@1aboveio/skills 1.0.15 → 1.0.17

package/skills/engineering/harness-runtime/contracts.md

@@ -13,3 +13,5 @@ Shell code cannot invoke a native question tool inside the agent's current turn.
 When no supported native question tool is advertised, concise free-text input is permitted only for one optionless question. Textual multiple-choice emulation is forbidden. Unsupported multi-select and all secret input fail explicitly rather than degrading silently.
 
 Model discovery and catalog persistence remain separate from question planning. Current-turn tool availability is never inferred from model or harness configuration. Source-tree imports outside `skills/engineering` are unsupported until an installation-aware adapter entrypoint exists; consumers must not copy the runtime to work around that boundary.
+
+`agent-catalog.mjs` is the consumer bridge to the harness-owned agent catalog: one versioned JSON request on stdin (`version`, `harness`, `cwd`, `available`, `foregroundModel`, `fallbackToForeground`, `launchCapabilities`, `hostPreferences`, `overrides`, `tiers`, …) and one JSON response on stdout with four worker slots. It resolves the resolver command from `PI_AGENT_CATALOG_COMMAND` (a JSON argv array, or one bare executable token) or defaults to `pi-agent-catalog` on PATH, runs it with no shell, bounds its output and runtime, and validates the response. Those host fields are validated and forwarded unchanged — nothing is inferred or completed here, so an unstated launch control or tier stays unstated. A missing, broken, or declining resolver is a reported block; the bridge never falls back to a skill-owned model ladder and never installs anything. `discover-models.mjs` and `model-catalog.mjs` remain for consumers that still import them and are no longer part of model-slot selection.

package/skills/engineering/harness-runtime/references/model-catalog.md

@@ -1,6 +1,12 @@
 # Model catalog (skill-owned baseline, per-harness overrides)
 
-resolve-issues preflight must classify every discovered model (family · tier) before it can recommend a pick for each slot. The installed `harness-runtime` package provides the shared catalog baseline at `references/model-catalog-seed.json`; the per-harness JSON files below hold only **explicit, human-confirmed overrides**. A skill install or update replaces the shipped baseline, so its newer classifications apply on the next pre-flight wherever no local override exists. It never copies that baseline into a user file or silently changes an override. Training-data knowledge is not a discovery source, and neither is this file's *absence* of a model: only discovered or explicitly human-named models are eligible ([resolve-issues shared modules](../../resolve-issues/references/shared-modules.md)).
+> **Legacy compatibility surface.** Model-slot selection now belongs to the harness agent catalog,
+> reached through [`agent-catalog.mjs`](../agent-catalog.mjs); `resolve-issues` names roles and reads
+> that bridge instead of classifying models. This document and `model-catalog.mjs` stay for other
+> consumers that still import them, and for the shipped baseline data. Do not use this doctrine to
+> re-derive a model ladder for a workflow.
+
+The legacy resolve-issues preflight classified every discovered model (family · tier) before it could propose a pick for each slot. The installed `harness-runtime` package provides the shared catalog baseline at `references/model-catalog-seed.json`; the per-harness JSON files below hold only **explicit, human-confirmed overrides**. A skill install or update replaces the shipped baseline, so its newer classifications apply on the next pre-flight wherever no local override exists. It never copies that baseline into a user file or silently changes an override. Training-data knowledge is not a discovery source, and neither is this file's *absence* of a model: only discovered or explicitly human-named models are eligible ([resolve-issues shared modules](../../resolve-issues/references/shared-modules.md)).
 
 **Read and write through [`model-catalog.mjs`](../model-catalog.mjs)** rather than hand-editing the JSON — it single-sources the prune predicate and the write paths. Run `model-catalog.mjs help`; the script is the source of truth for the precedence composition, the write-guards, and the shapes. At pre-flight step 2 **prefer `tiers --seen <ids>`**: it composes all three evidence arms (banked → cross-harness → team seed) with the precedence applied *inside* the command. A precedence or filtering rule stated only in prose is applied by an agent mid-gate from memory, and the failure is silent — exactly how rules 5 and 7 went wrong before 2026-07-20.
 

