnapshot) => string;
+/** I2: the bytes the tail consumed are no longer the file's prefix — rewritten in place, then grown. */
+export declare class JournalRewritten extends Error {
+    constructor();
+}
+/** I2 (D-857): the ONE way any reader beside the tail gets `journal`'s bytes — every consumed byte of the very
+ * file version the tail observed (an in-place rewrite, even an equal-length one, changes it), stamped before
+ * and after the read, and proved by digest to be the very bytes the tail's fold consumed (a rewrite followed by
+ * growth keeps the tail appending). Any change throws, so no second read is ever combined with this
+ * observation's lifecycle, owed or basis. */
+export declare function readObservedJournal(journal: TailSnapshot): Buffer;
 export interface LiveStoreOptions {
     cwd: string;
     runId: string;
@@ -102,6 +123,7 @@ export declare function createLiveStore(options: LiveStoreOptions): {
         delayed: boolean;
         freshness: string;
         operator: import("../../run/operator-state.js").OperatorSnapshot;
+        owed: OwedAuthority | undefined;
         journal: TailSnapshot;
         graph: CachedSource<{
             version: 1;
@@ -204,6 +226,7 @@ export declare function createLiveStore(options: LiveStoreOptions): {
         delayed: boolean;
         freshness: string;
         operator: import("../../run/operator-state.js").OperatorSnapshot;
+        owed: OwedAuthority | undefined;
         journal: TailSnapshot;
         graph: CachedSource<{
             version: 1;

