tickmarkr 2.8.6 → 2.8.7

package/dist/adapters/grok.js

@@ -115,16 +115,12 @@ export const grok = {
         return { command: this.headlessCommand(ctx.promptFile, a.model) };
     },
     parse: parseWorkerResult, // prompt.ts — last-valid-trailer, hard-wrap tolerant. No grok fork.
-    // v1.89 T1 / OBS-414: no capture exists, so none is invented. grok 0.2.93 has never been observed
-    // rendering a workspace/folder-trust prompt: it loads the operator's global Claude-Code-compat
-    // config rather than keeping a per-directory trust store, and no grok dispatch in any recorded run
-    // has stalled before launch (OBS-414's own sweep lists grok's gap as MCP suppression, not trust).
-    // FALSIFIER, and it is cheap: dispatch grok into a never-seen worktree and read the pane. One
-    // capture of a trust prompt replaces this with {fingerprint, key} — the capture is the only
-    // admissible evidence, and a guess here would press a key on whatever it happened to match.
+    // Queue row 215 (D-2118 add.1, D-2125): recorded Grok Build 1.0.62 and 1.0.67 directory-trust
+    // modal, quoted in GROK_TRUST_PANE. Enter is the measured acceptance key (y also accepts).
+    // Accepted residual: answering persists grok's trust for the main checkout root.
     trustDialog: {
-        kind: "none",
-        reason: "grok 0.2.93 keeps no per-directory trust store and no recorded pane shows it rendering a workspace-trust prompt; falsified by one capture from a fresh worktree",
+        fingerprint: "Grok Build may run or modify contents in this directory",
+        key: "Enter",
     },
     // v1.5 MODEL-01: fail OPEN to [] (advisory detection, unlike gates). Parses the model LIST only —
     // the auth banner on line 1 is ignored BY CONSTRUCTION (parseGrokModels anchors on the header).

package/dist/adapters/prompt.js

@@ -12,13 +12,21 @@ import { CAPACITY_RE } from "./types.js";
 // and the allowlist stays exactly as immutable during a run as it was before this text changed.
 export function buildTaskPrompt(task, feedback = "", nonce = "") {
     const list = (xs) => xs.map((x) => `- ${x}`).join("\n");
+    // Queue row 234 (D-2130 add.1, D-2131): only the worker brief carries the suite;
+    // the judge and the review brief keep the shared criterion text byte-equal.
+    const criteria = task.acceptance.map((item) => typeof item !== "string" && item.oracle === "test" && item.landing !== undefined
+        ? `${renderAcceptanceItem(item)} | suite: ${item.landing}`
+        : renderAcceptanceItem(item));
+    const suiteNote = task.acceptance.some((item) => typeof item !== "string" && item.oracle === "test" && item.landing !== undefined)
+        ? '\n\nFor test criteria with ` | suite: `, the test title is the text before the marker, and the test must pass in the named file.'
+        : "";
     return `You are an autonomous coding worker dispatched by tickmarkr into an isolated git worktree.
 
 ## Task ${task.id}: ${task.title}
 Goal: ${task.goal}
 
 ## Acceptance criteria (you will be judged against these, verbatim)
-${list(task.acceptance.map(renderAcceptanceItem))}
+${list(criteria)}${suiteNote}
 ${task.files.length ? `\n## File scope — touch ONLY paths matching:\n${list(task.files)}\n` : ""}${task.context.length ? `\n## Context (read these first)\n${list(task.context)}\n` : ""}${task.outOfScope?.length ? `\n## Out of scope\nStay within the task’s declared bounds; do not pursue these items:\n${list(task.outOfScope)}\n` : ""}
 ## Rules
 - Work only inside the current directory (your isolated worktree). Never push. Never switch branches.

package/dist/adapters/types.d.ts

@@ -117,6 +117,7 @@ export declare const TRUST_DIALOG_BLANK_MESSAGE = "trust-dialog fingerprint must
 export declare const CLAUDE_TRUST_PANE: string;
 export declare const CODEX_TRUST_PANE: string;
 export declare const CURSOR_TRUST_PANE = "Workspace Trust Required\nTrust this folder?";
+export declare const GROK_TRUST_PANE: string;
 export declare const KIMI_TRUST_PANE: string;
 export declare const KIMI_TRUST_PANE_029: string;
 export declare const KIMI_MCP_TRUST_PANE: string;

package/dist/adapters/types.js

@@ -59,6 +59,16 @@ export const CODEX_TRUST_PANE = [
 ].join("\n");
 // v1.22 T5 / OBS-19, cursor-agent's per-worktree dialog.
 export const CURSOR_TRUST_PANE = "Workspace Trust Required\nTrust this folder?";
+// Queue row 215 (D-2118 add.1, D-2125): quoted from the recorded Grok Build 1.0.62 modal in
+// tests/fixtures/grok-trust/grok-1.0.62.screen.txt; 1.0.67 renders these same modal rows centered.
+export const GROK_TRUST_PANE = [
+    "Do you trust the contents of this directory?",
+    "/Users/…/repo",
+    "Grok Build may run or modify contents in this directory,",
+    "posing security risks.",
+    "Yes, proceed                 y",
+    "No, quit                     n",
+].join("\n");
 // Queue row 198, kimi 2.2.0's folder-trust modal on a fresh task worktree (run 1394 T3, read off the
 // Orca screen before its one Enter). The worktree path is shortened as above; every other row is as
 // rendered. 2.2.0 renamed the selected option, so the 0.29.0 fingerprint below never matched it and the
@@ -92,6 +102,7 @@ export const KIMI_MCP_TRUST_PANE = [
 ].join("\n");
 export const RECORDED_TRUST_PANES = [
     CLAUDE_TRUST_PANE, CODEX_TRUST_PANE, CURSOR_TRUST_PANE, KIMI_TRUST_PANE, KIMI_TRUST_PANE_029, KIMI_MCP_TRUST_PANE,
+    GROK_TRUST_PANE,
 ];
 // v1.89 T1 / OBS-414 round 4 — EXACT, not "leading bytes of a recorded line". Round 3 accepted any
 // prefix of a captured line, and every prefix of a trust prompt is also a substring of unrelated
@@ -111,6 +122,7 @@ export const APPROVED_TRUST_FINGERPRINTS = [
     "Workspace Trust Required", // cursor-agent, OBS-19
     "❯ Trust this folder", // kimi 0.29.0, OBS-358 + OBS-406 — the cursor glyph is load-bearing
     "❯ Trust and continue", // kimi 2.2.0, queue row 198 — the same gate with its option renamed
+    "Grok Build may run or modify contents in this directory", // queue row 215, D-2125
 ];
 const isApprovedFingerprint = (fingerprint) => APPROVED_TRUST_FINGERPRINTS.includes(fingerprint)
     && RECORDED_TRUST_PANES.some((pane) => pane.includes(fingerprint));

package/dist/cli/commands/init.d.ts

@@ -1,3 +1,12 @@
+interface SkillDrift {
+    skill: string;
+    dir: string;
+    missing: string[];
+    modified: string[];
+}
+export declare function skillDrift(cwd: string): SkillDrift[];
+export declare const docsDrift: (cwd: string) => string[];
+export declare function installedAgentGuidance(cwd: string): string[];
 export type DetectedHost = "herdr" | "orca" | "subprocess";
 export declare function detectedHost(env?: NodeJS.ProcessEnv): DetectedHost;
 /** Test seam mirroring FleetIO: production callers omit it and get the process streams. */
@@ -6,3 +15,4 @@ export type InitIO = {
     output?: NodeJS.WriteStream;
 };
 export declare function init(argv: string[], cwd?: string, io?: InitIO): Promise<string>;
+export {};

package/dist/cli/commands/init.js

@@ -107,7 +107,11 @@ Outside multi-agent environments, run the loop directly.
 
 ### Version preflight
 
-Before \`tickmarkr compile\` or \`tickmarkr run\`: run \`tickmarkr version\`, read \`package.json\` version, and stop if the versions differ anywhere (major, minor, or patch); the binary and repository must agree on the entire version, so binary \`2.1.0\` versus repository \`2.1.1\` is a stop. Tell the operator to update or link the correct binary. Never proceed on hope — stale binaries silently skip daemon gates. Also verify no run is live in this repository before starting one: lead with this repository's \`.tickmarkr/graph.lock\`, read its holder pid, and treat it as live until \`kill -0 <pid>\` proves that holder dead. Never require a machine-wide process pattern to be empty: a lawful run in another repository — or the probing shell's own argv — can match. If you use a process probe as secondary evidence, exclude the probing process, resolve every candidate's own cwd (for example with \`lsof -a -p <pid> -d cwd\`), and count only candidates whose cwd is this repository root.
+Before \`tickmarkr compile\` or \`tickmarkr run\`: run \`tickmarkr version --check\` and stop on a non-zero exit. In the tickmarkr source repository (\`package.json\` named \`tickmarkr\`), stop if the versions differ anywhere (major, minor, or patch); the binary and repository must agree on the entire version, so binary \`2.1.0\` versus repository \`2.1.1\` is a stop. In a consumer repository, the check compares installed agent guidance with this binary's packaged block and skills, never the app's manifest version; refresh drifted guidance with \`tickmarkr init --agent --force\`. Tell the operator to update or link the correct binary when the source version differs. Never proceed on hope — stale binaries silently skip daemon gates. Also verify no run is live in this repository before starting one: lead with this repository's \`.tickmarkr/graph.lock\`, read its holder pid, and treat it as live until \`kill -0 <pid>\` proves that holder dead. Never require a machine-wide process pattern to be empty: a lawful run in another repository — or the probing shell's own argv — can match. If you use a process probe as secondary evidence, exclude the probing process, resolve every candidate's own cwd (for example with \`lsof -a -p <pid> -d cwd\`), and count only candidates whose cwd is this repository root.
+
+### Seat hygiene
+
+In a multi-tier session, the tiers clear each other at 50% context or more, after writing a handoff. A new spec or run is a mission boundary: write the handoff and clear before taking the next mission. Copy this duty into every brief and handoff. On a single-tier plain host, write your handoff and ask the operator to clear the session.
 