package/skills/engineering/resolve-issues/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: resolve-issues
-description: "Slash/explicit-only (/resolve-issues). Drive an issue, epic, or feature spec to reviewed, green PRs, one per issue, merged or handed back merge-ready: preflight, task map, exploration and a per-issue slice check, isolated implementers within live host capacity, then per issue its PR, independent better-review, CI, and queue/merge (or merge-ready hand-back) as soon as it is done. Asks once, at the end of preflight (implementer, target branch, merge mode, scheduler mode, plan), then never blocks on the human; small non-blocking problems collect in a dropbox, posted at the end as grouped ready-for-agent issues. /rush-issues is its no-questions shortcut. Do not auto-select. Use for whole-spec delivery, including high-risk work; risk changes model and validation depth, never the workflow. NOT for release work (resolve-release)."
+description: "Slash/explicit-only (/resolve-issues). Drive an issue, epic, or feature spec to reviewed, green PRs, one per issue, merged or handed back merge-ready: preflight assessment with an explorer only for planning unknowns, a per-issue slice check, isolated implementers within live host capacity, then per issue its PR, independent better-review, CI, and queue/merge (or merge-ready hand-back) as soon as it is done. Asks once, at the end of preflight (target branch, merge mode, scheduler mode, plan) and resolves the worker roles' models as run metadata instead of asking, then never blocks on the human; small non-blocking problems collect in a dropbox, posted at the end as grouped ready-for-agent issues. /rush-issues is its no-questions shortcut. Do not auto-select. Use for whole-spec delivery, including high-risk work; risk changes model and validation depth, never the workflow. NOT for release work (resolve-release)."
 disable-model-invocation: true
 metadata:
   workflow-role: coordinator
@@ -8,7 +8,7 @@ dependencies:
   - better-review
   - golden-path
   - harness-runtime
-release-version: 0.47.0
+release-version: 0.48.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Resolve issues
@@ -54,8 +54,8 @@ after 2 fix rounds without a new low of open P0/P1 path rows; no fixed round cap
 
 ```text
 preflight: ready label -> model fills -> plan draft
-  -> exploration -> size check (only scope or an open question holds a unit, with a split)
-  -> one approval (implementer, target branch, merge mode, scheduler mode, plan)
+  -> preflight assessment (optional explorer) -> size check (only scope or an open question holds a unit, with a split)
+  -> one approval (target branch, merge mode, scheduler mode, plan)
   -> schedule runnable units within live host capacity:
        prepare a unit's workspace when its first worker is admitted (never all units up front)
        -> implement -> first coherent commit: draft PR (CI starts) once parents' PRs are open
@@ -77,9 +77,9 @@ Read each procedure right before its stage; never substitute your own.
 
 | Stage | Procedure |
 |---|---|
-| Preflight: ready label, models, plan draft, exploration, size check, approval; what any filed text may say | [references/preflight.md](references/preflight.md) ([Filed text](references/preflight.md#filed-text)) |
+| Preflight: ready label, models, plan draft, assessment, size check, approval; what any filed text may say | [references/preflight.md](references/preflight.md) ([Filed text](references/preflight.md#filed-text)) |
 | Task plan shape and live board | [references/task-plan.md](references/task-plan.md) |
-| Exploration (preflight step 4) | [references/exploration.md](references/exploration.md) |
+| Preflight assessment and optional exploration (step 4) | [references/exploration.md](references/exploration.md) |
 | Implementation loop and opening each PR | [references/implementation.md](references/implementation.md) |
 | Read-only warehouse canary | [references/canary.md](references/canary.md) |
 | Owned workspaces: plan, prepare, cleanup, recover, inventory | [references/workspaces.md](references/workspaces.md) |
@@ -102,8 +102,11 @@ Read each procedure right before its stage; never substitute your own.
   started (`pending`), never `blocked`; what stays blocked ends deferred on its owning issue, never done.
 - **Your role.** Coordinate first ([principle 7](references/principles.md)); between notices you may do bounded work
   yourself: reproduce a failing browser or emulator journey, investigate an infrastructure failure, run a short
-  check. Leave code changes to workers so your attention stays on scheduling, and record each worker as the
-  unit's `workerKind` (`implement`, `fix`, `review`). Exploration continues the run's one explorer. After a context compaction, read this file in
+  check. When a journey or case you run fails, copy its `NATIVE_FAILURE` line (or the failing step, error and
+  evidence path) into the unit's plan row; an exit code alone is not a failure record.
+  Leave code changes to workers so your attention stays on scheduling, and record each worker as the
+  unit's `workerKind` (`implement`, `fix`, `review`). You own preflight findings;
+  delegate unresolved planning unknowns under [exploration.md](references/exploration.md#choose-the-owner). After a context compaction, read this file in
   full again before your next step: the summary keeps the run's state, not these rules. Fill
   free slots before starting your own work, stay within [expire.md](references/expire.md)'s limit, and send
   large output to files (read only the lines you need). Expect Pi's **Completions while busy: Steer active run**
@@ -143,16 +146,18 @@ Follow [preflight.md](references/preflight.md):
 0. **Ready label:** resume the spec's run if one exists; run `ready-check.mjs`;
    stop on an `unreadable` outcome; ask at step 6 on `unlabeled` or a `missing` compaction
    hook (`install-hooks.mjs --check`; shortcut: warn).
-1. **Model slots:** record the fast-path fills without asking.
+1. **Model slots:** record the fast-path fills without asking; the models and
+efforts are run metadata, never a question.
 2. **Provisional target:** the default branch.
 3. **Plan draft:** one unit per issue, links, delivery mode; show the board.
-4. **Exploration:** have one explorer record each unit's `slice` and,
-   separately, its `proof`, in every run; reuse prior findings for units
+4. **Preflight assessment:** record each unit's `slice` and,
+   separately, its `proof`, yourself for clear work; use an explorer only
