tickmarkr 2.8.4 → 2.8.6

package/dist/run/lock.js

@@ -1,7 +1,8 @@
-import { closeSync, constants, fstatSync, linkSync, lstatSync, mkdtempSync, openSync, readFileSync, renameSync, rmdirSync, statSync, unlinkSync, utimesSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { closeSync, constants, fstatSync, linkSync, lstatSync, mkdtempSync, openSync, readdirSync, readFileSync, realpathSync, renameSync, rmdirSync, statSync, unlinkSync, utimesSync, writeFileSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
 import { z } from "zod";
 import { tickmarkrDir, stateDirName } from "../graph/graph.js";
+import { GitTrustRefusal, trustedCommonDir } from "./git-trust.js";
 import { parseRunId } from "./journal.js";
 // HARD-01/02: coarse per-run advisory lock over .tickmarkr/graph.json. LOCK-02: the lock is created by
 // the link(2) idiom — write the full payload to graph.lock.<pid>.tmp, then linkSync(tmp, lockPath),
@@ -17,16 +18,31 @@ export const STALE_MS = 60_000; // 6× heartbeat headroom; PITFALLS floor is ≥
 // T-10-01: the payload is a trust boundary — parse with zod, fail closed on garbage. Only
 // pid/runId/startedAt are ever read; anything else is ignored (info-disclosure surface).
 const PayloadSchema = z.object({ pid: z.number().int().positive(), runId: z.string(), startedAt: z.number() });
+// Queue row 194 (D-2102): graph.lock lives per CHECKOUT, so a run in a linked worktree (Claude Desktop
+// nests each session under <repo>/.claude/worktrees/) never saw a run in the main checkout. The daemon's
+// acquire therefore also takes this REPOSITORY RUN CLAIM at the trusted common git dir — the runner
+// lease's anchor — by the same link(2) idiom and the same decision table (shouldRefuse). compile's two
+// holders take graph.lock only: it guards that checkout's own graph, never the repository's run.
+const ClaimSchema = PayloadSchema.extend({ checkout: z.string() });
+const MarkerSchema = z.object({ pid: z.number().int().positive(), startedAt: z.number() });
+const CLAIM_FILE = "tickmarkr-run.claim";
+const COMPILE_HOLDERS = new Set(["compile", "compile-refusal"]);
+const NO_CHECKOUT = "no checkout encloses this directory"; // git-trust's refusal detail outside any checkout
 const lockPath = (repoRoot) => join(tickmarkrDir(repoRoot), "graph.lock");
 const approvalSerializationPath = (repoRoot) => join(tickmarkrDir(repoRoot), "approval.lock");
 let heartbeat;
 let heldPath;
+const heldClaims = new Map(); // graph.lock path → its repository claim
 let approvalSequence = 0;
 // Best-effort release if the daemon exits without hitting its finally (crash mid-body). NO
 // SIGINT/SIGTERM handlers — those change kill semantics and leak listeners across the test
 // suite's many runDaemon calls; signal-death is exactly what stale-reclaim exists for.
-process.once("exit", () => { if (heldPath)
-    unlinkIfOurs(heldPath); });
+process.once("exit", () => {
+    for (const claim of heldClaims.values())
+        unlinkClaimIfOurs(claim);
+    if (heldPath)
+        unlinkIfOurs(heldPath);
+});
 // LOCK-04: the ONE decision table. Both acquireRunLock and isRunLockLive consume this — the two
 // hand-maintained copies of the rule cannot drift. The table changes HERE, once. previewUnlock /
 // commitUnlock (below) read the SAME underlying snapshot shape with their own eligibility rules
@@ -65,16 +81,17 @@ export function isPidLive(pid) {
     }
 }
 // statSync throws ENOENT when no lock exists — callers treat that as "not held".
-function inspect(p) {
+function inspect(p, schema = PayloadSchema) {
     const st = statSync(p); // single stat: both the heartbeat mtime and the reclaim-guard inode
     const mtimeMs = st.mtimeMs;
     const expired = Date.now() - mtimeMs > STALE_MS;
-    const parsed = PayloadSchema.safeParse(readPayload(p));
+    const parsed = schema.safeParse(readPayload(p));
     const garbage = !parsed.success; // LOCK-01: its own state — shouldRefuse refuses it unconditionally; only `tickmarkr unlock` removes it
     const pid = parsed.success ? parsed.data.pid : undefined;
     // harmless fallback for the garbage row — garbage short-circuits shouldRefuse before this is read
     const dead = pid === undefined ? true : !isPidLive(pid);
-    return { pid, runId: parsed.success ? parsed.data.runId : undefined, garbage, dead, expired, mtimeMs, ino: st.ino };
+    const checkout = parsed.success ? parsed.data.checkout : undefined;
+    return { pid, runId: parsed.success ? parsed.data.runId : undefined, startedAt: parsed.success ? parsed.data.startedAt : undefined, checkout, garbage, dead, expired, mtimeMs, ino: st.ino };
 }
 function readPayload(p) {
     try {
@@ -92,7 +109,177 @@ function unlinkIfOurs(p) {
     }