 ### Tip-verify-before-green
 
@@ -184,7 +188,7 @@ function skillFileList(root, prefix = "") {
 }
 // Drift is only computed for skills that ARE installed. A skill never installed is not drift — `--agent`
 // installs it and says so, and nagging about it would bury the case this exists for.
-function skillDrift(cwd) {
+export function skillDrift(cwd) {
     const drifted = [];
     for (const { skillsDir } of hostTargets(cwd)) {
         for (const skill of AGENT_SKILLS) {
@@ -215,7 +219,7 @@ function skillDrift(cwd) {
 // superseded preflight rules (patch-version drift tolerated, a machine-wide process match required)
 // through the very release that fixed the tracked copy, and a consultation was launched under the stale
 // text with nobody able to see it. Same rule as skillDrift: a doc that was never written is not drift.
-const docsDrift = (cwd) => hostTargets(cwd).map(({ docPath }) => docPath).filter((docPath) => {
+export const docsDrift = (cwd) => hostTargets(cwd).map(({ docPath }) => docPath).filter((docPath) => {
     if (!existsSync(docPath))
         return false;
     const current = readFileSync(docPath, "utf8");
@@ -227,6 +231,12 @@ const docsDrift = (cwd) => hostTargets(cwd).map(({ docPath }) => docPath).filter
         return true; // a truncated block is stale by definition
     return current.slice(begin, end + DOCS_END.length) !== AGENT_DOCS.trimEnd();
 });
+export function installedAgentGuidance(cwd) {
+    return hostTargets(cwd).flatMap(({ skillsDir, docPath }) => [
+        ...AGENT_SKILLS.map((skill) => join(skillsDir, skill, "SKILL.md")).filter((path) => existsSync(path)),
+        ...(existsSync(docPath) && readFileSync(docPath, "utf8").includes(DOCS_BEGIN) ? [docPath] : []),
+    ]);
+}
 const describeDrift = (d) => [
     d.missing.length ? `missing ${d.missing.join(", ")}` : "",
     d.modified.length ? `modified ${d.modified.join(", ")}` : "",

package/dist/cli/commands/version.d.ts

@@ -1,2 +1,2 @@
 export declare function distFingerprint(dir?: string): string;
-export declare function version(argv?: string[], dir?: string): Promise<string>;
+export declare function version(argv?: string[], dir?: string, cwd?: string): Promise<string>;

package/dist/cli/commands/version.js

@@ -23,7 +23,41 @@ export function distFingerprint(dir = distDir) {
         hash.update(relative(dir, file)).update("\0").update(readFileSync(file)).update("\0");
     return hash.digest("hex");
 }
-export async function version(argv = [], dir = distDir) {
+export async function version(argv = [], dir = distDir, cwd = process.cwd()) {
     const { version: v } = JSON.parse(readFileSync(pkgPath, "utf8"));
-    return argv.includes("--dist") ? `${v} dist:${resolve(dir)} fingerprint:${distFingerprint(dir)}` : v;
+    const stamp = argv.includes("--dist") ? `${v} dist:${resolve(dir)} fingerprint:${distFingerprint(dir)}` : v;
+    if (!argv.includes("--check"))
+        return stamp;
+    let manifest;
+    try {
+        manifest = JSON.parse(readFileSync(join(cwd, "package.json"), "utf8"));
+    }
+    catch { /* no source manifest — consumer guidance check */ }
+    if (manifest?.name === "tickmarkr") {
+        const repoVersion = manifest.version ?? "missing";
+        const equal = v === repoVersion;
+        const out = `tickmarkr binary ${stamp}: compared tickmarkr source repository package.json version ${repoVersion} — ${equal ? "entire version matches" : "versions differ; update or link the correct binary"}`;
+        if (!equal)
+            throw new Error(out);
+        return out;
+    }
+    const { docsDrift, installedAgentGuidance, skillDrift } = await import("./init.js");
+    const installed = installedAgentGuidance(cwd);
+    if (!installed.length)
+        return `tickmarkr binary ${stamp}: no installed agent guidance to compare`;
+    const drift = [
+        ...skillDrift(cwd).flatMap(({ dir: skillDir, missing, modified }) => [
+            ...missing.map((file) => `missing ${relative(cwd, join(skillDir, file))}`),
+            ...modified.map((file) => `modified ${relative(cwd, join(skillDir, file))}`),
+        ]),
+        ...docsDrift(cwd).map((file) => `stale agent-docs block in ${relative(cwd, file)}`),
+    ];
+    const out = [
+        `tickmarkr binary ${stamp}: compared installed agent guidance with this binary's packaged block and skills:`,
+        ...installed.map((file) => `  ${relative(cwd, file)}`),
+        ...(drift.length ? [...drift, "refresh: tickmarkr init --agent --force"] : ["installed guidance matches"]),
+    ].join("\n");
+    if (drift.length)
+        throw new Error(out);
+    return out;
 }

package/dist/cli/help.d.ts

@@ -195,6 +195,7 @@ export declare const COMMAND_HELP: {
         description: string;
         options: {
             "--dist": string;
+            "--check": string;
         };
         examples: string[];
     };

package/dist/cli/help.js

@@ -169,9 +169,12 @@ export const COMMAND_HELP = {
         ],
     },
     version: {
-        usage: "version [--dist]", description: "Print the installed package version. Top-level aliases: --version and -v.",
-        options: { "--dist": "Also print the resolved build directory and distribution fingerprint." },
-        examples: ["version", "version --dist"],
+        usage: "version [--dist] [--check]", description: "Print the installed package version. Top-level aliases: --version and -v.",
+        options: {
+            "--dist": "Also print the resolved build directory and distribution fingerprint.",
+            "--check": "Compare the entire source version when package.json is named tickmarkr; otherwise check installed agent guidance against this binary. Exit non-zero on drift; no installed guidance exits zero.",
+        },
+        examples: ["version", "version --dist", "version --check"],
     },
     verify: {
         usage: "verify [--base <ref>] [--criteria <file> | --task <id>] [options]",

package/dist/drivers/subprocess.js

@@ -49,7 +49,7 @@ export class SubprocessDriver {
     n = 0;
     async slot(cwd, name) {
         const id = `sp-${++this.n}`;
-        this.slots.set(id, { buf: "", exited: false });
+        this.slots.set(id, { buf: "", receivedBytes: 0, exited: false });
         return { id, name, cwd };
     }
     state(slot) {
@@ -72,8 +72,13 @@ export class SubprocessDriver {
             detached: true,
         });
         s.proc = p;
-        p.stdout.on("data", (d) => (s.buf = (s.buf + d).slice(-MAX_BUF)));
-        p.stderr.on("data", (d) => (s.buf = (s.buf + d).slice(-MAX_BUF)));
+        // Queue row 233 (D-2130): count both received streams before retention truncates the tail.
+        const receive = (d) => {
+            s.receivedBytes += d.length;
+            s.buf = (s.buf + d).slice(-MAX_BUF);
+        };
+        p.stdout.on("data", receive);
+        p.stderr.on("data", receive);
         p.on("close", () => (s.exited = true));
         p.on("error", (e) => { s.buf = (s.buf + `\n[tickmarkr subprocess error] ${e}\n`).slice(-MAX_BUF); s.exited = true; });
         // Queue row 108 (D-1622): THIS run's transport state. The slot's `exited` outlives an invocation (a reused slot) and
@@ -117,7 +122,7 @@ export class SubprocessDriver {
     async transportState(slot) {
         const s = this.state(slot);
         const run = s.invocation;
-        return { closed: run?.closed ?? false, bytes: Buffer.byteLength(s.buf), exitCode: run?.exitCode ?? null, signal: run?.signal ?? null };
+        return { closed: run?.closed ?? false, bytes: s.receivedBytes, exitCode: run?.exitCode ?? null, signal: run?.signal ?? null };
     }
     async read(slot, lines) {
         return this.state(slot).buf.split("\n").slice(-lines).join("\n");