+   for concrete planning unknowns. Reuse prior findings for units
    whose evidence did not change
    ([exploration.md](references/exploration.md#reuse-first)).
 5. **Size check:** run `size-check.mjs` (exit 0; read `verdict`). On `hold` or `stop`, hold the listed
-   units (their dependents wait, not started) and draft their splits (yours when none is drafted); on `exploration-unfinished`, continue the explorer.
-6. **Approval:** ask once for implementer, target, merge mode, scheduler mode, and plan;
+   units (their dependents wait, not started) and draft their splits (yours when none is drafted); on `exploration-unfinished`, complete the findings using step 4's owner routing.
+6. **Approval:** ask once for target, merge mode, scheduler mode, and plan;
    record the answers; plan each unit's branch, workspace, base, and lifecycle
    intent, and prepare a workspace only when its first worker is admitted
    ([workspaces.md](references/workspaces.md#prepare-at-admission-once)).

package/skills/engineering/resolve-issues/references/delivery-progress.md

@@ -49,6 +49,8 @@ issue or automatic scheduler gate. They do not waive required validation.
 - the [immediate acceptance checkpoint](#delivery-progress), existing baseline (or none),
   and, for a continuation, the last result, remaining uncertainty and next distinguishing
   test; retain the same checkpoint/history when changing workers
+- for a fix after a failed check or case, the last `failure` block (case, step, error,
+  evidence path) verbatim, so the worker starts from the cause
 - a concise worker-specific contract: business outcome and context, full acceptance,
   security and quality requirements, and principles relevant to the assigned work; a
   reviewer gets review.md's two rules instead. Do not forward coordinator scheduling

package/skills/engineering/resolve-issues/references/expire.md

@@ -220,9 +220,12 @@ secret the repository lacks is item 5: hand it back.
 Spawn no separate diagnosis worker for a known failure kind, and write no
 diagnosis document; an unknown infrastructure failure gets one fix worker
 ([Infrastructure failures](#infrastructure-failures)). The failure kind
-is already known from the reason code, the failing check, or
-`review-verdict.mjs`; take its response, keep the branch, workspace, and
-logs, and record one line, with the reason code, in the unit's plan row.
+is already known from the reason code, the failing check, the result's
+`failure` block, or `review-verdict.mjs`; take its response, keep the branch,
+workspace, and logs, and record one line, with the reason code, in the unit's
+plan row. A failed case whose `failure` names the step and error goes straight
+to a fix worker with that block. Assign investigation only when the record is
+missing, or names a step without a reason.
 
 | Failure | Response |
 |---|---|

package/skills/engineering/resolve-issues/references/exploration.md

@@ -1,16 +1,44 @@
 # Exploration
 
-**One explorer per run, after the plan draft, records what sizes, orders, and
-blocks the units: behaviors, missing prerequisites, proof, line estimates,
-dependencies, contracts, and the questions that hold a unit.**
+**Every run gets a coordinator-owned preflight assessment after the plan draft:**
+behaviors, missing prerequisites, proof, line estimates, dependencies, contracts,
+and the questions that hold a unit. A dedicated explorer is optional.
 In a one-unit run, leave `contracts`, `dependsOn`, and `stacksOn` empty.
 
-## Spawn
+## Choose the owner
+
+Read the issues, applicable repository guidance, and the few code or test paths
+needed to check the plan. For clear, bounded work, write the findings yourself.
+The findings are planning state, not product code; keep detailed code discovery
+with implementers.
+
+Delegate when a concrete unknown could change the plan: uncertain cross-unit
+dependencies or contracts, unclear boundaries or likely splitting, or an unfamiliar
+validation setup. Name the unknown and the affected units in the explorer's brief.
+Multiple units or a high-risk label alone do not require an explorer; unresolved
+planning uncertainty does. An unanswered product decision stays an open question,
+not an invitation for the explorer to invent a requirement.
+
+Use the same record and size check for both paths. Resolve each unit's planning
+unknowns or record its open human decision before approval. On later scope or base
+changes, apply this routing again only to affected units.
+
+Resolve the assessment target to an exact commit before reading code: initially
+the provisional target, then the approved target after a branch change. Record
+that SHA as findings `base`; use it explicitly for reuse checks and any explorer
+checkout. The coordinator's current branch is not evidence of the assessment target.
+
+## Optional explorer
+
+Use at most one explorer at a time per run, on the fleet `explore` row, within
+live host capacity. Reuse that explorer for further investigation when available.
+Give it only the affected units and unknowns. While it writes findings, it owns
+that file exclusively; collect its result before the coordinator updates it.
 
 | Field | Value |
 |---|---|
 | Model | The explorer fill ([preflight.md](preflight.md#1-model-slots)) |
-| Workspace | Read-only checkout of the provisional target; write only the findings directory |
+| Workspace | Read-only checkout at the assessment target SHA; write only the findings directory |
 | Task plan | Absolute `task-plan.json` path; its unit ids key the findings |
 | Prior findings | Newest `.resolve-issues/rush/*/exploration/findings.json` for the same spec locator, if any |
 | Deadline | 15 minutes, plus 1 minute per unit beyond 4 |
@@ -18,15 +46,23 @@ In a one-unit run, leave `contracts`, `dependsOn`, and `stacksOn` empty.
 
 ## Reuse first
 
-**When prior findings exist, explore only the units whose evidence changed.**
-Run, before spawning, and give the explorer its output:
+**Reuse requires unchanged requirements as well as unchanged code evidence.**
+First compare each unit's current criteria, dependency contracts, relevant guidance,
+and recorded decisions with the prior assessment. Reassess affected units even if
+the helper below says `reuse`; it checks Git evidence paths, not those inputs.
+When the prior inputs cannot be established, reassess that unit.
+
+Run the code-evidence check against the exact assessment target, not the caller's
+`HEAD`; include the output and any forced reassessments in an explorer brief:
 