     catch { /* ENOENT — nothing to release */ }
 }
+function unlinkClaimIfOurs(claim) {
+    try {
+        const parsed = ClaimSchema.safeParse(readPayload(claim.path));
+        if (parsed.success && parsed.data.pid === process.pid && parsed.data.checkout === claim.checkout)
+            unlinkSync(claim.path);
+    }
+    catch { /* ENOENT — nothing to release */ }
+}
+/** The repository run claim for the checkout enclosing `repoRoot`; undefined when no checkout encloses it
+ * (graph.lock alone guards there, as before). Any other git trust refusal propagates: fail closed. */
+export function repositoryClaimPath(repoRoot) {
+    try {
+        return join(trustedCommonDir(repoRoot), CLAIM_FILE);
+    }
+    catch (e) {
+        if (e instanceof GitTrustRefusal && e.detail === NO_CHECKOUT)
+            return undefined;
+        throw e;
+    }
+}
+// The case table: a live holder from ANY other checkout of this repository refuses naming its checkout,
+// run id and pid; a provably dead holder is reclaimed, then the taker re-serializes through link(2);
+// garbage refuses and is removed by hand only. A holder in another repository never meets this path: its
+// common dir — and so its claim — differs.
+function takeRepositoryClaim(repoRoot, runId) {
+    const p = repositoryClaimPath(repoRoot);
+    if (!p)
+        return;
+    const checkout = realpathSync(repoRoot);
+    while (!linkExclusive(p, { pid: process.pid, runId, startedAt: Date.now(), checkout })) {
+        const held = readClaim(p);
+        if (!held)
+            continue; // released between our link and our read
+        if (shouldRefuse(held.insp))
+            refuseClaim(p, held.insp);
+        reclaimDeadClaim(p, held.id);
+    }
+    heldClaims.set(lockPath(repoRoot), { path: p, checkout });
+    // While this live claim is the claim, every reclaim marker is keyed to a claim gone for good — moot,
+    // guarding nothing — so the taker sweeps them all; a reclaimer that died holding one strands nothing.
+    const prefix = `${basename(p)}.reclaim.`;
+    try {
+        for (const name of readdirSync(dirname(p)))
+            if (name.startsWith(prefix))
+                try {
+                    unlinkSync(join(dirname(p), name));
+                }
+                catch { /* another taker swept it */ }
+    }
+    catch { /* best-effort: a later taker sweeps what is left */ }
+}
+// link(2) exclusive create of a complete payload: true when created, false when `p` already exists.
+function linkExclusive(p, payload) {
+    const tmp = join(dirname(p), `${CLAIM_FILE}.${process.pid}.tmp`); // one per process: the claim and its markers share it
+    try {
+        unlinkSync(tmp);
+    }
+    catch { /* best-effort clean of our own stray tmp from a prior SIGKILL */ }
+    writeFileSync(tmp, JSON.stringify(payload));
+    try {
+        linkSync(tmp, p);
+        return true;
+    }
+    catch (e) {
+        if (e.code === "EEXIST")
+            return false;
+        throw e;
+    }
+    finally {
+        unlinkSync(tmp);
+    }
+}
+// A claim's identity is its inode, pid and start time: a claim is never rewritten in place, so an identity
+// once replaced never returns. undefined when no claim exists.
+function readClaim(p) {
+    try {
+        const insp = inspect(p, ClaimSchema);
+        return { insp, id: `${insp.ino}-${insp.pid}-${insp.startedAt}` };
+    }
+    catch (e) {
+        if (e.code === "ENOENT")
+            return undefined;
+        throw e;
+    }
+}
+// The reclaim runs under an exclusive RECLAIM MARKER beside the claim, keyed to the dead claim's identity:
+// two takers that both saw one dead claim could otherwise each pass a re-stat, and the later unlink would
+// delete the earlier taker's live replacement. Under the marker the claim is re-read, and only that same
+// dead claim is removed. A live marker owner refuses the other taker — a concurrent reclaimer is a run
+// starting in this repository. A marker whose owner died inside the reclaim is STRANDED: the next taker
+// passes to the next generation, which only one taker creates — a dead owner never removes its marker, so
+// two live owners never hold one identity at once — and recovers with no hand removal.
+// ponytail: a stranded marker whose dead pid is reused by an unrelated live process reads live and refuses
+// until the next successful taker sweeps it or it is removed by hand — the fail-closed direction, as graph.lock.
+function reclaimDeadClaim(p, id) {
+    let marker = `${p}.reclaim.${id}.0`;
+    for (let gen = 0; !linkExclusive(marker, { pid: process.pid, startedAt: Date.now() });) {
+        if (markerStranded(p, marker))
+            marker = `${p}.reclaim.${id}.${++gen}`;
