tickmarkr 2.6.7 → 2.6.9

package/dist/tui/ink/fleet-app.js

@@ -44,12 +44,24 @@ function ledgerChannelId(line) {
     const slash = head.indexOf("/");
     return slash === -1 ? undefined : `${head.slice(0, slash)}:${head.slice(slash + 1)}`;
 }
+/**
+ * Space picks exactly as Enter does in every single-select overlay (operator field report 2026-10-08,
+ * "can't choose here space key doesn't select" — the reach picker even OPENS on Space). Space keeps its
+ * own meaning only where it has one: the multi-select chains (candidates, prefer) toggle on it, the text
+ * stages (add-model, the classify note) type it, and the review diff confirms only on `y`. The lift
+ * listing is a confirm, not a pick: it clears a deny entry for every channel that entry covers, so only
+ * Enter lifts — a stray Space there does nothing.
+ */
+const spacePicks = (overlay) => overlay.kind === "classify"
+    ? overlay.stage !== "note"
+    : overlay.kind === "presets" || overlay.kind === "assign" || overlay.kind === "poolmode"
+        || overlay.kind === "judge" || overlay.kind === "reach";
 const REACH_CHOICES = [
     { id: "in", label: "in", gloss: "every seat may route here" },
     { id: "out-workers", label: "out · workers", gloss: "workers skip it; judge/review/consult unaffected" },
     { id: "out-all", label: "out · all seats", gloss: "no seat routes here" },
 ];
-export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts = {}, modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewAdvisories = [], reviewOverlay, reloadGuard, stagedRouting, holderOf, entry = "probe", initialJudge = "", judgeSeats = [], viewRows = Number.POSITIVE_INFINITY, frameColumns = 100, frameRows, ...initialDenyProps }) {
+export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts = {}, modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewAdvisories = [], reviewOverlay, layerStamp, reloadGuard, stagedRouting, holderOf, entry = "probe", initialJudge = "", judgeSeats = [], viewRows = Number.POSITIVE_INFINITY, frameColumns = 100, frameRows, ...initialDenyProps }) {
     const { exit } = useApp();
     const [, setRevision] = useState(0);
     // the props are the fleet command's contract, one per schema-enumerated scope (initialDeny…),
@@ -137,21 +149,51 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
     // the STAGED policy (fleet loads the candidate bytes; see stagedRouting) and the recorded
     // identity — never literal membership of the staged sets, which missed identity, bare-model and
     // family entries and could not tell an allowlist exclusion from a deny.
-    let routingMemo = null;
+    // B-KEYS (D-1338): the staged CONTENT every row and the staged policy derive from — the deny sets,
+    // the allow complement, classifications, efforts and seeds, read raw off ui (the provenance a
+    // review folds is a pure function of them). Computed per call, never per render: a handler
+    // mutates ui and reads rows in the same tick, before bump.
+    const stagedKey = () => JSON.stringify([
+        DENY_SCOPES.map((scope) => [...ui[scope.key]].sort()),
+        [...ui.allowOut].sort(),
+        ui.classifications,
+        ui.efforts,
+        ui.seededAllowOut,
+    ]);
+    // ponytail: both memos live in refs keyed on stagedKey — a render-local memo reset on every keypress,
+    // so each cursor move reloaded the policy and re-derived ~800 rows' reach (B-KEYS). A cursor move,
+    // a filter, showAll or an overlay never recompute a row; any staged edit changes the key and
+    // recomputes every group. Ceiling: one JSON.stringify of the staged sets per lookup (µs); a dirty
+    // counter bumped at every mutation site if a fleet ever outgrows it.
+    const routingMemo = useRef(null);
     const stagedPolicy = () => {
+        const key = memoKey();
+        const memo = routingMemo.current;
+        if (memo?.key === key)
+            return memo.policy;
         const deny = stagedDeny();
         const stage = stagedMetadata();
-        const key = JSON.stringify([deny, stage]);
-        if (routingMemo?.key !== key) {
-            routingMemo = {
-                key,
-                policy: stagedRouting
-                    ? stagedRouting(deny, stage)
