tickmarkr 2.8.3 → 2.8.5

package/skills/tickmarkr-auto/SKILL.md

@@ -20,18 +20,50 @@ Keep `name: tickmarkr-auto` and the installed links to canonical `skills/` intac
 
 ## Two-tier by default — role check before the loop
 
-When working in a multi-agent terminal environment, decide your role before starting:
+When working in a multi-agent terminal environment (herdr or Orca), decide your role before starting:
 
 - **Orchestrator:** your session was started to execute the mission. Rename your own tab/pane `ORCH · <version>` (short labels: ≤20 chars, `ROLE · token`) and run the loop below.
 - **Supervisor with a live orchestrator:** do not start a second run. Relay the mission to the existing orchestrator with a [verified handoff](#verified-handoffs-agent-to-agent-messaging), then supervise it as OVERSEER.
 - **Primary session without an orchestrator:** rename your own tab `OVERSEER · <version>` and your agent `overseer`, spawn one child orchestration session with your host's launch form, label its tab `ORCH · <version>` and name its agent, give it the mission and these rules verbatim, then supervise it. Do not drive a duplicate single-tier run yourself. Before spawning, confirm any PREVIOUS orchestrator has stood down (monitors stopped, input box empty — dim ghost-text suggestions are UI, not queued input; ANSI-verify before alarming) and close its tab — the journal, records, and ledger hold the story; scrollback is disposable.
-  - **Spawning on current herdr is two-step** — the one-shot `agent start --cwd/--tab/--no-focus` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138). First create the pane: `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` (tab create does not steal focus unless `--focus` is passed; parse `result.root_pane.pane_id` from its JSON), then start the agent in it:
-  - **Claude Code:** `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions`
-  - **Codex:** `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` — the unsandboxed flag is REQUIRED, not optional: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation (`git worktree add` cannot lock the ref). Do not downgrade this flag; the herdr pane and repo scope are the containment.
+  - **On herdr (`HERDR_ENV=1`)**: **spawning on current herdr is two-step** — the one-shot `agent start --cwd/--tab/--no-focus` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138). First create the pane: `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` (tab create does not steal focus unless `--focus` is passed; parse `result.root_pane.pane_id` from its JSON), then start the agent in it:
+    - **Claude Code:** `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions`
+    - **Codex:** `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` — the unsandboxed flag is REQUIRED, not optional: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation (`git worktree add` cannot lock the ref). Do not downgrade this flag; the herdr pane and repo scope are the containment.
+    - **Auxiliary seats run as the CLI's interactive TUI in their visible pane — never headless** (`claude -p` / `codex exec`): headless buffers output until exit so the pane renders idle for the entire run, is blind to SessionStart hook errors (a broken and a fixed hook both return green), and gives a stall watcher no midpoint — silent-time equals lifetime. Headless is for exit-code probes only (a quota check that wants `rc`), never for work anyone must watch.
+  - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: spawn it with `orca terminal create --worktree path:<repo> --title "ORCH · <version>" --command "<agent-cmd>" --json` and parse `result.terminal.handle` from the create receipt. **Auxiliary seats run as the CLI's interactive TUI in their visible terminal — never headless**, for the reasons the herdr branch gives.
   - **Auxiliary agents you spawn (consultants, reviewers, scouts) follow the same forms.** Never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions` (tickmarkr's own adapter uses exactly this for workers, judges, and consults). A read-only codex consultant may use `--sandbox read-only`; any codex session that must touch git needs the unsandboxed flag above.
-  - **Auxiliary seats run as the CLI's interactive TUI in their visible pane — never headless** (`claude -p` / `codex exec`): headless buffers output until exit so the pane renders idle for the entire run, is blind to SessionStart hook errors (a broken and a fixed hook both return green), and gives a stall watcher no midpoint — silent-time equals lifetime. Headless is for exit-code probes only (a quota check that wants `rc`), never for work anyone must watch.
 
-Outside a multi-agent terminal environment, run the loop directly.
+With neither herdr nor Orca there is no role to decide and no seat to spawn: follow [On a plain host (neither herdr nor Orca)](#on-a-plain-host-neither-herdr-nor-orca) and run the loop directly, single-tier.
+
+## On a plain host (neither herdr nor Orca)
+
+Neither `HERDR_ENV=1` nor the Orca markers are set: the Claude Desktop Code tab, a plain terminal, any
+agent session that owns no panes (queue row 192; D-2102). The role check above does not apply.
+
+- **This session runs SINGLE-TIER as the orchestrator.** There are no seats, no pane briefs, no tab
+  canon and no board: run every step of [the per-spec loop](#per-spec-loop) yourself and skip every
+  On herdr and On Orca scope.
+- **An empty mission is asked for, never assumed.** With no target named, ask the operator what to run
+  end-to-end before compiling anything; there is no other tier to relay it to.
+- **Run and resume launch through the anchor-free lines** of the
+  [detached launch](#host-owned-daemon-and-detached-beats): the same `node` detach with no address, one
+  line for `tickmarkr run` and one for `tickmarkr resume <runId>`. The daemon places no board, so a
+  missing board is never a fault; confirm the launch from the lock pid as that section says.
+- **Run-end and parks are watched through the host's background wait**, never a foreground wait past
+  the host's ten-minute tool cap: the cap kills that wait, ends the turn and leaves the run unwatched.
+  Start the wait as a background task whose exit wakes this session, on journal lines after a baseline
+  taken at arm time and on the lock holder's death:
+  `n=$(wc -l < <journal>); until tail -n +$((n + 1)) <journal> | grep -qE '"event":"(run-end|task-human|task-failed|consult-verdict)"' || ! kill -0 <pid>; do sleep 20; done`
+  (`<journal>` is `<state-dir>/runs/<runId>/journal.jsonl`, `<pid>` the lock pid). On every wake read
+  CURRENT `tickmarkr status <runId>` first, then re-arm.
+- **The operator's view is `tickmarkr status <runId>`**, plus its live `status --watch --plain` form,
+  `tickmarkr status <runId> --watch --plain`, in a read-only Terminal tab beside this session.
+- **Reviews and judges run headless.** The subprocess driver runs every worker, judge and review as a
+  headless CLI call with no pane to watch: read their verdicts from the journal, the gate evidence and
+  `tickmarkr status <runId>`, never from a screen.
+- **Sessions hand off through the host's cross-session message tool**, confirmed by the peer's reply:
+  there is no composer to read back, so a message no peer answered is not a handoff.
+- **Keep a permission mode that never stalls per command** for the whole run (for example
+  `bypassPermissions`): nobody answers a per-command approval prompt in an unattended session.
 
