tickmarkr 2.8.8 → 2.8.9

package/README.md

@@ -441,6 +441,28 @@ The daemon reconciles at every safe point:
 unavailable, a pane vanished mid-sweep) do not replace gate verdicts; unconfirmed board
 cleanup is journaled and reported.
 
+### Worktree lifecycle
+
+Queue row 240 (D-2138): at run end, every journaled task checkout is removed once its
+recovery ref is recorded, including parked and failed tasks. Clean merged checkouts
+are removed silently. Dirty work is preserved under `refs/tickmarkr/preserved/`;
+unmerged clean heads are pinned there too. The journal records the recovery ref and
+removed checkout, and resume rebuilds from that work. Task branches and refs remain.
+
+A crash or SIGTERM leaves checkouts until the next daemon start in the same checkout.
+After its lifecycle row and reconciliation, that start sweeps other runs in this
+checkout's runs directory only when their newest lifecycle row records a proven dead
+pid, regardless of how they ended. Recovery and removal rows go into the owning run's
+journal and name the sweeping run; outstanding checks and measured wall windows stay unchanged.
+Only journaled task checkouts are touched: there is no worktree directory listing or
+in-use check. Live or unrecorded pids, this run's checkouts, verification checkouts,
+hand-made directories and sibling linked checkouts remain untouched; a refused start
+sweeps nothing. `visibility.keepPanes: forever` disables both removal boundaries.
+
+Staged bytes missing from the recovery tree, preservation failures and deletion failures
+keep the checkout and journal a run-level removal failure in the current run. Cleanup
+never changes the run's outcome or adds another run end.
+
 ### Workspace trust
 
 tickmarkr creates fresh git worktrees for change isolation. That is separate from each CLI's own

