tickmarkr 2.6.6 → 2.6.8

package/dist/cli/commands/fleet.js

@@ -281,8 +281,15 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         : readClaudeAliasIdentity(cwd, model) ?? CLAUDE_ALIAS_IDENTITY_STAMPS[model];
     // One ranking universe for the whole screen: every unclassified row bands fleet-relatively
     // against the same set, so a suggestion never depends on which adapter group renders first.
+    // T5: a displayed row's real members — every id doctor actually served among its collapsed variants
+    // (the bare id only when served, never the display label alone) — folded constituents append theirs.
+    // Each real id is ONE member even when doctor's list repeats it, so one act takes one reason from it.
     const detectedRows = fleetUnclassifiedModels(cfg, health, adapters)
-        .map((row) => ({ ...row, resolvedModel: resolvedCatalogModel(row.adapter, row.model) }));
+        .map((row) => ({
+        ...row,
+        resolvedModel: resolvedCatalogModel(row.adapter, row.model),
+        members: [...new Set([row.model, ...(row.variants ?? [])])].filter((id) => health[row.adapter]?.models?.includes(id)),
+    }));
     const catalogRanking = catalogTierRanking(cfg, catalog, detectedRows, resolvedCatalogModel);
     const foldedRows = [];
     const folds = new Map();
@@ -296,6 +303,8 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         if (first) {
             first.foldedModels ??= [first.model];
             first.foldedModels.push(row.model);
+            // T5: a collapsed constituent keeps every variant when it is catalog-folded
+            first.members = [...new Set([...first.members, ...row.members])];
         }
         else {
             foldedRows.push(next);
@@ -347,9 +356,26 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
                 ...unclassified
                     .filter((row) => !editable.tiers[adapter.id]?.[row.model])
                     .map((row) => {
-                    const evidence = rowEvidence(adapter.id, row.classifyModel ?? row.model, row.advisory.coverage === "covered" ? row.advisory.evidence : undefined);
+                    const found = rowEvidence(adapter.id, row.classifyModel ?? row.model, row.advisory.coverage === "covered" ? row.advisory.evidence : undefined);
+                    // T5: each member keeps its own recorded identity and auth verdict; a group is unauthed as a
+                    // row only when every member is — one member's failed probe never blocks the others' reach
+                    const grouped = row.members.length > 1 || (row.members.length === 1 && row.members[0] !== row.model);
+                    const members = grouped ? row.members.map((model) => {
+                        const identity = resolvedModelIdentity(adapter.id, model);
+                        const probed = health[adapter.id]?.modelAuth?.[model];
+                        return {
+                            model,
+                            ...(identity !== undefined ? { identity } : {}),
+                            ...(probed?.authed === false ? { unauthed: probed.reason ?? "probe failed" } : {}),
+                        };
+                    }) : undefined;
+                    const { unauthed: _unauthed, ...authedEvidence } = found ?? {};
+                    const evidence = members?.some((member) => member.unauthed === undefined) && found?.unauthed !== undefined
+                        ? (Object.keys(authedEvidence).length ? authedEvidence : undefined)
+                        : found;
                     return {
                         model: row.model,
+                        ...(members ? { members } : {}),
                         detectedAt: row.detectedAt,
                         ...(row.classifyModel ? { classifyModel: row.classifyModel } : {}),
                         ...(row.variants ? { variants: row.variants } : {}),
@@ -474,15 +500,18 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         ? { ...initial, allowOut: [...new Set([...(initial.allowOut ?? []), ...seeds.map((seed) => seed.entry)])].sort() }
         : initial);
     const FLAT_SCOPES = DENY_SCOPES.filter((scope) => scope.path.length === 3);
-    const seedChannel = (seed) => ({ adapter: seed.adapter, model: seed.displayModel, ...(seed.identity !== undefined ? { identity: seed.identity } : {}) });
+    const seedChannel = (seed) => ({ adapter: seed.adapter, model: seed.model, ...(seed.identity !== undefined ? { identity: seed.identity } : {}) });
     // an allow-complement entry excludes a seeded channel by the allow form's own matching (adapter id,
     // model, adapter:model, recorded identity) — the seed's spelling is one such entry, never the only one
     const seedRow = (seed) => ({
         adapter: seed.adapter,
-        models: [seed.displayModel],
-        ...(seed.identity !== undefined ? { identities: { [seed.displayModel]: seed.identity } } : {}),
+        models: [seed.model],
+        ...(seed.identity !== undefined ? { identities: { [seed.model]: seed.identity } } : {}),
     });
-    const allowExcludes = (staged, seed) => (staged.allowOut ?? []).some((entry) => universeEntryMatches(seedRow(seed), seed.displayModel, entry));
+    const allowExcludes = (staged, seed) => (staged.allowOut ?? []).some((entry) => universeEntryMatches(seedRow(seed), seed.model, entry));
+    // T5: the real channels a displayed row stands for (fleet's own derivation above); an ungrouped row is one
+    const rowMembers = (row) => ("members" in row && row.members)
+        || [{ model: ("classifyModel" in row && row.classifyModel) || row.model, ...(row.evidence?.identity !== undefined ? { identity: row.evidence.identity } : {}) }];
     // membership keeps the channel out: its allow complement or a flat (all-seats) deny entry
     const excludedIn = (staged, seed) => allowExcludes(staged, seed)
         || FLAT_SCOPES.some((scope) => (staged[scope.key] ?? []).some((entry) => entryMatchesChannel(entry, seedChannel(seed), true)));
@@ -573,12 +602,9 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
                 // own flat-deny lift: a row the baseline membership kept out that the staged one admits; a lone or
                 // unrelated tier stays user