package/dist/gates/baseline.js

@@ -428,11 +428,30 @@ export function classifyFailureOutput(output) {
 // and `stderr | <task id>` (digits and underscores) when the reporter no longer knows the task
 // (dist/chunks/index.*.js, `headerText`). The stripper knew only the first form.
 const VITEST_ECHO_BLOCK_RE = /^\s*std(?:out|err)\s+\|\s+(?:unknown test\s*$|\d+_[\d_]+\s*$|\S+\.(?:test|spec)\.[cm]?[jt]sx?(?:\s*$|\s+>\s+\S))/;
-/** Keep runner output while omitting Vitest's echoed test-owned stdout/stderr diagnostic blocks. */
+// Queue row 211 (D-2118): only Jest's complete, column-zero recovery warning is noise. A missing
+// neighbour, changed hint, indented copy or multi-line Watchman error remains failure evidence.
+const JEST_WATCHMAN_HEADER = "jest-haste-map: Watchman crawl failed. Retrying once with node crawler.";
+const JEST_WATCHMAN_HINT = "  Usually this happens when watchman isn't running. Create an empty `.watchmanconfig` file in your project's root folder or initialize a git or hg repository in your project.";
+const JEST_WATCHMAN_ERROR_RE = /^ {2}Error: Watchman error: [^\r\n]+\. Make sure watchman is running for this project\. See https:\/\/facebook\.github\.io\/watchman\/docs\/troubleshooting\.$/;
+/** Queue row 211 (D-2118): display readers retain raw Vitest echo lines while dropping this warning. */
+const withoutJestWatchmanBlocks = (output) => {
+    const kept = [];
+    const lines = output.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (line === JEST_WATCHMAN_HEADER && lines[i + 1] === JEST_WATCHMAN_HINT && JEST_WATCHMAN_ERROR_RE.test(lines[i + 2] ?? "")) {
+            i += 2;
+            continue;
+        }
+        kept.push(line);
+    }
+    return kept;
+};
+/** Queue row 211 (D-2118): omit the recovered Jest warning alongside Vitest's test-owned echo blocks. */
 const withoutVitestEchoBlocks = (output) => {
     const outside = [];
     let inVitestEchoBlock = false;
-    for (const line of output.split("\n")) {
+    for (const line of withoutJestWatchmanBlocks(output)) {
         const clean = line.replace(ANSI_RE, "");
         const runnerLine = stripTurboPrefix(clean) ?? clean;
         if (inVitestEchoBlock) {
@@ -625,8 +644,7 @@ function fingerprintOccurrences(output) {
 }
 // The diagnostic channel for a runner we cannot read: raw output lines, never fingerprints, never a
 // verdict. They exist so the operator sees SOMETHING when a green command turns red unrecognizably.
-const unrecognizedEvidence = (raw) => raw
-    .split("\n")
+const unrecognizedEvidence = (raw) => withoutJestWatchmanBlocks(raw)
     .map((l) => l.replace(ANSI_RE, "").trimEnd())
     .filter((l) => VOCAB_RE.test(l))
     .slice(0, 10)
@@ -1028,11 +1046,33 @@ export async function detectVacuousOracles(cwd, tasks) {
 // drop a FAIL line that fingerprint-collides with baseline noise). No headline anchors → byte-identical
 // fallback to today's text (non-vitest runners lose nothing). RED-pinned by tests/gates/baseline.test.ts
 // "HYG-08: details headlines the failing test, not the noise".
+// Queue row 224(a) (D-2118): Jest identities and their first message are display-only; Console and
+// column-zero validation bullets are not identities. Keep the existing metadata extraction separate.
+const JEST_IDENTITY_RE = /^ {2}● (?!Console\s*$)\S.*$/;
 function headlineDetails(raw, fresh, freshLines) {
-    const headlines = raw
+    const namedHeadlines = raw
         .split("\n")
         .map((l) => l.replace(ANSI_RE, ""))
         .filter((l) => namesFailureEitherForm(l) || SUMMARY_FAIL_RE.test(l));
+    const outputLines = withoutJestWatchmanBlocks(raw).map((l) => l.replace(ANSI_RE, ""));
+    let inVitestEchoBlock = false;
+    const headlines = outputLines.flatMap((line, index) => {
+        const runnerLine = stripTurboPrefix(line) ?? line;
+        const echoed = inVitestEchoBlock || VITEST_ECHO_BLOCK_RE.test(runnerLine);
+        if (inVitestEchoBlock) {
+            if (runnerLine.trim() === "")
+                inVitestEchoBlock = false;
+        }
+        else if (echoed)
+            inVitestEchoBlock = true;
+        // Queue row 224(a) (D-2118): preserve raw FAIL/summary headlines; only Jest identities exclude echoes.
+        if (namesFailureEitherForm(line) || SUMMARY_FAIL_RE.test(line))
+            return [line];
+        if (echoed || !JEST_IDENTITY_RE.test(line))
+            return [];
+        const message = withoutVitestEchoBlocks(outputLines.slice(index + 1).join("\n")).find((l) => l.trim() !== "");
+        return message === undefined ? [line] : [line, message];
+    });
     // S22: the ORIGINAL runner lines behind v2 comparison keys are the diagnostic; the keys are secondary.
     // A legacy entry's lines ARE its keys, so its details stay byte-identical.
     const lines = [...new Set(freshLines)].join("\n");
@@ -1042,7 +1082,7 @@ function headlineDetails(raw, fresh, freshLines) {
         return { details: same ? `new failures vs baseline:\n${lines}` : `new failures vs baseline:\n${lines}\n\n${keys}` };
     return {
         details: `failing tests:\n${headlines.join("\n")}\n\n${same ? "" : `new failure lines vs baseline:\n${lines}\n\n`}${keys}`,
-        meta: { failingTests: headlines.filter(namesFailureEitherForm) },
+        ...(namedHeadlines.length ? { meta: { failingTests: namedHeadlines.filter(namesFailureEitherForm) } } : {}),
     };
 }
 export async function compareToBaseline(cwd, commands, baseline, enabled, opts = {}) {
@@ -1225,7 +1265,7 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
         if (classification === "infra") {
             const evidence = failingLines.length
                 ? failingLines.slice(0, 10).join("\n")
-                : unrecognizedEvidence(raw) || raw.trim().split("\n").slice(0, 10).join("\n");
+                : unrecognizedEvidence(raw) || withoutJestWatchmanBlocks(raw).join("\n").trim().split("\n").slice(0, 10).join("\n");
             record({
                 gate: name,
                 pass: false,