package/dist/run/daemon.js

@@ -2133,6 +2133,54 @@ function endedRunIdsForReconcile(repoRoot) {
     }
     return ended;
 }
+// Queue row 240 (D-2138): ownership comes only from dispatch rows in this checkout's runs directory.
+async function removeJournaledTaskWorktrees(repo, owner, current, activeBranch) {
+    let events;
+    try {
+        events = owner.read();
+    }
+    catch {
+        return;
+    } // Queue row 240 (D-2138): unreadable ownership proves no task checkout.
+    const branch = activeBranch ?? events.find((e) => e.event === "run-start")?.data.branch;
+    if (typeof branch !== "string")
+        return;
+    await cleanupRunWorktrees(repo, branch, {
+        removeTaskIds: events.flatMap((e) => e.event === "task-dispatch" && e.taskId ? [e.taskId] : []),
+        run: owner.runId, by: current.runId,
+        producer: (task) => knownProducer(events, task),
+        append: (event, task, data) => {
+            // Queue row 240 (D-2138): the recovery handle retains its terminal task reason without reopening the decision.
+            const terminal = task && [...events].reverse().find((e) => e.taskId === task
+                && ["task-human", "task-failed", "task-done", "task-dispatch"].includes(e.event));
+            const reason = terminal && terminal.data.reason;
+            owner.append(event, task, { ...data, ...(typeof reason === "string" ? { reason } : {}) });
+        },
+        failed: (data) => current.append("worktree-removal-failed", undefined, data),
+    });
+}
+async function sweepDeadRunWorktrees(repo, current) {
+    let runs;
+    try {
+        runs = readdirSync(join(tickmarkrDir(repo), "runs"));
+    }
+    catch {
+        return;
+    }
+    for (const run of runs) {
+        if (run === current.runId)
+            continue;
+        try {
+            const owner = Journal.open(repo, run);
+            const lifecycle = [...owner.read()].reverse().find((e) => e.event === "run-start" || e.event === "run-resume");
+            const pid = lifecycle?.data.pid;
+            if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0 || isPidLive(pid))
+                continue;
+            await removeJournaledTaskWorktrees(repo, owner, current);
+        }
+        catch { /* Queue row 240 (D-2138): unreadable ownership proves nothing and never refuses a start. */ }
+    }
+}
 export async function runDaemon(repoRoot, opts = {}) {
     // OBS-1045: a daemon launched from inside a leased command (a nested runner, an operator's test
     // shell) inherits its ancestor's lease token through the environment, and every gate it ran would
@@ -3217,6 +3265,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                 // panes too. OBS-777: the one startup snapshot lets it reclaim only older runs proven ended, while
                 // every live or unknown run remains spared.
                 await reconcile();
+                if (!keepForever)
+                    await sweepDeadRunWorktrees(repoRoot, journal);
                 // v1.4 self-reference guard: a random nonce on the worker trailer AND exit marker. Displayed
                 // source/diffs (e.g. a worker editing tickmarkr's own prompt.ts/daemon.ts) can't know it, so an echoed
                 // TICKMARKR_RESULT/TICKMARKR_EXIT literal can never premature-harvest the worker. Quote-split keeps the
@@ -3553,6 +3603,64 @@ export async function runDaemon(repoRoot, opts = {}) {
                     // row is deliberately written before the later worktree-recreation row so the journal cannot
                     // describe only the commits it carried while omitting uncommitted work the removal destroyed.
                     const producerNow = () => knownProducer(journal.read(), t.id);
+                    const readTaskWork = async (taskBase, priorWt, events = journal.read()) => {
+                        if (existsSync(priorWt))
+                            return { head: await gitHead(priorWt), commits: await commitsAheadOf(taskBase, priorWt) };
+                        const taskBranch = `${branch}--${t.id}`;
+                        try {
+                            const read = async (command) => {
+                                const result = await shGit(command, repoRoot);
+                                if (result.code !== 0)
+                                    throw new Error(result.stderr || result.stdout || `git exited ${result.code}`);
+                                return result.stdout.trim();
+                            };
+                            const ahead = async (head) => (await read(`git log --reverse --format=%H ${shq(taskBase)}..${shq(head)}`)).split("\n").filter(Boolean);
+                            const ancestor = async (base, head) => {
+                                const result = await shGit(`git merge-base --is-ancestor ${shq(base)} ${shq(head)}`, repoRoot);
+                                if (result.code !== 0 && result.code !== 1)
+                                    throw new Error(result.stderr || result.stdout || `ancestry exited ${result.code}`);
+                                return result.code === 0;
+                            };
+                            const branchRef = `refs/heads/${taskBranch}`;
+                            const exists = await shGit(`git show-ref --verify --quiet ${shq(branchRef)}`, repoRoot);
+                            if (exists.code !== 0 && exists.code !== 1)
+                                throw new Error(exists.stderr || exists.stdout || `branch read exited ${exists.code}`);
+                            const tip = exists.code === 0 ? await read(`git rev-parse --verify ${shq(`${branchRef}^{commit}`)}`) : undefined;
+                            const removalAt = events.map((e) => e.event === "worktree-removed" && e.data.task === t.id).lastIndexOf(true);
+                            const removal = events[removalAt];
+                            if (removal && !events.slice(removalAt + 1).some((e) => e.event === "worktree-recreation" && e.taskId === t.id)
+                                && typeof removal.data.head === "string") {
+                                const resolved = await shGit(`git rev-parse --verify ${shq(`${removal.data.head}^{commit}`)}`, repoRoot);
+                                const head = resolved.stdout.trim();
+                                if (resolved.code === 0 && head && (!tip || await ancestor(tip, head))) {
+                                    const commits = await ahead(head);
+                                    let snapshot;
+                                    if (typeof removal.data.ref === "string") {
+                                        const pinned = await read(`git rev-parse --verify ${shq(`${removal.data.ref}^{commit}`)}`);
+                                        if (pinned !== head)
+                                            snapshot = removal.data.ref;
+                                    }
+                                    return { head, commits, snapshot, rebuiltFrom: "removal" };
+                                }
+                            }
+                            if (!tip)
+                                return { commits: [] };
+                            const commits = await ahead(tip);
+                            if (commits.length === 0)
+                                return { commits: [] };
+                            const dispatch = [...events].reverse().find((e) => e.event === "task-dispatch" && e.taskId === t.id);
+                            const base = dispatch?.data.base === undefined ? events.find((e) => e.event === "run-start")?.data.baseRef : dispatch.data.base;
+                            if (typeof base !== "string" || !await ancestor(base, tip))
+                                throw new Error("tip does not descend from its recorded dispatch base");
+                            const ref = `refs/tickmarkr/preserved/${tip}`;
+                            await read(`git update-ref ${shq(ref)} ${shq(tip)}`);
+                            journal.append("worktree-preserved", t.id, { ref, ...producerFields(producerNow()) });
+                            return { head: tip, commits, rebuiltFrom: "branch" };
+                        }
+                        catch (error) {
+                            return { commits: [], error: `Queue row 240 (D-2138): cannot rebuild task branch ${taskBranch}: ${error instanceof Error ? error.message : String(error)}` };
+                        }
+                    };
                     const recreateTaskWorktree = async (taskBranch, taskBase, priorWt) => {
                         const producer = producerNow();
                         const ref = await preserveWorktree(priorWt, producer);
@@ -4378,7 +4486,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 if (uncertain)
                                     return decline(uncertain);
                             }
-                            const commits = existsSync(wt) ? await commitsAheadOf(published, wt) : [];
+                            const work = await readTaskWork(published, wt);
+                            if (work.error) {
+                                await park(t, work.error, "infra", found.assignment, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
+                                return "parked";
+                            }
+                            const commits = work.commits;
                             if (!found.result.finished && commits.length === 0)
                                 return decline("unfinished");
                             recordHarvest(commits, found.result.finished, found.result.summary);
@@ -4435,6 +4548,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                         return found.assignment;
                     };
                     const harvestAuthor = rs && !satisfiedGate && !replayedGates && !recheck ? await harvestInterruptedAttempt() : undefined;
+                    if (harvestAuthor === "parked")
+                        return;
                     // OBS-1202: a recheck bound to a stall park that recorded a reapFailure re-verifies the parked
                     // attempt's owned census through the same reapWorker a live harvest uses, BEFORE any gate reads
                     // its tree. Only a complete, empty census releases the harvested commits to the battery; an
@@ -4487,7 +4602,12 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const preservedRef = recheck
                             ? effectiveEvents(journal.read()).reverse().find((e) => e.taskId === t.id && e.event === "task-approved" && e.data.release === RECHECK_RELEASE)?.data.recheckedRef
                             : undefined;
-                        if (!existsSync(priorWt) && !preservedRef) {
+                        const work = preservedRef ? undefined : await readTaskWork(taskBase, priorWt);
+                        if (work?.error) {
+                            await park(t, work.error, "infra", assignment, rs?.attempts ?? 0, startMs, gateFails, consults, tokens, metered, retryMode);
+                            return;
+                        }
+                        if (!work?.head && !preservedRef) {
                             if (satisfiedGate || recheck)
                                 throw new Error(`${recheck ? "recheck" : `approved gate ${satisfiedGate}`} cannot resume: task worktree is missing`);
                             // Observed passes are an optimization, never authority: without the task worktree there is no
@@ -4502,9 +4622,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 : satisfiedGate
                                     ? `approved gate ${satisfiedGate}`
                                     : `recorded gates on ${replayedGates.commit.slice(0, 10)}`;
-                        const priorTaskTip = preservedRef ? (await shGit(`git rev-parse ${shq(preservedRef)}`, repoRoot)).stdout.trim() : await gitHead(priorWt);
-                        const priorTaskSubject = await gateCommitSubject(taskBase, priorTaskTip, preservedRef ? repoRoot : priorWt);
-                        const commitsToCarry = preservedRef ? await commitsAheadOfRef(taskBase, priorTaskTip, repoRoot) : await commitsAheadOf(taskBase, priorWt);
+                        const priorTaskTip = preservedRef ? (await shGit(`git rev-parse ${shq(preservedRef)}`, repoRoot)).stdout.trim() : work.head;
+                        const priorTaskSubject = await gateCommitSubject(taskBase, priorTaskTip, preservedRef || work?.rebuiltFrom ? repoRoot : priorWt);
+                        const commitsToCarry = preservedRef ? await commitsAheadOfRef(taskBase, priorTaskTip, repoRoot) : [...work.commits];
+                        // Queue row 240 (D-2138): rechecking a dirt refusal gates the committed work as a present checkout did.
+                        // The refused bytes remain recoverable; an explicitly checked ref still selects its exact tree.
+                        const dirtRecheck = recheck && [...journal.read()].reverse()
+                            .find((e) => e.taskId === t.id && e.event === "gate-result")?.data.dirtyWorktree === true;
+                        if (work?.snapshot && !dirtRecheck)
+                            commitsToCarry.push(work.snapshot);
                         // 2.8.1 T2 (ANL-023 §7.2): a task with a recorded merge whose prior tip is PROVEN in E (`merge-base --is-ancestor`
                         // exit 0 — an empty or failed history read is no proof) keeps that tip as its gated subject — recreated on E it
                         // would be gated AT E, and a sibling's publication since its merge would hide the recorded merge. Nothing is gated
@@ -4538,6 +4664,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                             satisfiedGate = journal.replaySatisfiedGates(new Map([[t.id, currentTaskSubject]])).get(t.id);
                         }
                         journal.append("worktree-recreation", t.id, {
+                            ...(work?.rebuiltFrom ? { rebuiltFrom: work.rebuiltFrom } : {}),
                             attempted: commitsToCarry, carried: carriedCommits, ...(accountedCommits.length > 0 ? { accounted: accountedCommits } : {}),
                         });
                         // OBS-212: same fail-closed rule as the dispatch path — but this path is worse, because it runs
@@ -5096,6 +5223,15 @@ export async function runDaemon(repoRoot, opts = {}) {
                             });
                         }
                         lastContextTokens = undefined;
+                        const taskBase = published; // deps are merged → visible to this task (E, never the ref as it stands)
+                        const taskBranch = `${branch}--${t.id}`;
+                        const priorWt = worktreePath(repoRoot, taskBranch);
+                        const recreating = existsSync(priorWt);
+                        const work = await readTaskWork(taskBase, priorWt, journaledSoFar);
+                        if (work.error) {
+                            await park(t, work.error, "infra", assignment, attempt, startMs, gateFails, consults, tokens, metered, retryMode);
+                            return;
+                        }
                         graph = setStatus(graph, t.id, "running");
                         saveGraph(repoRoot, graph);
                         await trackedDriver.project?.(t.id, "in-progress");
@@ -5106,6 +5242,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const workerDispatchOrdinal = nextWorkerDispatchOrdinal++;
                         vendorEscalated.delete(channelKey(assignment)); // dispatched now: from here on it IS tried
                         journal.append("task-dispatch", t.id, {
+                            base: taskBase,
                             ...(scopeApproval?.data.release === "scope-request" ? { files: t.files, graphDefinitionHash: graphDefinitionHash(graph) } : {}),
                             assignment, attempt, workerDispatchOrdinal, provenance: dispatchProvenance([
                                 channelKey(assignment) === channelKey(r.assignment) ? r.provenance
@@ -5123,15 +5260,17 @@ export async function runDaemon(repoRoot, opts = {}) {
                             ...(carriedConsultGuidance ? { carriedConsultGuidance } : {}),
                         });
                         journal.phaseStart(t.id, "worker", { attempt, assignment });
-                        const taskBase = published; // deps are merged → visible to this task (E, never the ref as it stands)
                         taskBases.set(t.id, taskBase);
-                        const taskBranch = `${branch}--${t.id}`; // "--": a ref can't nest under the existing integration branch (locked decision 10)
-                        const priorWt = worktreePath(repoRoot, taskBranch);
-                        const recreating = existsSync(priorWt);
-                        // Carry the interrupted worker's snapshot, never incidental files created by later gates.
-                        const preserved = recreating ? reapedWorktreeRef : undefined;
+                        // Queue row 240 (D-2138): read a missing checkout like a present one: its recorded removal first,
+                        // with its preserved snapshot carried as a reaped worker's is; else a task branch proven by its
+                        // journaled dispatch base or the run-start base; else nothing. Never reset a branch holding commits unproven.
+                        // Queue row 240 (D-2138): like recheck, a dispatch after a dirt refusal carries committed work only;
+                        // the refused bytes remain recoverable from their ref, as when the prior checkout was present.
+                        const dirtRefusal = [...journaledSoFar].reverse()
+                            .find((e) => e.taskId === t.id && (e.event === "gate-result" || e.event === "task-dispatch"))?.data.dirtyWorktree === true;
+                        const preserved = recreating ? reapedWorktreeRef : dirtRefusal ? undefined : work.snapshot;
                         reapedWorktreeRef = undefined;
-                        const commitsToCarry = recreating ? await commitsAheadOf(taskBase, priorWt) : [];
+                        const commitsToCarry = [...work.commits];
                         if (preserved)
                             commitsToCarry.push(preserved);
                         const wt = await recreateTaskWorktree(taskBranch, taskBase, priorWt);
@@ -5140,8 +5279,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // orphan work a consult already verified as landed.
                         const { carried: carriedCommits, accounted: accountedCommits } = commitsToCarry.length > 0
                             ? await cherryPickCommits(wt, commitsToCarry) : { carried: [], accounted: [] };
-                        if (recreating) {
+                        if (recreating || work.rebuiltFrom) {
                             journal.append("worktree-recreation", t.id, {
+                                ...(work.rebuiltFrom ? { rebuiltFrom: work.rebuiltFrom } : {}),
                                 attempted: commitsToCarry, carried: carriedCommits, ...(accountedCommits.length > 0 ? { accounted: accountedCommits } : {}),
                             });
                         }
@@ -7564,9 +7704,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                     }
                     journal.append("run-end", undefined, { ...summary });
                     await reconcile(); // run-end boundary: nothing in flight — full sweep (empty desired set)
-                    // OBS-28: lingering worktrees starve CLI probes; keepPanes:forever is the debug override.
+                    // Queue row 240 (D-2138): every task checkout of this run is removed once its recovery ref is recorded,
+                    // unless keepPanes is forever. A dead run's leftovers go at the next daemon start in the same checkout.
+                    // Only journaled task checkouts are touched; no directory listing or in-use check exists.
                     if (!keepForever)
-                        await cleanupRunWorktrees(repoRoot, branch, { removeTaskIds: summary.done });
+                        await removeJournaledTaskWorktrees(repoRoot, journal, journal, branch);
                     // VIS-02: name each blocked subtree by its nearest parked/failed root, e.g. "3 blocked behind P40-02".
                     const attribution = [...attributeBlocked(graph).entries()]
                         .sort(([a], [b]) => a.localeCompare(b))

package/dist/run/git.d.ts

@@ -234,11 +234,16 @@ export declare const sanitizeBranch: (branch: string) => string;
 export declare const WORKTREES_DIR = "worktrees.noindex";
 export declare const worktreePath: (repo: string, branch: string) => string;
 /**
- * OBS-28: remove this run's recorded task worktrees; tolerates already-gone paths. 2.8.1 T2: a run keeps no
- * integration checkout, and a 2.8.0 run's legacy one is never removed here (it may hold the only view of a merge).
+ * Queue row 240 (D-2138): remove only journaled task checkouts, after preserving their recovery tree.
+ * There is no in-use check. Branches and recovery refs remain; a failed operation keeps the checkout.
  */
 export declare function cleanupRunWorktrees(repo: string, branch: string, opts: {
     removeTaskIds: string[];
+    run: string;
+    by: string;
+    producer: (task: string) => PreserveProducer;
+    append: (event: string, task: string | undefined, data: Record<string, unknown>) => void;
+    failed: (data: Record<string, unknown>) => void;
 }): Promise<void>;
 export declare function resolveIntegrationBranch(_repo: string, branch: string): Promise<string>;
 /**