                 const own = admitted.some((seed) => seed.adapter === adapter && seed.model === model)
-                    || (modelGroups.find((group) => group.adapter === adapter)?.rows ?? [])
-                        .filter((row) => row.model === model || ("classifyModel" in row && row.classifyModel === model))
-                        .some((row) => {
-                        const channel = { adapter, displayModel: row.model, ...(row.evidence?.identity !== undefined ? { identity: row.evidence.identity } : {}) };
-                        return excludedIn(baseline, channel) && !excludedIn(staged, channel);
-                    });
+                    || (modelGroups.find((group) => group.adapter === adapter)?.rows ?? []).flatMap(rowMembers)
+                        .filter((member) => member.model === model)
+                        .some((member) => excludedIn(baseline, { adapter, ...member }) && !excludedIn(staged, { adapter, ...member }));
                 edits.push({ name: `tiers.${adapter}.models.${model}`, destination: own ? family() : "user" });
             }
         }
@@ -607,17 +633,22 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
     // the browser never showed, or whose spelling names no channel, is refused.
     const editingUniverse = (candidate, seeds) => {
         const target = universeOf(candidateChannels(candidate));
+        // T5 review: the seed's OWN channel must be in the universe — its entry matching another member's
+        // recorded identity (C-high recorded as C-low) never stands for an unauthed or unprobed C-low
         const covers = (seed) => target.some((row) => row.adapter === seed.adapter
-            && row.models.some((model) => universeEntryMatches(row, model, seed.entry)));
+            && row.models.includes(seed.model) && universeEntryMatches(row, seed.model, seed.entry));
         for (const seed of seeds) {
             if (covers(seed))
                 continue;
-            const shown = modelGroups.some((group) => group.adapter === seed.adapter && group.rows.some((row) => row.model === seed.displayModel));
+            // T5: a seed names a real member of the row it was staged from — never that row's display label
+            const shown = modelGroups.some((group) => group.adapter === seed.adapter
+                && group.rows.some((row) => row.model === seed.displayModel && rowMembers(row).some((member) => member.model === seed.model)));
             const row = target.find((candidateRow) => candidateRow.adapter === seed.adapter);
             if (shown && row) {
-                row.models = [...row.models, seed.displayModel];
+                if (!row.models.includes(seed.model))
+                    row.models = [...row.models, seed.model];
                 if (seed.identity !== undefined)
-                    row.identities = { ...row.identities, [seed.displayModel]: seed.identity };
+                    row.identities = { ...row.identities, [seed.model]: seed.identity };
             }
             if (!covers(seed))
                 throw new ConfigError(`the seeded allow entry ${seed.entry} names no channel of the discovered fleet — re-probe with tickmarkr doctor, then classify it again`);
@@ -1234,6 +1265,8 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         steeringOptionsFor,
         reviewAdvisories,
         reviewOverlay,
+        // B-KEYS r2 (D-1446): the editor's row memo keys on both overlay layers' bytes — previewCfg's own key
+        layerStamp: () => `${currentUserText()}\u0000${currentRepoOverlayText(cwd)}`,
         reloadGuard,
         stagedRouting,
         holderOf,
@@ -1282,24 +1315,36 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         // and it was not configured at probe time), so it stays unroutable — invisible in every
         // picker — until the next probe. Name the step, or the classify flow reads as broken.
         const unprobed = [];
+        // T5: a grouped classification admits every member's real id, yet a member doctor recorded unauthed
+        // stays unroutable — named, never implied routable by its group's admission
+        const unauthed = [];
         for (const [adapter, models] of Object.entries(write.edited.tiers)) {
             for (const [model, assigned] of Object.entries(models)) {
                 if (assigned === null || assigned === undefined)
                     continue;
                 if (JSON.stringify(write.initial.tiers[adapter]?.[model]) === JSON.stringify(assigned))
                     continue;
-                if (health[adapter]?.modelAuth?.[model] === undefined)
+                const probed = health[adapter]?.modelAuth?.[model];
+                if (probed === undefined)
                     unprobed.push(`${adapter}:${model}`);
+                else if (probed.authed === false)
+                    unauthed.push(`${adapter}:${model}`);
             }
         }
         // B2: a repo-shadowed save says what still applies here — never claimed applied
         const head = [`fleet: wrote ${pending.path}`, ...(pending.destination === "user"
                 ? repoShadowNotes(result.review.before, result.review.after).map((note) => `fleet: ${note}`)
                 : [])].join("\n");
-        if (!unprobed.length)
-            return head;
-        const named = unprobed.slice(0, 3).join(", ") + (unprobed.length > 3 ? `, +${unprobed.length - 3} more` : "");
-        return `${head}\nfleet: ${unprobed.length} newly classified model(s) have no probe verdict yet (${named}) — run \`tickmarkr fleet --fresh\` to probe them; unverified models stay unroutable`;
+        const listed = (ids) => ids.slice(0, 3).join(", ") + (ids.length > 3 ? `, +${ids.length - 3} more` : "");
+        return [
+            head,
+            ...(unprobed.length
+                ? [`fleet: ${unprobed.length} newly classified model(s) have no probe verdict yet (${listed(unprobed)}) — run \`tickmarkr fleet --fresh\` to probe them; unverified models stay unroutable`]
+                : []),
+            ...(unauthed.length
+                ? [`fleet: ${unauthed.length} newly classified model(s) are unauthed (${listed(unauthed)}) — re-probe with tickmarkr doctor; unauthed models stay unroutable`]
+                : []),
+        ].join("\n");
     };
     return {
         props,