 ```bash
 node <skill-base-dir>/scripts/findings-reuse.mjs \
-  --prior <prior findings.json> --units <this run's unit ids, comma-separated>
+  --prior <prior findings.json> --units <this run's unit ids, comma-separated> \
+  --head <assessment-target-SHA>
 ```
 
-- `reuse`: copy the entry unchanged, with the new `base`.
+- `reuse`: copy the entry unchanged only when the non-code inputs above also
+  match, with the new `base`.
 - `recheck`: re-explore the entry; its `changed` files are where to look.
 - `new`: explore from scratch.
 
@@ -34,7 +70,9 @@ Example: a resumed run starts after earlier units merged `src/charge/`; only
 the two units whose evidence names `src/charge/` are re-explored, the other
 four are copied.
 
-## Brief
+## Assessment record
+
+The coordinator and any delegated explorer use these rules:
 
 1. **Scaffold, then save one unit at a time.** Keep an existing
    `findings.json`; otherwise create it with `version: 2`, the `base` SHA,
@@ -106,7 +144,7 @@ four are copied.
        journey; `local` runs that Charge journey script on an owned emulator,
        not the repository's default phone journey.
      - Findings saved before `local` and `skill` existed are unfinished:
-       continue the explorer to add them, even when reusing the rest.
+       add them before the size check, even when reusing the rest.
    - `physical`: evidence only a real device gives; else empty.
 
    - `groups` and `setups` (only when `slice.newProductBehaviorCount` is
@@ -193,10 +231,14 @@ it then.
 
 ## Completion
 
-Confirm the findings exist, the model read-back matches, and no product source
-changed. Never edit the findings yourself. Run the size check; on `exploration-unfinished` or
-tool failures, continue the explorer with the errors. At the deadline, have it
-save what it has and stop; continue it in the same directory for the units
-still empty while size-check problems plus empty units reach new lows, then follow
-[expire.md](expire.md). Never skip exploration;
-reuse is not skipping.
+Confirm the findings exist and no product source changed. For delegated work,
+also confirm the model read-back matches and inspect the result. Run the size
+check; `exploration-unfinished` means complete or repair the findings, not spawn
+a worker automatically. Correct a missing field yourself when the evidence is
+clear; continue the explorer only for unresolved investigation.
+
+At an explorer's deadline, have it save what it has and stop. Inspect its partial
+findings, complete clear entries yourself, and continue investigation only for
+remaining unknowns while size-check problems plus empty units reach new lows;
+then follow [expire.md](expire.md). Finish the fleet `explore` row once the
+assessment and size check are complete, even when no explorer was needed.

package/skills/engineering/resolve-issues/references/implementation.md

@@ -76,7 +76,7 @@ the same work. A passing setup check is not a substitute for the blocked behavio
 No additional report or result schema is required.
 
 Have the implementer treat findings as leads, find its own code, and report
-any `product`, `scope`, `design`, or `approval` question the explorer missed and any
+any `product`, `scope`, `design`, or `approval` question the assessment missed and any
 human-only proof. Report each question in the result's `decisionNeeded`
 ([expire.md](expire.md#decide-before-you-defer)); add each proof as a
 handback step. Never edit `findings.json`.
@@ -101,7 +101,12 @@ implementer in its kept workspace with the brief and its findings entry.
    line, kind, one-line summary, whether it needs a human decision), and
    `decisionNeeded`: `null`, or the choice that stops the unit (question,
    options, recommendation; options are ways to proceed, and staying
-   blocked is never one). Fix workers write the same file. Return
+   blocked is never one). When a check or case fails, add
+   `failure`: `{case, step, error, evidenceDir}`, copied from the harness's
+   `NATIVE_FAILURE` line or failure record when it prints one; otherwise the failing
+   step, error message and evidence path the worker observed. An exit code alone is
+   not a failure; keep the first failure separate from cleanup errors. Fix workers
+   write the same file. Return
    nothing else: no artifact hashes, version inventories, screenshots,
    copied logs, or earlier attempts. For a continuation, include the current checkpoint,
    outcome and relevant prior-result links in the existing integration notes; do not

package/skills/engineering/resolve-issues/references/preflight.md

@@ -11,10 +11,22 @@ until step 6.
 node <skill-base-dir>/scripts/plan-sync.mjs --find-run --runs .resolve-issues/rush --issue <owner/name#123>
 ```
 