package/dist/run/daemon.js

@@ -1,7 +1,7 @@
 import { HOST_PROBE_SAMPLE_MS, HOST_PROBE_SAMPLES, HostDegradedError, hostDegraded, observeHost } from "./host-health.js";
 import { runWithInterruptionSink, VITEST_CACHE_ENV, worktreeVitestCache } from "../gates/test-manifest.js";
 import { COMMAND_LEASE_TOKEN_ENV, commandLeaseEnvironment, CommandLeases, currentCommandLeaseToken, isRunnerCommand, runWithCommandLease, withCommandLease } from "./lease.js";
-import { execFileSync, spawn } from "node:child_process";
+import { execFile, execFileSync, spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { shq } from "../adapters/types.js";
 import { appendFileSync, closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, readlinkSync, readSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
@@ -34,10 +34,10 @@ import { executionSignal, remainingExecutionMs, withExecutionBudget, withoutExec
 import { repairSelectionDecision, repairSelectionEnabled } from "./repair-selection.js";
 import { failureDisposition, reserveInfrastructureRetry } from "./recovery.js";
 import { runEnvironment } from "./environment.js";
-import { addDetachedWorktree, changeRepresented, cleanupRunWorktrees, declaredBaseContainment, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER, preserveWorktree, producerFields, reflogWitness, removeWorktree, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shell, shGit, SUITE_PARENT_ENV, verificationProtocol, WORKTREE_LAYOUT_CONTRACT, WORKTREES_DIR, worktreePath } from "./git.js";
+import { addDetachedWorktree, changeRepresented, cleanupRunWorktrees, declaredBaseContainment, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER, preserveWorktree, producerFields, reflogWitness, removeWorktree, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shell, shGit, SUITE_PARENT_ENV, verificationProtocol, WorktreeAdminRaceError, WORKTREE_LAYOUT_CONTRACT, WORKTREES_DIR, worktreePath } from "./git.js";
 import { MASK } from "./redact.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
-import { classifyRepairDisposition, resolveScopeHints } from "./repair-disposition.js";
+import { classifyRepairDisposition, namedPaths, resolveScopeHints } from "./repair-disposition.js";
 import { applyScopeAmendments, activeRetryBan, interruptedAttempt, RESUME_HARVEST_SOURCE, resumeHarvestAuthor, approvalAction, APPROVAL_REFUSED, bindingToken, effectiveEvents, foldDecisions, physicalLine, staleApprovals, classifyTaskFailure, classifyWorkerResultCause, deferredReviewFindings, engagementComparable, formatPriorFindingEvidence, GATE_FINGERPRINT_CAP, GATE_SATISFIED_RELEASE, identicalGateFailures, isDeferredFinding, journaledFailureBrief, Journal, loadRoutingProfile, newRunId, normalizeGateFailure, outstandingConsultGuidance, readableExcerpt, receiptOrigin, outstandingReviewFindings, pendingApprovalActions, pendingRechecks, pendingRepairFindings, phaseForGate, priorJudgments, readPriorRunEvidence, recordedTaskFailureKind, reraisedReviewChains, RECHECK_RELEASE, renderStructuredReviewFinding, repairReachSinceApproval, repairsSinceApproval, reviewRoundsSinceApproval, runHasEnded, standingRulings, structuredFindings, upheldFeedbackByTask } from "./journal.js";
 import { carriedAuthorVendors, gateReviewerFloor, isDiffCapPark, isGarbageReview, pickReviewer } from "../gates/review.js";
 import { acquireApprovalSerialization, acquireRunLock, isPidLive, releaseRunLock } from "./lock.js";
@@ -855,7 +855,11 @@ export function resetDeadChannelFastKillMsForTests() {
 // monotonic-tracker silence — CONCLUDES the wait. Conclude, never kill: the pane is harvested by
 // the same tail a window expiry uses, and the carried worktree goes straight to gates. Set at the
 // fast-kill's window on purpose (the OBS-264 arithmetic is "a ~36m stall + ~15m redo becomes a
-// ~5m gate pass"); a worker that is merely thinking still burns CPU and is never concluded here.
+// ~5m gate pass"). Queue row 231 (D-2119): a headless worker waiting on its remote provider can be
+// silent with flat CPU. Print mode also requires a fresh reading of no ESTABLISHED TCP connection
+// in its owned process group; connected or unreadable holds the harvest. Interactive workers keep
+// the triad: an idle pane holds connections too. Residual (D-2125): a truly hung headless worker
+// holding a connection rides the stall window instead.
 const HARVEST_SILENT_MS = 5 * 60_000;
 let harvestSilentMs = HARVEST_SILENT_MS;
 /** Test seam — shrink the harvest silence gate without minute-long sleeps. */
@@ -3235,11 +3239,6 @@ export async function runDaemon(repoRoot, opts = {}) {
                     ];
                     return `${identity} — release with ${commands.map((command) => `\`${command}\``).join(" or ")}`;
                 };
-                // Lexing never starts in the middle of a word. Resolution is separate so missing hints
-                // remain visible evidence without becoming executable approval advice.
-                const namedPaths = (text) => [...text.matchAll(/(?:^|[\s`'"])((?:[A-Za-z0-9_@.()[\]-]+\/)+[A-Za-z0-9_@.[\]-]+|[A-Za-z0-9_@-]+(?:\.[A-Za-z0-9_-]+)+)(?=$|[\s`'"),:;.!?])/g)]
-                    .map((match) => match[1].replace(/^\.\//, "").replace(/\.$/, ""))
-                    .filter((path) => !path.split("/").includes(".."));
                 const diffPaths = async (base, wt) => {
                     const out = await shGit(`git diff --name-only -z ${shq(base)}..HEAD`, wt);
                     return new Set(out.code === 0 ? out.stdout.split("\0").filter(Boolean) : []);
@@ -3526,7 +3525,20 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const ref = await preserveWorktree(priorWt, producer);
                         if (ref)
                             journal.append("worktree-preserved", t.id, { ref, ...producerFields(producer) });
-                        return driver.worktree(repoRoot, taskBranch, taskBase);
+                        // Queue row 223 (D-2118): only this typed add race buys retries, with three adds total.
+                        const addWorktree = () => {
+                            return driver.worktree(repoRoot, taskBranch, taskBase);
+                        };
+                        for (let attempt = 1;; attempt++) {
+                            try {
+                                return await addWorktree();
+                            }
+                            catch (error) {
+                                if (!(error instanceof WorktreeAdminRaceError) || attempt >= 3)
+                                    throw error;
+                                journal.append("worktree-add-retry", t.id, { attempt, nextAttempt: attempt + 1, evidence: error.evidence });
+                            }
+                        }
                     };
                     // A dead worker with a clean checkout still needs a durable recovery handle: there may be no
                     // pane left to identify even the commit it was dispatched from. preserveWorktree deliberately
@@ -5310,17 +5322,19 @@ export async function runDaemon(repoRoot, opts = {}) {
                         let cpuFlat;
                         let cpuAccountant;
                         let cpuGapCount = 0;
-                        let unmeasurableNoted = false;
-                        // One line per attempt, whichever way the CPU leg turns out to be unmeasurable. A triad that
+                        const unmeasurableNoted = new Set();
+                        // Queue row 231 (D-2119): one line per reading per attempt, including the connection leg.
+                        // One CPU line per attempt, whichever way that leg turns out to be unmeasurable. A triad that
                         // can never conclude is this feature silently ABSENT — on a host whose `ps` the probe cannot
                         // read, every stall would ride its whole window out again with nothing saying why. Named once
                         // per attempt, not per slice: the condition is structural, and a per-slice line would bury it.
-                        const noteUnmeasurable = (reason) => {
-                            if (unmeasurableNoted)
+                        const noteUnmeasurable = (reason, reading = "cpu") => {
+                            if (unmeasurableNoted.has(reading))
                                 return;
-                            unmeasurableNoted = true;
+                            unmeasurableNoted.add(reading);
                             journal.append("worker-harvest-unmeasurable", t.id, { slot: slot.name, attempt, reason });
                         };
+                        let harvestHeldNoted = false;
                         // The CPU leg needs a marker in the worker's own argv, and every launch path puts this
                         // attempt's dispatch script there EXCEPT interactiveSeed: runInteractiveSeed launches the
                         // TUI directly, by a command the ADAPTER owns (seed.launch(model)) which tickmarkr cannot
@@ -5382,6 +5396,39 @@ export async function runDaemon(repoRoot, opts = {}) {
                             const carried = await commitsAheadOf(taskBase, wt);
                             if (carried.length === 0)
                                 return false; // nothing landed: not this branch's population
+                            if (!interactive) {
+                                // Queue row 231 (D-2119): query afresh only after the other legs hold. lsof ORs selections
+                                // without -a; -g includes connector children in the owned group, not just the CLI root.
+                                // No environment inspection. One async PATH lookup, bounded from invocation like the
+                                // reap census (15 s); SIGKILL also retires a probe that ignores SIGTERM.
+                                const group = readOwnedProcessGroup(groupFile);
+                                const connection = group === undefined ? "unreadable" : await new Promise((resolve) => {
+                                    try {
+                                        execFile("lsof", ["-nP", "-a", "-g", String(group), "-iTCP", "-sTCP:ESTABLISHED", "-Fp"], { encoding: "utf8", timeout: 15_000, killSignal: "SIGKILL", maxBuffer: 4 * 1024 * 1024 }, (error, stdout, stderr) => {
+                                            if (!error && stdout.trim())
+                                                resolve("connected");
+                                            else if (error && error.code === 1 && !stdout && !stderr)
+                                                resolve("none");
+                                            else
+                                                resolve("unreadable");
+                                        });
+                                    }
+                                    catch {
+                                        resolve("unreadable");
+                                    }
+                                });
+                                if (connection === "unreadable") {
+                                    noteUnmeasurable("the worker ESTABLISHED TCP connection reading could not be read", "connection");
+                                    return false;
+                                }
+                                if (connection === "connected") {
+                                    if (!harvestHeldNoted) {
+                                        harvestHeldNoted = true;
+                                        journal.append("worker-harvest-held", t.id, { slot: slot.name, attempt, reason: "established-tcp-connection", processGroup: group });
+                                    }
+                                    return false;
+                                }
+                            }
                             journal.append("worker-harvest", t.id, {
                                 slot: slot.name, attempt, commits: carried.length,
                                 silentMs, cpuMs: leg.cpu.ms, cpuResolutionMs: leg.cpu.resolutionMs,
@@ -5860,13 +5907,17 @@ export async function runDaemon(repoRoot, opts = {}) {
                                             lastStatus = st;
                                             journal.append("worker-status", t.id, { slot: slot.name, status: st, attempt });
                                         }
-                                        if (st === "blocked" || st === "idle") {
+                                        // Queue row 215 (D-2118 add.1): an unhooked CLI can report unknown at its startup modal.
+                                        // Bound that status to worker-launch's startup window, including time spent reading.
+                                        const withinTrustStartup = () => workerLaunchedAt !== undefined
+                                            && Date.now() - workerLaunchedAt <= workerStartupWindowMs;
+                                        if (st === "blocked" || st === "idle" || (st === "unknown" && withinTrustStartup())) {
                                             // T5: once-per-slot auto-answer when the adapter declares a trust dialog and the pane
                                             // text matches. tickmarkr created the worktree from the operator's own repo — safe by construction.
                                             if (!trustAnswered && adapter.trustDialog && driver.sendKey) {
                                                 try {
-                                                    const paneText = await workerTransport.read(slot, 80);
-                                                    if (matchesTrustDialog(paneText, adapter.trustDialog)) {
+                                                    const paneText = await (slot.readScreen ? slot.readScreen() : workerTransport.read(slot, 80));
+                                                    if ((st !== "unknown" || withinTrustStartup()) && matchesTrustDialog(paneText, adapter.trustDialog)) {
                                                         trustAnswered = true;
                                                         trustAnsweredSlots.add(slot.id);
                                                         // v1.25 T1: audit trail for live runs — prove the dialog appeared and was answered.
@@ -6092,9 +6143,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         }
                                         // OBS-548: the FOURTH leg, and the one the daemon already measured. The three legs above
                                         // are all channel-side: they say a pane stopped talking. The tree's CPU says whether
-                                        // anything is still WORKING, and the harvest triad forty lines up refuses exactly this
-                                        // conclusion without it — "a worker that is merely thinking still burns CPU and is never
-                                        // concluded here". A live CPU delta is a live worker, by construction; an UNMEASURABLE
+                                        // anything is still WORKING, and the harvest triad forty lines up refuses this
+                                        // conclusion without it. Queue row 231 (D-2119): print-mode harvest additionally checks
+                                        // connections because a remote model turn can have flat CPU. An UNMEASURABLE
                                         // reading keeps the fail-open contract the probe already states (undefined is never
                                         // evidence a worker stopped), so on a host whose `ps` cannot be read the fast-kill stands
                                         // down and the fixed attempt ceiling bounds the hold.
@@ -6281,13 +6332,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 }
                                 await noteLaunched();
                                 // OBS-54: headless workers have the same output-inactivity budget as visible panes.
-                                // v1.76: same monotonic-progress measure as the interactive site; harvest stays raw.
+                                // Queue row 233 (D-2130): print progress is the driver's received-byte count, never a row
+                                // high-water over the bounded tail; a driver reporting no count keeps the row measure.
                                 const stallWindowMs = taskTimeoutMinutes * 60_000;
+                                const hardDeadline = attemptStart + (attemptHardTimeoutMs ?? stallWindowMs * 4);
                                 const initialPane = await workerTransport.read(slot, 500);
                                 startupFailure = startupFailureInWindow(initialPane, workerLaunchedAt);
                                 let everHadOutput = initialPane.length > 0;
                                 const stallProgress = new StallProgressTracker();
-                                stallProgress.observe({ paneText: initialPane, seedSubmitted: true, contextTokens });
+                                stallProgress.observe({ paneText: initialPane, receivedBytes: (await workerTransport.transportState?.(slot))?.bytes, seedSubmitted: true, contextTokens });
                                 let lastProgressAt = Date.now();
                                 finished = false;
                                 // T2 review (material): the exit marker proves the PROCESS EXITED, never that the worker
@@ -6297,10 +6350,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // worker-result-harvested row. The interactive site has always kept them apart (`finished`
                                 // there is the trailer regex; the exit marker only sets exitCode), and the cause taxonomy
                                 // already names this shape "clean-exit-no-trailer" — unreachable in print mode until now.
-                                while (!startupFailure && Date.now() - lastProgressAt < stallWindowMs) {
+                                while (!startupFailure && Date.now() - lastProgressAt < stallWindowMs && Date.now() < hardDeadline) {
                                     fatalStop.signal.throwIfAborted();
                                     executionSignal()?.throwIfAborted();
-                                    const remaining = stallWindowMs - (Date.now() - lastProgressAt);
+                                    const remaining = Math.min(stallWindowMs - (Date.now() - lastProgressAt), hardDeadline - Date.now());
                                     let slice = Math.min(BLOCKED_POLL_MS, Math.max(100, Math.min(stallWindowMs / 2, remaining)));
                                     const startupLeft = workerLaunchedAt === undefined
                                         ? 0
@@ -6331,11 +6384,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                                         break;
                                     }
                                     await sampleContext();
-                                    if (stallProgress.observe({ paneText, contextTokens }))
+                                    if (stallProgress.observe({ paneText, receivedBytes: (await workerTransport.transportState?.(slot))?.bytes, contextTokens }))
                                         lastProgressAt = Date.now();
-                                    // T2 (OBS-264): the same liveness triad the interactive loop runs. A headless worker that
-                                    // committed and went quiet is finished work too, and before this it rode the entire
-                                    // window out before anything looked at its commits.
+                                    // Queue row 231 (D-2119): print mode adds a fresh owned-group connection reading to the
+                                    // silence/commits/CPU triad; a quiet remote model turn can hold a connection with flat CPU.
                                     // No nudge hold here, deliberately: print mode has no nudge surface at all (no pane to
                                     // steer, driver.nudge is never consulted on this path), so there is no pending daemon
                                     // action for the triad to preempt — the asymmetry with the interactive call site above is
@@ -6350,7 +6402,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 // without one is finished:false with a non-null exitCode — the harvest synthesis then owns
                                 // it when the worktree carries work, and classifyWorkerResultCause names it otherwise.
                                 finished = new RegExp(trailerPattern(nonce)).test(output);
-                                timedOut = !processExited && !finished && Date.now() - lastProgressAt >= stallWindowMs;
+                                timedOut = !processExited && !finished && (Date.now() - lastProgressAt >= stallWindowMs || Date.now() >= hardDeadline);
                             }
                         }
                         finally {
@@ -7101,7 +7153,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // Budget spent means the FRESH LADDER owns this failure — including a review-only one, whose
                         // same-channel fix retry is exactly the round the budget just declared too expensive to repeat.
                         const repairExhausted = repairable && !repair;
-                        if (repair && !capStep) {
+                        const fundedRepair = repair && !capStep;
+                        if (fundedRepair) {
                             journal.append("repair-attempt", t.id, {
                                 repair: repairHistory.length + 1, charge: repairsDrawn + 1, of: MAX_REPAIRS,
                                 gates: failing.map((g) => g.gate),
@@ -7126,8 +7179,13 @@ export async function runDaemon(repoRoot, opts = {}) {
                             });
                             await driver.notify(`tickmarkr ${runId}: ${t.id} escalation: ${step}`, { tier: "attention" });
                         }
+                        // Queue row 224(b) (D-2118): pinned tasks park on the first unfunded owned deterministic red
+                        // at or after the second, so this climb fires at most once. Unpinned tasks climb on exactly
+                        // the second owned deterministic red, even when it funds a repair.
                         const climbCause = repairExhausted ? "repair-exhausted"
-                            : deterministic && ownedGateFailures === 2 ? "gate-fail" : undefined;
+                            : deterministic && (t.routingHints?.pin
+                                ? ownedGateFailures >= 2 && !fundedRepair
+                                : ownedGateFailures === 2) ? "gate-fail" : undefined;
                         if (climbCause) {
                             const climbed = await climb(climbCause, deterministic ?? failing[0], attempt + 1);
                             if (climbed === "parked")
@@ -7240,6 +7298,10 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 if (fatalStop.signal.aborted)
                                     return;
                                 const cleanupEvidence = cleanupErrors.length ? { cleanupErrors } : {};
+                                if (err instanceof WorktreeAdminRaceError) {
+                                    await park(t, err.message, "infra", null, 0, Date.now(), 0, 0, undefined, 0, "fresh", { evidence: err.evidence, ...cleanupEvidence });
+                                    return;
+                                }
                                 if (err instanceof HostDegradedError) {
                                     await park(t, err.message, "infra", null, 0, Date.now(), 0, 0, undefined, 0, "fresh", { disposition: "host-degraded", ...cleanupEvidence });
                                     return;