 ## Stand-down (mission end and retirement)
 
@@ -79,21 +111,24 @@ concurrently* — so a machine-wide check answers a question nobody asked and bl
 
 ## Verified handoffs (agent-to-agent messaging)
 
-When relaying missions between agents in a multi-agent terminal, **never use bare send-text** (`herdr agent send` / pane send-text) — it writes text without pressing Enter, so handoffs sit unsubmitted (OBS-39).
+Never report "briefed" or "relayed" without the confirmation your host gives:
 
-Use one of:
+- **On herdr (`HERDR_ENV=1`)**: when relaying missions between agents in a multi-agent terminal, **never use bare send-text** (`herdr agent send` / pane send-text) — it writes text without pressing Enter, so handoffs sit unsubmitted (OBS-39). Use one of:
+  - `herdr pane run <pane> "<message>"` — text plus Enter in the target shell
+  - `herdr notification show "<message>"` — OS-level delivery for the operator
 
-- `herdr pane run <pane> "<message>"` — text plus Enter in the target shell
-- `herdr notification show "<message>"` — OS-level delivery for the operator
-
-After sending, **confirm delivery** by reading the target pane and verifying the message landed (input empty, agent status `working`, or notification acknowledged). Never report "briefed" or "relayed" without read-back confirmation.
+  After sending, **confirm delivery** by reading the target pane and verifying the message landed (input empty, agent status `working`, or notification acknowledged). Never report "briefed" or "relayed" without read-back confirmation.
+- **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: send with `orca terminal send --terminal <handle> --text "<message>" --enter --wait-submit 15 --json` and treat it as delivered only when `result.send.prompt.stages` carries a `turn_started` stage — `accepted: true` proves input acceptance, not a started turn.
+- With neither host, hand off through the host's cross-session message tool, confirmed by the peer's reply ([On a plain host (neither herdr nor Orca)](#on-a-plain-host-neither-herdr-nor-orca)).
 
 ## Per-spec loop
 
 1. **Prepare** — confirm the target list. Run the [binary preflight](#binary-preflight-before-compile-or-run). Check `git status`, confirm no tickmarkr run is active, and work from a non-main branch.
 2. **Compile** — run `tickmarkr compile <spec-or-directory>`. Fix source-spec defects instead of editing the generated graph.
 3. **Plan** — run `tickmarkr plan`. Review routes, capability-floor warnings, and human gates before execution.
-4. **Run** — launch `tickmarkr run` using the [detached launch](#host-owned-daemon-and-detached-beats), and start detached beats with their run-end stop items. A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for the run's terminal events — the shipped watcher below, or a foreground `until grep` on the run's terminal events — and ensure it is re-armed at most every twenty minutes. Never rely on a `Monitor`-only wake. Watch the run journal rather than polling agents, using the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800` — which takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict` and grades the run-end summary's execution clauses for you — `EXECUTION COMPLETE` or `NOT GREEN`, never green, because a run-end record is history; the debt clause is yours — read CURRENT `tickmarkr status <runId>` (step 5). Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the relevant agent session.
+4. **Run** — launch `tickmarkr run` using the [detached launch](#host-owned-daemon-and-detached-beats), and start detached beats with their run-end stop items. A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for the run's terminal events, and never rely on a `Monitor`-only wake. Watch the run journal rather than polling agents: the consumer takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict`. A run-end record is history, never green; the debt clause is yours — read CURRENT `tickmarkr status <runId>` (step 5). Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the relevant agent session. The consumer is host-specific; with neither host it is the background wait of [On a plain host (neither herdr nor Orca)](#on-a-plain-host-neither-herdr-nor-orca).
+   - **On herdr (`HERDR_ENV=1`)**: the consumer is the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800`, which grades the run-end summary's execution clauses for you, `EXECUTION COMPLETE` or `NOT GREEN`, never green — or a foreground `until grep` on the run's terminal events; ensure it is re-armed at most every twenty minutes.
+   - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: the consumer is that same shipped journal watcher or a foreground `until grep` on the run's terminal events; ensure it is re-armed at most every twenty minutes.
 5. **Verify and consolidate** — continue only after a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty, and CURRENT `tickmarkr status <runId>` reads its owed checks outstanding empty AND known (`outstanding 0`) — a run with a parked task is partial, not green. Empty execution buckets alone are not green either (D-660): every bucket empty and the tip passed, but an operator waived one review, leaves one accepted-risk review check owed — status reads `outstanding 1 (T7 review)` and `run`/`resume` still exit 0 on execution alone, so the run is execution complete, not green. It turns green only when a `tickmarkr verify --record <runId>` discharge moves CURRENT status to `outstanding 0`, including a discharge landing after run-end — the historical run-end record keeps the old count, so never read debt from it; `outstanding unknown` is never green. Tickmarkr consolidates accepted work on `tickmarkr/<runId>` and never signs off to the main branch. A human controls any later release merge.
 6. **Record** — `tickmarkr report <runId> --md` prints Markdown to stdout; redirect explicitly beside the spec (for example `tickmarkr report <runId> --md > feature.record.md`) and commit the execution record when the repository tracks those records.
 7. **Continue** — move to the next requested target. If a target fails or is parked, stop with the journal evidence rather than silently skipping it.
@@ -101,12 +136,13 @@ After sending, **confirm delivery** by reading the target pane and verifying the
 ## Host-owned daemon and detached beats
 
 Launch the daemon DETACHED, with no pane of its own: one `tickmarkr run` or `tickmarkr resume <runId>`
-process in its own session, its stdout and stderr appended to `<state-dir>/daemon.log`, and the
-ORCH's recorded address as its board anchor, so the daemon self-places its one board beside the
-ORCH in the ORCH tab. Never launch it in a visible split, pane or tab, as an agent harness
-background task, or tied to an agent session: the launching shell may end, and the daemon keeps
-running and logging. The detach wrapper is `node`, which tickmarkr already requires — no private
-script, no extra visible daemon pane and no CLI log flag:
+process in its own session, its stdout and stderr appended to `<state-dir>/daemon.log`, and on
+herdr or Orca the ORCH's recorded address as its board anchor, so the daemon self-places its one
+board beside the ORCH in the ORCH tab; with neither host it carries no address and places no board.
+Never launch it in a visible split, pane or tab, as an agent harness background task, or tied to
+an agent session: the launching shell may end, and the daemon keeps running and logging. The
+detach wrapper is `node`, which tickmarkr already requires — no private script, no extra visible
+daemon pane and no CLI log flag:
 
 ```bash
 # On Orca: <ORCH handle> is the ORCH terminal handle
@@ -115,19 +151,27 @@ cd <repo> && ORCA_TERMINAL_HANDLE="<ORCH handle>" node -e "require('child_proces
 # On herdr: <ORCH pane id> is the ORCH pane id
 cd <repo> && HERDR_PANE_ID="<ORCH pane id>" node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr run >> <state-dir>/daemon.log 2>&1 < /dev/null
 cd <repo> && HERDR_PANE_ID="<ORCH pane id>" node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr resume <runId> >> <state-dir>/daemon.log 2>&1 < /dev/null
+# On a plain host (neither herdr nor Orca): the same detach with no address
+cd <repo> && node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr run >> <state-dir>/daemon.log 2>&1 < /dev/null
+cd <repo> && node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr resume <runId> >> <state-dir>/daemon.log 2>&1 < /dev/null
 ```
 
 - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: run the
   `ORCA_TERMINAL_HANDLE` lines; `<ORCH handle>` is the ORCH's own `$ORCA_TERMINAL_HANDLE`.
 - **On herdr (`HERDR_ENV=1`)**: run the `HERDR_PANE_ID` lines; `<ORCH pane id>` is the ORCH's own
   `$HERDR_PANE_ID`.
+- With neither host, run the two lines that carry no address
+  ([On a plain host (neither herdr nor Orca)](#on-a-plain-host-neither-herdr-nor-orca)).
 
-After either launch, read this repository's lock pid from `<state-dir>/graph.lock` and confirm it:
+After any launch, read this repository's lock pid from `<state-dir>/graph.lock` and confirm it:
 `kill -0 <pid>` succeeds, `ps -o pgid= -p <pid>` prints that same pid (its own session group;
 ppid 1 is never proof on its own), walk its ppid chain and verify no agent session is an ancestor,
 and read `<state-dir>/daemon.log`. No live holder means the launch failed: read the log, fix the
 cause and run the same line again — never a second daemon beside a live holder, and never a
-visible split to watch it; the daemon-placed board is the live surface.
+visible split to watch it.
+
+- **On herdr (`HERDR_ENV=1`)**: the daemon-placed board is the live surface.
+- **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: the daemon-placed board is the live surface.
 
 Detached beats are product-owned, one per (tier, seat), from the repository root, through the
 shipped lifecycle verbs — never a hand-rolled setsid plus nohup wrapper, pidfile or shell loop:

package/skills/tickmarkr-loop/SKILL.md

@@ -9,18 +9,50 @@ Use this for any spec that `tickmarkr compile` accepts. It is SDD-agnostic: use
 
 ## Two-tier by default — role check before the loop
 
-When working in a multi-agent terminal environment, decide your role before starting:
+When working in a multi-agent terminal environment (herdr or Orca), decide your role before starting:
 
 - **Orchestrator:** your session was started to execute the mission. Rename your own tab/pane `ORCH · <version>` (short labels: ≤20 chars, `ROLE · token`) and run the loop below.
 - **Supervisor with a live orchestrator:** do not start a second run. Relay the mission to the existing orchestrator with a [verified handoff](#verified-handoffs-agent-to-agent-messaging), then supervise it as OVERSEER.
 - **Primary session without an orchestrator:** rename your own tab `OVERSEER · <version>` and your agent `overseer`, spawn one child orchestration session with your host's launch form, label its tab `ORCH · <version>` and name its agent, give it the mission and these rules verbatim, then supervise it. Do not drive a duplicate single-tier run yourself. Before spawning, confirm any PREVIOUS orchestrator has [stood down](#stand-down-mission-end-and-retirement) and close its tab.
-  - **Spawning on current herdr is two-step** — the one-shot `agent start --cwd/--tab/--no-focus` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138). First create the pane: `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` (tab create does not steal focus unless `--focus` is passed; parse `result.root_pane.pane_id` from its JSON), then start the agent in it:
-  - **Claude Code:** `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions`
-  - **Codex:** `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` — the unsandboxed flag is REQUIRED, not optional: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation (`git worktree add` cannot lock the ref). Do not downgrade this flag; the herdr pane and repo scope are the containment.
+  - **On herdr (`HERDR_ENV=1`)**: **spawning on current herdr is two-step** — the one-shot `agent start --cwd/--tab/--no-focus` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138). First create the pane: `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` (tab create does not steal focus unless `--focus` is passed; parse `result.root_pane.pane_id` from its JSON), then start the agent in it:
+    - **Claude Code:** `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions`
+    - **Codex:** `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` — the unsandboxed flag is REQUIRED, not optional: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation (`git worktree add` cannot lock the ref). Do not downgrade this flag; the herdr pane and repo scope are the containment.
+    - **Auxiliary seats run as the CLI's interactive TUI in their visible pane — never headless** (`claude -p` / `codex exec`): headless buffers output until exit so the pane renders idle for the entire run, is blind to SessionStart hook errors (a broken and a fixed hook both return green), and gives a stall watcher no midpoint — silent-time equals lifetime. Headless is for exit-code probes only (a quota check that wants `rc`), never for work anyone must watch.
+  - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: spawn it with `orca terminal create --worktree path:<repo> --title "ORCH · <version>" --command "<agent-cmd>" --json` and parse `result.terminal.handle` from the create receipt. **Auxiliary seats run as the CLI's interactive TUI in their visible terminal — never headless**, for the reasons the herdr branch gives.
   - **Auxiliary agents you spawn (consultants, reviewers, scouts) follow the same forms.** Never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions` (tickmarkr's own adapter uses exactly this for workers, judges, and consults). A read-only codex consultant may use `--sandbox read-only`; any codex session that must touch git needs the unsandboxed flag above.
-  - **Auxiliary seats run as the CLI's interactive TUI in their visible pane — never headless** (`claude -p` / `codex exec`): headless buffers output until exit so the pane renders idle for the entire run, is blind to SessionStart hook errors (a broken and a fixed hook both return green), and gives a stall watcher no midpoint — silent-time equals lifetime. Headless is for exit-code probes only (a quota check that wants `rc`), never for work anyone must watch.
 
-Outside a multi-agent terminal environment, run the loop directly.
+With neither herdr nor Orca there is no role to decide and no seat to spawn: follow [On a plain host (neither herdr nor Orca)](#on-a-plain-host-neither-herdr-nor-orca) and run the loop directly, single-tier.
+
+## On a plain host (neither herdr nor Orca)
+
+Neither `HERDR_ENV=1` nor the Orca markers are set: the Claude Desktop Code tab, a plain terminal, any
+agent session that owns no panes (queue row 192; D-2102). The role check above does not apply.
+
+- **This session runs SINGLE-TIER as the orchestrator.** There are no seats, no pane briefs, no tab
+  canon and no board: run every step of [the loop](#the-loop) yourself and skip every On herdr and On
+  Orca scope.
+- **An empty mission is asked for, never assumed.** With no spec named, ask the operator what to run
+  end-to-end before compiling anything; there is no other tier to relay it to.
+- **Run and resume launch through the anchor-free lines** of the
+  [detached launch](#host-owned-daemon-and-detached-beats): the same `node` detach with no address, one
+  line for `tickmarkr run` and one for `tickmarkr resume <runId>`. The daemon places no board, so a
+  missing board is never a fault; confirm the launch from the lock pid as that section says.
+- **Run-end and parks are watched through the host's background wait**, never a foreground wait past
+  the host's ten-minute tool cap: the cap kills that wait, ends the turn and leaves the run unwatched.
+  Start the wait as a background task whose exit wakes this session, on journal lines after a baseline
+  taken at arm time and on the lock holder's death:
+  `n=$(wc -l < <journal>); until tail -n +$((n + 1)) <journal> | grep -qE '"event":"(run-end|task-human|task-failed|consult-verdict)"' || ! kill -0 <pid>; do sleep 20; done`
+  (`<journal>` is `<state-dir>/runs/<runId>/journal.jsonl`, `<pid>` the lock pid). On every wake read
+  CURRENT `tickmarkr status <runId>` first, then re-arm.
+- **The operator's view is `tickmarkr status <runId>`**, plus its live `status --watch --plain` form,
+  `tickmarkr status <runId> --watch --plain`, in a read-only Terminal tab beside this session.
+- **Reviews and judges run headless.** The subprocess driver runs every worker, judge and review as a
+  headless CLI call with no pane to watch: read their verdicts from the journal, the gate evidence and
+  `tickmarkr status <runId>`, never from a screen.
+- **Sessions hand off through the host's cross-session message tool**, confirmed by the peer's reply:
+  there is no composer to read back, so a message no peer answered is not a handoff.
+- **Keep a permission mode that never stalls per command** for the whole run (for example
+  `bypassPermissions`): nobody answers a per-command approval prompt in an unattended session.
 
 ## Invariants
 
@@ -65,14 +97,15 @@ concurrently* — so a machine-wide check answers a question nobody asked and bl
 
 ## Verified handoffs (agent-to-agent messaging)
 
-When relaying missions between agents in a multi-agent terminal, **never use bare send-text** (`herdr agent send` / pane send-text) — it writes text without pressing Enter, so handoffs sit unsubmitted (OBS-39).
+Never report "briefed" or "relayed" without the confirmation your host gives:
 
-Use one of:
+- **On herdr (`HERDR_ENV=1`)**: when relaying missions between agents in a multi-agent terminal, **never use bare send-text** (`herdr agent send` / pane send-text) — it writes text without pressing Enter, so handoffs sit unsubmitted (OBS-39). Use one of:
+  - `herdr pane run <pane> "<message>"` — text plus Enter in the target shell
+  - `herdr notification show "<message>"` — OS-level delivery for the operator
 
-- `herdr pane run <pane> "<message>"` — text plus Enter in the target shell
-- `herdr notification show "<message>"` — OS-level delivery for the operator
-
-After sending, **confirm delivery** by reading the target pane and verifying the message landed (input empty, agent status `working`, or notification acknowledged). Never report "briefed" or "relayed" without read-back confirmation.
+  After sending, **confirm delivery** by reading the target pane and verifying the message landed (input empty, agent status `working`, or notification acknowledged). Never report "briefed" or "relayed" without read-back confirmation.
+- **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: send with `orca terminal send --terminal <handle> --text "<message>" --enter --wait-submit 15 --json` and treat it as delivered only when `result.send.prompt.stages` carries a `turn_started` stage — `accepted: true` proves input acceptance, not a started turn.
+- With neither host, hand off through the host's cross-session message tool, confirmed by the peer's reply ([On a plain host (neither herdr nor Orca)](#on-a-plain-host-neither-herdr-nor-orca)).
 
 ## Dedicated consultant tab rule
 
@@ -88,19 +121,22 @@ When spawning consultants (agents gathering synthesis input for decisions like S
 1. **Prepare** — start from the requested spec. Run the [binary preflight](#binary-preflight-before-compile-or-run). Check `git status`, confirm no tickmarkr run is active, and work from a non-main branch.
 2. **Compile** — run `tickmarkr compile <spec>`. Correct compilation errors in the spec, never in the generated graph.
 3. **Plan** — run `tickmarkr plan`. Review the routing table, capability-floor warnings, and every human gate, including work that each gate blocks.
-4. **Run** — launch `tickmarkr run` using the [detached launch](#host-owned-daemon-and-detached-beats), and start detached beats with their run-end stop items. A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for the run's terminal events — the shipped watcher below, or a foreground `until grep` on the run's terminal events — and ensure it is re-armed at most every twenty minutes. Never rely on a `Monitor`-only wake. Watch the run journal rather than polling agents, using the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800` — which takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict` and grades the run-end summary's execution clauses for you — `EXECUTION COMPLETE` or `NOT GREEN`, never green, because a run-end record is history; the debt clause is yours — read CURRENT `tickmarkr status <runId>` (step 5). Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the agent session; do not turn them into proxy questions.
+4. **Run** — launch `tickmarkr run` using the [detached launch](#host-owned-daemon-and-detached-beats), and start detached beats with their run-end stop items. A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for the run's terminal events, and never rely on a `Monitor`-only wake. Watch the run journal rather than polling agents: the consumer takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict`. A run-end record is history, never green; the debt clause is yours — read CURRENT `tickmarkr status <runId>` (step 5). Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the agent session; do not turn them into proxy questions. The consumer is host-specific; with neither host it is the background wait of [On a plain host (neither herdr nor Orca)](#on-a-plain-host-neither-herdr-nor-orca).
+   - **On herdr (`HERDR_ENV=1`)**: the consumer is the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800`, which grades the run-end summary's execution clauses for you, `EXECUTION COMPLETE` or `NOT GREEN`, never green — or a foreground `until grep` on the run's terminal events; ensure it is re-armed at most every twenty minutes.
+   - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: the consumer is that same shipped journal watcher or a foreground `until grep` on the run's terminal events; ensure it is re-armed at most every twenty minutes.
 5. **Verify and consolidate** — accept only a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty, and CURRENT `tickmarkr status <runId>` reads its owed checks outstanding empty AND known (`outstanding 0`) — a run with a parked task is partial, not green. Empty execution buckets alone are not green either (D-660): every bucket empty and the tip passed, but an operator waived one review, leaves one accepted-risk review check owed — status reads `outstanding 1 (T7 review)` and `run`/`resume` still exit 0 on execution alone, so the run is execution complete, not green. It turns green only when a `tickmarkr verify --record <runId>` discharge moves CURRENT status to `outstanding 0`, including a discharge landing after run-end — the historical run-end record keeps the old count, so never read debt from it; `outstanding unknown` is never green. Tickmarkr consolidates accepted task work on `tickmarkr/<runId>`; it never signs off to the main branch. A human may later merge that integration branch through the repository's normal release process.
 6. **Record** — `tickmarkr report <runId> --md` prints Markdown to stdout. Redirect it explicitly beside the source spec (for example `tickmarkr report <runId> --md > feature.record.md`) and commit the execution record when the repository tracks those records. Then [stand down](#stand-down-mission-end-and-retirement).
 
 ## Host-owned daemon and detached beats
 
 Launch the daemon DETACHED, with no pane of its own: one `tickmarkr run` or `tickmarkr resume <runId>`
-process in its own session, its stdout and stderr appended to `<state-dir>/daemon.log`, and the
-ORCH's recorded address as its board anchor, so the daemon self-places its one board beside the
-ORCH in the ORCH tab. Never launch it in a visible split, pane or tab, as an agent harness
-background task, or tied to an agent session: the launching shell may end, and the daemon keeps
-running and logging. The detach wrapper is `node`, which tickmarkr already requires — no private
-script, no extra visible daemon pane and no CLI log flag:
+process in its own session, its stdout and stderr appended to `<state-dir>/daemon.log`, and on
+herdr or Orca the ORCH's recorded address as its board anchor, so the daemon self-places its one
+board beside the ORCH in the ORCH tab; with neither host it carries no address and places no board.
+Never launch it in a visible split, pane or tab, as an agent harness background task, or tied to
+an agent session: the launching shell may end, and the daemon keeps running and logging. The
+detach wrapper is `node`, which tickmarkr already requires — no private script, no extra visible
+daemon pane and no CLI log flag:
 
 ```bash
 # On Orca: <ORCH handle> is the ORCH terminal handle
@@ -109,19 +145,27 @@ cd <repo> && ORCA_TERMINAL_HANDLE="<ORCH handle>" node -e "require('child_proces
 # On herdr: <ORCH pane id> is the ORCH pane id
 cd <repo> && HERDR_PANE_ID="<ORCH pane id>" node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr run >> <state-dir>/daemon.log 2>&1 < /dev/null
 cd <repo> && HERDR_PANE_ID="<ORCH pane id>" node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr resume <runId> >> <state-dir>/daemon.log 2>&1 < /dev/null
+# On a plain host (neither herdr nor Orca): the same detach with no address
+cd <repo> && node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr run >> <state-dir>/daemon.log 2>&1 < /dev/null
+cd <repo> && node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr resume <runId> >> <state-dir>/daemon.log 2>&1 < /dev/null
 ```
 
 - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: run the
   `ORCA_TERMINAL_HANDLE` lines; `<ORCH handle>` is the ORCH's own `$ORCA_TERMINAL_HANDLE`.
 - **On herdr (`HERDR_ENV=1`)**: run the `HERDR_PANE_ID` lines; `<ORCH pane id>` is the ORCH's own
   `$HERDR_PANE_ID`.
+- With neither host, run the two lines that carry no address
+  ([On a plain host (neither herdr nor Orca)](#on-a-plain-host-neither-herdr-nor-orca)).
 
-After either launch, read this repository's lock pid from `<state-dir>/graph.lock` and confirm it:
+After any launch, read this repository's lock pid from `<state-dir>/graph.lock` and confirm it:
 `kill -0 <pid>` succeeds, `ps -o pgid= -p <pid>` prints that same pid (its own session group;
 ppid 1 is never proof on its own), walk its ppid chain and verify no agent session is an ancestor,
 and read `<state-dir>/daemon.log`. No live holder means the launch failed: read the log, fix the
 cause and run the same line again — never a second daemon beside a live holder, and never a
-visible split to watch it; the daemon-placed board is the live surface.
+visible split to watch it.
+
+- **On herdr (`HERDR_ENV=1`)**: the daemon-placed board is the live surface.
+- **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: the daemon-placed board is the live surface.
 
 Detached beats are product-owned, one per (tier, seat), from the repository root, through the
 shipped lifecycle verbs — never a hand-rolled setsid plus nohup wrapper, pidfile or shell loop:

package/skills/tickmarkr-overseer/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: tickmarkr-overseer
-description: "Use when the user asks to oversee/supervise/babysit an autonomous tickmarkr run in a Herdr workspace or Orca session (e.g. '/tickmarkr-overseer run the milestone', 'supervise this tickmarkr run', 'babysit this pipeline'). Requires a supported host: herdr (HERDR_ENV=1) or Orca (TERM_PROGRAM=Orca and non-empty ORCA_TERMINAL_HANDLE). The skill argument is the mission (what to run end-to-end)."
+description: "Use when the user asks to oversee/supervise/babysit an autonomous tickmarkr run in a Herdr workspace, an Orca session or a plain agent session (e.g. '/tickmarkr-overseer run the milestone', 'supervise this tickmarkr run', 'babysit this pipeline'). Two-tier on herdr (HERDR_ENV=1) or Orca (TERM_PROGRAM=Orca and non-empty ORCA_TERMINAL_HANDLE); single-tier as the orchestrator on a plain host with neither. The skill argument is the mission (what to run end-to-end)."
 ---
 
 # Overseer (tickmarkr)
@@ -10,7 +10,7 @@ hierarchy of VISIBLE agents (you → orchestrator → tickmarkr's own worker fle
 to the user with evidence.
 
 The mission is the skill argument. If empty, ask the user what to run end-to-end before doing anything else.
-Requires a supported host: herdr (`HERDR_ENV=1`) or Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`); if neither host is detected, say so and stop.
+Requires a supported host: herdr (`HERDR_ENV=1`) or Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`) for that hierarchy; if neither host is detected, do not stop: this is a plain host — follow [On a plain host (neither herdr nor Orca)](#on-a-plain-host-neither-herdr-nor-orca) and run single-tier as the orchestrator.
 
 Use the canonical loop skill's [cockpit, parked decisions and printed twins](../tickmarkr-loop/SKILL.md#cockpit-parked-decisions-and-printed-twins)
 when reading or relaying operator evidence. Delivered views are **1 Home, 4 Run, 5 Evidence**;
@@ -69,6 +69,41 @@ the answer took session-file archaeology). The flip from the engine (P89, journa
 GSD legs (P92) had been RULED NOWHERE — no ledger entry decides it — and then propagated for six phases
 through brief lineage. **An executor choice nobody made is still an executor choice, and it compounds.**
 
+## On a plain host (neither herdr nor Orca)
+
+Neither `HERDR_ENV=1` nor the Orca markers are set: the Claude Desktop Code tab, a plain terminal, any
+agent session that owns no panes (queue row 192; D-2102). There is no hierarchy to build, so this scope
+replaces the two-tier setup.
+
+- **This session runs SINGLE-TIER as the orchestrator.** The OVERSEER's rulings and the ORCHESTRATOR's
+  loop (`tickmarkr compile` → `plan` → `run` → `report`) are this one session: there are no seats, no
+  pane briefs, no tab canon and no board. Skip Setup steps 1–4, the seat-spawn recipes, the watcher
+  instruments and every On herdr and On Orca scope; read
+  [what the ORCHESTRATOR does](#what-the-orchestrator-does-and-what-you-require-of-it) as your own
+  duties and keep every ruling and evidence law.
+- **An empty mission is asked for, never assumed.** With an empty skill argument, ask the operator what
+  to run end-to-end before doing anything else; there is no other tier to relay it to.
+- **Run and resume launch through the anchor-free lines** of the
+  [detached launch](#host-owned-daemon-and-detached-beats): the same `node` detach with no address, one
+  line for `tickmarkr run` and one for `tickmarkr resume <runId>`. The daemon places no board, so a
+  missing board is never a fault; confirm the launch from the lock pid as that section says.
+- **Run-end and parks are watched through the host's background wait**, never a foreground wait past
+  the host's ten-minute tool cap: the cap kills that wait, ends the turn and leaves the run unwatched.
+  Start the wait as a background task whose exit wakes this session, on journal lines after a baseline
+  taken at arm time and on the lock holder's death:
+  `n=$(wc -l < <journal>); until tail -n +$((n + 1)) <journal> | grep -qE '"event":"(run-end|task-human|task-failed|consult-verdict)"' || ! kill -0 <pid>; do sleep 20; done`
+  (`<journal>` is `<state-dir>/runs/<runId>/journal.jsonl`, `<pid>` the lock pid). On every wake read
+  CURRENT `tickmarkr status <runId>` first, then re-arm.
+- **The operator's view is `tickmarkr status <runId>`**, plus its live `status --watch --plain` form,
+  `tickmarkr status <runId> --watch --plain`, in a read-only Terminal tab beside this session.
+- **Reviews and judges run headless.** The subprocess driver runs every worker, judge and review as a
+  headless CLI call with no pane to watch: read their verdicts from the journal, the gate evidence and
+  `tickmarkr status <runId>`, never from a screen. No seat transport rule applies: there are no seats.
+- **Sessions hand off through the host's cross-session message tool**, confirmed by the peer's reply:
+  there is no composer to read back, so a message no peer answered is not a handoff.
+- **Keep a permission mode that never stalls per command** for the whole run (for example
+  `bypassPermissions`): nobody answers a per-command approval prompt in an unattended session.
+
 ## Setup
 
 0. **Adopt before you build.** If this workspace already has a supervision hierarchy — an
@@ -333,12 +368,13 @@ For Leg-2 (both hosts), a Codex reviewer under `workspace-write` must be briefed
 ## Host-owned daemon and detached beats
 
 Launch the daemon DETACHED, with no pane of its own: one `tickmarkr run` or `tickmarkr resume <runId>`
-process in its own session, its stdout and stderr appended to `<state-dir>/daemon.log`, and the
-ORCH's recorded address as its board anchor, so the daemon self-places its one board beside the
-ORCH in the ORCH tab. Never launch it in a visible split, pane or tab, as an agent harness
-background task, or tied to an agent session: the launching shell may end, and the daemon keeps
-running and logging. The detach wrapper is `node`, which tickmarkr already requires — no private
-script, no extra visible daemon pane and no CLI log flag:
+process in its own session, its stdout and stderr appended to `<state-dir>/daemon.log`, and on
+herdr or Orca the ORCH's recorded address as its board anchor, so the daemon self-places its one
+board beside the ORCH in the ORCH tab; with neither host it carries no address and places no board.
+Never launch it in a visible split, pane or tab, as an agent harness background task, or tied to
+an agent session: the launching shell may end, and the daemon keeps running and logging. The
+detach wrapper is `node`, which tickmarkr already requires — no private script, no extra visible
+daemon pane and no CLI log flag:
 
 ```bash
 # On Orca: <ORCH handle> is the ORCH terminal handle
@@ -347,6 +383,9 @@ cd <repo> && ORCA_TERMINAL_HANDLE="<ORCH handle>" node -e "require('child_proces
 # On herdr: <ORCH pane id> is the ORCH pane id
 cd <repo> && HERDR_PANE_ID="<ORCH pane id>" node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr run >> <state-dir>/daemon.log 2>&1 < /dev/null
 cd <repo> && HERDR_PANE_ID="<ORCH pane id>" node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr resume <runId> >> <state-dir>/daemon.log 2>&1 < /dev/null
+# On a plain host (neither herdr nor Orca): the same detach with no address
+cd <repo> && node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr run >> <state-dir>/daemon.log 2>&1 < /dev/null
+cd <repo> && node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr resume <runId> >> <state-dir>/daemon.log 2>&1 < /dev/null
 ```
 
 - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: run the
@@ -357,13 +396,18 @@ cd <repo> && HERDR_PANE_ID="<ORCH pane id>" node -e "require('child_process').sp
 - **On herdr (`HERDR_ENV=1`)**: run the `HERDR_PANE_ID` lines; `<ORCH pane id>` is the ORCH's own
   `$HERDR_PANE_ID`. When the OVERSEER launches the fallback, substitute the ORCH pane id recorded
   at seat creation, never the OVERSEER's pane.
+- With neither host, run the two lines that carry no address
+  ([On a plain host (neither herdr nor Orca)](#on-a-plain-host-neither-herdr-nor-orca)).
 
-After either launch, read this repository's lock pid from `<state-dir>/graph.lock` and confirm it:
+After any launch, read this repository's lock pid from `<state-dir>/graph.lock` and confirm it:
 `kill -0 <pid>` succeeds, `ps -o pgid= -p <pid>` prints that same pid (its own session group;
 ppid 1 is never proof on its own), walk its ppid chain and verify no agent session is an ancestor,
 and read `<state-dir>/daemon.log`. No live holder means the launch failed: read the log, fix the
 cause and run the same line again — never a second daemon beside a live holder, and never a
-visible split to watch it; the daemon-placed board is the live surface.
+visible split to watch it.
+
+- **On herdr (`HERDR_ENV=1`)**: the daemon-placed board is the live surface.
+- **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: the daemon-placed board is the live surface.
 
 Detached beats are product-owned, one per (tier, seat), from the repository root, through the
 shipped lifecycle verbs — never a hand-rolled setsid plus nohup wrapper, pidfile or shell loop:
@@ -521,26 +565,34 @@ journal tail to decide what happens next, or sweeping orphans — you have taken
 