package/dist/run/git.js

@@ -817,12 +817,45 @@ const sanitize = sanitizeBranch;
 export const WORKTREES_DIR = "worktrees.noindex";
 export const worktreePath = (repo, branch) => join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));
 /**
- * OBS-28: remove this run's recorded task worktrees; tolerates already-gone paths. 2.8.1 T2: a run keeps no
- * integration checkout, and a 2.8.0 run's legacy one is never removed here (it may hold the only view of a merge).
+ * Queue row 240 (D-2138): remove only journaled task checkouts, after preserving their recovery tree.
+ * There is no in-use check. Branches and recovery refs remain; a failed operation keeps the checkout.
  */
 export async function cleanupRunWorktrees(repo, branch, opts) {
-    for (const id of opts.removeTaskIds)
-        await removeWorktree(repo, worktreePath(repo, `${branch}--${id}`));
+    for (const task of new Set(opts.removeTaskIds)) {
+        const dir = worktreePath(repo, `${branch}--${task}`);
+        if (!existsSync(dir))
+            continue;
+        try {
+            const head = await gitHead(dir);
+            const producer = opts.producer(task);
+            let ref = await preserveWorktree(dir, producer);
+            if (!ref) {
+                const merged = await shGit(`git merge-base --is-ancestor ${shq(head)} ${shq(`refs/heads/${branch}`)}`, repo);
+                if (merged.code !== 0 && merged.code !== 1)
+                    throw new Error(merged.stderr || merged.stdout || "ancestry comparison failed");
+                if (merged.code === 1) {
+                    ref = `refs/tickmarkr/preserved/${head}`;
+                    await shGitOk(`git update-ref ${shq(ref)} ${shq(head)}`, repo);
+                }
+            }
+            // Queue row 240 (D-2138 add.4): a disposable preservation index never sees staged-only bytes.
+            const staged = await shGit(`git diff-index --cached --name-only --diff-filter=ACMRT -z ${shq(ref ?? head)} --`, dir);
+            if (staged.code !== 0 || staged.stdout.length)
+                throw new Error(staged.stderr || "staged bytes are absent from the recovery tree");
+            if (ref)
+                opts.append("worktree-preserved", task, { ref, ...producerFields(producer), by: opts.by });
+            if (ref)
+                opts.append("worktree-removed", undefined, { task, dir, head, ref, by: opts.by });
+            // Queue row 240 (D-2138): unlike rollback, a refused deletion must never fall through to rm -rf.
+            await withWorktreeAdmin(() => shGitOk(`git worktree remove --force ${shq(dir)}`, repo));
+        }
+        catch (error) {
+            try {
+                opts.failed({ run: opts.run, task, dir, error: error instanceof Error ? error.message : String(error) });
+            }
+            catch { /* Queue row 240 (D-2138): cleanup never replaces the run's outcome, even with an unwritable journal. */ }
+        }
+    }
 }
 export async function resolveIntegrationBranch(_repo, branch) {
     return branch;

package/dist/run/wall-budget.js

@@ -21,8 +21,9 @@ const bucketOf = (gate) => gate === "test" ? "test" : gate === "acceptance" || g
 // Rows another process writes around a restart — the operator's approval, the resuming daemon's
 // reclaim and rehash audit — so the prior engagement's own last row is the one before them.
 // ponytail: a closed list; a new out-of-engagement writer lengthens the interruption it precedes.
-const OUTSIDE_ENGAGEMENT = new Set(["task-approved", "graph-rehash", "lock-reclaimed", "superseded"]);
-const outsideEngagement = (e) => OUTSIDE_ENGAGEMENT.has(e.event) || (e.event === "exit-cause" && e.data.cause === "unclean");
+const OUTSIDE_ENGAGEMENT = new Set(["task-approved", "graph-rehash", "lock-reclaimed", "superseded", "worktree-removed", "worktree-removal-failed"]);
+const outsideEngagement = (e) => OUTSIDE_ENGAGEMENT.has(e.event) || (e.event === "worktree-preserved" && e.data.by !== undefined)
+    || (e.event === "exit-cause" && e.data.cause === "unclean");
 const WORKER_END = new Set(["worker-result", "worker-dead", "worker-hard-timeout"]);
 const invocationOf = (data) => {
     if (typeof data.nonce === "string")
@@ -39,8 +40,11 @@ export function wallBudget(events) {
     const lastEnd = lastOf("run-end");
     const lastResume = lastOf("run-resume");
     const from = at(events[first]);
-    // A closed engagement ends at its run-end; an open or crashed one at its newest row.
-    const to = at(events[lastEnd > lastResume ? lastEnd : events.length - 1]);
+    // Queue row 240 (D-2138): cleanup by another daemon cannot lengthen an open or crashed engagement.
+    let newestInside = events.length - 1;
+    while (newestInside > first && outsideEngagement(events[newestInside]))
+        newestInside--;
+    const to = at(events[lastEnd > lastResume ? lastEnd : newestInside]);
     if (!Number.isFinite(from) || !Number.isFinite(to) || to < from)
         return undefined;
     const spans = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.8.8",
+  "version": "2.8.9",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-auto/SKILL.md

@@ -26,7 +26,7 @@ When working in a multi-agent terminal environment (herdr or Orca), decide your
 
 - **Orchestrator:** your session was started to execute the mission. Rename your own tab/pane `ORCH · <label>` (short labels: ≤20 chars, `ROLE · token`) and run the loop below.
 - **Supervisor with a live orchestrator:** do not start a second run. Relay the mission to the existing orchestrator with a [verified handoff](#verified-handoffs-agent-to-agent-messaging), then supervise it as OVERSEER.
-- **Primary session without an orchestrator:** rename your own tab `OVERSEER · <label>` and your agent `overseer`, spawn one child orchestration session with your host's launch form, label its tab `ORCH · <label>` and name its agent, give it the mission and these rules verbatim, then supervise it. Do not drive a duplicate single-tier run yourself. Before spawning, confirm any PREVIOUS orchestrator has stood down (monitors stopped, input box empty — dim ghost-text suggestions are UI, not queued input; ANSI-verify before alarming) and close its tab — the journal, records, and ledger hold the story; scrollback is disposable.
+- **Primary session without an orchestrator:** rename your own tab `OVERSEER · <label>` and your agent `overseer`, spawn one child orchestration session with your host's launch form, label its tab `ORCH · <label>` and name its agent, give it the mission and these rules verbatim, then supervise it. Do not drive a duplicate single-tier run yourself. Before spawning, retire any PREVIOUS orchestrator through [mission-end teardown](#mission-end-teardown-queue-row-240-d-2138-add1-r3-add4).
   - **On herdr (`HERDR_ENV=1`)**: **spawning on current herdr is two-step** — the one-shot `agent start --cwd/--tab/--no-focus` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138). First create the pane: `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <label>"` (tab create does not steal focus unless `--focus` is passed; parse `result.root_pane.pane_id` from its JSON), then start the agent in it:
     - **Claude Code:** `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions`
     - **Codex:** `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` — the unsandboxed flag is REQUIRED, not optional: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation (`git worktree add` cannot lock the ref). Do not downgrade this flag; the herdr pane and repo scope are the containment.
@@ -69,7 +69,62 @@ agent session that owns no panes (queue row 192; D-2102). The role check above d
 
 ## Stand-down (mission end and retirement)
 
-On each mission's terminal state, after the record commit and operator notification: the orchestrator stops every monitor and background task it started, sweeps the heartbeat/beat files its watchers wrote (a stale beat beside a live one reads as coverage to whoever globs the directory), prints one final stand-down line, and leaves nothing queued in its input box. A finished session with an armed watcher or pre-filled input is a loaded gun.
+At each terminal state (green, failed, or parked), finish the execution record beside the source spec.
+The ORCH's artifact is this execution record. Append its named terminal marker BEFORE the record commit
+(queue row 240; D-2138 add.1 R3): `printf '\n<!-- tickmarkr:orch-end %s -->\n' "<runId>" >> "<execution-record>"`.
+Verify the final line is `<!-- tickmarkr:orch-end <runId> -->`, then commit that record when tracked
+and notify the operator. Stop every monitor and background task you started, sweep your watcher
+heartbeat/beat files, print a final stand-down line, and leave nothing queued in your input box.
+After that stand-down, write `pids/<seat>.stood-down` with `mission=<mission>` as the brief requires.
+The supervisor reads back the stand-down and exactly that execution record's end marker, then closes
+the retired ORCH at its recorded address using the host's exact command and ownership proof below;
+a plain host has no spawned terminal to close. Ghost-text suggestions are UI, not queued input.
+
+## Mission-end teardown (queue row 240; D-2138 add.1 R3, add.4)
+
+**The spawner closes the seat it created.** Manual closes and watcher closes follow this same law:
+close only once its artifact and terminal marker are on disk, its stand-down is read back, and no
+next mission is named for it. An agent's `done` signal, a bare handle, or a title alone is never enough.
+The ORCH's artifact is the execution record ending in `<!-- tickmarkr:orch-end <runId> -->`;
+the supervisor reads exactly that record and that run's marker before retiring the orchestrator.
+Keep a reused seat only with its next mission named and a `/clear` at the mission boundary.
+Keep the latest settled consult round only while the mission continues; at mission end apply this
+same close or reuse rule. A dedicated consultant tab may outlive the orchestrator tab during that
+continuing mission, never indefinitely after the mission ends.
+
+**Record ownership at spawn**, beside watcher pids under `<state-dir>/overseer/pids/<seat>.handle`:
+write `host`, `address`, `title`, `checkout`, and `mission`, one `key=value` per line, from the create
+receipt; use the actual tab title and checkout. This is the spawn ledger, not a list reconstructed
+from titles. Record an owned tab as `tab=<tab-id>` when the seat owns it. Every spawned seat's brief
+ends with: after stand-down, write `pids/<seat>.stood-down` containing `mission=<mission>`.
+On every new assignment, including named-next-mission reuse, rewrite the ledger's `mission` and
+delete the old stood-down file BEFORE that mission starts (D-2138 add.6 V01). Read back the stood-down
+file and require its mission to equal the ledger's current mission; an earlier mission's stand-down
+never retires the reused seat.
+
+**Before every close, first match the spawn record against the live tab title and checkout**, at its
+recorded address. A mismatch closes nothing. Never close a tab you did not create, a recycled handle
+now showing an operator's terminal, a seat matched by title alone, or your own launching terminal.
+A stale or mismatched Orca handle permits read-only re-resolution by title and checkout to read the
+seat; never close the replacement by title, never rewrite ownership from a title-only match.
+
+- **On herdr (`HERDR_ENV=1`)**: verify `herdr pane list`: the recorded address equals `pane_id`,
+  the recorded title equals `label`, and the recorded checkout equals `cwd` (filesystem identity).
+  Only then use `herdr pane close <pane>` at the recorded address. Prove the pane absent from
+  `herdr pane list`; for a seat owning its tab, use `herdr tab close <tab>` at its recorded tab id
+  after the final owned pane closes, and prove the tab absent from `herdr tab list`. A shared tab
+  with a pending sibling stays open. Never assume emptied tabs disappear without checking.
+- **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: verify ownership with
+  `orca terminal list --include-visual-layouts --json`: the spawn record's address is the leaf handle,
+  its title is the live TAB title (never the shell's pane title), and its checkout matches the layout
+  worktree and terminal row. An unbound checkout or truncated listing is unverifiable and closes nothing.
+  Only then use `orca terminal close --terminal <handle> --json` with the recorded handle. Require
+  `result.close.handle` equal to that handle, or the documented live-terminal refusal
+  `ok:false`, `error.code:runtime_error`, `error.message:tab_not_found` from that same runtime.
+  Prove the handle absent from `orca terminal list --json` AND its owned tab absent from
+  `orca terminal list --include-visual-layouts --json` after its final terminal closes, in the same
+  runtime as the pre-close listing. A surviving owned tab is a spec question, never permission to
+  close by title. The Orca smoke e2e asserts this tab leg; a receipt alone is no close proof.
 