package/dist/run/git.d.ts

@@ -199,6 +199,11 @@ export declare function shGitOk(cmd: string, cwd: string, own?: OwnGitOptions):
 export declare function gitSync(dir: string, args: readonly string[], { env }?: {
     env?: NodeJS.ProcessEnv;
 }): SpawnSyncReturns<string>;
+/** Queue row 223 (D-2118): git could not read a sibling's partially written admin file during add. */
+export declare class WorktreeAdminRaceError extends Error {
+    readonly evidence: string;
+    constructor(evidence: string);
+}
 /**
  * v2.6.8 T2: the DETACHED worktree capability, declared by calling it (the daemon's baseline recapture and standalone
  * verify's base worktree). Under the ref-store pin git stubs a detached add's new HEAD as `ref: refs/heads/.invalid`

package/dist/run/git.js

@@ -621,6 +621,41 @@ export function gitSync(dir, args, { env = process.env } = {}) {
         pin?.release();
     }
 }
+// Queue row 223 (D-2118): one process-wide administration queue; recreation and rollback retain
+// their caller's hold, including trust rechecks and branch restoration, without queuing behind it.
+let worktreeAdminTail = Promise.resolve();
+const worktreeAdminHold = new AsyncLocalStorage();
+async function withWorktreeAdmin(operation) {
+    if (worktreeAdminHold.getStore())
+        return operation();
+    const prior = worktreeAdminTail;
+    let release;
+    worktreeAdminTail = new Promise((done) => { release = done; });
+    await prior;
+    try {
+        return await worktreeAdminHold.run(true, operation);
+    }
+    finally {
+        release();
+    }
+}
+/** Queue row 223 (D-2118): git could not read a sibling's partially written admin file during add. */
+export class WorktreeAdminRaceError extends Error {
+    evidence;
+    constructor(evidence) {
+        super(`worktree add encountered a sibling admin read race (queue row 223, D-2118): ${evidence}`);
+        this.evidence = evidence;
+        this.name = "WorktreeAdminRaceError";
+    }
+}
+const siblingAdminReadFailed = (stderr) => {
+    for (const line of stderr.split("\n")) {
+        const read = /^(?:fatal: |error: )?failed to read (?:'([^'\r\n]+)'|"([^"\r\n]+)"|([^:\r\n]+))(?::|$)/.exec(line);
+        if (read && /(?:^|\/)worktrees\/[^/\r\n]+\/(?:commondir|gitdir|HEAD)$/.test(read[1] ?? read[2] ?? read[3]))
+            return true;
+    }
+    return false;
+};
 /**
  * v2.6.8 T2: the DETACHED worktree capability, declared by calling it (the daemon's baseline recapture and standalone
  * verify's base worktree). Under the ref-store pin git stubs a detached add's new HEAD as `ref: refs/heads/.invalid`
@@ -633,6 +668,9 @@ export function gitSync(dir, args, { env = process.env } = {}) {
  * back through the trusted common directory derived here once (dropWorktree), even while that commondir stays hostile.
  */
 export async function addDetachedWorktree(cwd, dir, commitish, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS, { logHead = false } = {}) {
+    return withWorktreeAdmin(() => addDetachedWorktreeHeld(cwd, dir, commitish, timeoutMs, logHead));
+}
+async function addDetachedWorktreeHeld(cwd, dir, commitish, timeoutMs, logHead) {
     // 2.8.1 T1 (ANL-023 §7.1): `logHead` writes the new checkout's HEAD reflog whatever the repository's
     // core.logAllRefUpdates says, so a later HEAD move by any command is appended to an established witness.
     const git = logHead ? "git -c core.logAllRefUpdates=always" : "git";
@@ -682,6 +720,9 @@ function rollbackFailed(error, failure) {
  * step bounded by `timeoutMs`; every step is tried, and any that failed is thrown, never swallowed.
  */
 async function dropWorktree(store, { dir, branch }, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS) {
+    return withWorktreeAdmin(() => dropWorktreeHeld(store, { dir, branch }, timeoutMs));
+}
+async function dropWorktreeHeld(store, { dir, branch }, timeoutMs) {
     const failed = await withoutExecutionBudget(async () => {
         const run = async (cmd) => {
             try {
@@ -859,6 +900,9 @@ export function checkoutIncarnation(worktree) {
     }
 }
 export async function createWorktree(repo, branch, baseRef) {
+    return withWorktreeAdmin(() => createWorktreeHeld(repo, branch, baseRef));
+}
+async function createWorktreeHeld(repo, branch, baseRef) {
     branch = await resolveTaskBranch(repo, branch);
     const dir = join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));
     if (existsSync(dir))
@@ -866,7 +910,13 @@ export async function createWorktree(repo, branch, baseRef) {
     // the worktree capability: a branch add, whose symbolic HEAD keeps the ref-store pin (see OwnGitCapability); a raced
     // add is rolled back, its branch restored to the value read here or deleted when it is new
     const prior = (await shGit(`git rev-parse --verify -q ${shq(`refs/heads/${branch}`)}`, repo)).stdout.trim() || undefined;
-    await shGitOk(`git worktree add -B ${shq(branch)} ${shq(dir)} ${shq(baseRef)}`, repo, { createsWorktree: "branch", rollback: { dir, branch: { name: branch, prior } } });
+    const cmd = `git worktree add -B ${shq(branch)} ${shq(dir)} ${shq(baseRef)}`;
+    const added = await shGit(cmd, repo, DEFAULT_SHELL_TIMEOUT_MS, { createsWorktree: "branch", rollback: { dir, branch: { name: branch, prior } } });
+    if (added.code !== 0) {
+        if (siblingAdminReadFailed(added.stderr))
+            throw new WorktreeAdminRaceError(added.stderr.trim());
+        throw new Error(`command failed (${added.code}): ${cmd}\n${added.stderr || added.stdout}`);
+    }
     linkNodeModules(repo, dir);
     return dir;
 }

package/dist/run/repair-disposition.d.ts

@@ -33,7 +33,7 @@ export interface RepairDispositionInput {
     /** task tree plus diff, deleted tracked paths included */
     inventory: Iterable<string>;
 }
-/** Lexing never starts in the middle of a word (same lexer as the daemon's scope-red disposition). */
+/** Queue row 230: tsc's position, numeric or baseline-normalized (#), ends a path; named parentheses stay. */
 export declare const namedPaths: (text: string) => string[];
 /** Binds candidates to the SUPPLIED inventory and nothing else: an exact path, else a unique
  * path-suffix. Anything unbound or bound twice comes back as a non-executable diagnostic. */