-When it prints a directory, resume that run (`next-actions.mjs --run <dir> --resume` with
-[fresh capacity](implementation.md#live-capacity))
-instead of starting another; its plan picks up whatever the tree gained
-since. It exits 0 whether or not it found a run: no run prints nothing on stdout
+When it prints a directory, reuse that run instead of starting another. Before
+calling the scheduler, reload its plan, decisions and standing orders. Refresh the
+source requirements as described under [issue-tree sync](task-plan.md#issue-tree-sync)
+and resolve the recorded target to its current exact SHA. Apply
+[assessment reuse](exploration.md#reuse-first) against those inputs.
+
+If assessment was interrupted, findings are incomplete, or affected requirements or
+target evidence changed, complete step 4 and rerun step 5 for those units before
+scheduling them. Finish any outstanding step 6 approval once; preserve choices
+already approved. A saved size stop remains held until reassessment clears it or
+its `runWhole` recommendation is accepted. Do not treat a scheduler action as proof
+that assessment or approval finished.
+
+Then resume with `next-actions.mjs --run <dir> --resume` and
+[fresh capacity](implementation.md#live-capacity); its plan picks up whatever the
+tree gained since. The run finder exits 0 whether or not it found a run: no run prints nothing on stdout
 (`--json`: `{"found":false}`). Example: `/rush-issues #12` finds the run whose saved tree holds
 #12 and resumes it, never a second run beside it.
 