 ## Invariants
 
@@ -132,7 +187,7 @@ Never report "briefed" or "relayed" without the confirmation your host gives:
    - **On herdr (`HERDR_ENV=1`)**: the consumer is the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800`, which grades the run-end summary's execution clauses for you, `EXECUTION COMPLETE` or `NOT GREEN`, never green — or a foreground `until grep` on the run's terminal events; ensure it is re-armed at most every twenty minutes.
    - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: the consumer is that same shipped journal watcher or a foreground `until grep` on the run's terminal events; ensure it is re-armed at most every twenty minutes.
 5. **Verify and consolidate** — continue only after a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty, and CURRENT `tickmarkr status <runId>` reads its owed checks outstanding empty AND known (`outstanding 0`) — a run with a parked task is partial, not green. Empty execution buckets alone are not green either (D-660): every bucket empty and the tip passed, but an operator waived one review, leaves one accepted-risk review check owed — status reads `outstanding 1 (T7 review)` and `run`/`resume` still exit 0 on execution alone, so the run is execution complete, not green. It turns green only when a `tickmarkr verify --record <runId>` discharge moves CURRENT status to `outstanding 0`, including a discharge landing after run-end — the historical run-end record keeps the old count, so never read debt from it; `outstanding unknown` is never green. Tickmarkr consolidates accepted work on `tickmarkr/<runId>` and never signs off to the main branch. A human controls any later release merge.
-6. **Record** — `tickmarkr report <runId> --md` prints Markdown to stdout; redirect explicitly beside the spec (for example `tickmarkr report <runId> --md > feature.record.md`) and commit the execution record when the repository tracks those records.
+6. **Record** — `tickmarkr report <runId> --md` prints Markdown to stdout; redirect explicitly beside the spec (for example `tickmarkr report <runId> --md > feature.record.md`) then follow [stand-down](#stand-down-mission-end-and-retirement) to append the ORCH end marker before committing the execution record when tracked.
 7. **Continue** — move to the next requested target. If a target fails or is parked, stop with the journal evidence rather than silently skipping it.
 
 ## Host-owned daemon and detached beats

package/skills/tickmarkr-loop/SKILL.md

@@ -15,7 +15,7 @@ When working in a multi-agent terminal environment (herdr or Orca), decide your
 
 - **Orchestrator:** your session was started to execute the mission. Rename your own tab/pane `ORCH · <label>` (short labels: ≤20 chars, `ROLE · token`) and run the loop below.
 - **Supervisor with a live orchestrator:** do not start a second run. Relay the mission to the existing orchestrator with a [verified handoff](#verified-handoffs-agent-to-agent-messaging), then supervise it as OVERSEER.
-- **Primary session without an orchestrator:** rename your own tab `OVERSEER · <label>` and your agent `overseer`, spawn one child orchestration session with your host's launch form, label its tab `ORCH · <label>` and name its agent, give it the mission and these rules verbatim, then supervise it. Do not drive a duplicate single-tier run yourself. Before spawning, confirm any PREVIOUS orchestrator has [stood down](#stand-down-mission-end-and-retirement) and close its tab.
+- **Primary session without an orchestrator:** rename your own tab `OVERSEER · <label>` and your agent `overseer`, spawn one child orchestration session with your host's launch form, label its tab `ORCH · <label>` and name its agent, give it the mission and these rules verbatim, then supervise it. Do not drive a duplicate single-tier run yourself. Before spawning, retire any PREVIOUS orchestrator through [mission-end teardown](#mission-end-teardown-queue-row-240-d-2138-add1-r3-add4).
   - **On herdr (`HERDR_ENV=1`)**: **spawning on current herdr is two-step** — the one-shot `agent start --cwd/--tab/--no-focus` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138). First create the pane: `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <label>"` (tab create does not steal focus unless `--focus` is passed; parse `result.root_pane.pane_id` from its JSON), then start the agent in it:
     - **Claude Code:** `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions`
     - **Codex:** `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` — the unsandboxed flag is REQUIRED, not optional: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation (`git worktree add` cannot lock the ref). Do not downgrade this flag; the herdr pane and repo scope are the containment.
@@ -111,12 +111,66 @@ Never report "briefed" or "relayed" without the confirmation your host gives:
 
 ## Dedicated consultant tab rule
 
-When spawning consultants (agents gathering synthesis input for decisions like SCOPER analysis or architectural reviews), create them in a DEDICATED tab separate from the ORCHESTRATOR tab. This ensures that when the orchestrator stands down, the consultant panes persist and their assessments remain available for review and reference.
+When spawning consultants (agents gathering synthesis input for decisions like SCOPER analysis or architectural reviews), create them in a DEDICATED tab separate from the ORCHESTRATOR tab. The dedicated consultant tab persists beyond an orchestrator retirement only while the mission continues; keep the latest settled round during that mission, then apply mission-end teardown to close or reuse it (queue row 240; D-2138 add.1 R3).
 
 ## Stand-down (mission end and retirement)
 
-- **Orchestrator, on terminal state** (green, failed, or parked), after the record commit and operator notification: stop every monitor and background task you started, sweep the heartbeat/beat files your watchers wrote (a stale beat beside a live one reads as coverage to whoever globs the directory), print one final stand-down line, and leave NOTHING queued in your input box. A finished session with an armed watcher or pre-filled input is a loaded gun — a retired v1.40 orchestrator sat idle with "merge … tag, publish" unsent in its input; one stray Enter would have shipped a duplicate release.
-- **Supervisor, when a mission completes** (and always before spawning the next orchestrator): verify the orchestrator stood down, then close its tab. Seeming input-box text in a retired pane can be the TUI's dim ghost-text suggestion, not queued input — confirm with an ANSI read (dim escape around the text) or type-one-char-and-read-back before treating it as the loaded gun; close the tab either way. The journal, execution record, OBS ledger, and memory hold the story; pane scrollback is disposable. Never leave a retired agent idle with watchers armed.
+At each terminal state (green, failed, or parked), finish the execution record beside the source spec.
+The ORCH's artifact is this execution record. Append its named terminal marker BEFORE the record commit
+(queue row 240; D-2138 add.1 R3): `printf '\n<!-- tickmarkr:orch-end %s -->\n' "<runId>" >> "<execution-record>"`.
+Verify the final line is `<!-- tickmarkr:orch-end <runId> -->`, then commit that record when tracked
+and notify the operator. Stop every monitor and background task you started, sweep your watcher
+heartbeat/beat files, print a final stand-down line, and leave nothing queued in your input box.
+After that stand-down, write `pids/<seat>.stood-down` with `mission=<mission>` as the brief requires.
+The supervisor reads back the stand-down and exactly that execution record's end marker, then closes
+the retired ORCH at its recorded address using the host's exact command and ownership proof below;
+a plain host has no spawned terminal to close. Ghost-text suggestions are UI, not queued input.
+
+## Mission-end teardown (queue row 240; D-2138 add.1 R3, add.4)
+
+**The spawner closes the seat it created.** Manual closes and watcher closes follow this same law:
+close only once its artifact and terminal marker are on disk, its stand-down is read back, and no
+next mission is named for it. An agent's `done` signal, a bare handle, or a title alone is never enough.
+The ORCH's artifact is the execution record ending in `<!-- tickmarkr:orch-end <runId> -->`;
+the supervisor reads exactly that record and that run's marker before retiring the orchestrator.
+Keep a reused seat only with its next mission named and a `/clear` at the mission boundary.
+Keep the latest settled consult round only while the mission continues; at mission end apply this
+same close or reuse rule. A dedicated consultant tab may outlive the orchestrator tab during that
+continuing mission, never indefinitely after the mission ends.
+
+**Record ownership at spawn**, beside watcher pids under `<state-dir>/overseer/pids/<seat>.handle`:
+write `host`, `address`, `title`, `checkout`, and `mission`, one `key=value` per line, from the create
+receipt; use the actual tab title and checkout. This is the spawn ledger, not a list reconstructed
+from titles. Record an owned tab as `tab=<tab-id>` when the seat owns it. Every spawned seat's brief
+ends with: after stand-down, write `pids/<seat>.stood-down` containing `mission=<mission>`.
+On every new assignment, including named-next-mission reuse, rewrite the ledger's `mission` and
+delete the old stood-down file BEFORE that mission starts (D-2138 add.6 V01). Read back the stood-down
+file and require its mission to equal the ledger's current mission; an earlier mission's stand-down
+never retires the reused seat.
+
+**Before every close, first match the spawn record against the live tab title and checkout**, at its
+recorded address. A mismatch closes nothing. Never close a tab you did not create, a recycled handle
+now showing an operator's terminal, a seat matched by title alone, or your own launching terminal.
+A stale or mismatched Orca handle permits read-only re-resolution by title and checkout to read the
+seat; never close the replacement by title, never rewrite ownership from a title-only match.
+
+- **On herdr (`HERDR_ENV=1`)**: verify `herdr pane list`: the recorded address equals `pane_id`,
+  the recorded title equals `label`, and the recorded checkout equals `cwd` (filesystem identity).
+  Only then use `herdr pane close <pane>` at the recorded address. Prove the pane absent from
+  `herdr pane list`; for a seat owning its tab, use `herdr tab close <tab>` at its recorded tab id
+  after the final owned pane closes, and prove the tab absent from `herdr tab list`. A shared tab
+  with a pending sibling stays open. Never assume emptied tabs disappear without checking.
+- **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: verify ownership with
+  `orca terminal list --include-visual-layouts --json`: the spawn record's address is the leaf handle,
+  its title is the live TAB title (never the shell's pane title), and its checkout matches the layout
+  worktree and terminal row. An unbound checkout or truncated listing is unverifiable and closes nothing.
+  Only then use `orca terminal close --terminal <handle> --json` with the recorded handle. Require
+  `result.close.handle` equal to that handle, or the documented live-terminal refusal
+  `ok:false`, `error.code:runtime_error`, `error.message:tab_not_found` from that same runtime.
+  Prove the handle absent from `orca terminal list --json` AND its owned tab absent from
+  `orca terminal list --include-visual-layouts --json` after its final terminal closes, in the same
+  runtime as the pre-close listing. A surviving owned tab is a spec question, never permission to
+  close by title. The Orca smoke e2e asserts this tab leg; a receipt alone is no close proof.
 