 ### What the ORCHESTRATOR does, and what you require of it
 
-- **The live surface arrives with the run.** `tickmarkr run` is stdout-silent until run-end by design;
-  its daemon self-places one shipped `role: "watch"` board BESIDE the supervising seat — the right half
-  of the tab, narration on the left — and pins that board to the daemon's run id. **Look for the matching
-  daemon-placed pane.** If it is absent, treat that as a daemon/run liveness fault and use the normal
-  recovery path; never hand-place, hand-roll, or launch a replacement live surface. A board the daemon
-  could not stack is not silently re-arranged: the split is closed and the run continues BOARDLESS, so an
-  absent board means the placement failed, never that it landed somewhere else in the tab.
+- **The live surface arrives with the run.** `tickmarkr run` is stdout-silent until run-end by design.
+  With neither host there is no board: the plain-host scope's status view is the live surface.
+  - **On herdr (`HERDR_ENV=1`)**: its daemon self-places one shipped `role: "watch"` board BESIDE the
+    supervising seat — the right half of the tab, narration on the left — and pins that board to the
+    daemon's run id. **Look for the matching daemon-placed pane.** If it is absent, treat that as a
+    daemon/run liveness fault and use the normal recovery path; never hand-place, hand-roll, or launch a
+    replacement live surface. A board the daemon could not stack is not silently re-arranged: the split
+    is closed and the run continues BOARDLESS, so an absent board means the placement failed, never that
+    it landed somewhere else in the tab.
+  - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: the same board, placed and
+    pinned the same way beside the ORCH. **Look for the matching daemon-placed pane.** If it is absent,
+    treat that as a daemon/run liveness fault and use the normal recovery path; never hand-place,
+    hand-roll, or launch a replacement live surface.
 - **The journal is the source of truth**, not panes. Watchers go on `run-end` / `task-human` /
   `task-failed` / `consult-verdict`; never sleep-poll inside an agent turn. **Never key a watcher on an
   agent's `done`** — that is turn end and fires the moment a seat finishes acknowledging you.
   A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for those terminal
-  events — the shipped watcher below, or a foreground `until grep` on the run's terminal events — and
-  ensure it is re-armed at most every twenty minutes. Never rely on a `Monitor`-only wake.
-  - **On herdr (`HERDR_ENV=1`)**: Use the shipped journal instruments:
+  events, and never rely on a `Monitor`-only wake. The consumer is host-specific; with neither host it is
+  the plain-host scope's background wait.
+  - **On herdr (`HERDR_ENV=1`)**: the consumer is the shipped watcher below, or a foreground `until grep`
+    on the run's terminal events; ensure it is re-armed at most every twenty minutes. Use the shipped
+    journal instruments:
     **All four are covered by one shipped instrument** — `scripts/watch-journal.sh <runs-dir> [poll] [cap]
     [events-csv]` — which arms on a line baseline, wakes once, and grades a `run-end`'s execution clauses —
     `EXECUTION COMPLETE` or `NOT GREEN`, never green: green is CURRENT `tickmarkr status <runId>` at
     `outstanding 0`. `scripts/watch-parks.sh` stays the park-specific wake for THIS seat (it counts parks and speaks
     about rulings); the two overlap on `task-human` deliberately, and arming both is coverage, not a bug.
-  - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: Arm a file/journal consumer for the same terminal events and inspect the seat with `orca terminal read --terminal <handle> --screen --json`; re-arm after every wake.
+  - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: Arm a file/journal consumer for the same terminal events, or a foreground `until grep` on them, and ensure it is re-armed at most every twenty minutes; inspect the seat with `orca terminal read --terminal <handle> --screen --json`; re-arm after every wake.
 - **Daemon liveness ≠ journal activity.** A dead daemon emits no events, so journal watchers sleep through
   its death. Liveness comes from the lock's OWN pid (`kill -0`), never a command-name grep. Recovery is
   `tickmarkr resume <runId>` — **the orchestrator's command, not yours** — and note that resume REPLAYS the
@@ -777,10 +829,10 @@ an overseer ran nine hours at 86% unable to read its own number; a context watch
 when the run's own status text pushed the percentage off the statusline; and an orchestrator went
 **366k → 970k of 1M between two checks** while its ACT wake sat unread in a detached log.
 
-**On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**, use the same mutual-clear
-policy through brief/handoff files and `orca terminal send --enter --wait-submit`; identify seats by
-terminal handle, verify submission from the receipt, and read the terminal before continuing. Do not
-run the Herdr pane commands or Herdr context watcher below.
+- **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**, use the same mutual-clear
+  policy through brief/handoff files and `orca terminal send --enter --wait-submit`; identify seats by
+  terminal handle, verify submission from the receipt, and read the terminal before continuing. Do not
+  run the Herdr pane commands or Herdr context watcher below.
 
 #### On herdr (`HERDR_ENV=1`) — mutual clear
 
@@ -1020,13 +1072,17 @@ they are left implicit:
    - **On herdr (`HERDR_ENV=1`)**, subagents run as visible herdr panes in per-task tabs (`herdr agent start …`);
    - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**, they run as visible terminals created with the Orca seat-spawn recipe. A seat report whose work
    was produced by invisible subagents is rejected on read.
-2. **Seats are interactive TUI, never headless `-p`.** The P92–P96 exec lane —
-   `cat brief | claude -p … ` in a visible pane — satisfied visibility in the letter only: `claude -p`
-   buffers output until exit, so the pane renders idle for the entire run; it is blind to SessionStart
-   hook errors (a broken and a fixed hook both return green); and its silence has no midpoint for a
-   stall watcher to catch — silent-time equals lifetime. Standing operator rule since 2026-07-13:
-   consults and one-off LLM calls run as the CLI's real interactive TUI in a visible named pane.
-   Headless is for exit-code probes — a quota check that wants `rc`, never work anyone must watch.
+2. **Seat transport is host-specific.** With neither host there are no seats, and the plain-host scope's
+   reviews and judges run headless.
+   - **On herdr (`HERDR_ENV=1`)**: **Seats are interactive TUI, never headless `-p`.** The P92–P96 exec
+     lane — `cat brief | claude -p … ` in a visible pane — satisfied visibility in the letter only:
+     `claude -p` buffers output until exit, so the pane renders idle for the entire run; it is blind to
+     SessionStart hook errors (a broken and a fixed hook both return green); and its silence has no
+     midpoint for a stall watcher to catch — silent-time equals lifetime. Standing operator rule since
+     2026-07-13: consults and one-off LLM calls run as the CLI's real interactive TUI in a visible named
+     pane. Headless is for exit-code probes — a quota check that wants `rc`, never work anyone must watch.
+   - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: **Seats are interactive TUI,
+     never headless `-p`**, for every reason the herdr branch gives, in a visible named terminal.
 3. **Buy seat diversity through Fleet, at every dispatch and respawn.** Resolve authors with `tickmarkr fleet --pick consult` and independent checkers/verifiers with `tickmarkr fleet --pick review --exclude-vendor <author-vendor>`, adding every applicable vendor exclusion under the Fleet selection contract. Consume the successful JSON adapter/model before using the visible-seat recipes; never select directly from doctor data. When one vendor's model
    quota collapses, the reflex is to collapse every seat onto the surviving model and hold the
    cross-vendor CLI back for a late probe — P97 ran planner, checker and verifier as one family that