package/dist/cli/commands/init.js

@@ -130,13 +130,24 @@ you were handed the whole picture — list the repository root, open every guida
   predate a project rename, so **search by CONCEPT, not by the current product name.** A memory nobody opens
   is worse than none: every seat assumes the lesson is recorded somewhere and no seat looks.
 - **The gates are the product.** Seven, defined in \`src/graph/schema.ts\`:
-  \`build test lint evidence scope acceptance review\`. **That is DECLARATION order, not execution order** —
-  the first five run as a battery that stops at its first red, then \`acceptance\` and \`review\` run
-  CONCURRENTLY (\`run-gates.ts:39\`, *"judge ‖ review"*). One repair reorders them: a repair the REVIEW sent
-  back (carried \`review:material\`, test selection on, no required repair test) runs build, lint, evidence and
-  scope, then \`acceptance\` ‖ \`review\`, then its test screen, so a review that re-reds an unchanged subject
-  starts no test at all; a test-red repair keeps the battery first. Either way nothing merges until the FULL
-  suite has passed on the merge-candidate commit. The first five are MANDATORY; only \`acceptance\` and
+  \`build test lint evidence scope acceptance review\`. **That is DECLARATION order, not execution order.**
+  The cheap checks run first and stop at their first red: \`build\`, \`lint\`, then \`evidence\` and \`scope\`.
+  A fresh or semantic-repair candidate then runs \`acceptance\` ‖ \`review\` CONCURRENTLY (\`run-gates.ts\`,
+  *"judge ‖ review"*) before any test payload: a decisive semantic red ends the round with zero diagnostic
+  or full test-gate runs (a required acceptance oracle still executes); otherwise ONE full verification job
+  follows, with no selected screen. Only an attributed behavioral test-red repair may buy one diagnostic
+  first — every required failing file plus conservatively selected tests reaching the diff — admitted only
+  on comparable harness timing with ratio <= 0.15 AND estimated cost <= 60000 ms; its behavioral red stops
+  the round before semantics, otherwise semantics precede the full job. Disabled, unsupported, over-cap or
+  unknown-cost selection skips the diagnostic instead of running a full suite before semantics, and a
+  killed diagnostic is never green. A seatless or no-verdict review lets acceptance finish and publish and
+  the full job run in-round, and stays unsatisfied until review-only recovery; a seatless acceptance
+  cancels its sibling, records the unrun test (\`testOwed\`) and every enabled gate still owed (an unrecorded
+  review included), cannot merge and parks infra; an actual cancellation or throw awaits cleanup and leaves
+  no mergeable partial set. Test-only verification and an explicit full recheck keep their full scope with
+  no invented semantics and no diagnostic. Nothing merges until the FULL suite has passed on the exact
+  merge-candidate commit; an exact full green answers only after identity, environment, cleanliness and
+  current complete-manifest checks. The first five are MANDATORY; only \`acceptance\` and
   \`review\` may be omitted per task. Implementations are in \`src/gates/\` — \`baseline.ts\` (build/test/lint,
   diffed against a recorded baseline so pre-existing failures are forgiven), \`evidence.ts\`, \`scope.ts\`,
   \`acceptance.ts\` (its judge reads the DIFF and every criterion must cite a changed hunk), \`review.ts\`