 ## The loop
 
@@ -127,7 +181,7 @@ When spawning consultants (agents gathering synthesis input for decisions like S
    - **On herdr (`HERDR_ENV=1`)**: the consumer is the shipped watcher — `.claude/skills/tickmarkr-overseer/scripts/watch-journal.sh <state-dir>/runs 20 28800`, which grades the run-end summary's execution clauses for you, `EXECUTION COMPLETE` or `NOT GREEN`, never green — or a foreground `until grep` on the run's terminal events; ensure it is re-armed at most every twenty minutes.
    - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: the consumer is that same shipped journal watcher or a foreground `until grep` on the run's terminal events; ensure it is re-armed at most every twenty minutes.
 5. **Verify and consolidate** — accept only a green run. A run is green when the run-end event exists in the journal, the tip verify is not "failed", the summary's `failed`, `human`, `blocked` and `pending` buckets are all empty, and CURRENT `tickmarkr status <runId>` reads its owed checks outstanding empty AND known (`outstanding 0`) — a run with a parked task is partial, not green. Empty execution buckets alone are not green either (D-660): every bucket empty and the tip passed, but an operator waived one review, leaves one accepted-risk review check owed — status reads `outstanding 1 (T7 review)` and `run`/`resume` still exit 0 on execution alone, so the run is execution complete, not green. It turns green only when a `tickmarkr verify --record <runId>` discharge moves CURRENT status to `outstanding 0`, including a discharge landing after run-end — the historical run-end record keeps the old count, so never read debt from it; `outstanding unknown` is never green. Tickmarkr consolidates accepted task work on `tickmarkr/<runId>`; it never signs off to the main branch. A human may later merge that integration branch through the repository's normal release process.
-6. **Record** — `tickmarkr report <runId> --md` prints Markdown to stdout. Redirect it explicitly beside the source spec (for example `tickmarkr report <runId> --md > feature.record.md`) and commit the execution record when the repository tracks those records. Then [stand down](#stand-down-mission-end-and-retirement).
+6. **Record** — `tickmarkr report <runId> --md` prints Markdown to stdout. Redirect it explicitly beside the source spec (for example `tickmarkr report <runId> --md > feature.record.md`) then follow [stand-down](#stand-down-mission-end-and-retirement) to append the ORCH end marker before committing the execution record when tracked.
 
 ## Host-owned daemon and detached beats
 

package/skills/tickmarkr-overseer/SKILL.md

@@ -71,6 +71,53 @@ the answer took session-file archaeology). The flip from the engine (P89, journa
 GSD legs (P92) had been RULED NOWHERE — no ledger entry decides it — and then propagated for six phases
 through brief lineage. **An executor choice nobody made is still an executor choice, and it compounds.**
 
+## Hand-made checkout law (queue row 240; D-2138 add.1 R4, add.4; gap G7)
+
+This one law applies on herdr, on Orca and on a plain host, to EVERY hand-made checkout:
+integration snapshots, SCOPER, REF, oracle and any other manually created worktree. `<repo>` is the
+repository's primary root, never a task checkout. Its seats-directory home is `<repo>-seats/<name>`,
+a sibling of the repository root; on Orca an Orca-managed worktree is also allowed. Never create one
+inside `.tickmarkr/worktrees.noindex`, or under `/private/tmp` (including the `/tmp` alias): a reboot
+wipes that temporary root. Product-journaled task checkouts, Orca-managed run checkouts and throwaway
+clones retain their existing lifecycle; this is the creating seat's duty, never a product cleanup sweep.
+
+**Creation and ledger.** Before creation, make the seats directory and `<repo>/.tickmarkr/overseer/`
+if absent. Immediately after each successful creation, before using the checkout, append one line to
+`<repo>/.tickmarkr/overseer/checkouts.ledger` (the repository's `.tickmarkr/overseer/checkouts.ledger`):
+
+```text
+path=<repo>-seats/<name> | purpose=<snapshot/scoper/REF/oracle/...> | owner=<seat> | remove-when=mission <mission> ends | keep=none | state=open
+```
+
+For an Orca-managed checkout, record its actual path instead. Use a stable owner seat identity even on
+a plain host; a successor never silently adopts another seat's lines. Each refresh closes the old
+checkout's line and appends a new line for the newly created checkout. A keep reason is recorded as
+`keep=<reason>; owner=<seat>; until=<condition>`, never inferred from a directory's name.
+
+**Mission-end removal, per owned ledger line.** At mission end (green, failed or parked), after users
+of the checkout have stood down, read only open lines whose `owner` is THIS seat. Use each line's exact
+`path`: an unledgered checkout or another seat's checkout is untouched. Never discover removal targets
+by directory glob, directory sweep or worktree-list inventory. For each owned line:
+
+1. Run `git -C <dir> status --porcelain` at that exact ledger path; require successful exit and capture
+   the entire output. Nonempty means **dirty → kept**: record `state=kept` and report its status and path.
+2. A recorded keep reason means **kept**, even if clean: record `state=kept`, the reason, owner seat and
+   condition for eventual removal, and report them. A dirty checkout with a keep reason records both.
+3. Only a clean checkout with no keep reason can proceed. Before ANY such removal (including a snapshot
+   refresh), determine whether HEAD is detached with `git -C <dir> symbolic-ref -q HEAD` (exit 1 means
+   detached). Resolve its exact head with `git -C <dir> rev-parse --verify HEAD`. For a detached head,
+   prove it reachable from a retained named ref using
+   `git -C <repo> for-each-ref --contains <sha> --format='%(refname)'`. Record the retained ref on the
+   ledger line and retain it after removal; HEAD and a reflog are not named refs. A successful query
+   with no retained named ref means **pin first**: run
+   `git -C <repo> update-ref refs/tickmarkr/preserved/<sha> <sha>`, verify that ref resolves to `<sha>`,
+   and write `preserved=refs/tickmarkr/preserved/<sha>` on THIS checkout's ledger line BEFORE removal.
+   Keep that recovery ref after removal. A failed status, HEAD/ref query, pin or ledger write means
+   kept and reported, never permission to continue.
+4. Then use `git worktree remove <dir>` from `<repo>`, **without force, never `--force` or `-f`**.
+   Only successful removal closes that ledger line (`state=closed`); a refusal leaves it open/kept
+   and is reported. Never delete the directory directly or override a dirty/locked refusal.
+
 ## On a plain host (neither herdr nor Orca)
 