package/dist/run/repair-disposition.js

@@ -1,8 +1,8 @@
 import { filesGlob } from "../graph/files-glob.js";
 const failed = (g) => !(g.pass || g.meta?.skipped === true) || g.meta?.infra === true;
 const REFUSAL_RE = /outside|out.of.scope|allowlist|scope expansion|not (?:in|own)|unowned/i;
-/** Lexing never starts in the middle of a word (same lexer as the daemon's scope-red disposition). */
-export const namedPaths = (text) => [...text.matchAll(/(?:^|[\s`'"])((?:[A-Za-z0-9_@.()[\]-]+\/)+[A-Za-z0-9_@.[\]-]+|[A-Za-z0-9_@-]+(?:\.[A-Za-z0-9_-]+)+)(?=$|[\s`'"),:;.!?])/g)]
+/** Queue row 230: tsc's position, numeric or baseline-normalized (#), ends a path; named parentheses stay. */
+export const namedPaths = (text) => [...text.matchAll(/(?:^|[\s`'"])((?:[A-Za-z0-9_@.()[\]-]+\/)+(?:[A-Za-z0-9_@.[\]-]|\([A-Za-z0-9_@.[\]-]*\))+|(?:[A-Za-z0-9_@-]|\([A-Za-z0-9_@.[\]-]*\))+(?:\.(?:[A-Za-z0-9_-]|\([A-Za-z0-9_@.[\]-]*\))+)+)(?=$|[\s`'"),:;.!?]|\((?:\d+|#),\s*(?:\d+|#)\))/g)]
     .map((match) => match[1].replace(/^\.\//, "").replace(/\.$/, ""))
     .filter((path) => !path.split("/").includes(".."));
 /** Binds candidates to the SUPPLIED inventory and nothing else: an exact path, else a unique

package/dist/run/stall.d.ts

@@ -3,6 +3,7 @@
 export declare function normalizeStallSnapshot(text: string): string;
 export interface StallProgressSample {
     paneText: string;
+    receivedBytes?: number;
     seedSubmitted?: boolean;
     contextTokens?: number;
 }
@@ -102,6 +103,7 @@ export declare const PANE_READ_ROWS = 1000;
  */
 export declare class StallProgressTracker {
     private transcriptRows;
+    private receivedBytes;
     private rawWindowLines;
     private seedSubmitted;
     private contextTokens;

package/dist/run/stall.js

@@ -613,6 +613,7 @@ export const PANE_READ_ROWS = 1000;
  */
 export class StallProgressTracker {
     transcriptRows = 0; // non-empty high-water over the bounded read — the growth signal
+    receivedBytes = 0;
     rawWindowLines = 0; // raw-line high-water — the SATURATION signal (see the getter)
     seedSubmitted = false;
     contextTokens;
@@ -654,6 +655,14 @@ export class StallProgressTracker {
             rowsAdvanced = true;
             this.rowGrowthAt = now; // raw signal — advances even when the report below is suppressed
         }
+        // Queue row 233 (D-2130): print-mode progress is the driver's received-byte count, never a
+        // row high-water over the bounded tail. A driver reporting no count keeps the row measure.
+        const bytes = sample.receivedBytes;
+        let outputAdvanced = rowsAdvanced;
+        if (bytes !== undefined && Number.isFinite(bytes) && bytes >= 0) {
+            outputAdvanced = bytes > this.receivedBytes;
+            this.receivedBytes = Math.max(this.receivedBytes, bytes);
+        }
         let seedAdvanced = false;
         if (sample.seedSubmitted && !this.seedSubmitted) {
             this.seedSubmitted = true;
@@ -674,10 +683,9 @@ export class StallProgressTracker {
         }
         if (tokensAdvanced || seedAdvanced)
             return true;
-        if (rowsAdvanced) {
-            // T1: row growth past the flat-token cap is cosmetic — the paid-work counter has not moved,
-            // so the inactivity window must NOT re-arm on it. A tracker that never sees a token sample
-            // (unmetered adapter) keeps the old row-growth behavior.
+        if (outputAdvanced) {
+            // Queue row 233 (D-2130): both output measures obey the existing flat-token cap;
+            // an unmetered adapter can keep re-arming on output indefinitely, up to its hard deadline.
             if (this.lastTokenGrowthAt !== undefined && now - this.lastTokenGrowthAt >= rowRearmTokenFlatMs)
                 return false;
             return true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.8.6",
+  "version": "2.8.7",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-auto/SKILL.md

@@ -20,16 +20,18 @@ Keep `name: tickmarkr-auto` and the installed links to canonical `skills/` intac
 
 ## Two-tier by default — role check before the loop
 
+`<label>` means the version only in the tickmarkr source repository (`package.json` named `tickmarkr`); elsewhere it means the mission or run, never the installed binary version.
+
 When working in a multi-agent terminal environment (herdr or Orca), decide your role before starting:
 
-- **Orchestrator:** your session was started to execute the mission. Rename your own tab/pane `ORCH · <version>` (short labels: ≤20 chars, `ROLE · token`) and run the loop below.
+- **Orchestrator:** your session was started to execute the mission. Rename your own tab/pane `ORCH · <label>` (short labels: ≤20 chars, `ROLE · token`) and run the loop below.
 - **Supervisor with a live orchestrator:** do not start a second run. Relay the mission to the existing orchestrator with a [verified handoff](#verified-handoffs-agent-to-agent-messaging), then supervise it as OVERSEER.
-- **Primary session without an orchestrator:** rename your own tab `OVERSEER · <version>` and your agent `overseer`, spawn one child orchestration session with your host's launch form, label its tab `ORCH · <version>` and name its agent, give it the mission and these rules verbatim, then supervise it. Do not drive a duplicate single-tier run yourself. Before spawning, confirm any PREVIOUS orchestrator has stood down (monitors stopped, input box empty — dim ghost-text suggestions are UI, not queued input; ANSI-verify before alarming) and close its tab — the journal, records, and ledger hold the story; scrollback is disposable.
-  - **On herdr (`HERDR_ENV=1`)**: **spawning on current herdr is two-step** — the one-shot `agent start --cwd/--tab/--no-focus` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138). First create the pane: `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` (tab create does not steal focus unless `--focus` is passed; parse `result.root_pane.pane_id` from its JSON), then start the agent in it:
+- **Primary session without an orchestrator:** rename your own tab `OVERSEER · <label>` and your agent `overseer`, spawn one child orchestration session with your host's launch form, label its tab `ORCH · <label>` and name its agent, give it the mission and these rules verbatim, then supervise it. Do not drive a duplicate single-tier run yourself. Before spawning, confirm any PREVIOUS orchestrator has stood down (monitors stopped, input box empty — dim ghost-text suggestions are UI, not queued input; ANSI-verify before alarming) and close its tab — the journal, records, and ledger hold the story; scrollback is disposable.
+  - **On herdr (`HERDR_ENV=1`)**: **spawning on current herdr is two-step** — the one-shot `agent start --cwd/--tab/--no-focus` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138). First create the pane: `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <label>"` (tab create does not steal focus unless `--focus` is passed; parse `result.root_pane.pane_id` from its JSON), then start the agent in it:
     - **Claude Code:** `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions`
     - **Codex:** `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` — the unsandboxed flag is REQUIRED, not optional: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation (`git worktree add` cannot lock the ref). Do not downgrade this flag; the herdr pane and repo scope are the containment.
     - **Auxiliary seats run as the CLI's interactive TUI in their visible pane — never headless** (`claude -p` / `codex exec`): headless buffers output until exit so the pane renders idle for the entire run, is blind to SessionStart hook errors (a broken and a fixed hook both return green), and gives a stall watcher no midpoint — silent-time equals lifetime. Headless is for exit-code probes only (a quota check that wants `rc`), never for work anyone must watch.
-  - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: spawn it with `orca terminal create --worktree path:<repo> --title "ORCH · <version>" --command "<agent-cmd>" --json` and parse `result.terminal.handle` from the create receipt. **Auxiliary seats run as the CLI's interactive TUI in their visible terminal — never headless**, for the reasons the herdr branch gives.
+  - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: spawn it with `orca terminal create --worktree path:<repo> --title "ORCH · <label>" --command "<agent-cmd>" --json` and parse `result.terminal.handle` from the create receipt. **Auxiliary seats run as the CLI's interactive TUI in their visible terminal — never headless**, for the reasons the herdr branch gives.
   - **Auxiliary agents you spawn (consultants, reviewers, scouts) follow the same forms.** Never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions` (tickmarkr's own adapter uses exactly this for workers, judges, and consults). A read-only codex consultant may use `--sandbox read-only`; any codex session that must touch git needs the unsandboxed flag above.
 
 With neither herdr nor Orca there is no role to decide and no seat to spawn: follow [On a plain host (neither herdr nor Orca)](#on-a-plain-host-neither-herdr-nor-orca) and run the loop directly, single-tier.
@@ -83,11 +85,11 @@ Run every requested target in order without seeking routine confirmation. Stop o
 
 ## Binary preflight (before compile or run)
 
-Before `tickmarkr compile` or `tickmarkr run`, compare the installed binary against the repository's `package.json` version:
+Before `tickmarkr compile` or `tickmarkr run`:
 
-1. Run `tickmarkr version` (one line, machine-parseable).
-2. Read the `version` field from the repository's `package.json`.
-3. If the binary and repository do not **agree on the entire version** (including the patch; e.g. binary `2.1.0` vs repo `2.1.1`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`), or to install this repository's build as a REAL COPY — `npm pack`, then `npm i -g ./<tarball>`. Do not compile, plan, or run on hope.
+1. Run `tickmarkr version --check` and **stop immediately on a non-zero exit**.
+2. In a consumer repository, it compares installed agent guidance with this binary's packaged block and skills, never the app's manifest version. Refresh drifted guidance with `tickmarkr init --agent --force`.
+3. Only in the tickmarkr source repository (`package.json` named `tickmarkr`), the check compares its version with the binary. If the binary and repository do not **agree on the entire version** (including the patch; e.g. binary `2.1.0` vs repo `2.1.1`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`), or to install this repository's build as a REAL COPY — `npm pack`, then `npm i -g ./<tarball>`. Do not compile, plan, or run on hope.
    > ⚠ **Never `npm i -g .` on the repository directory, and never link it.** npm SYMLINKS a directory install, which makes the working tree itself the machine-wide binary: every later build — including a gate's own `npm run build` — silently hot-swaps the CLI for every repository on the machine, with no version change to notice it by. Measured 2026-08-29: a verify build gate rewrote the shared binary while another repository's daemon was mid-run against it, and a positive control that rebuilds at a pre-fix ref would have installed the very defect it was proving fixed, machine-wide (OBS-771). Verify an install by comparing the global and repo **inodes** — they must DIFFER — never by `tickmarkr version`, which cannot go red when nothing is bumped.
 