package/dist/cli/commands/plan.js

@@ -11,7 +11,7 @@ import { DEFAULT_CONFIG, effectiveReviewPolicy, overlayPreferShapes, ROUTING_MOD
 import { batteryPriority, chainDepth, dispatchWaves, graphDefinitionHash, loadGraph, stateDirName } from "../../graph/graph.js";
 import { filesGlob } from "../../graph/files-glob.js";
 import { renderAcceptanceItem } from "../../graph/schema.js";
-import { pendingDaemonApprovalActions, resolveRunMode } from "../../run/daemon.js";
+import { pendingDaemonApprovalActions, replayedReviewerDemotions, resolveRunMode } from "../../run/daemon.js";
 import { disallowedBy, excludedChannels, exclusionLine, observedSeat, routingEntrySeatLines } from "../../route/preference.js";
 import { decayWeight, HALF_LIFE_RUNS, staffLedEvidence } from "../../route/profile.js";
 import { resolvedFloor, route, RoutingError } from "../../route/router.js";
@@ -193,22 +193,20 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
             .filter((event) => event.event === "gate-result" && event.data.gate === "review" && typeof event.data.reviewer === "string")
             .map((event) => event.data.reviewer)
         : [];
-    // daemon.ts replayedReviewerExclusions: a journaled review-pool-demotion is excluded from every review
-    // pick of the resumed run this plan previews (reviewer role only).
-    const replayedReviewerExclusions = [...new Set((matchingEvents ?? [])
-            .filter((event) => event.event === "review-pool-demotion" && typeof event.data.reviewer === "string")
-            .map((event) => event.data.reviewer))];
-    const demotedReviewers = new Set(replayedReviewerExclusions);
+    // daemon.ts demotedReviewers: a journaled review-pool-demotion is a SOFT preference in the resumed run
+    // this plan previews (ranked last, never excluded; reviewer role only) — never a launch-caused one (v2.6.8 T1).
+    const demotedReviewers = replayedReviewerDemotions(matchingEvents ?? []);
     // daemon.ts demotedChannels: the resumed run's worker exclusions (journal replayExcludedChannels).
     const runJournal = matchingRunId ? Journal.open(cwd, matchingRunId) : undefined;
     const demotedWorkers = runJournal?.replayExcludedChannels() ?? new Set();
-    // run-gates.ts retired (OBS-1025 add.2): seats with two no-verdicts this run are out of every pick, tallied
-    // as daemon.ts seeds reviewNoVerdicts — noVerdict rows only, and a checkout-proof timeout never strikes.
+    // run-gates.ts retired (OBS-1025 add.2): seats with two real no-verdicts this run are out of every pick,
+    // tallied as daemon.ts seeds reviewNoVerdicts — noVerdict rows only, and a launch failure (any
+    // launchCause, or none) never strikes (v2.6.8 T1).
     const noVerdicts = new Map();
     for (const event of matchingEvents ?? []) {
         if (event.event !== "review-no-verdict" || event.data.noVerdict !== true || typeof event.data.reviewer !== "string")
             continue;
-        if (event.data.cause === "seat-launch-failed" && event.data.launchCause === "checkout-proof-timeout")
+        if (event.data.cause === "seat-launch-failed")
             continue;
         noVerdicts.set(event.data.reviewer, (noVerdicts.get(event.data.reviewer) ?? 0) + 1);
     }
@@ -412,15 +410,15 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
         // Never dispatched, daemon.ts subjectAuthors is just the fresh author; its vendor stays off the review.
         const authors = [channelKey(author)];
         const authorVendors = carriedAuthorVendors(pools.review, authors);
-        // Production's inputs as the task's first review round sees them: excludeReviewers = daemon badReviewers =
-        // replayedReviewerExclusions. run-gates.ts:1303 floors on THIS task's journaled reviewers at their dispatched
-        // tiers (daemon taskReviewers) ∪ excludeReviewers, so a replayed exclusion RAISES the floor; :1305 picks
-        // with excludeReviewers ∪ retired. prefer only reorders (the seat count below passes none).
-        const priorReviewers = [...(matchingEvents ?? []).filter((e) => e.taskId === task.id && typeof e.data.reviewer === "string"
-                && ((e.event === "gate-result" && e.data.gate === "review") || e.event === "review-no-verdict"))
-                .map((e) => ({ reviewer: e.data.reviewer, tier: e.data.reviewerTier })), ...replayedReviewerExclusions];
+        // Production's inputs as the task's first review round sees them: excludeReviewers = daemon badReviewers,
+        // empty at resume (a replayed demotion is soft). run-gates floors on THIS task's journaled reviewers at their
+        // dispatched tiers (daemon taskReviewers) ∪ excludeReviewers, and picks with excludeReviewers ∪ retired.
+        // prefer only reorders (the seat count below passes none).
+        const priorReviewers = (matchingEvents ?? []).filter((e) => e.taskId === task.id && typeof e.data.reviewer === "string"
+            && ((e.event === "gate-result" && e.data.gate === "review") || e.event === "review-no-verdict"))
+            .map((e) => ({ reviewer: e.data.reviewer, tier: e.data.reviewerTier }));
         const reviewFloor = gateReviewerFloor(task, cfg, author, pools.review, priorReviewers).floor;
-        const exclusions = [...replayedReviewerExclusions, ...retiredReviewers];
+        const exclusions = retiredReviewers;
         const reviewer = pickReviewer(author, pools.review, exclusions, cfg.review.prefer ?? [], reviewFloor, reviewHistory, (seat, count) => { rotationSeat = seat; rotationCount = count; }, demotedReviewers, authorVendors, authors);
         if (!reviewer)
             return { line: "none — no cross-vendor reviewer available", cost: 0 };

package/dist/cli/commands/verify.js

@@ -13,7 +13,7 @@ import { runGates } from "../../gates/run-gates.js";
 import { getTask, loadGraph } from "../../graph/graph.js";
 import { GATE_NAMES } from "../../graph/schema.js";
 import { executionSignal } from "../../run/execution-budget.js";
-import { linkNodeModules, removeWorktree, shGit, shGitOk } from "../../run/git.js";
+import { addDetachedWorktree, linkNodeModules, removeWorktree, shGit, shGitOk } from "../../run/git.js";
 import { foldOwedChecks, integrationMapped, owedCriteria, Journal, OWED_DISCHARGE_EVENT } from "../../run/journal.js";
 import { withRepositoryLease } from "../../run/lease.js";
 import { isPidLive } from "../../run/lock.js";
@@ -417,7 +417,9 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
         }
         const baseDir = mkdtempSync(join(stateDir, `base-${mergeBase.slice(0, 12)}-${process.pid}-`));
         try {
-            await shGitOk(`git worktree add --detach '${baseDir}' '${mergeBase}'`, cwd);
+            const added = await addDetachedWorktree(cwd, baseDir, mergeBase);
+            if (added.code !== 0)
+                throw new Error(`command failed (${added.code}): git worktree add --detach '${baseDir}' '${mergeBase}'\n${added.stderr || added.stdout}`);
             linkNodeModules(cwd, baseDir, { force: true });
             const baseline = await captureBaseline(baseDir, subset);
             if (baseline.refusal)