 Neither `HERDR_ENV=1` nor the Orca markers are set: the Claude Desktop Code tab, a plain terminal, any
@@ -197,7 +244,8 @@ replaces the two-tier setup.
        (own tab, or a shared WORKERS tab), never the ORCH tab.
      - `CONSULT · <topic>` — ONE shared tab for ALL consultants of a round, side-by-side splits; never one
        tab per consultant; do NOT auto-close after adjudication (operator, 2026-08-09 — keep the round's
-       panes until the thread is confirmed finished or a successor round supersedes them).
+       panes while the mission continues or until a successor round supersedes them; at mission end apply
+       mission-end teardown, queue row 240; D-2138 add.1 R3).
      - `REVIEW <task>` — reviewer panes.
      Never multiply beyond these without asking. **Tabs you did not create are the OPERATOR'S — provenance
      decides: never close, rename, reuse, or send input to one, however idle it looks.** An "idle
@@ -249,8 +297,8 @@ replaces the two-tier setup.
   **Handles do not survive an Orca restart (OBS-1050, three gates lost to it in v2.5.6).** The restart
   re-issues every terminal handle; a recorded one answers `terminal_handle_stale` and any watcher or gate
   keyed to it is already dead. So: record every seat's handle in `pids/<seat>.handle` beside its title at
-  spawn; on `terminal_handle_stale`, re-list terminals and re-resolve the seat by TITLE, then rewrite the
-  handle file; and treat a stale handle as a dead seat until the read-back of the new handle proves
+  spawn with host, address, title, checkout and mission; on `terminal_handle_stale`, re-list terminals
+  and re-resolve by title and checkout for READS ONLY, never rewrite the spawn record from title alone; and treat a stale handle as a dead seat until the read-back of the new handle proves
   otherwise — a gate that was running in that seat has to be re-launched, never assumed to continue.
   When briefing a seat on either host, take its current address from the handoff file; never hardcode a pane id
   or terminal handle in a brief or command template.
@@ -343,7 +391,8 @@ Kimi `-y`, artifact plus terminal marker, and verified file-brief delivery. Flee
   into it (measured 2026-09-20: `terminal create` timed out on an unmanaged spec worktree, the overseer
   split instead, and the run had to be re-seated before GO). Before delivering the brief, prove the seat
   is in its own tab: `orca terminal list --json`, the new handle's `tabId` must differ from the
-  overseer's; if it does not, close the seat and create it again the lawful way. `split` is for seats
+  overseer's; if it does not, withhold the brief and report the misplaced seat; never treat the
+  launching tab as owned (queue row 240; D-2138 add.4). `split` is for seats
   that BELONG beside another seat (consultant pairs, a reviewer beside its surgeon), never for the
   orchestrator or a gate seat.
   **Seat names on Orca are TAB titles, and a tab title HOLDS; the pane title is the agent's and drifts.**
@@ -551,8 +600,15 @@ journal tail to decide what happens next, or sweeping orphans — you have taken
      branch name alone, which moves while you are reading it;
    - **the operator view of that branch** — a live run has NO integration checkout: the daemon publishes
      each merge onto `tickmarkr/<runId>` by compare-and-swap from the repository root. View it through a
-     detached snapshot (`git worktree add --detach <dir> tickmarkr/<runId>`), refreshed by removing it
-     (`git worktree remove <dir>`) and re-adding it; check the branch out attached only with the daemon
+     detached snapshot in the seats-directory home `<repo>-seats/<name>`:
+     `git worktree add --detach <repo>-seats/<name> tickmarkr/<runId>`. Append its path, snapshot purpose,
+     owner seat and mission-end removal condition to `.tickmarkr/overseer/checkouts.ledger` before use.
+     Follow the hand-made checkout law (queue row 240; D-2138 add.1 R4, add.4): before refresh or
+     mission-end removal, prove a clean detached HEAD reachable from a retained named ref with
+     `git for-each-ref --contains <sha>`; otherwise pin `refs/tickmarkr/preserved/<sha>` and write that
+     handle on its ledger line first. Refresh only through that law's clean/no-keep check and
+     `git worktree remove <repo>-seats/<name>` without force, close its line, then re-add and append a
+     new line; dirty or kept snapshots stay and are reported. Check the branch out attached only with the daemon
      stopped (no live `graph.lock`) — an attached checkout taken while the run is live goes stale at the next
      publication, and any write to the ref parks the next merge infra. Run `tickmarkr verify` and `report`
      from the main checkout or a snapshot;
@@ -1526,43 +1582,87 @@ orchestrator turn boundary.
 
 At seat spawn, arm file/journal watchers for artifact completion, run events, missing progress and context evidence. Record each watcher owner and bounded expiry; renew on every wake and stop on stand-down. Read `orca terminal read --terminal <handle> --screen --json` on each wake to detect blocked or pending input. For a human gate, write a checkpoint evidence file and announce it through verified terminal send; the moment a successor opens that file (or any other cited file) back, log the open per CITE-IS-NOT-READ (`opened <path>` appended to `.tickmarkr/overseer/opened-files.log`). Use Orca notifications only when the installed host advertises a notification capability; the current CLI has no `notification` command, so the file and terminal receipt remain the delivery path. A notification or accepted input alone never proves delivery or completion. A seat-liveness watcher on the ORCHESTRATOR handle is mandatory, not optional: poll `orca terminal read --terminal <handle> --screen --json` on a bounded interval and key liveness on `result.terminal.status === "running"` — never on the envelope's own `ok`. `ok: true` proves only that the READ command executed; a closed seat's read still returns that same `ok: true` with `result.terminal.status: "exited"`, and a matcher keyed on `ok` reads that exited seat as alive and never fires (OBS-1087). Treat `result.terminal.status !== "running"`, `terminal_handle_stale`, or a missing terminal as seat death, and re-resolve by title before re-arming (OBS-1050 — the orchestrator seat exited silently and the daemon ran unsupervised to a PARTIAL run-end).
 
+The artifact watcher is available on Orca (queue row 240; D-2138 add.4):
+`TKR_CLOSE_TERMINALS="<handle>,<handle>" bash skills/tickmarkr-overseer/scripts/watch-artifacts.sh <MARKER> <cap-s> <poll-s> <file>...`.
+Supply one recorded address per artifact in argument order; a length mismatch is refused at arm time.
+Both all-complete and wake-on-any exits close only each completed artifact's stood-down seat after
+matching the spawn ledger to its live tab title, leaf handle and layout checkout. Pending siblings,
+missing markers, missing/current-mission-mismatched stand-downs and timeouts close nothing.
+The verified close uses `orca terminal close --terminal <handle> --json`, checks the handle receipt
+or documented live refusal, then handle absence from the terminal list and owned-tab absence from
+visual layouts. A stale handle permits read-only re-resolution by title; it never licenses a close.
+Do not arm closure for the latest settled consult round while its mission continues.
+
+## Mission-end teardown (queue row 240; D-2138 add.1 R3, add.4)
+
+**The spawner closes the seat it created.** Manual closes and watcher closes follow this same law:
+close only once its artifact and terminal marker are on disk, its stand-down is read back, and no
+next mission is named for it. An agent's `done` signal, a bare handle, or a title alone is never enough.
+The ORCH's artifact is the execution record ending in `<!-- tickmarkr:orch-end <runId> -->`;
+the supervisor reads exactly that record and that run's marker before retiring the orchestrator.
+Keep a reused seat only with its next mission named and a `/clear` at the mission boundary.
+Keep the latest settled consult round only while the mission continues; at mission end apply this
+same close or reuse rule. A dedicated consultant tab may outlive the orchestrator tab during that
+continuing mission, never indefinitely after the mission ends.
+
+**Record ownership at spawn**, beside watcher pids under `<state-dir>/overseer/pids/<seat>.handle`:
+write `host`, `address`, `title`, `checkout`, and `mission`, one `key=value` per line, from the create
+receipt; use the actual tab title and checkout. This is the spawn ledger, not a list reconstructed
+from titles. Record an owned tab as `tab=<tab-id>` when the seat owns it. Every spawned seat's brief
+ends with: after stand-down, write `pids/<seat>.stood-down` containing `mission=<mission>`.
+On every new assignment, including named-next-mission reuse, rewrite the ledger's `mission` and
+delete the old stood-down file BEFORE that mission starts (D-2138 add.6 V01). Read back the stood-down
+file and require its mission to equal the ledger's current mission; an earlier mission's stand-down
+never retires the reused seat.
+
+**Before every close, first match the spawn record against the live tab title and checkout**, at its
+recorded address. A mismatch closes nothing. Never close a tab you did not create, a recycled handle
+now showing an operator's terminal, a seat matched by title alone, or your own launching terminal.
+A stale or mismatched Orca handle permits read-only re-resolution by title and checkout to read the
+seat; never close the replacement by title, never rewrite ownership from a title-only match.
+
+- **On herdr (`HERDR_ENV=1`)**: verify `herdr pane list`: the recorded address equals `pane_id`,
+  the recorded title equals `label`, and the recorded checkout equals `cwd` (filesystem identity).
+  Only then use `herdr pane close <pane>` at the recorded address. Prove the pane absent from
+  `herdr pane list`; for a seat owning its tab, use `herdr tab close <tab>` at its recorded tab id
+  after the final owned pane closes, and prove the tab absent from `herdr tab list`. A shared tab
+  with a pending sibling stays open. Never assume emptied tabs disappear without checking.
+- **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: verify ownership with
+  `orca terminal list --include-visual-layouts --json`: the spawn record's address is the leaf handle,
+  its title is the live TAB title (never the shell's pane title), and its checkout matches the layout
+  worktree and terminal row. An unbound checkout or truncated listing is unverifiable and closes nothing.
+  Only then use `orca terminal close --terminal <handle> --json` with the recorded handle. Require
+  `result.close.handle` equal to that handle, or the documented live-terminal refusal
+  `ok:false`, `error.code:runtime_error`, `error.message:tab_not_found` from that same runtime.
+  Prove the handle absent from `orca terminal list --json` AND its owned tab absent from
+  `orca terminal list --include-visual-layouts --json` after its final terminal closes, in the same
+  runtime as the pre-close listing. A surviving owned tab is a spec question, never permission to
+  close by title. The Orca smoke e2e asserts this tab leg; a receipt alone is no close proof.
+
 ## Specialist pipeline rules
 