+    }
+    try {
+        const now = readClaim(p);
+        if (now?.id !== id)
+            return; // replaced since our read: the caller re-serializes through link(2)
+        if (shouldRefuse(now.insp))
+            refuseClaim(p, now.insp);
+        try {
+            unlinkSync(p);
+        }
+        catch (e) {
+            if (e.code !== "ENOENT")
+                throw e;
+        }
+    }
+    finally {
+        try {
+            unlinkSync(marker);
+        }
+        catch { /* swept as moot by the claim's next taker */ }
+    }
+}
+// true when `marker`'s owner provably died holding it: dead, and the same bytes on the same inode after the
+// death proof. false when it went or changed under the read (that generation is retried). A live owner
+// refuses; a garbage marker refuses for removal by hand.
+function markerStranded(p, marker) {
+    const read = () => {
+        try {
+            return { ino: statSync(marker).ino, bytes: readFileSync(marker, "utf8") };
+        }
+        catch (e) {
+            if (e.code === "ENOENT")
+                return undefined;
+            throw e;
+        }
+    };
+    const before = read();
+    if (!before)
+        return false;
+    let owner;
+    try {
+        owner = MarkerSchema.parse(JSON.parse(before.bytes));
+    }
+    catch {
+        throw new Error(`reclaim marker ${marker} holds an unreadable/garbage payload — refusing to reclaim repository run claim ${p}; once no tickmarkr run is starting in this repository, remove ${marker} by hand`);
+    }
+    if (isPidLive(owner.pid))
+        throw new Error(`repository run claim ${p} is being reclaimed from its dead holder by another tickmarkr process (pid ${owner.pid}) — retry; if none is starting in this repository, remove ${marker} by hand`);
+    const after = read();
+    return after !== undefined && after.ino === before.ino && after.bytes === before.bytes;
+}
+function refuseClaim(p, insp) {
+    if (insp.garbage)
+        throw new Error(`repository run claim ${p} holds an unreadable/garbage payload — refusing to reclaim it; once no tickmarkr run is live in this repository, remove ${p} by hand`);
+    throw new Error(`repository run claim ${p} held by pid ${insp.pid} (run ${insp.runId}) in checkout ${insp.checkout} — one live tickmarkr run per repository across its main checkout and linked worktrees; wait for that run to end`);
+}
+// Run and resume (runDaemon) take graph.lock, then the repository claim; a claim refusal releases the
+// graph.lock just taken, before any journal exists. compile's holders take graph.lock alone.
 export function acquireRunLock(repoRoot, runId) {
+    const acquired = acquireGraphLock(repoRoot, runId);
+    if (COMPILE_HOLDERS.has(runId))
+        return acquired;
+    try {
+        takeRepositoryClaim(repoRoot, runId);
+    }
+    catch (e) {
+        releaseRunLock(repoRoot);
+        throw e;
+    }
+    return acquired;
+}
+function acquireGraphLock(repoRoot, runId) {
     const p = lockPath(repoRoot);
     const tmp = join(tickmarkrDir(repoRoot), `graph.lock.${process.pid}.tmp`);
     try {
@@ -127,7 +314,7 @@ export function acquireRunLock(repoRoot, runId) {
             // Single-machine tool — this is the ceiling.
             const st = statSync(p); // re-stat immediately before removing — abort if replaced since inspect()
             if (st.ino !== insp.ino || st.mtimeMs !== insp.mtimeMs)
-                return acquireRunLock(repoRoot, runId); // loser path
+                return acquireGraphLock(repoRoot, runId); // loser path
             try {
                 unlinkSync(p);
             }
@@ -135,7 +322,7 @@ export function acquireRunLock(repoRoot, runId) {
                 if (e2.code !== "ENOENT")
                     throw e2;
             } // successor already took it
-            const again = acquireRunLock(repoRoot, runId); // re-serializes two stealers through linkSync
+            const again = acquireGraphLock(repoRoot, runId); // re-serializes two stealers through linkSync
             return { reclaimed: { pid: pid ?? -1, mtimeMs }, ...again };
         }
         const stateDir = stateDirName(repoRoot);
@@ -151,6 +338,12 @@ export function releaseRunLock(repoRoot) {
         clearInterval(heartbeat);
         heartbeat = undefined;
     }
+    // the claim goes first: released after graph.lock, a successor run in this checkout would meet our claim
+    const claim = heldClaims.get(lockPath(repoRoot));
+    if (claim) {
+        unlinkClaimIfOurs(claim);
+        heldClaims.delete(lockPath(repoRoot));
+    }
     unlinkIfOurs(lockPath(repoRoot)); // never delete a reclaiming successor's lock — only ours
     heldPath = undefined;
 }