package/dist/cli/help.d.ts

@@ -186,6 +186,7 @@ export declare const COMMAND_HELP: {
             "--pct <0..100>": string;
             "--threshold-pct <0..100>": string;
             "--stand-down": string;
+            "--status": string;
         };
         examples: string[];
     };

package/dist/cli/help.js

@@ -148,17 +148,25 @@ export const COMMAND_HELP = {
         ],
     },
     beat: {
-        usage: "beat <orchestrator|orchestrator-context|overseer|overseer-context|watch> --seat <identity> [options]",
-        description: "Write one supervision beat using the recorded arm. Stood-down arms stay DISARMED until explicitly re-armed; stopped beats become STALE.",
+        usage: "beat <start|stop|status> <orchestrator|orchestrator-context|overseer|overseer-context|watch> --seat <identity> | beat <tier> --seat <identity> [options]",
+        description: "start launches one detached --loop beat per tier and exits 0 only after reading back that child's own advancing beat; stop retires only that recorded generation and reads back DISARMED; status is read-only and exits nonzero for STALE, MISMATCH, UNREADABLE or a dead invocation's leftovers. The legacy <tier> form writes one supervision beat using the recorded arm: stood-down arms stay DISARMED until explicitly re-armed; stopped beats become STALE. " +
+            "Legacy migration: start refuses a legacy (unowned) ARMED/STALE arm nonzero and prints its exit under the RECORDED seat — `tickmarkr beat <tier> --seat <seat> --stand-down` (`--seat=<seat>` when the seat begins with a dash), after \"stop pid <N> first\" when its --loop writer is still alive (tickmarkr never signals a process it did not launch, nor takes its live claim; an arm with no recorded seat gets no invented one) — then start owns the tier and reads back ARMED. A writer stopped inside its claimed tick does not strand that step: the --stand-down reclaims the claim it died holding, printing the notice; while the writer lives, the step waits and refuses BUSY. " +
+            "Claims — actors IN: compliant claim contenders (start, stop and each legacy write — one-shot, --new-arm, --loop tick, --stand-down — through this CLI), a crashed owner (holder pid ESRCH or a zombie, its claim and records left behind) and a killed compliant recovery or release taker (dead at any step of the one claim-removal path); OUT, the one residual: an external writer editing, replacing or deleting claim, lock or record files outside this CLI, under which nothing beyond the identity MISMATCH refusals is promised (its edit between a final claim check and the mutation's own system call is not seen — there is no filesystem compare-and-rename). A claim records its holder pid and birth (its runtime's own start record, read with no process probe) and, for a launch claim, the launched writer publishing under it. Every claimant takes over a held claim only when every pid read from that claim's own bytes is confirmed dead (ESRCH or a zombie) — the legacy {tier, token, pid, claimedAt} claim included — printing the reclaim notice with its final result even when it then had to wait or refuse; a live, reused or unreadable holder or writer is never taken over: start tries once, every other claimant waits at most 20 attempts 250 ms apart, then refuses BUSY with nothing written. A launched writer acts under its launcher's claim only while that launcher is not confirmed dead, recording itself as the claim's writer before its first act; once the launcher is dead, a writer past its first beat releases that claim itself (with a notice) and takes the tier claim like any writer — or, when that launcher died before binding its arm epoch, exits right after the release, leaving an abandoned launch the next start, stop or legacy write retires — and one still launching refuses having written nothing; a killed start neither strands stop nor lets recovery take the claim from a live writer. Under its launcher's claim the writer checks nothing after its last act (each act verified the claim last), so start's release after its read-back never ends the loop it launched. A claim is removed in one way only, by recovery and by its holder's release alike: under a per-claim removal lock that appears already naming its taker's pid and birth, once no claimed act is running under those bytes (a release waits up to 2 s, a recovery refuses BUSY), the checked bytes are moved aside into the lock and kept only when they are exactly those bytes — other bytes found there are put straight back, and a claim linked while that removal is under way is never acted under: its claimant withdraws exactly the claim it linked and refuses BUSY (its next attempt links afresh). Claim bytes an invocation could not remove — another live taker held them or moved them aside, even on a mistaken death proof, or its release was refused — stay provably that process's strand wherever they are (its pid, its checked birth and a token none of its invocations still holds): while a live taker holds them every claimant is BUSY naming it; once none does, that process's own next start, stop or legacy write withdraws them from the claim path, or discards them from a killed taker's lock instead of restoring them, with a notice; its own status reports them as its stranded claim wherever they are — on the claim path or moved aside into a live or dead taker's lock, naming that taker — with the recovery command (to run once a live taker has finished or exited); and once that process has exited they are a dead claim any start, stop or legacy write reclaims — so no caller, a long-lived bridge included, needs to exit before recovery completes, and no claim is left that nobody acts under and nobody can recover. Killed-taker recovery: a lock whose taker is confirmed dead is recovered by the next start, stop or legacy write with a notice naming that taker — bytes it moved aside are discarded when every pid they record is dead, otherwise restored — and that invocation also removes the act markers, <tier>.stage.