 ### On herdr (`HERDR_ENV=1`) — specialist panes
 
-- **Dedicated consultant tab**: Consultants (agents spawned to gather synthesis input for decisions like SCOPER analysis or architectural reviews) must run in a DEDICATED tab separate from the ORCHESTRATOR tab. When the orchestrator stands down, the consultant panes should persist so their assessments remain available for review and reference.
-- **Scoper worktree rule**: The SCOPER (or any worktree-based specialist synthesizing into the spec pipeline) must do ALL git operations in a dedicated worktree (e.g., `git worktree add /private/tmp/tkr-scoper-v155 -b spec/...`), never switching the main checkout's branch. This prevents race conditions between the specialist's branch operations and the orchestrator's shipping logic.
+- **Dedicated consultant tab**: Consultants (agents spawned to gather synthesis input for decisions like SCOPER analysis or architectural reviews) must run in a DEDICATED tab separate from the ORCHESTRATOR tab. The dedicated consultant tab persists beyond an orchestrator retirement only while the mission continues; the latest settled round follows mission-end teardown at that mission's end (queue row 240; D-2138 add.1 R3).
+- **Scoper worktree rule**: The SCOPER (or any worktree-based specialist synthesizing into the spec pipeline) must do ALL git operations in a dedicated worktree in the seats-directory home `<repo>-seats/<name>` (e.g., `git worktree add -b spec/<mission> <repo>-seats/scoper-<mission>`), never switching the main checkout's branch. Append its path, scoper purpose, owner seat and mission-end removal condition to `.tickmarkr/overseer/checkouts.ledger` before use. The hand-made checkout law (queue row 240; D-2138 add.1 R4, add.4) governs it: at mission end remove only a clean owned checkout with no keep reason using `git worktree remove <repo>-seats/scoper-<mission>` without force and close its line; dirty or kept checkouts stay and are reported. Before removing a detached HEAD, prove reachability from a retained named ref with `git for-each-ref --contains <sha>`, otherwise pin `refs/tickmarkr/preserved/<sha>` and write that handle on its ledger line first. This prevents race conditions between the specialist's branch operations and the orchestrator's shipping logic.
 - **One fresh pane per consult ROUND** (operator rule, 2026-08-04): every consult round spawns a NEW pane in
   the consult tab rather than re-prompting the seat that answered last round — unless there is a stated
   reason to reuse. Two payoffs: each round starts with a clean context window instead of inheriting the
   previous round's, which is what fills a long mission's seats and forces mid-mission `/clear`; and the
   prior round's pane persists as a readable record of what that seat actually saw and said. Reuse only when
   continuity of the seat's own reasoning is the point, and say so when you do.
-- **CLOSE WHAT YOU SPAWNED** (operator observation, 2026-08-04: *"orch doesn't auto close the panes that he
-  created when no more needed"*). Panes accumulate silently — one mission reached **15 panes and 10 tabs**,
-  ten of them holding live agent sessions for work that had been on disk and fully consumed for hours.
-  Neither seat cleaned up, because neither had been told to.
-  - **Whoever spawns a pane owns closing it.** The orchestrator closes its workers; the overseer closes the
-    consultants and sweeps it spawned. The overseer sweeps whatever is left at mission end.
-  - **Verify the deliverable is ON DISK before closing** — a pane is the only place an unwritten finding
-    exists, and an agent that rendered "Done" without writing its artifact did not deliver (the
-    trust-disk-over-transcripts rule — cited by NAME, because a renumbered list orphans a "rule N").
-    **Non-empty is the FLOOR, not the test: completeness is the artifact's own TERMINAL MARKER.** One
-    consult verdict was 10KB on disk while its seat still read `working` — size proved it had started, and
-    only the closing `VERDICT:` line proved it had finished. Require the terminal marker a report is
-    supposed to end with, per seat, then close.
-  - **A pane is not an archive; the report is.** Once a worker's findings are written and synthesized, its
-    transcript adds nothing the report does not.
-  - **KEEP: the active seat, and the most recent SETTLED consult round.** That last one earns its place —
-    re-prompting the seat that found a defect to confirm its own fix is cheaper and stricter than briefing
-    a fresh one, which is the stated-reason exception above. Close consult rounds only once a later round
-    has re-derived their findings.
-  - Emptied tabs disappear on their own; do not close tabs by hand.
-  - **CLOSE IT AUTOMATICALLY, because remembering is what fails.** `watch-artifacts.sh` already fires on
-    the one signal that means a seat is finished — the artifact plus its terminal marker — so hand it the
-    panes too: `TKR_CLOSE_PANES="w1:p1,w1:p2" watch-artifacts.sh …`. It closes them on completion and
-    **never on timeout**, where the seats are still working. Closing on the marker cannot reap a seat
-    mid-write, which is exactly why `done` would be the wrong trigger.
+- **CLOSE WHAT YOU SPAWNED**: apply the universal mission-end teardown, including the spawn record
+  ownership check and current mission's stand-down. The spawner is responsible for closure.
+  Keep the active seat and latest settled consult round while the mission continues; at its end close
+  or name the next mission and clear before reuse (queue row 240; D-2138 add.1 R3, add.4).
+  - For a seat owning its tab, after verified `herdr pane close <pane>`, explicitly use
+    `herdr tab close <tab>` at the recorded tab id and prove absence from `herdr tab list`; shared tabs
+    stay while a pending sibling owns a pane. The spawn record must match live label and checkout first.
+  - **Automatic closure**: `TKR_CLOSE_PANES="w1:p1,w1:p2" watch-artifacts.sh …` supplies one recorded
+    pane address per artifact, in argument order. Both all-complete and wake-on-any exits close only
+    completed artifacts with current-mission stood-down files and verified ledger identity, never
+    pending siblings or timeout. No ledger record means a reported refusal and an open pane.
+    Do not arm closure for the latest settled consult round while its mission continues.
 
 - **MEASURE BEFORE EVERY SPLIT, AND JOIN *DOWN* WHEN A RIGHT-SPLIT WOULD GO UNDER THE FLOOR.**
   **Operator-observed 2026-08-06, with a screenshot:** five consult panes in one tab rendered **14 columns
@@ -1593,7 +1693,7 @@ At seat spawn, arm file/journal watchers for artifact completion, run events, mi
 
 ### On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`) — specialist terminals
 
-Create specialist seats using `orca terminal create --worktree path:<repo> --command "<agent-cmd>" --json` and record each returned handle. For a deliberate split use `orca terminal split --terminal <owned-handle> --direction horizontal --command "<agent-cmd>" --json`, retaining the child receipt. Deliver briefs with `terminal send --enter --wait-submit 15`, verify observed submission (`result.send.prompt.stages.includes("turn_started")`), and collect files beside `orca terminal read --terminal <handle> --screen --json`. File/journal completion watchers close only recorded seats after the terminal artifact marker; timeout never authorizes closure.
+Create specialist seats using `orca terminal create --worktree path:<repo> --command "<agent-cmd>" --json` and record each returned handle. For a deliberate split use `orca terminal split --terminal <owned-handle> --direction horizontal --command "<agent-cmd>" --json`, retaining the child receipt. Deliver briefs with `terminal send --enter --wait-submit 15`, verify observed submission (`result.send.prompt.stages.includes("turn_started")`), and collect files beside `orca terminal read --terminal <handle> --screen --json`. Completion watchers use the universal mission-end teardown: artifact plus terminal marker, current-mission stand-down read back, and spawn ledger matched to the live tab title and checkout before closing the recorded handle with `orca terminal close --terminal <handle> --json`; require the handle receipt or documented live refusal, handle absence and final owned-tab absence. Timeout never authorizes closure (queue row 240; D-2138 add.4).
 
 ## Non-negotiable rules
 

package/skills/tickmarkr-overseer/scripts/watch-artifacts.sh

@@ -15,10 +15,9 @@
 #
 # Prints one wake reason and EXITS. Re-arm after every wake.
 #
-# TKR_CLOSE_PANES="w1:p1,w1:p2" closes those panes when every artifact completes — the answer to panes
-# accumulating because nobody was watching for "this seat is finished". It fires ONLY on completion,
-# never on timeout. Operator-observed 2026-08-06: five consult panes in one tab left each 14 columns
-# wide and unreadable, because closing was a step someone had to remember.
+# Queue row 240; D-2138 add.1 R3, add.4: optional close lists carry ONE recorded address per
+# artifact, in argument order. Completion wakes on delivery; closure additionally requires the
+# current mission's stand-down and live identity matching the spawn ledger. Never close on timeout.
 set -u
 # macOS ships bash 3.2, where `set -u` makes "${arr[@]}" on an EMPTY array a fatal unbound-variable
 # error. Every expansion below therefore uses the ${arr[@]+"${arr[@]}"} guard. Caught by the timeout
@@ -38,6 +37,19 @@ POLL="${3:?}"
 shift 3
 [ "$#" -gt 0 ] || { echo "watch-artifacts: no files given" >&2; exit 2; }
 
+# Refuse ambiguous arming before watching anything; preserve empty fields for count validation.
+CLOSE_HOST=""
+CLOSE_ADDRESSES="${TKR_CLOSE_TERMINALS:-${TKR_CLOSE_PANES:-}}"
+if [ -n "${TKR_CLOSE_TERMINALS:-}" ] && [ -n "${TKR_CLOSE_PANES:-}" ]; then
+  echo "watch-artifacts: choose one host close list" >&2; exit 2
+fi
+if [ -n "$CLOSE_ADDRESSES" ]; then
+  if [ -n "${TKR_CLOSE_TERMINALS:-}" ]; then CLOSE_HOST=orca; else CLOSE_HOST=herdr; fi
+  node -e 'const a=process.argv[1].split(","); if(a.length!==Number(process.argv[2]) || a.some(x=>!x.trim())) process.exit(2)' "$CLOSE_ADDRESSES" "$#" || {
+    echo "watch-artifacts: close list requires one recorded address per artifact in argument order" >&2; exit 2;
+  }
+fi
+
 # OBS-848: ownership is a pid-file fact, never an argv/path pattern. Two tiers intentionally watch
 # the same artifacts, so the journal/file argument cannot identify which watcher a seat may retire.
 PID_DIR="${TKR_STATE_DIR:-.tickmarkr}/overseer/pids"
@@ -55,7 +67,7 @@ trap clear_pid EXIT
 # two that happened to be in view at the time. Class, not instance.
 END=$((SECONDS + CAP))
 
-# A file is DONE when the marker appears in its last few lines AND the file has stopped growing.
+# Queue row 240; D-2138 add.4: DONE requires the marker on the final line and stable content.
 #
 # Anchored to the tail on purpose: a report that merely *mentions* its own marker mid-body has not
 # finished, and grepping the whole file would call that done. This brief tells seats to end the file with
@@ -110,7 +122,7 @@ done
 done_file() {                  # $1 = index into "$@", $2 = path
   local i="$1" f="$2" sig
   [ -s "$f" ] || return 1
-  tail -5 "$f" 2>/dev/null | grep -qF -- "$MARKER" || return 1
+  tail -n 1 "$f" 2>/dev/null | grep -qF -- "$MARKER" || return 1
   # CONTENT HASH, not size+mtime. The first version of this used `stat` size and mtime and the drill
   # killed it on the incident's own shape: the correction that cost a ruling was `23 WEAK · 19 SOUND`
   # -> `25 WEAK · 17 SOUND`, which is **byte-identical in length**, and mtime is whole seconds. A
@@ -124,12 +136,136 @@ done_file() {                  # $1 = index into "$@", $2 = path
   return 1
 }
 