package/dist/run/protocol.d.ts

@@ -75,8 +75,8 @@ export declare const GateEvidenceReceiptSchema: z.ZodObject<{
     termination: z.ZodObject<{
         kind: z.ZodEnum<{
             unknown: "unknown";
-            timeout: "timeout";
             signal: "signal";
+            timeout: "timeout";
             "not-started": "not-started";
             exit: "exit";
         }>;

package/dist/tui/cockpit/live-store.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { closeSync, fstatSync, openSync, readSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { graphPath, stateDirName } from "../../graph/graph.js";
+import { repoOverlayPath } from "../../config/config.js";
 import { validateGraph } from "../../graph/schema.js";
 import { foldOwedChecks, parseJournalText, parseRunId } from "../../run/journal.js";
 import { isPidLive, STALE_MS } from "../../run/lock.js";
@@ -329,7 +330,16 @@ export function createLiveStore(options) {
         reset: () => { fold = new OperatorStateFold(); }, record: record => fold.apply(record),
     });
     const graph = new JsonSource(graphPath(options.cwd), raw => validateGraph(JSON.parse(raw)), STORE_LIMITS.graphBytes);
-    const config = new JsonSource(options.configPath ?? join(state, "config.yaml"), raw => raw);
+    // Queue row 195 / D-2102: the cockpit's live config source follows the ONE repo-layer path rule, re-resolved
+    // on every observation so an own overlay created or removed, or a main file
+    // appearing, moves the source; an explicit configPath stays fixed.
+    let config;
+    const readConfig = (at) => {
+        const path = options.configPath ?? repoOverlayPath(options.cwd);
+        if (config?.path !== path)
+            config = new JsonSource(path, raw => raw);
+        return config.read(at);
+    };
     const cache = new JsonSource(options.cachePath ?? join(state, "doctor.json"), JSON.parse);
     const lock = new JsonSource(join(state, "graph.lock"), raw => {
         const v = JSON.parse(raw);
@@ -379,7 +389,7 @@ export function createLiveStore(options) {
             owed = owedOf(journal);
         }
         const graphReading = graph.read(observedAt);
-        const configReading = config.read(observedAt);
+        const configReading = readConfig(observedAt);
         const cacheReading = cache.read(observedAt);
         const owner = lock.read(observedAt);
         const alive = owner.status === "readable" && owner.value ? (options.isDaemonAlive ?? isPidLive)(owner.value.pid) : undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.8.4",
+  "version": "2.8.6",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-auto/SKILL.md