-                    : { ok: true, routing: { deny: denyBlockFrom(denyLists()) } },
-            };
-        }
-        return routingMemo.policy;
+        const policy = stagedRouting
+            ? stagedRouting(deny, stage)
+            : { ok: true, routing: { deny: denyBlockFrom(denyLists()) } };
+        routingMemo.current = { key, policy };
+        return policy;
     };
+    const rowsMemo = useRef({ key: "", byAdapter: new Map() });
+    // B-KEYS r2 (D-1446): staged content alone does not identify a row — the rows also derive from the loaded
+    // overlay layers (stagedRouting and holderOf read both files) and the props they read. Once per render a
+    // generation moves when the layer bytes or one of those props changes, and both memos key on it beside the
+    // staged content: a layer written mid-session shows on the next frame, as on the base, while a cursor move
+    // over unchanged layers still derives nothing. Cost: one read of each overlay per frame (the B2 previewCfg key).
+    const layers = useRef({ stamp: "", inputs: [], gen: 0 });
+    {
+        const stamp = layerStamp?.() ?? "";
+        const inputs = [modelGroups, stagedRouting, holderOf];
+        if (stamp !== layers.current.stamp || inputs.some((input, at) => input !== layers.current.inputs[at])) {
+            layers.current = { stamp, inputs, gen: layers.current.gen + 1 };
+        }
+    }
+    const memoKey = () => `${layers.current.gen}\u0000${stagedKey()}`;
     // OBS-1099 add.1: the browser's deny discovery ranges over the schema-enumerated scopes (the
     // route collector names its four paths by hand, so a scope the schema gains would never render
     // or lift here). A flat scope reaches every seat; a nested one only the seat its block names
@@ -321,7 +363,19 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
         const found = members.map(coveringFor).filter((covering) => covering !== undefined);
         return found.find((covering) => covering.shared) ?? found[0];
     };
+    // B-KEYS: one derivation per group per staged state — the memo above hands every later pass
+    // (visibleCount per rail row, modelRows, the hidden and folded counts, a handler's lookup) the
+    // same rows; the returned array is read, never mutated, by every caller.
     const groupRows = (group) => {
+        const key = memoKey();
+        if (rowsMemo.current.key !== key)
+            rowsMemo.current = { key, byAdapter: new Map() };
+        const memo = rowsMemo.current.byAdapter;
+        const rows = memo.get(group.adapter) ?? deriveGroupRows(group);
+        memo.set(group.adapter, rows);
+        return rows;
+    };
+    const deriveGroupRows = (group) => {
         const rows = group.rows.map((row) => {
             const members = membersOf(group.adapter, row);
             const staged = ui.classifications.find((classification) => classification.adapter === group.adapter
@@ -949,6 +1003,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
             return true;
         };
         if (overlay) {
+            const pick = key.return || (input === " " && spacePicks(overlay));
             if (overlay.kind === "presets") {
                 const rowCount = modeOptions.length + (overlay.home ? 1 : 0);
                 if (key.escape) {
@@ -973,7 +1028,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                     bump();
                     return;
                 }
-                if (key.return) {
+                if (pick) {
                     if (overlay.home && overlay.at === modeOptions.length) {
                         setOverlay(null); // custom → the browser IS the full editor
                         return;
@@ -1023,8 +1078,10 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                     finish({ kind: "discard" });
                     return;
                 }
+                // the review screen holds every staged edit by definition — `q` takes the same two presses
+                // as every other screen, never one keystroke to lose the session (`n` is the explicit discard)
                 if (input === "q") {
-                    finish({ kind: "quit" });
+                    guardedQuit(armed);