<pid>.<id> directories and the pid-named entry a taker killed while assembling or releasing its lock (before its owner entry is written, or after it is moved out) left, each with a notice naming the dead pid; a live or unprovable taker's lock is never taken (BUSY, naming it). \"Never taken over\" therefore means: only a claim or lock proven dead is reclaimed, exactly as checked; nothing live or unknown is taken, and no claim, lock or stage directory is ever the operator's to remove by hand. Dead owners recover the same way: a generation whose recorded pid is confirmed dead, or a launch abandoned before it bound its pid or arm epoch (no launch holds the claim and no recorded process is alive), is retired — its owner record removed, nothing signalled — by the next stop (which stands its arm down and reads back DISARMED), by start (which stands it down, then launches and reads back ARMED) or by a legacy write from that seat (whose requested write then proceeds: a one-shot records its beat on that arm, --stand-down stands it down, --new-arm/--loop replace it), each printing the recovery; an owner whose recorded process lives is never retired this way. Every claimed mutation — each owner record rename, log open, spawn, signal and removal, and each record a staged stand-down, arm or beat write changed — is one claimed act: it marks the claim, re-runs its owner-generation check inside the act (a staged write also compares every supervision record with what it was staged from), then verifies the claim LAST, immediately before the mutation. No claim removal lands inside an act, and a claim, owner or arm replaced before that final check lands nothing further: nothing more is written, signalled or removed and the invocation refuses nonzero at its next check, its release included (a launched writer under its launcher's claim has no release: what its acts landed, they landed under the verified claim). Status (beat status <tier> and the legacy <tier> --status) only observes: over a dead claim or a killed taker's or writer's leftovers it changes no file, exits nonzero naming the dead pids and prints the command that recovers them, and it names every live holder (the claim's, and each removal lock's taker) beside the state it reads, `tickmarkr beat stop <tier> --seat <seat>` (the recorded seat, else the one given, quoted as one shell word) — start or a legacy write recovers the same way; status never does. " +
+            "Identity: Linux teardown argv ([comm]) and a child dying mid-read stay UNREADABLE until a complete read or confirmed death (\"died before its beat read back\"); on Darwin a missing or unusable lsof refuses UNREADABLE naming lsof, and restoring lsof restores start/status/stop.",
         options: {
-            "--seat <identity>": "Required: identify the supervising pane or agent.",
+            "--seat <identity>": "Required for start, stop and every write: identify the supervising pane or agent; optional for status.",
             "--new-arm": "Create a new durable arm, allowing beats to resume after stand-down; the hand-off step for a seat taking over a stood-down tier (combine with --arm-id and --pct on a context tier).",
-            "--loop": "Create a new durable arm and beat in this process every 10 seconds; exit within one interval after stand-down.",
+            "--loop": "Create a new durable arm and beat in this process every 10 seconds; exit nonzero with its reason within one interval after stand-down, supersession or a refused write.",
             "--arm-id <identity>": "Name a newly created arm; with --pct, identify the context observation arm. Never refuses a tick.",
             "--pct <0..100>": "Report current context consumption percentage.",
             "--threshold-pct <0..100>": "Set the context warning threshold (default 75).",
-            "--stand-down": "Record an explicit handoff and stand down this tier. A later one-shot tick on the old arm exits non-zero; context observations still raise and discharge the clear duty.",
-        }, examples: ["beat overseer --seat supervisor", "beat overseer --seat supervisor --loop", "beat overseer --seat supervisor --stand-down", "beat overseer --seat supervisor --new-arm"],
+            "--stand-down": "Record an explicit handoff and stand down this tier. A later one-shot tick on the old arm exits non-zero; context observations still raise and discharge the clear duty. With the recorded seat it is the legacy migration step start prints — it reclaims a claim the stopped writer died holding, never a live one; then start owns the tier.",
+            "--status": "Legacy spelling of beat status <tier>: the same read-only result, writing nothing.",
+        }, examples: [
+            "beat start overseer --seat supervisor", "beat status overseer --seat supervisor", "beat stop overseer --seat supervisor",
+            "beat overseer --seat supervisor", "beat overseer --seat supervisor --loop", "beat overseer --seat supervisor --stand-down",
+            "beat overseer --seat supervisor --new-arm", "beat overseer --status",
+        ],
     },
     version: {
         usage: "version [--dist]", description: "Print the installed package version. Top-level aliases: --version and -v.",