@@ -20,18 +20,50 @@ Keep `name: tickmarkr-auto` and the installed links to canonical `skills/` intac
 
 ## Two-tier by default — role check before the loop
 
-When working in a multi-agent terminal environment, decide your role before starting:
+When working in a multi-agent terminal environment (herdr or Orca), decide your role before starting:
 
 - **Orchestrator:** your session was started to execute the mission. Rename your own tab/pane `ORCH · <version>` (short labels: ≤20 chars, `ROLE · token`) and run the loop below.
 - **Supervisor with a live orchestrator:** do not start a second run. Relay the mission to the existing orchestrator with a [verified handoff](#verified-handoffs-agent-to-agent-messaging), then supervise it as OVERSEER.
 - **Primary session without an orchestrator:** rename your own tab `OVERSEER · <version>` and your agent `overseer`, spawn one child orchestration session with your host's launch form, label its tab `ORCH · <version>` and name its agent, give it the mission and these rules verbatim, then supervise it. Do not drive a duplicate single-tier run yourself. Before spawning, confirm any PREVIOUS orchestrator has stood down (monitors stopped, input box empty — dim ghost-text suggestions are UI, not queued input; ANSI-verify before alarming) and close its tab — the journal, records, and ledger hold the story; scrollback is disposable.
-  - **Spawning on current herdr is two-step** — the one-shot `agent start --cwd/--tab/--no-focus` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138). First create the pane: `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` (tab create does not steal focus unless `--focus` is passed; parse `result.root_pane.pane_id` from its JSON), then start the agent in it:
-  - **Claude Code:** `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions`
-  - **Codex:** `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` — the unsandboxed flag is REQUIRED, not optional: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation (`git worktree add` cannot lock the ref). Do not downgrade this flag; the herdr pane and repo scope are the containment.
+  - **On herdr (`HERDR_ENV=1`)**: **spawning on current herdr is two-step** — the one-shot `agent start --cwd/--tab/--no-focus` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138). First create the pane: `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` (tab create does not steal focus unless `--focus` is passed; parse `result.root_pane.pane_id` from its JSON), then start the agent in it:
+    - **Claude Code:** `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions`
+    - **Codex:** `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` — the unsandboxed flag is REQUIRED, not optional: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation (`git worktree add` cannot lock the ref). Do not downgrade this flag; the herdr pane and repo scope are the containment.
+    - **Auxiliary seats run as the CLI's interactive TUI in their visible pane — never headless** (`claude -p` / `codex exec`): headless buffers output until exit so the pane renders idle for the entire run, is blind to SessionStart hook errors (a broken and a fixed hook both return green), and gives a stall watcher no midpoint — silent-time equals lifetime. Headless is for exit-code probes only (a quota check that wants `rc`), never for work anyone must watch.
+  - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: spawn it with `orca terminal create --worktree path:<repo> --title "ORCH · <version>" --command "<agent-cmd>" --json` and parse `result.terminal.handle` from the create receipt. **Auxiliary seats run as the CLI's interactive TUI in their visible terminal — never headless**, for the reasons the herdr branch gives.
   - **Auxiliary agents you spawn (consultants, reviewers, scouts) follow the same forms.** Never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions` (tickmarkr's own adapter uses exactly this for workers, judges, and consults). A read-only codex consultant may use `--sandbox read-only`; any codex session that must touch git needs the unsandboxed flag above.
-  - **Auxiliary seats run as the CLI's interactive TUI in their visible pane — never headless** (`claude -p` / `codex exec`): headless buffers output until exit so the pane renders idle for the entire run, is blind to SessionStart hook errors (a broken and a fixed hook both return green), and gives a stall watcher no midpoint — silent-time equals lifetime. Headless is for exit-code probes only (a quota check that wants `rc`), never for work anyone must watch.
 