package/dist/tui/cockpit/live-store.js

@@ -1,8 +1,9 @@
+import { createHash } from "node:crypto";
 import { closeSync, fstatSync, openSync, readSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { graphPath, stateDirName } from "../../graph/graph.js";
 import { validateGraph } from "../../graph/schema.js";
-import { parseRunId } from "../../run/journal.js";
+import { foldOwedChecks, parseJournalText, parseRunId } from "../../run/journal.js";
 import { isPidLive, STALE_MS } from "../../run/lock.js";
 import { readTierLiveness, SUPERVISION_TIERS } from "../../run/supervision.js";
 import { OperatorStateFold } from "../../run/operator-state.js";
@@ -14,6 +15,12 @@ export const STORE_LIMITS = { graphBytes: 16 * 1024 * 1024, history: 256, histor
 const errorText = (e) => e instanceof Error ? e.message : String(e);
 const fileIdentity = (st) => `${st.dev}:${st.ino}`;
 const stamp = (st) => `${fileIdentity(st)}:${st.size}:${st.mtimeNs}:${st.ctimeNs}`;
+/** The one record shape the tail accepts; the complete-journal (owed) read validates against it too. */
+const isJournalRecord = (e) => {
+    const r = e;
+    return !!r && typeof r === "object" && typeof r.ts === "string" && Number.isFinite(Date.parse(r.ts)) && typeof r.event === "string"
+        && !!r.data && typeof r.data === "object" && !Array.isArray(r.data) && (r.taskId === undefined || typeof r.taskId === "string");
+};
 function decodeLine(bytes, source, line, offset, endOffset, generation, oversized = false) {
     const base = { source, line, id: `${source}#L${line}`, offset, endOffset, generation };
     let raw = "";
@@ -24,7 +31,7 @@ function decodeLine(bytes, source, line, offset, endOffset, generation, oversize
         if (!raw.trim())
             return { ...base, raw };
         const e = JSON.parse(raw);
-        if (!e || typeof e !== "object" || typeof e.ts !== "string" || !Number.isFinite(Date.parse(e.ts)) || typeof e.event !== "string" || !e.data || typeof e.data !== "object" || Array.isArray(e.data) || (e.taskId !== undefined && typeof e.taskId !== "string"))
+        if (!isJournalRecord(e))
             throw new Error("invalid journal record");
         return { ...base, raw, event: e };
     }
@@ -51,6 +58,8 @@ export class JournalTail {
     lastSuccessfulReadAt;
     failure;
     stale = false;
+    hash = createHash("sha256");
+    invalid = false;
     constructor(source, hooks = {}) {
         this.source = source;
         this.hooks = hooks;
@@ -66,8 +75,14 @@ export class JournalTail {
         this.errors = [];
         this.malformedCount = 0;
         this.generation++;
+        this.hash = createHash("sha256");
+        this.invalid = false;
         this.hooks.reset?.();
     }
+    /** I2: the consumed prefix was found rewritten (an in-place rewrite then growth reads as an append), so the
+     * next poll treats the file as replaced and refolds it from its first byte. */
+    invalidate() { this.invalid = true; }
+    get invalidated() { return this.invalid; }
     /** A same-inode append between stat and fstat is retried; exhaustion keeps the last good snapshot, pending. */
     poll(now = Date.now()) {
         try {
@@ -94,7 +109,7 @@ export class JournalTail {
             const st = statSync(this.source, { bigint: true });
             if (!st.isFile())
                 throw new Error("journal source is not a regular file");
-            const replaced = !this.st || fileIdentity(st) !== fileIdentity(this.st) || st.size < this.st.size || (st.size === this.st.size && stamp(st) !== stamp(this.st));
+            const replaced = this.invalid || !this.st || fileIdentity(st) !== fileIdentity(this.st) || st.size < this.st.size || (st.size === this.st.size && stamp(st) !== stamp(this.st));
             if (Number(st.size) > (replaced ? 0 : this.offset)) {
                 fd = openSync(this.source, "r");
                 const opened = fstatSync(fd, { bigint: true });
@@ -115,6 +130,7 @@ export class JournalTail {
                         throw new Error("journal truncated during read");
                     this.bytesRead += count;
                     remaining -= count;
+                    this.hash.update(buffer.subarray(0, count));
                     let begin = 0;
                     for (let index = 0; index < count; index++)
                         if (buffer[index] === 10) {
@@ -158,7 +174,7 @@ export class JournalTail {
     }
     snapshot() {
         return {
-            source: this.source, generation: this.generation, identity: this.st && fileIdentity(this.st), offset: this.offset, lines: this.line,
+            source: this.source, generation: this.generation, identity: this.st && fileIdentity(this.st), version: this.st && stamp(this.st), digest: this.hash.copy().digest("hex"), offset: this.offset, lines: this.line,
             history: this.history.slice(), errors: this.errors.slice(), malformedCount: this.malformedCount,
             pending: this.carryBytes ? { line: this.line + 1, bytes: this.carryBytes } : undefined,
             backlogBytes: Math.max(0, Number(this.st?.size ?? 0) - this.offset),
@@ -262,6 +278,48 @@ class JsonSource {
         }
     }
 }
+/** I2: the journal basis an owed-check fold read — the observed file version, its generation and the bytes consumed. */
+export const journalBasis = (journal) => `${journal.source}:${journal.generation}:${journal.version}:${journal.offset}`;
+const unknownOwed = (reason) => ({ known: false, debt: "unknown", outstanding: [], acceptedRisk: [], discharged: [], unknown: [{ reason }] });
+/** I2: the bytes the tail consumed are no longer the file's prefix — rewritten in place, then grown. */
+export class JournalRewritten extends Error {
+    constructor() { super("journal prefix rewritten since the tail consumed it"); }
+}
+/** I2 (D-857): the ONE way any reader beside the tail gets `journal`'s bytes — every consumed byte of the very
+ * file version the tail observed (an in-place rewrite, even an equal-length one, changes it), stamped before
+ * and after the read, and proved by digest to be the very bytes the tail's fold consumed (a rewrite followed by
+ * growth keeps the tail appending). Any change throws, so no second read is ever combined with this
+ * observation's lifecycle, owed or basis. */
+export function readObservedJournal(journal) {
+    const fd = openSync(journal.source, "r");
+    try {
+        const observed = () => { if (stamp(fstatSync(fd, { bigint: true })) !== journal.version)
+            throw new Error("journal changed since its observation"); };
+        observed();
+        const bytes = Buffer.alloc(journal.offset);
+        for (let length = 0; length < bytes.length;) {
+            const n = readSync(fd, bytes, length, bytes.length - length, length);
+            if (!n)
+                throw new Error("journal truncated since its observation");
+            length += n;
+        }
+        observed();
+        if (createHash("sha256").update(bytes).digest("hex") !== journal.digest)
+            throw new JournalRewritten();
+        return bytes;
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** The complete journal behind `journal`'s basis: its observed bytes, every non-blank line a valid record. */
+function readLedger(journal) {
+    const text = new TextDecoder("utf-8", { fatal: true }).decode(readObservedJournal(journal));
+    const events = parseJournalText(text);
+    if (events.length !== text.split("\n").filter(line => line.trim()).length || !events.every(isJournalRecord))
+        throw new Error("complete journal holds an invalid line");
+    return events;
+}
 /** C1 mount/C6 reader boundary. No timers or presence writes: the mount owns scheduling and disarm. */
 export function createLiveStore(options) {
     const now = options.now ?? Date.now;
@@ -285,10 +343,41 @@ export function createLiveStore(options) {
     let disposed = false;
     let queued;
     const metrics = [];
+    // I2: the complete journal is re-read only when its basis moves; its owed fold re-reads every discharge
+    // artifact on every observation, and only the immutable git re-proof is reused through this store's memo.
+    // ponytail: an ended run's whole parsed journal stays resident; fold a debt-only projection if that measures large.
+    const owedMemo = new Set();
+    let ledger;
+    const owedAuthority = (journal) => {
+        const basis = journalBasis(journal);
+        if (ledger?.basis !== basis) {
+            // Never cache a failure: only a successful read is reused; a failed one is unknown debt now and re-read next observation.
+            try {
+                ledger = { basis, events: readLedger(journal) };
+            }
+            catch (e) {
+                ledger = undefined;
+                if (e instanceof JournalRewritten)
+                    tail.invalidate();
+                return { basis, fold: unknownOwed(`complete journal unreadable: ${errorText(e)}`) };
+            }
+        }
+        return { basis, fold: foldOwedChecks(ledger.events, options.cwd, owedMemo) };
+    };
     function observe() {
         const observedAt = now();
         const delayed = lastObservation !== undefined && observedAt - lastObservation > 2 * OBSERVATION_INTERVAL_MS;
-        const journal = tail.poll(observedAt);
+        const isReadable = (j) => j.status === "readable" && j.backlogBytes === 0;
+        // Debt decides only an ended run's headline; a running or unreadable journal never pays for the fold.
+        const owedOf = (j) => isReadable(j) && fold.ended ? owedAuthority(j) : undefined;
+        let journal = tail.poll(observedAt);
+        let owed = owedOf(journal);
+        // I2: the owed read found the tail's consumed prefix rewritten, so its fold (lifecycle) is stale. Refold the
+        // whole file now: lifecycle and debt then come from the same bytes. A repeat rewrite is unknown debt.
+        if (tail.invalidated) {
+            journal = tail.poll(observedAt);
+            owed = owedOf(journal);
+        }
         const graphReading = graph.read(observedAt);
         const configReading = config.read(observedAt);
         const cacheReading = cache.read(observedAt);
@@ -301,11 +390,13 @@ export function createLiveStore(options) {
         if (metrics.length > STORE_LIMITS.metrics)
             metrics.shift();
         lastObservation = observedAt;
-        const readable = journal.status === "readable" && journal.backlogBytes === 0;
+        const readable = isReadable(journal);
         return {
             sequence: ++sequence, observedAt, delayed, freshness: errors.length ? "failed" : delayed ? "delayed" : "fresh",
-            operator: fold.snapshot({ graph: graphReading.status === "readable" ? graphReading.value : undefined, sequence, observedAt, readable, graphAvailability: { status: graphReading.status, error: graphReading.error } }),
-            journal, graph: graphReading, config: configReading, cache: cacheReading,
+            // I1: only this run's own lock naming a provably-dead (ESRCH) holder settles unfinished cells; an alive,
+            // EPERM, foreign, unreadable or absent lock is not proof the work stopped.
+            operator: fold.snapshot({ graph: graphReading.status === "readable" ? graphReading.value : undefined, sequence, observedAt, readable, graphAvailability: { status: graphReading.status, error: graphReading.error }, daemonDead: lockState === "dead", owed, basis: journalBasis(journal) }),
+            owed, journal, graph: graphReading, config: configReading, cache: cacheReading,
             lock: { ...owner, state: lockState, alive, expired: owner.identity ? observedAt - Number(owner.identity.split(":")[3]) / 1e6 > STALE_MS : undefined },
             supervision, errors, actionsEnabled: readable && !errors.length && !delayed,
             viewport, inputSequence, metrics: metrics.slice(),