package/dist/cli/index.d.ts

@@ -45,7 +45,7 @@ export declare const COMMANDS: {
     eval: typeof evalCommand;
 };
 export type RegisteredCommand = keyof typeof COMMANDS;
-export declare const USAGE = "tickmarkr \u2014 spec-driven orchestration harness for AI coding agents\nusage: tickmarkr <command>\n  init          guided setup + doctor; init --agent [--force] [--docs] adds agent skills/docs\n  doctor        re-probe adapters, herdr, auth; print capability matrix (--fix writes the test-runner ignore when a safe edit exists)\n  fleet         interactive fleet editor (fleet --print for CI drift checks)\n  compile <src> spec \u2192 .tickmarkr/graph.json (fails without acceptance criteria)\n  scope <intent> preview locally with --preview; draft after confirmation or --yes (--force to overwrite)\n  plan          dry-run routing table + cost estimate + floor lints\n  eval          discover and validate fixtures, seed isolated temp repos, then clean them up\n  run           execute the graph (--concurrency N --driver auto|herdr|subprocess|orca --route-strict; orca runs only when named)\n  status        live run state (--watch --events: JSON documents on stdout, keepalives on stderr; 2>&1 corrupts the stream)\n  stats         all-run channel delivery, red, rescue, author and reviewer statistics\n  verify        run the gate battery standalone against merge-base(--base, HEAD)..HEAD \u2014 verdict/JSON on stdout, progress on stderr; 2>&1 corrupts the verdict stream (--base main --criteria <file> | --task <id> [--files <glob>] [--author adapter:model] [--no-review] [--json])\n  resume <id>   continue a run from its journal\n  report <id>   cost/quality report (--md writes Markdown to stdout; redirect to save a record)\n  profile       show learned routing profile (profile reset = forget history via cursor, keeps telemetry)\n  ui            open Home, Run or Evidence (--view home|run|evidence; --setup <id> opens Run Parks)\n  unlock        remove a stale/garbage run lock (refuses if the holder is alive)\n  beat <tier>   record one supervision beat for orchestrator|orchestrator-context|overseer|overseer-context|watch, --seat <identity> required (--stand-down to hand off); a supervising seat's own watcher loop calls it, and status reads the tier STALE once the beats stop\n  approve <id> <task>  release a park (--uphold sides with the reviewer and funds a fixed attempt; --by <name> --reason <text>); takes effect on resume\n  version       print the installed version (--dist adds build location and fingerprint)\n\nUse tickmarkr <command> --help (or -h) for all options and examples.\nUse tickmarkr profile <operation> --help for nested profile help.";
+export declare const USAGE = "tickmarkr \u2014 spec-driven orchestration harness for AI coding agents\nusage: tickmarkr <command>\n  init          guided setup + doctor; init --agent [--force] [--docs] adds agent skills/docs\n  doctor        re-probe adapters, herdr, auth; print capability matrix (--fix writes the test-runner ignore when a safe edit exists)\n  fleet         interactive fleet editor (fleet --print for CI drift checks)\n  compile <src> spec \u2192 .tickmarkr/graph.json (fails without acceptance criteria)\n  scope <intent> preview locally with --preview; draft after confirmation or --yes (--force to overwrite)\n  plan          dry-run routing table + cost estimate + floor lints\n  eval          discover and validate fixtures, seed isolated temp repos, then clean them up\n  run           execute the graph (--concurrency N --driver auto|herdr|subprocess|orca --route-strict; orca runs only when named)\n  status        live run state (--watch --events: JSON documents on stdout, keepalives on stderr; 2>&1 corrupts the stream)\n  stats         all-run channel delivery, red, rescue, author and reviewer statistics\n  verify        run the gate battery standalone against merge-base(--base, HEAD)..HEAD \u2014 verdict/JSON on stdout, progress on stderr; 2>&1 corrupts the verdict stream (--base main --criteria <file> | --task <id> [--files <glob>] [--author adapter:model] [--no-review] [--json])\n  resume <id>   continue a run from its journal\n  report <id>   cost/quality report (--md writes Markdown to stdout; redirect to save a record)\n  profile       show learned routing profile (profile reset = forget history via cursor, keeps telemetry)\n  ui            open Home, Run or Evidence (--view home|run|evidence; --setup <id> opens Run Parks)\n  unlock        remove a stale/garbage run lock (refuses if the holder is alive)\n  beat <tier>   supervision beats for orchestrator|orchestrator-context|overseer|overseer-context|watch, --seat <identity> required: beat start|stop|status <tier> owns one detached loop per tier (status is read-only); the legacy beat <tier> records one beat (--stand-down to hand off), and status reads the tier STALE once the beats stop\n  approve <id> <task>  release a park (--uphold sides with the reviewer and funds a fixed attempt; --by <name> --reason <text>); takes effect on resume\n  version       print the installed version (--dist adds build location and fingerprint)\n\nUse tickmarkr <command> --help (or -h) for all options and examples.\nUse tickmarkr profile <operation> --help for nested profile help.";
 export declare function dispatch(cmd: string | undefined, argv: string[], commands?: CommandMap): Promise<{
     out: string;
     code: number;

package/dist/cli/index.js

@@ -46,7 +46,7 @@ usage: tickmarkr <command>
   profile       show learned routing profile (profile reset = forget history via cursor, keeps telemetry)
   ui            open Home, Run or Evidence (--view home|run|evidence; --setup <id> opens Run Parks)
   unlock        remove a stale/garbage run lock (refuses if the holder is alive)
-  beat <tier>   record one supervision beat for orchestrator|orchestrator-context|overseer|overseer-context|watch, --seat <identity> required (--stand-down to hand off); a supervising seat's own watcher loop calls it, and status reads the tier STALE once the beats stop
+  beat <tier>   supervision beats for orchestrator|orchestrator-context|overseer|overseer-context|watch, --seat <identity> required: beat start|stop|status <tier> owns one detached loop per tier (status is read-only); the legacy beat <tier> records one beat (--stand-down to hand off), and status reads the tier STALE once the beats stop
   approve <id> <task>  release a park (--uphold sides with the reviewer and funds a fixed attempt; --by <name> --reason <text>); takes effect on resume
   version       print the installed version (--dist adds build location and fingerprint)
 