                     return;
                 }
                 if (input === "y") {
@@ -1055,7 +1112,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                         bump();
                         return;
                     }
-                    if (key.return) {
+                    if (pick) {
                         const channel = CHANNELS[overlay.channelAt];
                         ui.channelByAdapter[overlay.adapter] = channel;
                         // OBS-508: a bulk stage waiting on the one first-touch channel answer resumes here.
@@ -1083,7 +1140,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                         bump();
                         return;
                     }
-                    if (key.return) {
+                    if (pick) {
                         // OBS-508: keep the suggested band → the evidence note arrives pre-typed; override the
                         // band → the note starts empty (the suggestion argues for a DIFFERENT tier).
                         const chosen = TIERS[overlay.tierAt];
@@ -1166,7 +1223,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                     bump();
                     return;
                 }
-                if (key.return && rows[overlay.at]) {
+                if (pick && rows[overlay.at]) {
                     const shape = rows[overlay.at].id;
                     ui.map = { ...ui.map, [shape]: { pin: { via: overlay.adapter, model: overlay.model } } };
                     setOverlay(null);
@@ -1263,7 +1320,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                     bump();
                     return;
                 }
-                if (key.return) {
+                if (pick) {
                     const { shape, chain } = overlay.picker;
                     // a pool is the shape's WHOLE declaration: pin and prefer leave with it (schema
                     // exclusivity — pin+pool and pool+prefer both fail config load)
@@ -1341,7 +1398,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                     bump();
                     return;
                 }
-                if (key.return) {
+                if (pick) {
                     const choice = REACH_CHOICES[overlay.at].id;
                     setOverlay(null);
                     applyReach(overlay.target, choice);
@@ -1378,7 +1435,8 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                 bump();
                 return;
             }
-            if (key.return && rows[overlay.at]) {
+            // Space picks too (spacePicks): a judge picker that swallowed it read as "can't choose"
+            if (pick && rows[overlay.at]) {
                 // single-select: one seat or back to the config default — never a chain
                 const picked = rows[overlay.at];
                 ui.judgeSeat = picked === judgeKeepRow ? null : picked;
@@ -2003,7 +2061,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
         const rows = [judgeKeepRow, ...judgeSeats].filter((row) => matches(row, ui.filter));
         const { visible, start, above, below } = windowRows(rows, overlay.at, capacity);
         const selectedSeat = ui.judgeSeat ?? judgeKeepRow;
-        return (_jsxs(OverlayPanel, { title: "pick \u00B7 judge", width: bodyW, children: [_jsx(Text, { dimColor: true, children: "one seat judges acceptance criteria \u2014 failover stays runtime (GATE-09)" }), _jsx(SearchRow, { filter: ui.filter, active: true }), above > 0 && _jsx(ElisionMark, { count: above, side: "above" }), visible.map((label, index) => (_jsxs(Text, { children: [_jsx(Pointer, { on: start + index === overlay.at }), label === selectedSeat ? _jsx(Glyph, { kind: "on" }) : _jsx(Text, { children: " " }), _jsx(Text, { bold: start + index === overlay.at, children: ` ${clip(label, bodyW - 10)}` })] }, label))), below > 0 && _jsx(ElisionMark, { count: below, side: "below" })] }));