-Outside a multi-agent terminal environment, run the loop directly.
+With neither herdr nor Orca there is no role to decide and no seat to spawn: follow [On a plain host (neither herdr nor Orca)](#on-a-plain-host-neither-herdr-nor-orca) and run the loop directly, single-tier.
+
+## On a plain host (neither herdr nor Orca)
+
+Neither `HERDR_ENV=1` nor the Orca markers are set: the Claude Desktop Code tab, a plain terminal, any
+agent session that owns no panes (queue row 192; D-2102). The role check above does not apply.
+
+- **This session runs SINGLE-TIER as the orchestrator.** There are no seats, no pane briefs, no tab
+  canon and no board: run every step of [the per-spec loop](#per-spec-loop) yourself and skip every
+  On herdr and On Orca scope.
+- **An empty mission is asked for, never assumed.** With no target named, ask the operator what to run
+  end-to-end before compiling anything; there is no other tier to relay it to.
+- **Run and resume launch through the anchor-free lines** of the
+  [detached launch](#host-owned-daemon-and-detached-beats): the same `node` detach with no address, one
+  line for `tickmarkr run` and one for `tickmarkr resume <runId>`. The daemon places no board, so a
+  missing board is never a fault; confirm the launch from the lock pid as that section says.
+- **Run-end and parks are watched through the host's background wait**, never a foreground wait past
+  the host's ten-minute tool cap: the cap kills that wait, ends the turn and leaves the run unwatched.
+  Start the wait as a background task whose exit wakes this session, on journal lines after a baseline
+  taken at arm time and on the lock holder's death:
+  `n=$(wc -l < <journal>); until tail -n +$((n + 1)) <journal> | grep -qE '"event":"(run-end|task-human|task-failed|consult-verdict)"' || ! kill -0 <pid>; do sleep 20; done`
+  (`<journal>` is `<state-dir>/runs/<runId>/journal.jsonl`, `<pid>` the lock pid). On every wake read
+  CURRENT `tickmarkr status <runId>` first, then re-arm.
+- **The operator's view is `tickmarkr status <runId>`**, plus its live `status --watch --plain` form,
+  `tickmarkr status <runId> --watch --plain`, in a read-only Terminal tab beside this session.
+- **Reviews and judges run headless.** The subprocess driver runs every worker, judge and review as a
+  headless CLI call with no pane to watch: read their verdicts from the journal, the gate evidence and
+  `tickmarkr status <runId>`, never from a screen.
+- **Sessions hand off through the host's cross-session message tool**, confirmed by the peer's reply:
+  there is no composer to read back, so a message no peer answered is not a handoff.
+- **Keep a permission mode that never stalls per command** for the whole run (for example
+  `bypassPermissions`): nobody answers a per-command approval prompt in an unattended session.
 
 ## Stand-down (mission end and retirement)
 
@@ -79,21 +111,24 @@ concurrently* — so a machine-wide check answers a question nobody asked and bl
 
 ## Verified handoffs (agent-to-agent messaging)
 
-When relaying missions between agents in a multi-agent terminal, **never use bare send-text** (`herdr agent send` / pane send-text) — it writes text without pressing Enter, so handoffs sit unsubmitted (OBS-39).
+Never report "briefed" or "relayed" without the confirmation your host gives:
 
-Use one of:
+- **On herdr (`HERDR_ENV=1`)**: when relaying missions between agents in a multi-agent terminal, **never use bare send-text** (`herdr agent send` / pane send-text) — it writes text without pressing Enter, so handoffs sit unsubmitted (OBS-39). Use one of:
+  - `herdr pane run <pane> "<message>"` — text plus Enter in the target shell
+  - `herdr notification show "<message>"` — OS-level delivery for the operator
 
-- `herdr pane run <pane> "<message>"` — text plus Enter in the target shell
-- `herdr notification show "<message>"` — OS-level delivery for the operator
-
-After sending, **confirm delivery** by reading the target pane and verifying the message landed (input empty, agent status `working`, or notification acknowledged). Never report "briefed" or "relayed" without read-back confirmation.
+  After sending, **confirm delivery** by reading the target pane and verifying the message landed (input empty, agent status `working`, or notification acknowledged). Never report "briefed" or "relayed" without read-back confirmation.
+- **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: send with `orca terminal send --terminal <handle> --text "<message>" --enter --wait-submit 15 --json` and treat it as delivered only when `result.send.prompt.stages` carries a `turn_started` stage — `accepted: true` proves input acceptance, not a started turn.
+- With neither host, hand off through the host's cross-session message tool, confirmed by the peer's reply ([On a plain host (neither herdr nor Orca)](#on-a-plain-host-neither-herdr-nor-orca)).
 