 A stale binary silently skips daemon gates shipped in newer releases — the v1.38 run exposed this when a global `1.36.0` binary missed the daemon tip-verify gate entirely (OBS-38). Preflight failure is always stop-and-report; never proceed-and-hope.

package/skills/tickmarkr-loop/SKILL.md

@@ -9,16 +9,18 @@ Use this for any spec that `tickmarkr compile` accepts. It is SDD-agnostic: use
 
 ## Two-tier by default — role check before the loop
 
+`<label>` means the version only in the tickmarkr source repository (`package.json` named `tickmarkr`); elsewhere it means the mission or run, never the installed binary version.
+
 When working in a multi-agent terminal environment (herdr or Orca), decide your role before starting:
 
-- **Orchestrator:** your session was started to execute the mission. Rename your own tab/pane `ORCH · <version>` (short labels: ≤20 chars, `ROLE · token`) and run the loop below.
+- **Orchestrator:** your session was started to execute the mission. Rename your own tab/pane `ORCH · <label>` (short labels: ≤20 chars, `ROLE · token`) and run the loop below.
 - **Supervisor with a live orchestrator:** do not start a second run. Relay the mission to the existing orchestrator with a [verified handoff](#verified-handoffs-agent-to-agent-messaging), then supervise it as OVERSEER.
-- **Primary session without an orchestrator:** rename your own tab `OVERSEER · <version>` and your agent `overseer`, spawn one child orchestration session with your host's launch form, label its tab `ORCH · <version>` and name its agent, give it the mission and these rules verbatim, then supervise it. Do not drive a duplicate single-tier run yourself. Before spawning, confirm any PREVIOUS orchestrator has [stood down](#stand-down-mission-end-and-retirement) and close its tab.
-  - **On herdr (`HERDR_ENV=1`)**: **spawning on current herdr is two-step** — the one-shot `agent start --cwd/--tab/--no-focus` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138). First create the pane: `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` (tab create does not steal focus unless `--focus` is passed; parse `result.root_pane.pane_id` from its JSON), then start the agent in it:
+- **Primary session without an orchestrator:** rename your own tab `OVERSEER · <label>` and your agent `overseer`, spawn one child orchestration session with your host's launch form, label its tab `ORCH · <label>` and name its agent, give it the mission and these rules verbatim, then supervise it. Do not drive a duplicate single-tier run yourself. Before spawning, confirm any PREVIOUS orchestrator has [stood down](#stand-down-mission-end-and-retirement) and close its tab.
+  - **On herdr (`HERDR_ENV=1`)**: **spawning on current herdr is two-step** — the one-shot `agent start --cwd/--tab/--no-focus` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138). First create the pane: `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <label>"` (tab create does not steal focus unless `--focus` is passed; parse `result.root_pane.pane_id` from its JSON), then start the agent in it:
     - **Claude Code:** `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions`
     - **Codex:** `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` — the unsandboxed flag is REQUIRED, not optional: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation (`git worktree add` cannot lock the ref). Do not downgrade this flag; the herdr pane and repo scope are the containment.
     - **Auxiliary seats run as the CLI's interactive TUI in their visible pane — never headless** (`claude -p` / `codex exec`): headless buffers output until exit so the pane renders idle for the entire run, is blind to SessionStart hook errors (a broken and a fixed hook both return green), and gives a stall watcher no midpoint — silent-time equals lifetime. Headless is for exit-code probes only (a quota check that wants `rc`), never for work anyone must watch.
-  - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: spawn it with `orca terminal create --worktree path:<repo> --title "ORCH · <version>" --command "<agent-cmd>" --json` and parse `result.terminal.handle` from the create receipt. **Auxiliary seats run as the CLI's interactive TUI in their visible terminal — never headless**, for the reasons the herdr branch gives.
+  - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: spawn it with `orca terminal create --worktree path:<repo> --title "ORCH · <label>" --command "<agent-cmd>" --json` and parse `result.terminal.handle` from the create receipt. **Auxiliary seats run as the CLI's interactive TUI in their visible terminal — never headless**, for the reasons the herdr branch gives.
   - **Auxiliary agents you spawn (consultants, reviewers, scouts) follow the same forms.** Never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions` (tickmarkr's own adapter uses exactly this for workers, judges, and consults). A read-only codex consultant may use `--sandbox read-only`; any codex session that must touch git needs the unsandboxed flag above.
 
 With neither herdr nor Orca there is no role to decide and no seat to spawn: follow [On a plain host (neither herdr nor Orca)](#on-a-plain-host-neither-herdr-nor-orca) and run the loop directly, single-tier.
@@ -69,11 +71,11 @@ Proceed through the loop without seeking routine confirmation. Stop only for a b
 
 ## Binary preflight (before compile or run)
 
-Before `tickmarkr compile` or `tickmarkr run`, compare the installed binary against the repository's `package.json` version:
+Before `tickmarkr compile` or `tickmarkr run`:
 
-1. Run `tickmarkr version` (one line, machine-parseable).
-2. Read the `version` field from the repository's `package.json`.
-3. If the binary and repository do not **agree on the entire version** (including the patch; e.g. binary `2.1.0` vs repo `2.1.1`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`), or to install this repository's build as a REAL COPY — `npm pack`, then `npm i -g ./<tarball>`. Do not compile, plan, or run on hope.
+1. Run `tickmarkr version --check` and **stop immediately on a non-zero exit**.
+2. In a consumer repository, it compares installed agent guidance with this binary's packaged block and skills, never the app's manifest version. Refresh drifted guidance with `tickmarkr init --agent --force`.
+3. Only in the tickmarkr source repository (`package.json` named `tickmarkr`), the check compares its version with the binary. If the binary and repository do not **agree on the entire version** (including the patch; e.g. binary `2.1.0` vs repo `2.1.1`), **stop immediately** and tell the operator to update the global install (`npm i -g tickmarkr@latest`), or to install this repository's build as a REAL COPY — `npm pack`, then `npm i -g ./<tarball>`. Do not compile, plan, or run on hope.
    > ⚠ **Never `npm i -g .` on the repository directory, and never link it.** npm SYMLINKS a directory install, which makes the working tree itself the machine-wide binary: every later build — including a gate's own `npm run build` — silently hot-swaps the CLI for every repository on the machine, with no version change to notice it by. Measured 2026-08-29: a verify build gate rewrote the shared binary while another repository's daemon was mid-run against it, and a positive control that rebuilds at a pre-fix ref would have installed the very defect it was proving fixed, machine-wide (OBS-771). Verify an install by comparing the global and repo **inodes** — they must DIFFER — never by `tickmarkr version`, which cannot go red when nothing is bumped.
 
 A stale binary silently skips daemon gates shipped in newer releases — the v1.38 run exposed this when a global `1.36.0` binary missed the daemon tip-verify gate entirely (OBS-38). Preflight failure is always stop-and-report; never proceed-and-hope.

package/skills/tickmarkr-overseer/SKILL.md

@@ -5,6 +5,8 @@ description: "Use when the user asks to oversee/supervise/babysit an autonomous
 
 # Overseer (tickmarkr)
 
+`<label>` means the version only in the tickmarkr source repository (`package.json` named `tickmarkr`); elsewhere it means the mission or run, never the installed binary version.
+
 Become the OVERSEER for this workspace or session. Do no heavy work directly — build and supervise a two-tier
 hierarchy of VISIBLE agents (you → orchestrator → tickmarkr's own worker fleet), and route human decisions
 to the user with evidence.
@@ -203,15 +205,15 @@ replaces the two-tier setup.
      **Live tab labels (standing operator rule, 2026-07-12):** on every decision or state change (role
      handoff, task done/merged, run end) rename the affected tabs — and keep labels SHORT: the role as the
      main name plus at most ONE hot-state token. Vocabulary: ORCH carries the milestone and progress
-     fraction (`ORCH · v1.19 4/5`, updated on every task-done); tickmarkr opens ONE TAB PER TASK, labelled
+     fraction (`ORCH · <label> 4/5`, updated on every task-done); tickmarkr opens ONE TAB PER TASK, labelled
      with the task id and holding that task's worker plus its judge/review/consult panes (tickmarkr
      updates it). Never long context strings or ✓-chains.
-   - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: Do not load the `herdr` skill and do not map a Herdr workspace. Work from the current Orca terminal context. Keep the overseer in the launching terminal, name it in the same act — `orca terminal rename --terminal "$ORCA_TERMINAL_HANDLE" --title "OVERSEER · <version>"` (tab title; see the seat-name law under Seat-spawn recipes) — and inspect terminals with `orca terminal list --json`. Launch the daemon detached at the orchestrator terminal's recorded handle using the detached launch below — no pane of its own; its self-placed watch board stays in the ORCH tab.
+   - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: Do not load the `herdr` skill and do not map a Herdr workspace. Work from the current Orca terminal context. Keep the overseer in the launching terminal, name it in the same act — `orca terminal rename --terminal "$ORCA_TERMINAL_HANDLE" --title "OVERSEER · <label>"` (tab title; see the seat-name law under Seat-spawn recipes) — and inspect terminals with `orca terminal list --json`. Launch the daemon detached at the orchestrator terminal's recorded handle using the detached launch below — no pane of its own; its self-placed watch board stays in the ORCH tab.
 2. **Orchestrator**: First consume a successful `tickmarkr fleet --pick consult` in the seat repository, per the Fleet selection contract below; then launch the returned adapter/model with your agent host.
-   - **On herdr (`HERDR_ENV=1`)**: Spawning on current herdr is two-step — the one-shot `agent start --cwd` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138): first create the pane with `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` and parse `result.root_pane.pane_id` from its JSON, then start the agent in it. For Claude Code, use `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions` (append `--model <picked-model>` after the `--` from the Fleet receipt). For Codex, use `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` (add `--model <picked-model>` from the Fleet receipt). The unsandboxed flag is REQUIRED: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation — do not downgrade it. Workers you never spawn — tickmarkr spawns its own visible worker panes. Auxiliary agents you do spawn (consultants, reviewers, scouts) follow the same forms: never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions --settings '{"promptSuggestionEnabled":false}'`. **For a codex consultant, use `-a never --sandbox workspace-write` — NOT `--sandbox read-only`.** ⚠ **`--sandbox read-only` CONTRADICTS this skill's own completion protocol and will hang the seat.** Every seat you spawn is told to deliver an ARTIFACT ending in a terminal MARKER, because that is the only completion signal the artifact watcher can key on (`done` is turn end). A read-only sandbox cannot write that artifact, so codex blocks on `Would you like to make the following edits?` for its OWN report — and the report exists ONLY in the pending edit, so abandoning the prompt destroys the work rather than merely delaying it. Measured 2026-08-28: a consultant spawned `--sandbox read-only` finished a 14,604-byte verdict, sat blocked on the write, and the operator saw the prompt before the supervising tier did. `read-only` is correct ONLY for a seat that writes nothing at all — which, under the artifact+marker rule, is no seat this skill tells you to spawn. When the prompt does appear, answer **"Yes, and don't ask again for these files"** rather than plain yes: plain yes re-blocks on the next write of the same file. **That `--settings` pair is not cosmetic and it is not optional:** claude-code's AUTOSUGGEST renders context-plausible ghost text into an idle seat's prompt line that is BYTE-IDENTICAL to a typed draft in text-format reads (OBS-482), so a supervising tier cannot tell a seat's own unsent work from a rendering artifact without `agent read --format ansi`. Turning the suggester off at spawn removes the ambiguity at its source instead of paying for the discrimination at every read. Verified against the shipped binary: `claude --settings '{"promptSuggestionEnabled":false}' -p …` exits 0 with a real response, and the key appears in the binary's own settings schema. **For kimi, pass `-y`** (`herdr agent start <name> --kind kimi --pane <id> -- -y`) — the adapter already launches its own workers that way (`src/adapters/kimi.ts:204`), and a kimi seat spawned without it sits on an approval prompt having done nothing. **Herdr cannot see that state**: it reports a kimi pane as `agent_status: working` with `screen_detection_skipped: true` while the prompt is up, so the BLOCKED-STATE watcher below is blind on this vendor and the spawn flag is the ONLY control. Every vendor you spawn needs its auto-approve form named here; a vendor absent from this list is a seat that will hang.
+   - **On herdr (`HERDR_ENV=1`)**: Spawning on current herdr is two-step — the one-shot `agent start --cwd` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138): first create the pane with `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <label>"` and parse `result.root_pane.pane_id` from its JSON, then start the agent in it. For Claude Code, use `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions` (append `--model <picked-model>` after the `--` from the Fleet receipt). For Codex, use `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` (add `--model <picked-model>` from the Fleet receipt). The unsandboxed flag is REQUIRED: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation — do not downgrade it. Workers you never spawn — tickmarkr spawns its own visible worker panes. Auxiliary agents you do spawn (consultants, reviewers, scouts) follow the same forms: never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions --settings '{"promptSuggestionEnabled":false}'`. **For a codex consultant, use `-a never --sandbox workspace-write` — NOT `--sandbox read-only`.** ⚠ **`--sandbox read-only` CONTRADICTS this skill's own completion protocol and will hang the seat.** Every seat you spawn is told to deliver an ARTIFACT ending in a terminal MARKER, because that is the only completion signal the artifact watcher can key on (`done` is turn end). A read-only sandbox cannot write that artifact, so codex blocks on `Would you like to make the following edits?` for its OWN report — and the report exists ONLY in the pending edit, so abandoning the prompt destroys the work rather than merely delaying it. Measured 2026-08-28: a consultant spawned `--sandbox read-only` finished a 14,604-byte verdict, sat blocked on the write, and the operator saw the prompt before the supervising tier did. `read-only` is correct ONLY for a seat that writes nothing at all — which, under the artifact+marker rule, is no seat this skill tells you to spawn. When the prompt does appear, answer **"Yes, and don't ask again for these files"** rather than plain yes: plain yes re-blocks on the next write of the same file. **That `--settings` pair is not cosmetic and it is not optional:** claude-code's AUTOSUGGEST renders context-plausible ghost text into an idle seat's prompt line that is BYTE-IDENTICAL to a typed draft in text-format reads (OBS-482), so a supervising tier cannot tell a seat's own unsent work from a rendering artifact without `agent read --format ansi`. Turning the suggester off at spawn removes the ambiguity at its source instead of paying for the discrimination at every read. Verified against the shipped binary: `claude --settings '{"promptSuggestionEnabled":false}' -p …` exits 0 with a real response, and the key appears in the binary's own settings schema. **For kimi, pass `-y`** (`herdr agent start <name> --kind kimi --pane <id> -- -y`) — the adapter already launches its own workers that way (`src/adapters/kimi.ts:204`), and a kimi seat spawned without it sits on an approval prompt having done nothing. **Herdr cannot see that state**: it reports a kimi pane as `agent_status: working` with `screen_detection_skipped: true` while the prompt is up, so the BLOCKED-STATE watcher below is blind on this vendor and the spawn flag is the ONLY control. Every vendor you spawn needs its auto-approve form named here; a vendor absent from this list is a seat that will hang.
    - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: Seats spawn with `orca terminal create` on a path worktree selector with a command:
-     `orca terminal create --worktree path:<repo> --title "ORCH · <version>" --command "<agent-cmd>" --json`
-     For Claude Code: `orca terminal create --worktree path:<repo> --title "ORCH · <version>" --command "claude --model <picked-model> --permission-mode bypassPermissions --settings '{\"promptSuggestionEnabled\":false}'" --json`. For Codex: `orca terminal create --worktree path:<repo> --title "ORCH · <version>" --command "codex --model <picked-model> --dangerously-bypass-approvals-and-sandbox" --json`. Parse `result.terminal.handle` from the create receipt.
+     `orca terminal create --worktree path:<repo> --title "ORCH · <label>" --command "<agent-cmd>" --json`
+     For Claude Code: `orca terminal create --worktree path:<repo> --title "ORCH · <label>" --command "claude --model <picked-model> --permission-mode bypassPermissions --settings '{\"promptSuggestionEnabled\":false}'" --json`. For Codex: `orca terminal create --worktree path:<repo> --title "ORCH · <label>" --command "codex --model <picked-model> --dangerously-bypass-approvals-and-sandbox" --json`. Parse `result.terminal.handle` from the create receipt.
    Require the orchestrator to use the host-owned daemon and detached-beat lifecycle below for both run and resume, and to report the lock pid ancestry check.
 3. **Standing instructions travel as a brief FILE, never as pane text** — PTY input truncates at ~1024B and a
    truncated brief silently drops policy. Write the full brief to `<repo>/.tickmarkr/overseer/ORCH-BRIEF.md`
@@ -221,7 +223,7 @@ replaces the two-tier setup.
    - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: Briefs travel as a file announced by `terminal send` with enter and a submit wait whose receipt is read for observed submission rather than input acceptance:
      `orca terminal send --terminal <handle> --text "Read .tickmarkr/overseer/ORCH-BRIEF.md and follow it exactly." --enter --wait-submit 15 --json`
      Read `result.send.prompt.stages` and treat the brief as delivered only when a `turn_started` stage is present; `accepted: true` proves input acceptance, not a started turn; never resend on `accepted` alone.
-   The brief MUST contain: the mission, the five-tab canon (on herdr) or seat layout (on Orca), the pane mechanics below, rules 1–2, the GSD-leg rules
+   The brief MUST contain: **Seat hygiene — in a multi-tier session the tiers clear each other at 50% context or more after writing a handoff; a new spec or run is a mission boundary, so hand off and clear before the next mission; copy this duty into every brief and handoff; on a single-tier plain host write your handoff and ask the operator to clear the session**, then the mission, the five-tab canon (on herdr) or seat layout (on Orca), the pane mechanics below, rules 1–2, the GSD-leg rules
    (below) whenever the mission dispatches `/gsd:*` legs, and require a verbatim one-sentence
    acknowledgment of the human-checkpoint rule before anything is dispatched.
    *method guards* in that brief (how to know a thing, not what is true of this spec), and deleting them
@@ -329,7 +331,7 @@ Kimi `-y`, artifact plus terminal marker, and verified file-brief delivery. Flee
   a `git worktree add` the overseer made for a spec branch, a throwaway clone — `terminal create` hangs and
   returns "Timed out waiting for terminal handle after creation". The lawful form for such a checkout is a
   terminal in a managed worktree with a cwd change in the command:
-  `orca terminal create --worktree path:<managed-repo> --title "ORCH · <version>" --command "cd <checkout> && <agent-cmd>" --json`.
+  `orca terminal create --worktree path:<managed-repo> --title "ORCH · <label>" --command "cd <checkout> && <agent-cmd>" --json`.
   **An Orca-hosted run's checkout is created by Orca** (`orca worktree create --repo id:<repo> --base-branch <spec-branch>`),
   never by `git worktree add`: the orca driver asks `orca worktree current` from inside every task worktree and refuses
   (`selector_not_found`) on an unmanaged checkout — every task fails pre-launch and the board cannot place (OBS-1061,
@@ -353,7 +355,7 @@ Kimi `-y`, artifact plus terminal marker, and verified file-brief delivery. Flee
   Code's turn summary, Codex's last prompt) and is NOT the seat's name. This is vendor-neutral by
   construction — no per-vendor env var, no agent command, no launch-form ritual — which is what makes
   it the same law as Herdr's tab label. So: **the overseer names its OWN seat at Setup 1** with
-  `orca terminal rename --terminal "$ORCA_TERMINAL_HANDLE" --title "OVERSEER · <version>"` (the seat
+  `orca terminal rename --terminal "$ORCA_TERMINAL_HANDLE" --title "OVERSEER · <label>"` (the seat
   it was invoked in is the one seat nobody else launches), every seat it spawns is named by
   `create --title`, and a live-label change (progress fraction, hot-state token) is `rename` again.
   **Prove a name by the field that holds:** `tabs[].title` in