+        return (_jsxs(OverlayPanel, { title: "pick \u00B7 judge", width: bodyW, children: [_jsx(Text, { dimColor: true, wrap: "truncate", children: clip("Space or Enter picks · Esc keeps · one seat judges acceptance criteria — failover stays runtime (GATE-09)", bodyW - 4) }), _jsx(SearchRow, { filter: ui.filter, active: true }), above > 0 && _jsx(ElisionMark, { count: above, side: "above" }), visible.map((label, index) => (_jsxs(Text, { children: [_jsx(Pointer, { on: start + index === overlay.at }), label === selectedSeat ? _jsx(Glyph, { kind: "on" }) : _jsx(Text, { children: " " }), _jsx(Text, { bold: start + index === overlay.at, children: ` ${clip(label, bodyW - 10)}` })] }, label))), below > 0 && _jsx(ElisionMark, { count: below, side: "below" })] }));
     })();
     const modelVisibilityLine = () => {
         const hidden = hiddenModelCount();
@@ -2180,7 +2238,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                 ? _jsx(Text, { color: INK.warn, children: ` ! ${clip(ui.notice, width - 4)}` })
                 : details.map((line) => _jsx(Text, { dimColor: true, children: ` ${clip(line, width - 2)}` }, line)), _jsx(KeyBar, { binds: keyBinds() })] }));
 }
-export async function runFleetInkEditor({ ageMs, adapters, health, initialAllowOut = [], initialEfforts, modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewAdvisories = [], reviewOverlay, reloadGuard, stagedRouting, holderOf, entry = "probe", initialJudge = "", judgeSeats = [], initialInput = [], input, output, debug = false, ...initialDenyProps }) {
+export async function runFleetInkEditor({ ageMs, adapters, health, initialAllowOut = [], initialEfforts, modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewAdvisories = [], reviewOverlay, layerStamp, reloadGuard, stagedRouting, holderOf, entry = "probe", initialJudge = "", judgeSeats = [], initialInput = [], input, output, debug = false, ...initialDenyProps }) {
     const agents = adapters.flatMap((adapter) => {
         const state = health[adapter.id];
         if (!state?.installed)
@@ -2204,7 +2262,7 @@ export async function runFleetInkEditor({ ageMs, adapters, health, initialAllowO
     // rebuilt from output.columns/rows so a pane resize re-renders at the new size. Same root
     // element type on every rerender ⇒ React keeps the component instance, so staged edits,
     // cursor, and overlays all survive the resize.
-    const editorElement = () => (_jsx(FleetApp, { ageMs: ageMs, agents: agents, ...initialDenyProps, initialAllowOut: initialAllowOut, initialEfforts: initialEfforts, modelGroups: declaredModelGroups, initialMode: initialMode, modeOptions: modeOptions, initialMap: initialMap, modePreview: modePreview, shapeRows: shapeRows, candidatesForShape: candidatesForShape, preferOptionsForShape: preferOptionsForShape, initialSteering: initialSteering, steeringOptionsFor: steeringOptionsFor, reviewAdvisories: reviewAdvisories, reviewOverlay: reviewOverlay, reloadGuard: reloadGuard, stagedRouting: stagedRouting, holderOf: holderOf, entry: entry, initialJudge: initialJudge, judgeSeats: judgeSeats, 
+    const editorElement = () => (_jsx(FleetApp, { ageMs: ageMs, agents: agents, ...initialDenyProps, initialAllowOut: initialAllowOut, initialEfforts: initialEfforts, modelGroups: declaredModelGroups, initialMode: initialMode, modeOptions: modeOptions, initialMap: initialMap, modePreview: modePreview, shapeRows: shapeRows, candidatesForShape: candidatesForShape, preferOptionsForShape: preferOptionsForShape, initialSteering: initialSteering, steeringOptionsFor: steeringOptionsFor, reviewAdvisories: reviewAdvisories, reviewOverlay: reviewOverlay, layerStamp: layerStamp, reloadGuard: reloadGuard, stagedRouting: stagedRouting, holderOf: holderOf, entry: entry, initialJudge: initialJudge, judgeSeats: judgeSeats, 
         // v1.90.9: cap every list to the terminal minus chrome so the cursor and header can
         // never scroll off-screen (omp's 218-model list did exactly that pre-cap).
         // OBS-523: chrome is ≤12 rows worst case (header, borders, padding, scope+search,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.6.7",
+  "version": "2.6.9",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",
@@ -114,6 +114,9 @@
       "scripts/export-public.sh",
       "scripts/verify-export.sh",
       "tests/scripts/verify-export.test.ts",
+      "scripts/check-analysis.mjs",
+      "scripts/atlas.mjs",
+      "tests/docs/analysis-library.test.ts",
       ".github/workflows/ci.yml",
       "**/*.local.*"
     ]