 ## Per-spec loop
 
 1. **Prepare** — confirm the target list. Run the [binary preflight](#binary-preflight-before-compile-or-run). Check `git status`, confirm no tickmarkr run is active, and work from a non-main branch.
 2. **Compile** — run `tickmarkr compile <spec-or-directory>`. Fix source-spec defects instead of editing the generated graph.
 3. **Plan** — run `tickmarkr plan`. Review routes, capability-floor warnings, and human gates before execution.
-4. **Run** — launch `tickmarkr run` using the [detached launch](#host-owned-daemon-and-detached-beats), and start detached beats with their run-end stop items. A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for the run's terminal events — the shipped watcher below, or a foreground `until grep` on the run's terminal events — and ensure it is re-armed at most every twenty minutes. Never rely on a `Monitor`-only wake. Watch the run journal rather than polling agents, using the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800` — which takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict` and grades the run-end summary's execution clauses for you — `EXECUTION COMPLETE` or `NOT GREEN`, never green, because a run-end record is history; the debt clause is yours — read CURRENT `tickmarkr status <runId>` (step 5). Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the relevant agent session.
+4. **Run** — launch `tickmarkr run` using the [detached launch](#host-owned-daemon-and-detached-beats), and start detached beats with their run-end stop items. A watch ending the seat's turn is no watch: keep a **blocking journal consumer** alive for the run's terminal events, and never rely on a `Monitor`-only wake. Watch the run journal rather than polling agents: the consumer takes a line baseline at arm time, then wakes ONCE on `run-end`, `task-human`, `task-failed` or `consult-verdict`. A run-end record is history, never green; the debt clause is yours — read CURRENT `tickmarkr status <runId>` (step 5). Re-arm after every wake. ⛔ Never `tail -F | grep -m1` (run-end is the journal's last line, so tail never notices the broken pipe and the watcher hangs forever) and never a pane-level done wait (it fires on every agent turn end, not mission end). ⚠ A bare whole-file `grep -q '"event":"run-end"'` is the trap the watcher exists to avoid: on a resume it matches the PREVIOUS run's run-end and returns instantly, so a re-armed watcher reads as coverage that does not exist. Resolve blocked interactions in the relevant agent session. The consumer is host-specific; with neither host it is the background wait of [On a plain host (neither herdr nor Orca)](#on-a-plain-host-neither-herdr-nor-orca).
+   - **On herdr (`HERDR_ENV=1`)**: the consumer is the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800`, which grades the run-end summary's execution clauses for you, `EXECUTION COMPLETE` or `NOT GREEN`, never green — or a foreground `until grep` on the run's terminal events; ensure it is re-armed at most every twenty minutes.
+   - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: the consumer is that same shipped journal watcher or a foreground `until grep` on the run's terminal events; ensure it is re-armed at most every twenty minutes.
 5. **Verify and consolidate** — continue only after a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty, and CURRENT `tickmarkr status <runId>` reads its owed checks outstanding empty AND known (`outstanding 0`) — a run with a parked task is partial, not green. Empty execution buckets alone are not green either (D-660): every bucket empty and the tip passed, but an operator waived one review, leaves one accepted-risk review check owed — status reads `outstanding 1 (T7 review)` and `run`/`resume` still exit 0 on execution alone, so the run is execution complete, not green. It turns green only when a `tickmarkr verify --record <runId>` discharge moves CURRENT status to `outstanding 0`, including a discharge landing after run-end — the historical run-end record keeps the old count, so never read debt from it; `outstanding unknown` is never green. Tickmarkr consolidates accepted work on `tickmarkr/<runId>` and never signs off to the main branch. A human controls any later release merge.
 6. **Record** — `tickmarkr report <runId> --md` prints Markdown to stdout; redirect explicitly beside the spec (for example `tickmarkr report <runId> --md > feature.record.md`) and commit the execution record when the repository tracks those records.
 7. **Continue** — move to the next requested target. If a target fails or is parked, stop with the journal evidence rather than silently skipping it.
@@ -101,12 +136,13 @@ After sending, **confirm delivery** by reading the target pane and verifying the
 ## Host-owned daemon and detached beats
 