package/dist/drivers/herdr.js

@@ -4,7 +4,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { declaredInputBoxForWorkerName, matchesEmptyInputBox, matchesInputBox, matchesOccupiedInputBox, missingInputStateDeclarations, shq } from "../adapters/types.js";
 import { consumePaneLaunchIntent, PANE_IDENTITY_ENV, paneIdentityLine } from "../brand.js";
-import { createWorktree, sh } from "../run/git.js";
+import { createWorktree, sh, shGit } from "../run/git.js";
 import { Journal } from "../run/journal.js";
 import { readSupervision, readWatchBoard, requestWatchBoardStop, reserveWatchBoard, stopWatchBoard, WATCH_OWNER_ENV } from "../run/supervision.js";
 import { canonicalWorktreePath } from "./orca.js";
@@ -487,7 +487,7 @@ export class HerdrDriver {
         if (typeof pane.cwd !== "string" || canonicalWorktreePath(pane.cwd) !== checkout) {
             throw new Error(`herdr adopt: pane ${pane.pane_id} labelled ${slot.name} sits in ${pane.cwd ?? "an unreported cwd"}, not the task checkout ${checkout} — foreign`);
         }
-        const top = await sh("git rev-parse --show-toplevel", checkout);
+        const top = await shGit("git rev-parse --show-toplevel", checkout);
         if (top.code !== 0 || canonicalWorktreePath(top.stdout.trim()) !== checkout) {
             throw new Error(`herdr adopt: ${checkout} is not its own git checkout — no checkout proof for ${slot.name}`);
         }

package/dist/drivers/orca.d.ts

@@ -32,10 +32,13 @@ export declare class OrcaError extends Error {
     readonly code?: string;
     readonly runtimeId?: string;
     readonly launchCause?: SeatLaunchCause;
+    /** v2.6.8 T1: the CLI was killed at the timeout it was handed — the one evidence that a deadline interrupted it. */
+    readonly timedOut?: boolean;
     constructor(family: string, reason: string, raw: string, opts?: {
         code?: string;
         runtimeId?: string;
         launchCause?: SeatLaunchCause;
+        timedOut?: boolean;
     });
 }
 /** The slot cannot be addressed: dead/unknown terminal record, or a handle that cannot be recovered
@@ -86,9 +89,12 @@ export declare function canonicalWorktreePath(path: string): string;
 /** The proof line a worker terminal prints first: create, recovery and focus read it back. */
 export declare const CHECKOUT_MARK = "TICKMARKR_CHECKOUT";
 /** E1: the one typed launch cause a driver attaches to its launch failure. `checkout-proof-timeout`
- *  means the terminal printed NO proof frame by the ceiling — a slow host, not a misplaced seat. A
- *  foreign or malformed frame is placement evidence and carries no cause (never a timeout exemption). */
+ *  means the terminal printed NO proof frame by the ceiling — or (v2.6.8 T1) a read the ceiling
+ *  interrupted left the own frame's prefix unfinished — a slow host, not a misplaced seat. A complete
+ *  foreign frame, or a malformed one read whole (in a page landing late or at the ceiling too), is
+ *  placement evidence and carries no cause. */
 export type SeatLaunchCause = "checkout-proof-timeout";
+export declare function withLaunchGuard<T>(guard: () => void, run: () => Promise<T>): Promise<T>;
 /** The exact bytes the create command prints as its first line. */
 export declare function checkoutProofLine(checkout: string): string;
 /** Every complete frame in a scrollback, decoded and canonicalized; whether an incomplete one was seen. */
@@ -266,12 +272,14 @@ export declare class OrcaDriver implements ExecutorDriver {
      * the terminal record must name `handle` and `_meta.runtimeId` must be `runtimeId` — the runtime
      * that supplied the ownership listing — else another terminal's or another runtime's bytes were
      * answered and nothing is proven. Proven means provesCheckout: exact canonical full-path equality
-     * of a complete frame, no other checkout named, no incomplete frame.
+     * of a complete frame, no other checkout named, no incomplete frame or unparseable mark — in the pages
+     * or the anchor's tail (v2.6.8 T1).
      * E1: with a `deadline` (create's window) there is ONE absolute deadline: a read is issued only while
      * budget is left and is handed exactly that budget, and a page that still lands past it is late —
      * nothing late proves the checkout. `seen` is what the scrollback showed, for the typed timeout:
      * `misplaced` — a frame naming another checkout, a cut frame or an unparseable mark in anything read
-     * (the anchor's tail and every page included, even when paging stopped or a later read threw);
+     * (the anchor's tail and every page included, even when paging stopped, a later read threw or the page's
+     * own cursors were malformed — v2.6.8 T1; the tail read after the pages it overlaps, tailInContext);
      * `absent` — ONLY when every page down to the start of the scrollback was read before the ceiling
      * and none carries a trace of the mark; `unread` — every other exit: PROOF_PAGES reached, a limited
      * read with no (or the same) next cursor or a truncated anchor without one, a read that threw, a read