package/skills/tickmarkr-auto/SKILL.md

@@ -12,8 +12,9 @@ Use the canonical loop skill's [cockpit, parked decisions and printed twins](../
 for each target: delivered views are **1 Home, 4 Run, 5 Evidence**; Fleet/Bootstrap and
 Plan/Health remain follow-ons with CLI entries. The recorded 1/3 merged, human T2, blocked
 T3 case stays PARTIAL despite tip pass. Review the Run confirmation, read back the appended
-`task-approved` receipt, and explicitly launch `tickmarkr resume <runId>` with the host-owned split form below when no live owner exists;
-approval records permission and never dispatches work itself. Non-TTY readers keep `status`,
+`task-approved` receipt, and explicitly launch `tickmarkr resume <runId>` with the detached launch below when no live owner exists;
+approval records permission and never dispatches work itself. A waive needs an `OOB: executed`
+read at the task head (the walkthrough's record example); a static CLEAN never funds one. Non-TTY readers keep `status`,
 `report` and default-watch line output, with `--watch --plain` as the TTY fallback.
 Keep `name: tickmarkr-auto` and the installed links to canonical `skills/` intact.
 
@@ -92,26 +93,41 @@ After sending, **confirm delivery** by reading the target pane and verifying the
 1. **Prepare** — confirm the target list. Run the [binary preflight](#binary-preflight-before-compile-or-run). Check `git status`, confirm no tickmarkr run is active, and work from a non-main branch.
 2. **Compile** — run `tickmarkr compile <spec-or-directory>`. Fix source-spec defects instead of editing the generated graph.
 3. **Plan** — run `tickmarkr plan`. Review routes, capability-floor warnings, and human gates before execution.
-4. **Run** — launch `tickmarkr run` using the [host-owned split form](#host-owned-daemon-and-detached-beats), and start detached beats with their run-end stop items. A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for the run's terminal events — the shipped watcher below, or a foreground `until grep` on the run's terminal events — and ensure it is re-armed at most every twenty minutes. Never rely on a `Monitor`-only wake. Watch the run journal rather than polling agents, using the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800` — which takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict` and grades the run-end summary against every execution clause for you; the debt clause is yours — read CURRENT `tickmarkr status <runId>` (step 5). Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the relevant agent session.
+4. **Run** — launch `tickmarkr run` using the [detached launch](#host-owned-daemon-and-detached-beats), and start detached beats with their run-end stop items. A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for the run's terminal events — the shipped watcher below, or a foreground `until grep` on the run's terminal events — and ensure it is re-armed at most every twenty minutes. Never rely on a `Monitor`-only wake. Watch the run journal rather than polling agents, using the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800` — which takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict` and grades the run-end summary's execution clauses for you — `EXECUTION COMPLETE` or `NOT GREEN`, never green, because a run-end record is history; the debt clause is yours — read CURRENT `tickmarkr status <runId>` (step 5). Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the relevant agent session.
 5. **Verify and consolidate** — continue only after a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty, and CURRENT `tickmarkr status <runId>` reads its owed checks outstanding empty AND known (`outstanding 0`) — a run with a parked task is partial, not green. Empty execution buckets alone are not green either (D-660): every bucket empty and the tip passed, but an operator waived one review, leaves one accepted-risk review check owed — status reads `outstanding 1 (T7 review)` and `run`/`resume` still exit 0 on execution alone, so the run is execution complete, not green. It turns green only when a `tickmarkr verify --record <runId>` discharge moves CURRENT status to `outstanding 0`, including a discharge landing after run-end — the historical run-end record keeps the old count, so never read debt from it; `outstanding unknown` is never green. Tickmarkr consolidates accepted work on `tickmarkr/<runId>` and never signs off to the main branch. A human controls any later release merge.
 6. **Record** — `tickmarkr report <runId> --md` prints Markdown to stdout; redirect explicitly beside the spec (for example `tickmarkr report <runId> --md > feature.record.md`) and commit the execution record when the repository tracks those records.
 7. **Continue** — move to the next requested target. If a target fails or is parked, stop with the journal evidence rather than silently skipping it.
 
 ## Host-owned daemon and detached beats
 
-Launch the daemon as a SPLIT of the orchestrator's own pane in the ORCH tab, owned by the
-host PTY. Never launch it as an agent harness background task or in a separate tab. The daemon
-self-places its board from that split, keeping both daemon and board in the ORCH tab.
+Launch the daemon DETACHED, with no pane of its own: one `tickmarkr run` or `tickmarkr resume <runId>`
+process in its own session, its stdout and stderr appended to `<state-dir>/daemon.log`, and the
+ORCH's recorded address as its board anchor, so the daemon self-places its one board beside the
+ORCH in the ORCH tab. Never launch it in a visible split, pane or tab, as an agent harness
+background task, or tied to an agent session: the launching shell may end, and the daemon keeps
+running and logging. The detach wrapper is `node`, which tickmarkr already requires — no private
+script, no extra visible daemon pane and no CLI log flag:
 
-- **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**:
-  `orca terminal split --terminal "$ORCA_TERMINAL_HANDLE" --direction vertical --command "tickmarkr run"`.
-- **On herdr (`HERDR_ENV=1`)**: use `herdr pane split` on the orchestrator's own pane, then
-  `herdr pane run <new> "tickmarkr run"` in the returned split.
+```bash
+# On Orca: <ORCH handle> is the ORCH terminal handle
+cd <repo> && ORCA_TERMINAL_HANDLE="<ORCH handle>" node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr run >> <state-dir>/daemon.log 2>&1 < /dev/null
+cd <repo> && ORCA_TERMINAL_HANDLE="<ORCH handle>" node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr resume <runId> >> <state-dir>/daemon.log 2>&1 < /dev/null
+# On herdr: <ORCH pane id> is the ORCH pane id
+cd <repo> && HERDR_PANE_ID="<ORCH pane id>" node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr run >> <state-dir>/daemon.log 2>&1 < /dev/null
+cd <repo> && HERDR_PANE_ID="<ORCH pane id>" node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr resume <runId> >> <state-dir>/daemon.log 2>&1 < /dev/null
+```
+
+- **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: run the
+  `ORCA_TERMINAL_HANDLE` lines; `<ORCH handle>` is the ORCH's own `$ORCA_TERMINAL_HANDLE`.
+- **On herdr (`HERDR_ENV=1`)**: run the `HERDR_PANE_ID` lines; `<ORCH pane id>` is the ORCH's own
+  `$HERDR_PANE_ID`.
 
-For `resume`, use the same host-owned split form with `tickmarkr resume <runId>` in place of
-`tickmarkr run`. After either launch, read this repository's lock pid and walk its ppid chain
-in the process table to the host PTY; verify no agent session is an ancestor. If an agent is
-an ancestor, stop that launch and relaunch through the host split before continuing.
+After either launch, read this repository's lock pid from `<state-dir>/graph.lock` and confirm it:
+`kill -0 <pid>` succeeds, `ps -o pgid= -p <pid>` prints that same pid (its own session group;
+ppid 1 is never proof on its own), walk its ppid chain and verify no agent session is an ancestor,
+and read `<state-dir>/daemon.log`. No live holder means the launch failed: read the log, fix the
+cause and run the same line again — never a second daemon beside a live holder, and never a
+visible split to watch it; the daemon-placed board is the live surface.
 
 Detached beats are product-owned, one per (tier, seat), from the repository root, through the
 shipped lifecycle verbs — never a hand-rolled setsid plus nohup wrapper, pidfile or shell loop:
@@ -133,5 +149,33 @@ generation and identity still match, and reads back DISARMED. Never put beats in
 background task or a visible tab. Include a run-end `beat stop` item for every beat started, also
 on failure, park or handoff, and require its DISARMED read-back.
 
+**Legacy beat migration.** `beat start` refuses a legacy (pre-lifecycle, unowned) arm nonzero and
+prints its exit under the RECORDED seat; `beat stop` refuses it too, so a stop followed by a start
+is a dead end, never a migration. When the refusal names `stop pid <N> first`, that pid is the old
+`--loop` writer: stop exactly that pid yourself (`kill <N>`, then confirm `kill -0 <N>` fails) —
+tickmarkr never signals a process it did not launch. Then run the printed step under the seat it
+names, start again and read back ARMED:
+
+```bash
+cd <repo> && tickmarkr beat <tier> --seat <recorded seat> --stand-down
+cd <repo> && tickmarkr beat start <tier> --seat <seat>
+cd <repo> && tickmarkr beat status <tier> --seat <seat>
+```
+
+**Crash recovery.** A crashed owner, a writer killed inside its claimed tick or a killed recovery
+taker leaves its claim, removal lock or stage directory behind. `beat status` only observes: it
+exits nonzero, names the dead pids, prints the command that recovers them and changes no file —
+status never recovers. Run the command it prints; the next ordinary `stop` or `start` recovers what
+was left, with a notice naming each dead pid, and the start reads back ARMED:
+
+```bash
+cd <repo> && tickmarkr beat status <tier> --seat <seat>
+cd <repo> && tickmarkr beat stop <tier> --seat <seat>
+cd <repo> && tickmarkr beat start <tier> --seat <seat>
+```
+
+Never delete a claim, lock or stage file by hand. A live or unprovable holder refuses BUSY naming
+it: wait for that holder to finish or exit, then run the same command.
+
 Keep only watchers that must WAKE the seat in the harness. Re-arm them on each wake and at
 their harness cap; daemon and beat lifetimes must not depend on that cap.

package/skills/tickmarkr-loop/SKILL.md

@@ -88,25 +88,40 @@ When spawning consultants (agents gathering synthesis input for decisions like S
 1. **Prepare** — start from the requested spec. Run the [binary preflight](#binary-preflight-before-compile-or-run). Check `git status`, confirm no tickmarkr run is active, and work from a non-main branch.
 2. **Compile** — run `tickmarkr compile <spec>`. Correct compilation errors in the spec, never in the generated graph.
 3. **Plan** — run `tickmarkr plan`. Review the routing table, capability-floor warnings, and every human gate, including work that each gate blocks.
-4. **Run** — launch `tickmarkr run` using the [host-owned split form](#host-owned-daemon-and-detached-beats), and start detached beats with their run-end stop items. A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for the run's terminal events — the shipped watcher below, or a foreground `until grep` on the run's terminal events — and ensure it is re-armed at most every twenty minutes. Never rely on a `Monitor`-only wake. Watch the run journal rather than polling agents, using the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800` — which takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict` and grades the run-end summary against every execution clause for you; the debt clause is yours — read CURRENT `tickmarkr status <runId>` (step 5). Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the agent session; do not turn them into proxy questions.
+4. **Run** — launch `tickmarkr run` using the [detached launch](#host-owned-daemon-and-detached-beats), and start detached beats with their run-end stop items. A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for the run's terminal events — the shipped watcher below, or a foreground `until grep` on the run's terminal events — and ensure it is re-armed at most every twenty minutes. Never rely on a `Monitor`-only wake. Watch the run journal rather than polling agents, using the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800` — which takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict` and grades the run-end summary's execution clauses for you — `EXECUTION COMPLETE` or `NOT GREEN`, never green, because a run-end record is history; the debt clause is yours — read CURRENT `tickmarkr status <runId>` (step 5). Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the agent session; do not turn them into proxy questions.
 5. **Verify and consolidate** — accept only a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty, and CURRENT `tickmarkr status <runId>` reads its owed checks outstanding empty AND known (`outstanding 0`) — a run with a parked task is partial, not green. Empty execution buckets alone are not green either (D-660): every bucket empty and the tip passed, but an operator waived one review, leaves one accepted-risk review check owed — status reads `outstanding 1 (T7 review)` and `run`/`resume` still exit 0 on execution alone, so the run is execution complete, not green. It turns green only when a `tickmarkr verify --record <runId>` discharge moves CURRENT status to `outstanding 0`, including a discharge landing after run-end — the historical run-end record keeps the old count, so never read debt from it; `outstanding unknown` is never green. Tickmarkr consolidates accepted task work on `tickmarkr/<runId>`; it never signs off to the main branch. A human may later merge that integration branch through the repository's normal release process.
 6. **Record** — `tickmarkr report <runId> --md` prints Markdown to stdout. Redirect it explicitly beside the source spec (for example `tickmarkr report <runId> --md > feature.record.md`) and commit the execution record when the repository tracks those records. Then [stand down](#stand-down-mission-end-and-retirement).
 