+# Queue row 240; D-2138 add.4 U04/U05/U08/U09, add.6 V01: both completion exits use
+# this path. A bare address, title alone or old mission's stand-down never licenses a close.
+close_completed() {
+  [ -n "$CLOSE_HOST" ] || return 0
+  node - "$PID_DIR" "$CLOSE_HOST" "$CLOSE_ADDRESSES" ${READY_INDEXES[@]+"${READY_INDEXES[@]}"} <<'NODE'
+const fs = require("fs");
+const path = require("path");
+const { spawnSync } = require("child_process");
+const [dir, host, addresses, ...ready] = process.argv.slice(2);
+const canonical = p => { try { return fs.realpathSync(p); } catch { return path.resolve(p); } };
+const field = (o) => typeof o === "string" && o ? o : undefined;
+const checkout = o => field(o.worktree) || field(o.worktreePath) || field(o.worktree_path)
+  || field(o.worktree?.path) || (field(o.worktreeId)?.split("::").slice(1).join("::"))
+  || field(o.path) || field(o.cwd);
+const same = (a, b) => !!a && !!b && canonical(a) === canonical(b);
+function record(file) {
+  const raw = fs.readFileSync(file, "utf8");
+  const entries = raw.trim().split("\n").map(line => { const i = line.indexOf("="); return [line.slice(0, i), line.slice(i + 1)]; });
+  if (entries.some(([k]) => !k) || new Set(entries.map(([k]) => k)).size !== entries.length) throw Error("malformed spawn/stand-down record");
+  return { raw, values: Object.fromEntries(entries) };
+}
+function call(args, refusal = false) {
+  const r = spawnSync(host, args, { encoding: "utf8", timeout: 10000 });
+  if (r.error || r.signal) throw Error("host call unreadable or timed out");
+  let body; try { body = JSON.parse(r.stdout); } catch { throw Error("host response is not JSON"); }
+  if (refusal && r.status === 1 && body.ok === false && body.error?.code === "runtime_error" && body.error?.message === "tab_not_found") return body;
+  if (r.status !== 0 || body.ok === false || !body.result) throw Error("host call refused");
+  return body;
+}
+function orcaList(visual = true) {
+  const body = call(["terminal", "list", ...(visual ? ["--include-visual-layouts"] : []), "--limit", "10000", "--json"]);
+  if (body.ok !== true || !body._meta?.runtimeId || body._meta.runtimeId === "none" || body.result.truncated === true
+    || !Array.isArray(body.result.terminals) || (visual && !Array.isArray(body.result.visualLayouts))) throw Error("unverifiable terminal list");
+  return body;
+}
+function tabs(node, out = []) {
+  if (Array.isArray(node)) node.forEach(n => tabs(n, out));
+  else if (node && typeof node === "object") {
+    if (Array.isArray(node.tabs)) out.push(...node.tabs);
+    tabs(node.first, out); tabs(node.second, out);
+  }
+  return out;
+}
+function leaves(node, out = []) {
+  if (Array.isArray(node)) node.forEach(n => leaves(n, out));
+  else if (node && typeof node === "object") {
+    if (node.type === "terminal" && field(node.handle)) out.push(node.handle);
+    else { leaves(node.panes, out); leaves(node.first, out); leaves(node.second, out); }
+  }
+  return out;
+}
+function liveTabs(body) {
+  return body.result.visualLayouts.flatMap(layout => tabs(layout.root).map(tab => ({ tab, checkout: checkout(layout), handles: leaves(tab.panes) })));
+}
+function paneList() {
+  const result = call(["pane", "list"]).result;
+  if (!Array.isArray(result.panes)) throw Error("unverifiable pane list");
+  return result.panes;
+}
+for (const index of ready) {
+  let attempted = false;
+  const address = addresses.split(",")[Number(index)];
+  try {
+    if (address === process.env.ORCA_TERMINAL_HANDLE || address === process.env.HERDR_PANE_ID) throw Error("own launching terminal");
+    const matches = fs.readdirSync(dir).filter(n => n.endsWith(".handle")).map(n => ({ file: path.join(dir, n), seat: n.slice(0, -7), ...record(path.join(dir, n)) }))
+      .filter(r => r.values.address === address && r.values.host === host);
+    if (matches.length !== 1) throw Error("no unique spawn ledger record names address");
+    const r = matches[0], v = r.values;
+    if (!v.title || !v.checkout || !v.mission) throw Error("incomplete spawn ledger");
+    if (r.seat === process.env.TKR_ARMING_SEAT) throw Error("own arming seat");
+    if (v.next_mission || v["next-mission"]) throw Error("named next mission keeps seat open until clear and reassignment");
+    const stood = path.join(dir, `${r.seat}.stood-down`);
+    const stoodDown = () => {
+      if (record(r.file).raw !== r.raw) throw Error("spawn ledger changed during verification");
+      if (record(stood).values.mission !== v.mission) throw Error("stand-down does not name current mission");
+    };
+    stoodDown();
+    if (host === "orca") {
+      const before = orcaList();
+      const rows = before.result.terminals.filter(t => t.handle === address);
+      const allTabs = liveTabs(before);
+      const owned = allTabs.filter(t => t.tab.title === v.title && same(t.checkout, v.checkout) && t.handles.includes(address));
+      if (rows.length !== 1 || !same(checkout(rows[0]), v.checkout) || owned.length !== 1) {
+        // Read-only re-resolution by title. Never substitute this candidate into a close command.
+        const candidates = allTabs.filter(t => t.tab.title === v.title && same(t.checkout, v.checkout)).flatMap(t => t.handles);
+        for (const handle of candidates) call(["terminal", "read", "--terminal", handle, "--screen", "--json"]);
+        throw Error("live tab title and checkout mismatch or stale handle; read-only re-resolution by title");
+      }
+      const tab = owned[0], tabId = tab.tab.id ?? tab.tab.tabId ?? rows[0].tabId;
+      if (!tabId) throw Error("owned tab id is unverifiable");
+      const finalTerminal = tab.handles.length === 1;
+      stoodDown();
+      attempted = true;
+      const receipt = call(["terminal", "close", "--terminal", address, "--json"], true);
+      if (receipt._meta?.runtimeId !== before._meta.runtimeId) throw Error("runtime changed at close");
+      if (receipt.ok !== false && (receipt.ok !== true || receipt.result?.close?.handle !== address)) throw Error("close receipt does not name recorded handle");
+      const after = orcaList(false), layoutAfter = orcaList();
+      if (after._meta.runtimeId !== before._meta.runtimeId || layoutAfter._meta.runtimeId !== before._meta.runtimeId
+        || after.result.terminals.some(t => t.handle === address)
+        || (finalTerminal && liveTabs(layoutAfter).some(t => (t.tab.id ?? t.tab.tabId) === tabId || (t.tab.title === v.title && same(t.checkout, v.checkout))))
+        || (!finalTerminal && tab.handles.filter(h => h !== address).some(h => !after.result.terminals.some(t => t.handle === h)))) throw Error("handle or final owned tab survives close, sibling disappeared, or runtime changed; spec question, never close by title");
+      console.log(`  CLOSED ${address}: receipt ${receipt.ok === false ? "runtime_error: tab_not_found" : receipt.result.close.handle}; handle absent from terminal list; ${finalTerminal ? `owned tab ${tabId} absent from visual layout` : `shared tab ${tabId} kept for sibling terminals`}`);
+    } else {
+      const before = paneList(), rows = before.filter(p => p.pane_id === address);
+      if (rows.length !== 1 || rows[0].label !== v.title || !same(rows[0].cwd, v.checkout)) throw Error("live pane label and checkout mismatch");
+      stoodDown();
+      attempted = true;
+      call(["pane", "close", address]);
+      const after = paneList();
+      if (after.some(p => p.pane_id === address)) throw Error("pane survives close");
+      // A shared consultant tab belongs to several seats. Only a recorded sole owner reaps its tab.
+      if (v.tab && rows[0].tab_id === v.tab && !after.some(p => p.tab_id === v.tab)) {
+        call(["tab", "close", v.tab]);
+        const listed = call(["tab", "list"]).result.tabs;
+        if (!Array.isArray(listed) || listed.some(t => (t.tab_id ?? t.id) === v.tab)) throw Error("owned tab survives close");
+      }
+      console.log(`  CLOSED ${address}: spawn record matched label and cwd; pane absent from pane list`);
+    }
+  } catch (error) { console.log(`  ${attempted ? "CLOSE UNPROVEN" : "LEFT OPEN"} ${address}: ${error.code === "ENOENT" ? "missing spawn or stand-down record" : error.message}`); }
+}
+NODE
+}
+
 while :; do
   pending=()
   ready=()
+  READY_INDEXES=()
   i=0
   for f in "$@"; do
-    if done_file "$i" "$f"; then ready+=("$f"); else pending+=("$f"); fi
+    if done_file "$i" "$f"; then ready+=("$f"); READY_INDEXES+=("$i"); else pending+=("$f"); fi
     i=$((i + 1))
   done
 
@@ -152,6 +288,7 @@ while :; do
       if [ -s "$f" ]; then echo "  PARTIAL     $(wc -c <"$f" | tr -d ' ') bytes, no marker yet  $f  last-line: $(tail -n 1 "$f" | tr -d '\0' | cut -c1-72)"
       else echo "  NOT STARTED $f  <- check whether that seat is BLOCKED; a stalled seat writes nothing"; fi
     done
+    close_completed
     exit 0
   fi
 
@@ -161,17 +298,7 @@ while :; do
     echo "  RE-HASH BEFORE YOU QUOTE IT. The marker means the file ENDS with '$MARKER', never that its"
     echo "  author has stopped: a rewrite-in-place keeps the marker terminal at every instant. If shasum"
     echo "  now differs from the value above, you are reading a superseded file."
-    # A seat whose artifact is COMPLETE has nothing left to give: the report is the archive, the pane is
-    # not. Closing here is safe precisely because the marker — not `done`, not a size — is the trigger,
-    # so this can never reap a seat mid-write. Only on the COMPLETE path: on a timeout the seats are
-    # still working and closing one would destroy the work being waited for.
-    if [ -n "${TKR_CLOSE_PANES:-}" ]; then
-      for pane in ${TKR_CLOSE_PANES//,/ }; do
-        # `herdr pane close` exits 0 even for a pane that is already gone, so report the body rather
-        # than the status — an exit code here would claim a close that may never have happened.
-        printf '  CLOSED %s -> %s\n' "$pane" "$(herdr pane close "$pane" 2>&1 | head -c 80)"
-      done
-    fi
+    close_completed
     exit 0
   fi