 Launch the daemon DETACHED, with no pane of its own: one `tickmarkr run` or `tickmarkr resume <runId>`
-process in its own session, its stdout and stderr appended to `<state-dir>/daemon.log`, and the
-ORCH's recorded address as its board anchor, so the daemon self-places its one board beside the
-ORCH in the ORCH tab. Never launch it in a visible split, pane or tab, as an agent harness
-background task, or tied to an agent session: the launching shell may end, and the daemon keeps
-running and logging. The detach wrapper is `node`, which tickmarkr already requires — no private
-script, no extra visible daemon pane and no CLI log flag:
+process in its own session, its stdout and stderr appended to `<state-dir>/daemon.log`, and on
+herdr or Orca the ORCH's recorded address as its board anchor, so the daemon self-places its one
+board beside the ORCH in the ORCH tab; with neither host it carries no address and places no board.
+Never launch it in a visible split, pane or tab, as an agent harness background task, or tied to
+an agent session: the launching shell may end, and the daemon keeps running and logging. The
+detach wrapper is `node`, which tickmarkr already requires — no private script, no extra visible
+daemon pane and no CLI log flag:
 
 ```bash
 # On Orca: <ORCH handle> is the ORCH terminal handle
@@ -115,19 +151,27 @@ cd <repo> && ORCA_TERMINAL_HANDLE="<ORCH handle>" node -e "require('child_proces
 # On herdr: <ORCH pane id> is the ORCH pane id
 cd <repo> && HERDR_PANE_ID="<ORCH pane id>" node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr run >> <state-dir>/daemon.log 2>&1 < /dev/null
 cd <repo> && HERDR_PANE_ID="<ORCH pane id>" node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr resume <runId> >> <state-dir>/daemon.log 2>&1 < /dev/null
+# On a plain host (neither herdr nor Orca): the same detach with no address
+cd <repo> && node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr run >> <state-dir>/daemon.log 2>&1 < /dev/null
+cd <repo> && node -e "require('child_process').spawn(process.argv[1], process.argv.slice(2), { detached: true, stdio: 'inherit' }).unref()" tickmarkr resume <runId> >> <state-dir>/daemon.log 2>&1 < /dev/null
 ```
 
 - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: run the
   `ORCA_TERMINAL_HANDLE` lines; `<ORCH handle>` is the ORCH's own `$ORCA_TERMINAL_HANDLE`.
 - **On herdr (`HERDR_ENV=1`)**: run the `HERDR_PANE_ID` lines; `<ORCH pane id>` is the ORCH's own
   `$HERDR_PANE_ID`.
+- With neither host, run the two lines that carry no address
+  ([On a plain host (neither herdr nor Orca)](#on-a-plain-host-neither-herdr-nor-orca)).
 
-After either launch, read this repository's lock pid from `<state-dir>/graph.lock` and confirm it:
+After any launch, read this repository's lock pid from `<state-dir>/graph.lock` and confirm it:
 `kill -0 <pid>` succeeds, `ps -o pgid= -p <pid>` prints that same pid (its own session group;
 ppid 1 is never proof on its own), walk its ppid chain and verify no agent session is an ancestor,
 and read `<state-dir>/daemon.log`. No live holder means the launch failed: read the log, fix the
 cause and run the same line again — never a second daemon beside a live holder, and never a
-visible split to watch it; the daemon-placed board is the live surface.
+visible split to watch it.
+
+- **On herdr (`HERDR_ENV=1`)**: the daemon-placed board is the live surface.
+- **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: the daemon-placed board is the live surface.
 
 Detached beats are product-owned, one per (tier, seat), from the repository root, through the
 shipped lifecycle verbs — never a hand-rolled setsid plus nohup wrapper, pidfile or shell loop: