@1aboveio/skills 1.0.11 → 1.0.13

package/skills/engineering/engineering/references/init-scope.md

@@ -1,6 +1,14 @@
 # What initialization includes
 
-The default is durable project guidance, not an orchestration or infrastructure setup.
+Standalone `/engineering` first asks for Global, Project, or Session scope. Only a
+Project selection, `/engineering init`, or an explicit project save uses the project
+initializer described here. Global saving follows `SKILL.md`'s separate procedure;
+Session keeps the rules in conversation context without writing files.
+On later standalone calls, configured scopes offer a targeted reset with
+[owned-guidance cleanup](scope-management.md#reset-and-clean-up); setup does not
+grant permission to remove pre-existing rules.
+
+Project initialization creates durable guidance, not an orchestration or infrastructure setup.
 This review covers every active first-party skill in the Engineering package and
 the related delivery, CI, and merge-queue convention owners. Archived skills are
 not initialization sources; pinned external skills keep their upstream ownership.

package/skills/engineering/engineering/references/scope-management.md

@@ -0,0 +1,85 @@
+# Scope management
+
+This procedure governs standalone setup and reset. It does not authorize cleanup
+while the skill is loaded for implementation, review, or tracker routing.
+
+## Detect configuration
+
+- Global uses only the current agent's supported user-level instruction file.
+  Project uses the selected Git root, or current directory without Git, and its
+  `AGENTS.md` and `CONTRIBUTING.md`. Apply the save procedure's target validation
+  before setup or reset. Do not scan unrelated projects or agent installations.
+- A valid ownership record, equivalent existing engineering rules, or an explicit
+  active session choice means the corresponding scope is configured. Distinguish
+  fully configured, partially configured, and existing rules not owned by this skill.
+  Rules inherited from another scope do not mean this scope is configured.
+- Inspect files afresh on every standalone call. Keep the session choice in context
+  across reload or compaction; a new session starts without that temporary choice.
+  A reset session choice remains off until the user explicitly enables it again.
+- Report unknown, unreadable, invalid, and conflicting guidance honestly. Offer to
+  resolve that scope rather than presenting a save or reset as safe. An unknown
+  global path does not prevent a known project or session action.
+
+## Record ownership
+
+After an authorized Global or Project save, keep a small JSON ownership record in
+an HTML comment in each changed guidance file:
+
+```markdown
+<!-- engineering:ownership
+{"version":1,"scope":"project","createdFile":false,"additions":[]}
+-->
+```
+
+Populate `additions` from the actual before/after diff, never from the presence of
+a familiar heading. Each entry has `namespace` (`conventions` or `engineering`),
+`id`, and `sha256` fields. These identify the `<!-- <namespace>:<id>:start -->`
+and matching `end` marker, and the SHA-256 of the bytes between them. Store marker
+identifiers, not literal comment strings, so the initializer does not count the
+receipt as duplicate markers. Include any new wrapper heading inside its recorded
+block. Record only newly inserted text. Use the
+existing `conventions:<id>:start/end` markers for new project sections. Wrap any
+new global defaults or new loading pointer in unique `engineering:<id>:start/end`
+comments before recording their hashes. Do not rewrap existing text or claim it as
+owned. Keep existing valid records and add only new entries; deduplicate entries.
+
+Set `createdFile` only when this save created that file. Preserve unrelated bytes
+and existing links. Do not create a sidecar, global settings entry, or project file
+for a session choice. A repeated save with no additions leaves files unchanged.
+If a record is malformed or ownership is uncertain, preserve the affected text and
+report the problem instead of inventing a receipt or claiming complete setup.
+
+## Reset and clean up
+
+A selected reset or an explicit scoped reset request authorizes removal of that
+scope's saved defaults, not a reinstall, refresh, or reset of every scope.
+
+1. Re-read and validate every target in the selected scope before editing. Explain
+   the planned removals and any preserved user rules. A read-only reset preview
+   stays read-only. Cancellation performs no cleanup.
+2. **Session:** Clear only the explicit temporary engineering choice. Do not edit
+   files or agent settings. Continue to honor inherited global and project rules
+   and binding requirements; session reset does not switch those off.
+3. **Global or Project:** Remove recorded additions only when their markers are
+   unique and balanced and their current content matches the recorded hash. Remove
+   their ownership entries as well. Retain edited blocks and their records, explain
+   the difference, and ask before removing user changes. Never delete an entire
+   section just because its heading matches a template.
+4. For older or unrecorded guidance, including legacy tracker blocks, ownership
+   cannot be inferred from markers alone. Identify the exact candidate text and
+   ask for agreement before deleting it. Do not adopt or erase rules written by
+   another skill. Safe, independently owned removals may proceed while an uncertain
+   removal remains unresolved; report the reset as partial.
+5. Remove owned loading pointers only if they are unchanged and no longer needed
+   by retained guidance. Keep a pointer that still loads user policy. Remove an
+   empty ownership record and any empty wrapper heading added by this save.
+   Delete a file only if `createdFile` proves this skill created it and nothing
+   except the original generated title and whitespace remains. Preserve pre-existing
+   files, symlinks, hand edits, and unrelated sections; never delete an instruction
+   directory or skill installation. Do not touch `CLAUDE.md` during project reset,
+   because project init does not own it.
+6. Report what was removed, retained, or blocked and which scopes still apply.
+   Resetting Project does not remove Global defaults, and resetting Global does
+   not erase project policy. Repeating a completed reset makes no file changes.
+   Reset does not disable ordinary read-only use of engineering defaults when a
+   later implementation or routing task loads this skill.

package/skills/engineering/engineering-runtime/SKILL.md

@@ -3,7 +3,7 @@ name: engineering-runtime
 description: Internal support package for shared Engineering Workflow executable behavior. Never select or invoke this package as a user capability.
 disable-model-invocation: true
 user-invocable: false
-release-version: 0.45.0
+release-version: 0.45.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Engineering Runtime

package/skills/engineering/engineering-runtime/coherence/workflow.json

@@ -369,7 +369,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "8ab89f526fd30be9a81c8dc602d797e7aa8d2f09c63da0b56d8d214966e7e1fc",
+      "contentDigest": "5a7d8e43506d55cf9ea6e4a7c3bc44caf32f384f61b2ac83048760f522ec74c8",
       "digestExcludes": []
     },
     {
@@ -382,7 +382,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "386ab76e0a90f031da690ca27ee5066684d895290ae0c97faabf6aaad94cd495",
+      "contentDigest": "d60f3b5770b305d86d703aecf9a08f4ed9b1ea428e881c34212529ef8d12d1f4",
       "digestExcludes": []
     },
     {
@@ -395,7 +395,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "0399fc78af9e7823ace55e04aa867b30b12c738f2a47e28395184512525861bf",
+      "contentDigest": "a97b8b8e123e4da19f49614540de3dd607f0711eb8b406516ca023d695a3dcfe",
       "digestExcludes": []
     },
     {
@@ -408,7 +408,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "2bc51a5c6ed89007075d51f174c7b76d0a743b61f0d299c2067487679c86dd3f",
+      "contentDigest": "a0ac298524bc181d5310ee8f05eb0171a8ab801f68ca18ea55b90b9a8cf54b57",
       "digestExcludes": []
     },
     {
@@ -421,7 +421,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "c3cd951d823c6ce4f2b9b229892e450ad285e27cda157c5eead0d8ddc3d550f5",
+      "contentDigest": "3d5b22f5e45edbcca8b88a6802231a830f90b083de6d3fbdc0ceb823ae5971a5",
       "digestExcludes": []
     },
     {
@@ -434,7 +434,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "639a25b40d67942c5355abee9d791b02784bedc50fa1f5fb8b4d90125f0b95e7",
+      "contentDigest": "e66777d1d522e495078dfdcb506ae815810bf0c8aa648349da4a3bb12566cfdd",
       "digestExcludes": []
     },
     {
@@ -447,7 +447,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "c595e281773af00b485dcb7d18e762f487b85761db42afa8287015581acdd8b5",
+      "contentDigest": "01d95a93132107140a55a13fceafb0d3993c742e80dd7f367018306d71690b36",
       "digestExcludes": []
     },
     {
@@ -460,7 +460,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "ec21e8eb116ccf6b3c1e798f4039fc2fa05558e63cae157e0bcb75ea81627d68",
+      "contentDigest": "75aebb12f6d3461fe1892bce7b535ec8dcf94b3943aa8c488cf46255654f5e57",
       "digestExcludes": []
     },
     {
@@ -473,7 +473,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "d973f6bb977f4cba06e26afa42a54bbaa90d29001086c87a83d84f335df590d4",
+      "contentDigest": "c5f4d18c646ece47620c9d778860c96f2f3764caa1ecaff0ef821835b7421aa0",
       "digestExcludes": []
     },
     {
@@ -486,7 +486,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "43d2be290e65e536f0b9ff21087cce81c337158948edbdf901c609d3e73b9b0b",
+      "contentDigest": "491cfe94839fa027fed6c79631a8dc581f65ef1e1b222a61f76e15863e540e5b",
       "digestExcludes": []
     },
     {
@@ -499,7 +499,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "73163c04711d6901162bd3cdb3a847db2845e8e51dbd53169ad13e7d2817f45c",
+      "contentDigest": "ec5d51ec669aa5ed0693d54ef70efd97a19dd9817accfdb2ca7afe1a711547e7",
       "digestExcludes": []
     },
     {
@@ -512,13 +512,13 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "9086b011f69d48e264c00241c6c1864e04678f791f575625cff2e788a2b58163",
+      "contentDigest": "de617480630819345cb53fea3fbd5ca2e9d4d360680a9feace942c518806f59b",
       "digestExcludes": [
         "coherence/workflow.json"
       ]
     }
   ],
-  "releaseIdentity": "986e36012356e16fd54d77f0844860cd5ed9c4cac6f18ef1d3d540a3697dcfdf",
+  "releaseIdentity": "4eabbf3d0e0d3af4e9436e1a4e4c07ef153a7cc07d74d42ab94c15717146dfa3",
   "lifecycleAuthority": "native-skills-cli",
   "repairRecipe": {
     "id": "engineering-workflow-dependency-first",

package/skills/engineering/ensure-coverage/SKILL.md

@@ -2,7 +2,7 @@
 name: ensure-coverage
 description: "Define or audit behavior-first test criteria — ACs, required test levels, mock/integration/E2E policy — across three axes: breadth (Coverage Ledger), depth (over-mocking), presentation (perceivability of browser surfaces). NOT judging whether a single test is any good (test-quality), authoring browser tests (e2e-test), reviewing a PR (better-review), or delivering issues (resolve-issues)."
 disable-model-invocation: true
-release-version: 0.45.0
+release-version: 0.45.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Ensure Coverage

package/skills/engineering/golden-path/SKILL.md

@@ -3,7 +3,7 @@ name: golden-path
 description: "Golden-path E2E: the short list of user journeys whose failure blocks a release, kept in a repo as one contract (golden-paths.json) with a generated GOLDEN_PATHS.md and a generated GitHub Actions workflow, and run against a local build or a deployed URL for an ALIVE/DEAD verdict. Use to set golden paths up in a repo ('init golden paths', 'add golden-path CI'), to migrate an older smoke.manifest.json or a hand-built smoke setup ('audit', 'migrate smoke'), to add, change, or remove a golden path, to ask 'is the build alive?' or run them before a PR or release, or when a change touches a flow listed in GOLDEN_PATHS.md. NOT for writing the Playwright specs themselves (e2e-test), deciding what a change must prove (ensure-coverage), or general workflow YAML (github-actions)."
 dependencies:
   - e2e-test
-release-version: 0.45.0
+release-version: 0.45.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Golden path

package/skills/engineering/harness-runtime/SKILL.md

@@ -3,7 +3,7 @@ name: harness-runtime
 description: Internal import-only library shared by first-party engineering packages. Not a workflow skill; never select or invoke it as a user capability.
 disable-model-invocation: true
 user-invocable: false
-release-version: 0.45.0
+release-version: 0.45.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Harness Runtime

package/skills/engineering/resolve-issues/SKILL.md

@@ -8,7 +8,7 @@ dependencies:
   - better-review
   - golden-path
   - harness-runtime
-release-version: 0.45.0
+release-version: 0.45.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Resolve issues
@@ -41,7 +41,8 @@ what did not pass).
 ## Principles
 
 Read the [delivery principles](references/principles.md) before substantive work
-and include them verbatim in every worker brief. They are guidelines, not
+for coordinator decisions. Give workers only the principles relevant to their task,
+not the coordinator's scheduling instructions. They are guidelines, not
 restrictions: when two pull apart, take the one that ships sooner at the same bar.
 
 `/rush-issues` runs this workflow with every answer defaulted ([shortcut mode](references/preflight.md#shortcut-mode)).
@@ -130,7 +131,7 @@ infrastructure, and report verified behavior. Full acceptance and required CI st
 ## Every brief contains
 
 Use the full [brief checklist](references/delivery-progress.md#every-brief-contains),
-including the Goal and [Principles](references/principles.md) verbatim, checkpoint history and result contract.
+including the worker-specific contract, checkpoint history and result contract.
 Treat a missing or unreadable result as incomplete; resume a dead spawn once in its workspace.
 
 ## Workflow

package/skills/engineering/resolve-issues/references/ci.md

@@ -1,7 +1,11 @@
 # CI, queue, and merge
 
-Run per PR, in parallel with its review, from the moment its draft PR
-opens.
+The coordinator owns external CI and PR monitoring, review scheduling, readiness,
+enqueue and merge per PR, in parallel with review from the moment the draft opens.
+Use background tasks for CI and delivery watching so scheduling can continue; follow
+the queue owner's watcher where applicable. Workers may make short status reads or
+fetch failed logs for diagnosis, but must not run `gh run watch`,
+`gh pr checks --watch`, a delivery watcher, or create background monitoring.
 
 1. Watch the required checks for every pushed HEAD. Pushes to the unit's own
    PR branch need no approval. Green means every required check ran and passed
@@ -10,7 +14,9 @@ opens.
 2. On failure, read the logs; have a fix worker reproduce it, fix it on the
    same branch, rerun the failing check (a journey: off CI, with
    `proof.suite.local`) and the checks the fix affects plus
-   typecheck and build, and return the commands and results. An
+   typecheck and build, push the permitted branch, write its result and return
+   without waiting for CI. Pending CI is not a pass and does not weaken acceptance.
+   Long local tests and builds needed for the repair are allowed. An
    infrastructure failure goes to [expire.md](expire.md#infrastructure-failures).
 3. A changed HEAD needs approval bound to that HEAD: push it and let CI
    run. After a passing review, [carry](review.md#carry-after-a-pass) it:

package/skills/engineering/resolve-issues/references/delivery-progress.md

@@ -49,9 +49,19 @@ issue or automatic scheduler gate. They do not waive required validation.
 - the [immediate acceptance checkpoint](#delivery-progress), existing baseline (or none),
   and, for a continuation, the last result, remaining uncertainty and next distinguishing
   test; retain the same checkpoint/history when changing workers
-- the [Goal](../SKILL.md#goal) and [Principles](principles.md), verbatim (a reviewer gets review.md's two rules instead)
+- a concise worker-specific contract: business outcome and context, full acceptance,
+  security and quality requirements, and principles relevant to the assigned work; a
+  reviewer gets review.md's two rules instead. Do not forward coordinator scheduling
+  instructions wholesale
+- for implement and fix workers: implement or repair, run focused checks and required
+  local validation, push the permitted branch, write the result, and return. The
+  coordinator owns external CI/PR monitoring, review scheduling, readiness, enqueue
+  and merge. Short status reads and fetching failed logs for diagnosis are allowed;
+  no `gh run watch`, `gh pr checks --watch`, delivery watcher, or worker-created
+  background monitoring. Long local tests and builds remain allowed when needed.
+  Pending CI is a valid handoff, not a passed check or permission to weaken acceptance
 - the result path, `<run>/results/<unit>-<label>.json` (`<label>`: kind and attempt, e.g. `fix-2`), with `unit` and `decisionNeeded` (null or a choice)
-- at the deadline: stop starting work, commit, and report
+- at the deadline: stop starting work, commit, and report; identify any unpushed work or pending checks
 - environment rules: write only inside the workspace and its planned resources (and the findings directory for the explorer),
   with private caches and temp files registered before use (`TMPDIR`, `npm_config_cache`, `UV_CACHE_DIR`);
   reuse them through retries and return them to the cleanup owner ([workspaces](workspaces.md)); use the machine's

package/skills/engineering/resolve-issues/references/expire.md

@@ -109,14 +109,22 @@ Example: a worker ran from 08:16; its workspace last changed at 09:10, and
 nothing was checked until the human asked at 11:19. It had been stuck for two
 hours.
 
-- Record `workerSince` when you start a worker. While any worker runs, keep
-  one heartbeat running (a background `sleep 1800`) so a completion notice
-  reaches you even when no worker finishes; on each notice read fresh capacity
-  and run `next-actions.mjs` with the [live capacity arguments](implementation.md#live-capacity).
-  When it prints only `wait`, keep the heartbeat and end the turn: the harness
-  wakes the run at the printed time.
-- `check-worker` means the worker changed no workspace file for
-  `--quiet-minutes` (45 by default): read its latest output. Stuck: stop it
+- Record `workerSince` when you start a worker. Pi's subagent extension attaches
+  every single or batch launch to one shared supervision watcher and stops it
+  when the last active worker ends. Leave stall detection enabled; do not start
+  a separate heartbeat or background watcher for subagents. On a completion or
+  stale-worker notice, read fresh capacity and run `next-actions.mjs` with the
+  [live capacity arguments](implementation.md#live-capacity).
+- When the scheduler prints only `wait`, no worker is active. Arm one one-shot
+  background timer for the earliest retry time before ending the turn; the
+  scheduler prints the deadline but does not schedule a wakeup. Use the `wait`
+  action's `delaySeconds` for `sleep`, with its completion callback enabled.
+  Keep its task ID in the run's note. Reuse it while its deadline is unchanged;
+  cancel and replace it if the deadline changes, and cancel it when work resumes
+  or the run finishes. This retry timer is not a worker watcher.
+- A stale-worker notice or `check-worker` calls for inspection, not automatic
+  termination. `check-worker` means no workspace file changed for
+  `--quiet-minutes` (45 by default): read the worker's latest output. Stuck: stop it
   and take the `timeout-task` response. A long test with advancing test/phase results
   inside its declared command deadline may continue. Repeated heartbeats, unchanged
   logs or an unbounded child wait are not that evidence.

package/skills/engineering/resolve-issues/references/implementation.md

@@ -2,9 +2,10 @@
 
 ## Principles
 
-Give these to every implementer and fix worker, with SKILL.md's
-[Principles](../SKILL.md#principles). Each is a guideline toward the
-[Goal](../SKILL.md#goal), then an example.
+Use these worker-relevant guidelines in implementer and fix briefs, alongside the
+[worker contract](delivery-progress.md#every-brief-contains). Each serves the
+[Goal](../SKILL.md#goal), then gives an example; coordinator scheduling stays with
+the coordinator.
 
 1. **Done is the requested outcome working and its agreed criteria passing at `proof.level`.**
    Example: the Charge layout persists per installation and the repository test passes
@@ -27,9 +28,9 @@ Give these to every implementer and fix worker, with SKILL.md's
 5. **Run focused checks locally; CI runs the rest.**
    Example: run the touched package's tests and typecheck, push, and let CI
    run the full matrix. Never rebuild a release device campaign in a unit.
-6. **Report in one short record.**
+6. **Report in one short record and return.**
    Example: "Persists the Charge layout per installation. Ran charge tests
-   and typecheck: pass. CI: <link>. Pending: release device campaign
+   and typecheck: pass. CI: pending. Pending: release device campaign
    (#1400)." Provenance, when required, is the CI run's artifacts.
 
 After the approval, schedule runnable units continuously within
@@ -104,7 +105,13 @@ implementer in its kept workspace with the brief and its findings entry.
    nothing else: no artifact hashes, version inventories, screenshots,
    copied logs, or earlier attempts. For a continuation, include the current checkpoint,
    outcome and relevant prior-result links in the existing integration notes; do not
-   duplicate the full attempt history.
+   duplicate the full attempt history. After focused validation, the permitted push,
+   and the result, return without waiting for external CI or PR monitoring. Report
+   pending CI as pending; it does not meet full acceptance. The coordinator schedules
+   review and owns CI, readiness, enqueue and merge. Short status reads and failed-log
+   retrieval for diagnosis are allowed, but worker-created background monitoring,
+   delivery watchers, `gh run watch`, and `gh pr checks --watch` are not. This does
+   not prohibit long local tests or builds needed for the assigned validation.
 
 After 2 fix cycles without progress, or a stuck or late worker, follow
 [expire.md](expire.md). Start the next worker in the same workspace with the
@@ -125,7 +132,8 @@ transcript.
   only they show. A journey can satisfy several obligations it actually exercises;
   a new branch does not automatically need another test layer.
 - When CI runs the unit's `browser` or `emulator` suite, CI proves it: push
-  and read the journey's result on the pushed HEAD. CI confirms a fix; it
+  and the coordinator reads the journey's result on the pushed HEAD. The worker
+  returns with CI pending. CI confirms a fix; it
   never debugs one. After a failed journey, reproduce it with
   `proof.suite.local` before the next push or dispatch. When `local` passes
   where CI fails, the difference is the environment: run CI once more with

package/skills/engineering/resolve-issues/references/principles.md

@@ -1,7 +1,8 @@
 # Delivery principles
 
-Guidelines, not restrictions; put them in every brief. When two pull apart, take the one that
-ships sooner at the same bar.
+Coordinator guidance, not a worker brief. Give workers only the principles relevant to
+their assignment; do not forward scheduling instructions wholesale. These are guidelines,
+not restrictions; when two pull apart, take the one that ships sooner at the same bar.
 
 1. **Deliver when the requested behavior works and the agreed checks pass.**
    Example: the cashier can submit the Charge, the plan's charge tests and typecheck
@@ -30,7 +31,8 @@ ships sooner at the same bar.
    reviewer. A P0/P1 fix: delta; one that rewrote most of the PR: full.
 7. **Coordinate first.** On every completion notice, read fresh capacity and run `scripts/next-actions.mjs --run <run>`
    with the [live capacity arguments](implementation.md#live-capacity); do everything it prints
-   before resuming your own work; keep a [heartbeat](expire.md#waits).
+   before resuming your own work. The harness owns [worker monitoring](expire.md#waits);
+   do not start a duplicate heartbeat.
    Example: mid-way through an emulator debug, a notice says `impl-1322`
    finished; the script prints `start-review 1322` and `fill-slot 1323`, so
    start both, then return to the debug. On a new invocation, call it first with `--resume`.

package/skills/engineering/resolve-issues/scripts/next-actions.mjs

@@ -67,7 +67,7 @@
 //   retry-blocked   everything else is settled and a unit blocked on a cause that can clear by
 //                   itself (retry-*, timeout-task, spawn-death, external-blocker) is due its next automatic attempt
 //                   (30m, 2h, 8h after blockedAt): set it in-flight, autoRetries + 1
-//   wait            the same, but no attempt is due yet: keep a heartbeat, never finish
+//   wait            no worker is active and no retry is due: arm one one-shot timer, never finish
 //   finish          every unit is delivered, blocked, cancelled, or not started behind one of
 //                   those (named in the detail, with units built whose PR cannot open because a
 //                   parent will not land): write the handoff. For a
@@ -686,7 +686,10 @@ export function nextActions(plan, reviews = {}, capacity, { resume = false, now,
       for (const u of retryable.filter((v) => !v.blockedAt || !Number.isFinite(now))) due.push({ action: 'retry-blocked', unit: String(u.id), detail: retryDetail(u) })
     } else if (retryable.length) {
       const next = retryable.reduce((a, u) => (dueAt(u) < dueAt(a) ? u : a))
-      due.push({ action: 'wait', unit: String(next.id), detail: `unit ${next.id} is blocked (${next.blockedReason}); its next automatic attempt is at ${new Date(dueAt(next)).toISOString()}: keep a heartbeat until then and do not finish` })
+      const wakeAt = new Date(dueAt(next)).toISOString()
+      const delaySeconds = Math.max(0, Math.ceil((dueAt(next) - now) / 1000))
+      due.push({ action: 'wait', unit: String(next.id), wakeAt, delaySeconds,
+        detail: `unit ${next.id} is blocked (${next.blockedReason}); its next automatic attempt is at ${wakeAt}: arm one one-shot background retry timer (sleep ${delaySeconds}, completion callback enabled); cancel any obsolete retry timer and do not finish` })
     } else {
       const retained = units.filter((u) => managed(u) && u.lifecycle?.cleanup?.state === 'retained').map((u) => `${u.id}: ${u.lifecycle.cleanup.reason}`)
       due.push({ action: 'finish', unit: null, detail: `every unit is delivered, blocked, cancelled, or not started behind one of those: write the handoff${parked.length ? `; not started: ${parked.join(', ')}` : ''}${built.length ? `; built, PR not opened: ${built.join(', ')}` : ''}${openWaiting.length ? `; PR open, cannot land: ${openWaiting.join(', ')}` : ''}${retained.length ? `; retained environments (not cleaned): ${retained.join('; ')}` : ''}` })

package/skills/engineering/resolve-release/SKILL.md

@@ -4,7 +4,7 @@ description: "Slash/explicit-only (/resolve-release). Full GitHub Flow release f
 disable-model-invocation: true
 metadata:
   workflow-role: coordinator
-release-version: 0.45.0
+release-version: 0.45.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Resolve release

package/skills/engineering/rush-issues/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   workflow-role: coordinator
 dependencies:
   - resolve-issues
-release-version: 0.45.0
+release-version: 0.45.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Rush issues (shortcut of resolve-issues)

package/skills/engineering/rush-release/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   workflow-role: coordinator
 dependencies:
   - resolve-release
-release-version: 0.45.0
+release-version: 0.45.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Rush release (shortcut of resolve-release)

package/skills/engineering/test-quality/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: test-quality
 description: "Seven principles for tests that catch real bugs, and an audit that reports weak, redundant, and not-coverage tests without fixing them. Use when writing, changing, or reviewing tests, or when asked whether tests are useful, redundant, over-mocked, flaky, only assert static text, or test config files, or asked to make a slow test suite faster without losing coverage, or when the user asks to write the testing conventions into a repo's CONTRIBUTING.md. NOT defining what a spec must prove (ensure-coverage) or authoring browser tests (e2e-test)."
-release-version: 0.45.0
+release-version: 0.45.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Test Quality

package/skills/risk-compliance/compliance-audit/SKILL.md

@@ -2,7 +2,7 @@
 name: compliance-audit
 version: 2.9.0
 description: "Audit operations against financial-compliance checklists (AML/KYC, VARS, PCI-DSS, TPA oversight, onboarding, transaction monitoring). Produces tracker.md (with a tracker.xlsx export) and phase-trail.md with layered validation; cites evidence by original filename. Input: reg-parser or the built-in VARS checklist."
-release-version: 0.45.0
+release-version: 0.45.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Compliance Audit

package/skills/risk-compliance/contract-compare/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: contract-compare
 description: "Compare two or more contracts side-by-side for structured diff, gap analysis, and benchmarking. Use when: comparing contracts or agreements, contract diff, compare terms, vendor-vs-vendor, compare our template vs theirs, compliance gap between contracts. NOT for single-contract risk review — use contract-review for that."
-release-version: 0.45.0
+release-version: 0.45.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Contract Compare

package/skills/risk-compliance/contract-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: contract-review
 description: "Review contracts for legal, commercial, and compliance risks via convert → chunk review → merge → validate (+ optional mandate preprocessing). Use for reviewing, auditing, or checking any contract, agreement, NDA, MSA, or SLA; input a file path (PDF/DOCX/TXT) or pasted text."
-release-version: 0.45.0
+release-version: 0.45.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Contract Review

package/skills/risk-compliance/doc-authenticity/SKILL.md

@@ -3,7 +3,7 @@ name: doc-authenticity
 version: 0.4.1
 description: "Screen PDF documents and raster images for fabrication, tampering, Photoshop or other image-editor use, and content validity. Detects file type, runs format-specific authenticity forensics, classifies bank statements, conversation logs, invoices, agreements, and other documents, then applies type-specific validity checks. Produces separate authenticity (NO_EVIDENCE_OF_MODIFICATION / SUSPICIOUS / LIKELY_MODIFIED / INCONCLUSIVE) and validity (VALID / INVALID / INCONCLUSIVE) verdicts. Use whenever a user asks whether a document, screenshot, scan, statement, invoice, contract, chat log, receipt, or payment evidence is genuine, original, edited, Photoshopped, manipulated, fake, or valid."
 disable-model-invocation: true
-release-version: 0.45.0
+release-version: 0.45.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Document and Image Authenticity

package/skills/risk-compliance/fraud-detection/SKILL.md

@@ -12,7 +12,7 @@ description: >
   impact, and a business report. Use for fraud, scam, mule, account-takeover,
   chargeback, dispute, transfer, collection, or payout risk analysis even when the
   user does not name this skill.
-release-version: 0.45.0
+release-version: 0.45.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Fraud Detection

package/skills/risk-compliance/payment-analysis/SKILL.md

@@ -14,7 +14,7 @@ description: >
   transactions" — even if they do not say payment-analysis. Do NOT use for
   fraud rule discovery (fraud-detection) or TLD / MCC-miscoding
   clusters (tld-detection).
-release-version: 0.45.0
+release-version: 0.45.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Payment Analysis

package/skills/risk-compliance/portfolio-payment-analysis/SKILL.md

@@ -5,7 +5,7 @@ description: >
   and investigate selected merchants' authorization, settlement and disputes,
   including descriptor mapping and overlapping exports. Portfolio-level payment
   overviews belong to payment-analysis; fraud rule discovery belongs to fraud-detection.
-release-version: 0.45.0
+release-version: 0.45.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Portfolio payment analysis

package/skills/risk-compliance/similar-domain/SKILL.md

@@ -8,7 +8,7 @@ description: >
   links, an entity chain, and a watchlist for the operator's next domains.
   Not transaction data (tld-detection) or fraud rules (fraud-detection).
 disable-model-invocation: true
-release-version: 0.45.0
+release-version: 0.45.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Similar Domain

package/skills/risk-compliance/tld-detection/SKILL.md

@@ -6,7 +6,7 @@ description: >
   patterns, with USD and BIN-country currency views, group profiles and priorities.
   Not payment-analysis, fraud-detection, or website research.
 disable-model-invocation: true
-release-version: 0.45.0
+release-version: 0.45.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # TLD detection