 ## Host-owned daemon and detached beats
 
-Launch the daemon as a SPLIT of the orchestrator's own pane in the ORCH tab, owned by the
-host PTY. Never launch it as an agent harness background task or in a separate tab. The daemon
-self-places its board from that split, keeping both daemon and board in the ORCH tab.
+Launch the daemon DETACHED, with no pane of its own: one `tickmarkr run` or `tickmarkr resume <runId>`
+process in its own session, its stdout and stderr appended to `<state-dir>/daemon.log`, and the
+ORCH's recorded address as its board anchor, so the daemon self-places its one board beside the
+ORCH in the ORCH tab. Never launch it in a visible split, pane or tab, as an agent harness
+background task, or tied to an agent session: the launching shell may end, and the daemon keeps
+running and logging. The detach wrapper is `node`, which tickmarkr already requires — no private
+script, no extra visible daemon pane and no CLI log flag:
 
-- **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**:
-  `orca terminal split --terminal "$ORCA_TERMINAL_HANDLE" --direction vertical --command "tickmarkr run"`.
-- **On herdr (`HERDR_ENV=1`)**: use `herdr pane split` on the orchestrator's own pane, then
-  `herdr pane run <new> "tickmarkr run"` in the returned split.
+```bash
+# On Orca: <ORCH handle> is the ORCH terminal handle
+cd <repo> && ORCA_TERMINAL_HANDLE="<ORCH handle>" node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr run >> <state-dir>/daemon.log 2>&1 < /dev/null
+cd <repo> && ORCA_TERMINAL_HANDLE="<ORCH handle>" node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr resume <runId> >> <state-dir>/daemon.log 2>&1 < /dev/null
+# On herdr: <ORCH pane id> is the ORCH pane id
+cd <repo> && HERDR_PANE_ID="<ORCH pane id>" node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr run >> <state-dir>/daemon.log 2>&1 < /dev/null
+cd <repo> && HERDR_PANE_ID="<ORCH pane id>" node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr resume <runId> >> <state-dir>/daemon.log 2>&1 < /dev/null
+```
+
+- **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: run the
+  `ORCA_TERMINAL_HANDLE` lines; `<ORCH handle>` is the ORCH's own `$ORCA_TERMINAL_HANDLE`.
+- **On herdr (`HERDR_ENV=1`)**: run the `HERDR_PANE_ID` lines; `<ORCH pane id>` is the ORCH's own
+  `$HERDR_PANE_ID`.
 
-For `resume`, use the same host-owned split form with `tickmarkr resume <runId>` in place of
-`tickmarkr run`. After either launch, read this repository's lock pid and walk its ppid chain
-in the process table to the host PTY; verify no agent session is an ancestor. If an agent is
-an ancestor, stop that launch and relaunch through the host split before continuing.
+After either launch, read this repository's lock pid from `<state-dir>/graph.lock` and confirm it:
+`kill -0 <pid>` succeeds, `ps -o pgid= -p <pid>` prints that same pid (its own session group;
+ppid 1 is never proof on its own), walk its ppid chain and verify no agent session is an ancestor,
+and read `<state-dir>/daemon.log`. No live holder means the launch failed: read the log, fix the
+cause and run the same line again — never a second daemon beside a live holder, and never a
+visible split to watch it; the daemon-placed board is the live surface.
 
 Detached beats are product-owned, one per (tier, seat), from the repository root, through the
 shipped lifecycle verbs — never a hand-rolled setsid plus nohup wrapper, pidfile or shell loop:
@@ -128,6 +143,34 @@ generation and identity still match, and reads back DISARMED. Never put beats in
 background task or a visible tab. Include a run-end `beat stop` item for every beat started, also
 on failure, park or handoff, and require its DISARMED read-back.
 
+**Legacy beat migration.** `beat start` refuses a legacy (pre-lifecycle, unowned) arm nonzero and
+prints its exit under the RECORDED seat; `beat stop` refuses it too, so a stop followed by a start
+is a dead end, never a migration. When the refusal names `stop pid <N> first`, that pid is the old
+`--loop` writer: stop exactly that pid yourself (`kill <N>`, then confirm `kill -0 <N>` fails) —
+tickmarkr never signals a process it did not launch. Then run the printed step under the seat it
+names, start again and read back ARMED:
+
+```bash
+cd <repo> && tickmarkr beat <tier> --seat <recorded seat> --stand-down
+cd <repo> && tickmarkr beat start <tier> --seat <seat>
+cd <repo> && tickmarkr beat status <tier> --seat <seat>
+```
+
+**Crash recovery.** A crashed owner, a writer killed inside its claimed tick or a killed recovery
+taker leaves its claim, removal lock or stage directory behind. `beat status` only observes: it
+exits nonzero, names the dead pids, prints the command that recovers them and changes no file —
+status never recovers. Run the command it prints; the next ordinary `stop` or `start` recovers what
+was left, with a notice naming each dead pid, and the start reads back ARMED:
+
+```bash
+cd <repo> && tickmarkr beat status <tier> --seat <seat>
+cd <repo> && tickmarkr beat stop <tier> --seat <seat>
+cd <repo> && tickmarkr beat start <tier> --seat <seat>
+```
+
+Never delete a claim, lock or stage file by hand. A live or unprovable holder refuses BUSY naming
+it: wait for that holder to finish or exit, then run the same command.
+
 Keep only watchers that must WAKE the seat in the harness. Re-arm them on each wake and at
 their harness cap; daemon and beat lifetimes must not depend on that cap.
 
@@ -146,7 +189,7 @@ run/task, original park `#L`, actor/reason, exact argv, consequence and enactor.
 confirms; `n`/Esc cancel; Enter never confirms. Read the receipt's appended `task-approved`
 line and actor/reason back from the journal. Approval records permission, never dispatch,
 a passed gate or task completion. With no live owner it says **approved; resume required**:
-exit the observer and launch `tickmarkr resume <runId>` explicitly with the same host-owned split form above. A matching live daemon
+exit the observer and launch `tickmarkr resume <runId>` explicitly with the same detached launch above. A matching live daemon
 enacts at its next task boundary; if a different live run owns the repository lock, wait
 for that run to end before resuming this one.
 
@@ -174,7 +217,15 @@ Run offers only validated park verbs: human/attempt-cap/other non-gate parks all
 infra allows approve or `--recheck`; review gate-fail allows `--waive`, `--uphold` or
 `--recheck`; other gate-fail allows waive/recheck. Waive satisfies only the identified
 failed gate, uphold funds a fixed attempt carrying review findings, and recheck reruns the
-declared battery without satisfying a gate. A stall park that recorded a `reapFailure`
+declared battery without satisfying a gate. A waive needs EXECUTED evidence: mark every
+out-of-band (OOB) read behind it `OOB: static` (diff and source read, nothing run) or
+`OOB: executed` (the finding's claim run at the task's head commit, exit code and log on file).
+Static CLEAN never backs a waive — a static read that missed an executed material defect looks
+like one that found none, and a static read relabelled executed is a false record. When the
+finding's reproduction, executed at the task head, fails, the ruling is uphold or recheck; waive
+only when it passes and the record names it, keeping the park/gate binding and the owed check
+(`outstanding 1 (T2 review)` until `tickmarkr verify --record <runId>`):
+`D-NNN WAIVE T2 review — park <line>@<ts> --gate review — OOB: executed — <reproduction> at <task-head-sha>: exit 0, log <path>`. A stall park that recorded a `reapFailure`
 (unreadable or surviving worker census) allows approve or `--recheck --park <line>@<ts>`:
 recheck re-verifies that attempt's owned census and gates its harvested commits with no
 worker only with an explicitly recorded empty survivors array (`[]`) — a missing,