package/dist/tui/cockpit/log-view.d.ts

@@ -0,0 +1,28 @@
+import type { JournalEvent } from "../../run/journal.js";
+import { type JournalLine, type TailSnapshot } from "./live-store.js";
+/** The board uses the daemon's TTY narration, including its suppression and sanitization. */
+export declare const renderLogLines: (events: readonly JournalEvent[], runId: string, columns: number) => string[];
+export interface LogRow {
+    line: number;
+    text: string;
+}
+export interface LogPage {
+    rows: readonly LogRow[];
+    error?: string;
+}
+type PageReader = (firstLine: number, count?: number, generation?: number) => readonly JournalLine[];
+interface LogSource {
+    journal: TailSnapshot;
+    page: PageReader;
+    runId: string;
+    columns: number;
+}
+/** Demand-page backwards to fill the viewport, including events outside the store's retained tail.
+ * Only the requested visible rows survive; suppressed events never consume viewport rows. */
+export declare function readLogPage(source: LogSource, count: number, end?: number): LogPage;
+/** Move by visible narration rows. Undefined means follow the journal tail again. */
+export declare function moveLogEnd(source: LogSource, end: number | undefined, delta: number): number | undefined;
+export declare function LogView({ page }: {
+    page: LogPage;
+}): import("react").JSX.Element;
+export {};

package/dist/tui/cockpit/log-view.js

@@ -0,0 +1,60 @@
+import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
+import { Box, Text } from "ink";
+import { narrationRow } from "../../cli/commands/run.js";
+import { STORE_LIMITS } from "./live-store.js";
+/** The board uses the daemon's TTY narration, including its suppression and sanitization. */
+export const renderLogLines = (events, runId, columns) => events.map(event => narrationRow(event, runId, columns)).filter((line) => line !== null);
+const narrate = (rows, source) => rows.flatMap(row => row.event
+    ? renderLogLines([row.event], source.runId, source.columns).map(text => ({ line: row.line, text })) : []);
+/** Demand-page backwards to fill the viewport, including events outside the store's retained tail.
+ * Only the requested visible rows survive; suppressed events never consume viewport rows. */
+export function readLogPage(source, count, end = source.journal.lines) {
+    let cursor = Math.min(end, source.journal.lines);
+    let rows = [];
+    try {
+        while (cursor > 0 && rows.length < count) {
+            const first = Math.max(1, cursor - STORE_LIMITS.history + 1);
+            const retained = source.journal.history.filter(row => row.line >= first && row.line <= cursor);
+            const page = retained.length === cursor - first + 1 ? retained
+                : source.page(first, cursor - first + 1, source.journal.generation);
+            rows = [...narrate(page, source), ...rows].slice(-count);
+            cursor = first - 1;
+        }
+        return { rows };
+    }
+    catch (error) {
+        return { rows: [], error: error instanceof Error ? error.message : String(error) };
+    }
+}
+/** Move by visible narration rows. Undefined means follow the journal tail again. */
+export function moveLogEnd(source, end, delta) {
+    const cursor = Math.min(end ?? source.journal.lines, source.journal.lines);
+    if (delta < 0) {
+        const rows = readLogPage(source, -delta + 1, cursor).rows;
+        return rows[Math.max(0, rows.length - 1 + delta)]?.line ?? end;
+    }
+    let first = cursor + 1, remaining = delta;
+    while (first <= source.journal.lines) {
+        const last = Math.min(source.journal.lines, first + STORE_LIMITS.history - 1);
+        let rows;
+        try {
+            rows = narrate(source.page(first, last - first + 1, source.journal.generation), source);
+        }
+        catch {
+            return end;
+        } // A stale journal observation must never terminate the board's key handler.
+        if (rows.length >= remaining) {
+            const line = rows[remaining - 1].line;
+            return line === source.journal.lines ? undefined : line;
+        }
+        remaining -= rows.length;
+        first = last + 1;
+    }
+    return undefined;
+}
+export function LogView({ page }) {
+    return _jsx(Box, { flexDirection: "column", children: page.error
+            ? _jsxs(Text, { children: ["Log unavailable: ", page.error] })
+            : page.rows.length ? page.rows.map(row => _jsx(Text, { wrap: "truncate-end", children: row.text }, row.line))
+                : _jsx(Text, { children: "No narrated events" }) });
+}

package/dist/tui/cockpit/run-view.js

@@ -98,6 +98,10 @@ export function runGateCells(task, evidence, rows = []) {
         else if (cell.state === "queued") {
             labels.push(`queued — ${row?.event?.event ?? "wait"}${typeof data.count === "number" ? ` (${data.count} suites)` : ""}`);
         }
+        else if (cell.state === "unknown" && row?.event?.event !== "gate-result") {
+            // I1: a start or wait row settled at a terminal boundary — no verdict ever measured it.
+            labels.push(`unknown — ${row?.event?.event ?? "start"} never finished`);
+        }
         else if (data.disabled === true) {
             labels.push("disabled by policy");
         }

package/dist/tui/cockpit/shell.d.ts

@@ -2,13 +2,14 @@ import { type ReactNode } from "react";
 import { type ShellPlan } from "./layout.js";
 import { SHELL_BINDINGS } from "./keys.js";
 import type { LiveStoreSnapshot } from "./live-store.js";
-export type ShellView = "home" | "run" | "evidence";
+export type ShellView = "home" | "run" | "evidence" | "log";
 export type ShellFocus = ShellPlan["focus"][number];
 export interface ShellState {
     view: ShellView;
     focus: ShellFocus;
     scroll: number;
     help: boolean;
+    logEnd?: number;
     evidenceSection?: number;
     canOpen?: boolean;
     shortcutColumns?: number;

package/dist/tui/cockpit/shell.js

@@ -13,7 +13,8 @@ export const shellHelp = (bindings = SHELL_BINDINGS) => [
     "Esc closes deepest overlay; it never quits.",
     "Text: q1? is literal; Enter applies; Esc cancels.",
     "Confirm: y alone confirms; n/Esc cancels.",
-    "Tab now moves focus; view numbers are 1/4/5.",
+    "Tab now moves focus; view numbers are 1/4/5/7.",
+    "Log: arrows/page keys scroll; f toggles tail follow.",
     "Fleet: tickmarkr fleet", "Plan: tickmarkr plan", "Health: tickmarkr doctor",
 ];
 /** Read the Yoga geometry that actually painted, including clipped/scrolled leaves.
@@ -65,10 +66,11 @@ export function CockpitShell({ snapshot, state, columns, rows, version, children
     const overlay = state.editor !== undefined ? [`${state.editorKind === "export" ? "Export destination" : "Filter"}: ${state.editor}`, "Enter Apply | Esc Cancel"] : state.overlay ?? (state.help ? shellHelp(bindings) : undefined);
     const totalRows = overlay?.length ?? contentRows;
     const displayOffset = overlay ? Math.min(state.overlayOffset, Math.max(0, totalRows - plan.bodyRows)) : scroll;
-    const position = `${totalRows ? displayOffset + 1 : 0}–${Math.min(totalRows, displayOffset + plan.bodyRows)}/${totalRows} | ${Math.max(0, totalRows - plan.bodyRows)} hidden`;
+    const logMode = state.view === "log" ? `${state.logEnd === undefined ? "FOLLOW" : "PAUSED"} | ` : "";
+    const position = `${logMode}${totalRows ? displayOffset + 1 : 0}–${Math.min(totalRows, displayOffset + plan.bodyRows)}/${totalRows} | ${Math.max(0, totalRows - plan.bodyRows)} hidden`;
     const keybar = bindings.filter(b => ["focus", "open", "actions", "help", "quit"].includes(b.action) && (columns >= 60 || b.action !== "focus")).map(b => `${b.key} ${columns < 60 && b.action === "actions" ? "Act" : b.label}`).join(" | ");
     const status = columns < 60 ? `${op.label} | tip ${op.currentTip.toUpperCase()}` : `${op.label} | MERGED ${op.merged}/${op.planned ?? "?"} | CURRENT TIP ${op.currentTip.toUpperCase()} | ${snapshot.freshness}`;
     return _jsx(ShellPresentation.Provider, { value: true, children: _jsx(ShellTheme.Provider, { value: { mode: colour, palette }, children: _jsxs(Box, { ref: root, flexDirection: "column", width: columns, height: rows, flexShrink: 0, backgroundColor: ink(palette.surface), children: [line(`tickmarkr ${version} | ${state.view.toUpperCase()} | ${snapshot.journal.source.split("/").at(-2) ?? "run identity unknown"}`), line(columns < 60
-                        ? `1H 4R 5E | ${position}`
-                        : `1 Home  4 Run  5 Evidence | ${state.focus} | ${position}`), line("─".repeat(columns), columns, palette.chrome), _jsxs(Box, { height: plan.bodyRows, flexShrink: 0, flexDirection: "row", overflow: "hidden", children: [_jsx(Box, { width: 1, flexDirection: "column", children: Array.from({ length: plan.bodyRows }, (_, i) => _jsx(Text, { color: ink(palette.chrome), children: "\u2502" }, i)) }), plan.rail > 0 && _jsxs(_Fragment, { children: [_jsx(Box, { width: plan.rail, flexDirection: "column", children: ["1 Home", "4 Run", "5 Evidence", "", "CLI:", "fleet", "plan", "doctor"].map((t, i) => _jsx(Text, { color: ink(palette.chrome), children: fitCells(t, plan.rail) }, i)) }), _jsx(Box, { width: 1, flexDirection: "column", children: Array.from({ length: plan.bodyRows }, (_, i) => _jsx(Text, { color: ink(palette.chrome), children: "\u2502" }, i)) })] }), _jsxs(Box, { width: plan.bodyColumns, height: plan.bodyRows, flexDirection: "column", overflow: "hidden", flexShrink: 0, children: [overlay?.slice(displayOffset, displayOffset + plan.bodyRows).map((t, i) => _jsx(Text, { wrap: "truncate-end", color: ink(palette.text), children: fitCells(t, plan.bodyColumns) }, i)), _jsx(Box, { ref: leaf, display: overlay ? "none" : "flex", flexDirection: "column", flexShrink: 0, marginTop: -scroll, children: children })] }), plan.shortcuts > 0 && _jsxs(_Fragment, { children: [_jsx(Box, { width: 1, flexDirection: "column", children: Array.from({ length: plan.bodyRows }, (_, i) => _jsx(Text, { color: ink(palette.chrome), children: "\u2502" }, i)) }), _jsx(Box, { width: plan.shortcuts, flexDirection: "column", children: bindings.map(b => _jsx(Text, { color: ink(palette.chrome), wrap: "truncate-end", children: fitCells(`${b.key} ${b.label}`, plan.shortcuts) }, b.key)) })] }), _jsx(Box, { width: 1, flexDirection: "column", children: Array.from({ length: plan.bodyRows }, (_, i) => _jsx(Text, { color: ink(palette.chrome), children: "\u2502" }, i)) })] }), line("─".repeat(columns), columns, palette.chrome), line(status), line(keybar), line("─".repeat(columns), columns, palette.chrome)] }) }) });
+                        ? `1H 4R 5E 7L | ${position}`
+                        : `1 Home  4 Run  5 Evidence  7 Log | ${state.focus} | ${position}`), line("─".repeat(columns), columns, palette.chrome), _jsxs(Box, { height: plan.bodyRows, flexShrink: 0, flexDirection: "row", overflow: "hidden", children: [_jsx(Box, { width: 1, flexDirection: "column", children: Array.from({ length: plan.bodyRows }, (_, i) => _jsx(Text, { color: ink(palette.chrome), children: "\u2502" }, i)) }), plan.rail > 0 && _jsxs(_Fragment, { children: [_jsx(Box, { width: plan.rail, flexDirection: "column", children: ["1 Home", "4 Run", "5 Evidence", "7 Log", "", "CLI:", "fleet", "plan", "doctor"].map((t, i) => _jsx(Text, { color: ink(palette.chrome), children: fitCells(t, plan.rail) }, i)) }), _jsx(Box, { width: 1, flexDirection: "column", children: Array.from({ length: plan.bodyRows }, (_, i) => _jsx(Text, { color: ink(palette.chrome), children: "\u2502" }, i)) })] }), _jsxs(Box, { width: plan.bodyColumns, height: plan.bodyRows, flexDirection: "column", overflow: "hidden", flexShrink: 0, children: [overlay?.slice(displayOffset, displayOffset + plan.bodyRows).map((t, i) => _jsx(Text, { wrap: "truncate-end", color: ink(palette.text), children: fitCells(t, plan.bodyColumns) }, i)), _jsx(Box, { ref: leaf, display: overlay ? "none" : "flex", flexDirection: "column", flexShrink: 0, marginTop: -scroll, children: children })] }), plan.shortcuts > 0 && _jsxs(_Fragment, { children: [_jsx(Box, { width: 1, flexDirection: "column", children: Array.from({ length: plan.bodyRows }, (_, i) => _jsx(Text, { color: ink(palette.chrome), children: "\u2502" }, i)) }), _jsx(Box, { width: plan.shortcuts, flexDirection: "column", children: bindings.map(b => _jsx(Text, { color: ink(palette.chrome), wrap: "truncate-end", children: fitCells(`${b.key} ${b.label}`, plan.shortcuts) }, b.key)) })] }), _jsx(Box, { width: 1, flexDirection: "column", children: Array.from({ length: plan.bodyRows }, (_, i) => _jsx(Text, { color: ink(palette.chrome), children: "\u2502" }, i)) })] }), line("─".repeat(columns), columns, palette.chrome), line(status), line(keybar), line("─".repeat(columns), columns, palette.chrome)] }) }) });
 }

package/dist/tui/ink/fleet-app.d.ts

@@ -16,6 +16,12 @@ export type FleetEditorState = Record<DenyScopeKey, string[]> & {
     };
     steering: Record<FleetSteeringKey, string[] | undefined>;
 };
+/** T8: the staged classifications and efforts every preview folds — the same metadata a review stages,
+ * so a preview ranks what w would write before the first review and after an escaped one. */
+export type FleetStagedMetadata = Pick<FleetEditorState, "classifications" | "efforts">;
+/** OBS-525: auto reverts the shape's WHOLE routing declaration — pool included, not just the pin.
+ * prefer survives: it biases auto routing and is valid without pin/pool. */
+export declare function autoMapEntry(entry: MapEntry | undefined): MapEntry;
 export type FleetOverlayReview = {
     kind: "empty";
 } | {
@@ -136,9 +142,9 @@ export declare function FleetApp({ ageMs, agents, initialAllowOut, initialEffort
     initialMode: RoutingMode;
     modeOptions: FleetModeOption[];
     initialMap: Record<string, MapEntry>;
-    modePreview: (mode: RoutingMode, map: Record<string, MapEntry>, deny: FleetStagedDeny) => string[];
-    shapeRows: (mode: RoutingMode, map: Record<string, MapEntry>, deny: FleetStagedDeny) => FleetShapeRow[];
-    candidatesForShape: (shape: Shape, mode: RoutingMode, map: Record<string, MapEntry>, deny: FleetStagedDeny) => {
+    modePreview: (mode: RoutingMode, map: Record<string, MapEntry>, deny: FleetStagedDeny, stage?: FleetStagedMetadata) => string[];
+    shapeRows: (mode: RoutingMode, map: Record<string, MapEntry>, deny: FleetStagedDeny, stage?: FleetStagedMetadata) => FleetShapeRow[];
+    candidatesForShape: (shape: Shape, mode: RoutingMode, map: Record<string, MapEntry>, deny: FleetStagedDeny, stage?: FleetStagedMetadata) => {
         rows: FleetCandidateOption[];
         excludedNote?: string;
         ledger?: string[];
@@ -177,9 +183,9 @@ export declare function runFleetInkEditor({ ageMs, adapters, health, initialAllo
     initialMode: RoutingMode;
     modeOptions: FleetModeOption[];
     initialMap: Record<string, MapEntry>;
-    modePreview: (mode: RoutingMode, map: Record<string, MapEntry>, deny: FleetStagedDeny) => string[];
-    shapeRows: (mode: RoutingMode, map: Record<string, MapEntry>, deny: FleetStagedDeny) => FleetShapeRow[];
-    candidatesForShape: (shape: Shape, mode: RoutingMode, map: Record<string, MapEntry>, deny: FleetStagedDeny) => {
+    modePreview: (mode: RoutingMode, map: Record<string, MapEntry>, deny: FleetStagedDeny, stage?: FleetStagedMetadata) => string[];
+    shapeRows: (mode: RoutingMode, map: Record<string, MapEntry>, deny: FleetStagedDeny, stage?: FleetStagedMetadata) => FleetShapeRow[];
+    candidatesForShape: (shape: Shape, mode: RoutingMode, map: Record<string, MapEntry>, deny: FleetStagedDeny, stage?: FleetStagedMetadata) => {
         rows: FleetCandidateOption[];
         excludedNote?: string;
         ledger?: string[];

package/dist/tui/ink/fleet-app.js

@@ -12,6 +12,12 @@ import { windowRows } from "./components.js";
 import { wrapCells } from "../cockpit/width.js";
 import { clip, clipPathTail, ElisionMark, enterAltScreen, fmtCtx, fmtMs, fmtUsdPair, Glyph, INK, inkInput, inkOutput, KeyBar, OverlayPanel, padCell, padCellStart, Pointer, SearchRow, } from "./frame.js";
 const STEERING_KEYS = ["review", "consult"];
+/** OBS-525: auto reverts the shape's WHOLE routing declaration — pool included, not just the pin.
+ * prefer survives: it biases auto routing and is valid without pin/pool. */
+export function autoMapEntry(entry) {
+    const { pin: _pin, pool: _pool, ...rest } = entry ?? {};
+    return rest;
+}
 /** every scope's staged list, empty — the "every policy scope open" probe the picker lifts against */
 export const openStagedDeny = () => ({
     ...Object.fromEntries(DENY_SCOPES.map((scope) => [stagedDenyKeyOf(scope), []])),
@@ -346,7 +352,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
         ...Object.fromEntries(DENY_SCOPES.map((scope) => [stagedDenyKeyOf(scope), [...ui[scope.key]].sort()])),
         allowOut: [...ui.allowOut].sort(),
     });
-    const shapeList = () => shapeRows(ui.selectedMode, ui.map, stagedDeny());
+    const shapeList = () => shapeRows(ui.selectedMode, ui.map, stagedDeny(), stagedMetadata());
     const steeringList = () => [
         ...STEERING_KEYS.map((key) => ({
             id: key,
@@ -369,6 +375,11 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
         ...modelGroups.map((_, index) => ({ kind: "adapter", index })),
     ];
     // ── state transitions ──────────────────────────────────────────────────────
+    // T8: the previews fold the CURRENT staged metadata — never only what the last review saw
+    const stagedMetadata = () => {
+        const { classifications, efforts } = editorState();
+        return { classifications, efforts };
+    };
     const editorState = () => ({
         ...denyLists(),
         allowOut: [...ui.allowOut].sort(),
@@ -733,7 +744,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
         // channel must be OFFERED at or above the floor once every policy scope is open — a failed
         // model probe (dropped by discovery), a pin or a pool keep it out of that list and a floor
         // marks it belowFloor, so nothing here lifts it.
-        const eligible = candidatesForShape(overlay.shape, ui.selectedMode, ui.map, openStagedDeny()).rows
+        const eligible = candidatesForShape(overlay.shape, ui.selectedMode, ui.map, openStagedDeny(), stagedMetadata()).rows
             .some((row) => row.id === id && !row.belowFloor);
         if (!eligible) {
             // the ledger line spells its reasons; drop the row label and the reach segment for the notice
@@ -756,7 +767,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
         const text = `lift: cleared ${found.entry} from ${found.scope}${after.reach === "in" ? "" : ` — still out: ${after.reasons.join("; ")}`}`;
         ui.lastEdit = { id, text };
         ui.notice = text;
-        const picked = candidatesForShape(overlay.shape, ui.selectedMode, ui.map, stagedDeny());
+        const picked = candidatesForShape(overlay.shape, ui.selectedMode, ui.map, stagedDeny(), stagedMetadata());
         ui.overlay = { ...overlay, rows: picked.rows, excludedNote: picked.excludedNote, ledger: picked.ledger ?? [], at: 0 };
         bump();
     };
@@ -1590,17 +1601,12 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
             if (!shape)
                 return;
             if (hotkey === "a") {
-                // OBS-525: auto reverts the shape's WHOLE routing declaration — pool included, not just
-                // the pin. prefer survives: it biases auto routing and is valid without pin/pool.
-                const nextEntry = { ...ui.map[shape] };
-                delete nextEntry.pin;
-                delete nextEntry.pool;
-                ui.map = { ...ui.map, [shape]: nextEntry };
+                ui.map = { ...ui.map, [shape]: autoMapEntry(ui.map[shape]) };
                 bump();
                 return;
             }
             if (key.return || hotkey === "p") {
-                const picked = candidatesForShape(shape, ui.selectedMode, ui.map, stagedDeny());
+                const picked = candidatesForShape(shape, ui.selectedMode, ui.map, stagedDeny(), stagedMetadata());
                 setOverlay({
                     kind: "candidates",
                     shape,
@@ -1791,7 +1797,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
         if (!overlay)
             return null;
         if (overlay.kind === "presets") {
-            const details = modeOptions[overlay.at] ? modePreview(modeOptions[overlay.at].id, ui.map, stagedDeny()) : [];
+            const details = modeOptions[overlay.at] ? modePreview(modeOptions[overlay.at].id, ui.map, stagedDeny(), stagedMetadata()) : [];
             return (_jsxs(OverlayPanel, { title: overlay.home ? "routing preset" : "routing mode", width: bodyW, children: [_jsx(Text, { dimColor: true, children: overlay.home ? "a preset routes every shape — custom opens the browser" : "floors move with the mode; the browser edits the rest" }), _jsx(Text, { children: " " }), modeOptions.map((option, index) => (_jsxs(Text, { children: [_jsx(Pointer, { on: overlay.at === index }), option.id === ui.selectedMode ? _jsx(Glyph, { kind: "on" }) : _jsx(Text, { children: " " }), _jsx(Text, { bold: overlay.at === index, children: ` ${padCell(option.id, 12)}` }), _jsx(Text, { dimColor: true, children: clip(option.gloss, bodyW - 20) })] }, option.id))), overlay.home && (_jsxs(Text, { children: [_jsx(Pointer, { on: overlay.at === modeOptions.length }), _jsx(Text, { children: " " }), _jsx(Text, { bold: overlay.at === modeOptions.length, children: ` ${padCell("custom", 12)}` }), _jsx(Text, { dimColor: true, children: clip("open the fleet browser (models · shapes · steering)", bodyW - 20) })] })), _jsx(Text, { children: " " }), details.map((line) => _jsx(Text, { dimColor: true, children: line }, line))] }));
         }
         if (overlay.kind === "review") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.6.4",
+  "version": "2.6.5",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-auto/SKILL.md

@@ -12,7 +12,7 @@ Use the canonical loop skill's [cockpit, parked decisions and printed twins](../
 for each target: delivered views are **1 Home, 4 Run, 5 Evidence**; Fleet/Bootstrap and
 Plan/Health remain follow-ons with CLI entries. The recorded 1/3 merged, human T2, blocked
 T3 case stays PARTIAL despite tip pass. Review the Run confirmation, read back the appended
-`task-approved` receipt, and explicitly `tickmarkr resume <runId>` when no live owner exists;
+`task-approved` receipt, and explicitly launch `tickmarkr resume <runId>` with the host-owned split form below when no live owner exists;
 approval records permission and never dispatches work itself. Non-TTY readers keep `status`,
 `report` and default-watch line output, with `--watch --plain` as the TTY fallback.
 Keep `name: tickmarkr-auto` and the installed links to canonical `skills/` intact.
@@ -92,7 +92,37 @@ After sending, **confirm delivery** by reading the target pane and verifying the
 1. **Prepare** — confirm the target list. Run the [binary preflight](#binary-preflight-before-compile-or-run). Check `git status`, confirm no tickmarkr run is active, and work from a non-main branch.
 2. **Compile** — run `tickmarkr compile <spec-or-directory>`. Fix source-spec defects instead of editing the generated graph.
 3. **Plan** — run `tickmarkr plan`. Review routes, capability-floor warnings, and human gates before execution.
-4. **Run** — run `tickmarkr run`. A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for the run's terminal events — the shipped watcher below, or a foreground `until grep` on the run's terminal events — and ensure it is re-armed at most every twenty minutes. Never rely on a `Monitor`-only wake. Watch the run journal rather than polling agents, using the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800` — which takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict` and grades the run-end summary against every execution clause for you; the debt clause is yours — read CURRENT `tickmarkr status <runId>` (step 5). Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the relevant agent session.
+4. **Run** — launch `tickmarkr run` using the [host-owned split form](#host-owned-daemon-and-detached-beats), and start detached beats with their run-end stop items. A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for the run's terminal events — the shipped watcher below, or a foreground `until grep` on the run's terminal events — and ensure it is re-armed at most every twenty minutes. Never rely on a `Monitor`-only wake. Watch the run journal rather than polling agents, using the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800` — which takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict` and grades the run-end summary against every execution clause for you; the debt clause is yours — read CURRENT `tickmarkr status <runId>` (step 5). Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the relevant agent session.
 5. **Verify and consolidate** — continue only after a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty, and CURRENT `tickmarkr status <runId>` reads its owed checks outstanding empty AND known (`outstanding 0`) — a run with a parked task is partial, not green. Empty execution buckets alone are not green either (D-660): every bucket empty and the tip passed, but an operator waived one review, leaves one accepted-risk review check owed — status reads `outstanding 1 (T7 review)` and `run`/`resume` still exit 0 on execution alone, so the run is execution complete, not green. It turns green only when a `tickmarkr verify --record <runId>` discharge moves CURRENT status to `outstanding 0`, including a discharge landing after run-end — the historical run-end record keeps the old count, so never read debt from it; `outstanding unknown` is never green. Tickmarkr consolidates accepted work on `tickmarkr/<runId>` and never signs off to the main branch. A human controls any later release merge.
 6. **Record** — `tickmarkr report <runId> --md` prints Markdown to stdout; redirect explicitly beside the spec (for example `tickmarkr report <runId> --md > feature.record.md`) and commit the execution record when the repository tracks those records.
 7. **Continue** — move to the next requested target. If a target fails or is parked, stop with the journal evidence rather than silently skipping it.
+
+## Host-owned daemon and detached beats
+
+Launch the daemon as a SPLIT of the orchestrator's own pane in the ORCH tab, owned by the
+host PTY. Never launch it as an agent harness background task or in a separate tab. The daemon
+self-places its board from that split, keeping both daemon and board in the ORCH tab.
+
+- **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**:
+  `orca terminal split --terminal "$ORCA_TERMINAL_HANDLE" --direction vertical --command "tickmarkr run"`.
+- **On herdr (`HERDR_ENV=1`)**: use `herdr pane split` on the orchestrator's own pane, then
+  `herdr pane run <new> "tickmarkr run"` in the returned split.
+
+For `resume`, use the same host-owned split form with `tickmarkr resume <runId>` in place of
+`tickmarkr run`. After either launch, read this repository's lock pid and walk its ppid chain
+in the process table to the host PTY; verify no agent session is an ancestor. If an agent is
+an ancestor, stop that launch and relaunch through the host split before continuing.
+
+Start `tickmarkr beat <tier> --seat <seat> --loop` as a DETACHED background process, one per
+(tier, seat), from the repository root. Use setsid plus nohup (or the host's equivalent detached
+session facility), redirect output to a file, and record a pidfile under the repository's state
+dir. Verify ppid 1 and no agent-session ancestor. Never put beats in a harness background task
+or a visible tab. The lifecycle must be idempotent: start checks the pidfile against the live
+process payload and returns an "already running" no-op for the same (repo, tier, seat); status
+checks that payload and beat freshness; stop sends `--stand-down` for the same tier and seat,
+verifies the loop exits within one interval, then removes its pidfile. A stale or reused pid
+must never be killed without matching its live payload. Include a run-end stop item for every
+beat started, also on failure, park or handoff; verify DISARMED and remove retired beat files.
+
+Keep only watchers that must WAKE the seat in the harness. Re-arm them on each wake and at
+their harness cap; daemon and beat lifetimes must not depend on that cap.