@@ -28,7 +40,7 @@ The script exits 0 whenever it ran (2 if it could not); read `outcome` in its JS
 
 - **`ready`:** continue. An open issue is work, whatever its sub-issues
   say: each `rollups` entry (open, every sub-issue closed) is a unit; the
-  explorer records what is left, or that nothing is, and then the handback
+  assessment records what is left, or that nothing is, and then the handback
   says "close #N". Example: held #40's filed prerequisite #41 closed;
   #40 is a rollup and stays a unit.
 - **`unlabeled`:** continue as on `ready`, and record the `missing` issues for
@@ -78,16 +90,38 @@ posts them; they join this run's end-of-run review
 
 ## 1. Model slots
 
-Run the fast path and record its fills by exact id and effort, using the
-ladders in [shared-modules.md](shared-modules.md#model-catalog). Never give
-the reviewer the implementer's id, at any effort. Let risk raise the tier and
-add the repository's deterministic domain checks, never change the workflow.
+Follow [model slots](shared-modules.md#model-slots): on Pi, inspect the live native
+catalog first after checking task overrides and authoritative host preferences;
+use the portable resolver when native role resolution is unavailable or cannot
+validate either exact request. Record the actual fills by
+exact id and effort. The skill names the roles — implementer, explorer, diagnoser,
+reviewer — and the harness agent catalog chooses the models, so rank nothing and
+copy nothing from a ladder. The fills are run metadata: show each role's model
+and effort on the board and never ask which model should implement. A model the
+human names is an explicit override, resolved by rerunning this step with
+`--implementer`, never by offering a list. Never give the reviewer the
+implementer's id, at any effort: the catalog enforces that, and the run blocks
+when it cannot. Let risk
+add the repository's deterministic domain checks and review depth, never change
+the workflow or re-choose the model.
 
 Pass a pinned implementer (`implementer=<id[@effort]>` in the invocation) as
-`--implementer`; when the result is `ok: false` with code `pinned-implementer-unavailable`, end the run as "pinned implementer unavailable"
-and never substitute another model.
-Example: `/rush-issues 1aboveio/ai#1545 implementer=gpt-6-luna@high` with no
-`gpt-6-luna` discovered stops at preflight and starts nothing.
+`--implementer` on the portable path. A declined result stops preflight with its
+`code` and `reason`, starting nothing: `pinned-implementer-unavailable` means the
+pinned model is unavailable and no other implementer is substituted;
+`catalog-unavailable` means the portable resolver could not be invoked.
+`capabilities-missing` means its input lacks model evidence: repair an omitted
+field from current host evidence and retry, or report precisely what could not
+be obtained. It does not establish a missing harness capability. Never revive
+the old picker or reuse an earlier run's pick.
+Example: `/rush-issues 1aboveio/ai#1545 implementer=gpt-6-luna@high` on a host
+whose catalog does not offer `gpt-6-luna` stops at preflight and starts nothing.
+
+**Catalog limitation:** optional exploration skips the worker, not catalog
+resolution. Both paths still require all four fills, including
+the explorer, even for coordinator-only assessment. Report a missing explorer as
+a catalog block; do not extract other fills from a declined response or substitute
+a model. Explorer-independent resolution needs a supported upstream protocol.
 
 ## 2. Provisional target
 
@@ -107,11 +141,13 @@ Example: epic #12's #20 (signed release and go/no-go) and #21
 (physical acceptance) stay out of the plan; the run ends when its code units
 land instead of waiting on them.
 
-## 4. Explore
+## 4. Assess the plan
 
-Run [exploration.md](exploration.md) on the provisional target, with any
-prior findings for the same spec. On tool failures or a size-check `exploration-unfinished` verdict,
-continue the explorer with the errors. Add the links the findings show.
+Follow [exploration.md](exploration.md#choose-the-owner) on the provisional
+target, reusing prior findings for the same spec. Write findings yourself for
+clear work; delegate concrete planning unknowns to an optional explorer.
+On tool failures or `exploration-unfinished`, complete the affected findings
+using the same owner routing. Add the links the findings show.
 
 ## 5. Size check
 
@@ -143,7 +179,7 @@ by row 1 of [Never block on the human](#never-block-on-the-human).
 | `ok`, `warn` | Continue |
 | `hold` | Hold the `held` units (their dependents wait, not started); start the `runnable` units |
 | `stop` | Run-wide failure or every unit held; draft the held units' splits |
-| `exploration-unfinished` | Continue the explorer with the error |
+| `exploration-unfinished` | Complete the findings using step 4's owner routing |
 | exit 2 | Fix the plan or command |
 
 Only scope and open questions hold a unit; proof only warns. Add each
@@ -274,7 +310,7 @@ Example: `/resolve-issues` answered "run the rest" files nothing;
    prerequisites keeps its unit, now depending on them.
    Example: #30 splits into #50 and #51, so the sync adds both, drops 30,
    and unit 34, `blocked_by` #30, now waits on 50 and 51.
-4. Continue the explorer for the new units only; rerun the size check.
+4. Assess the new units only using step 4's owner routing; rerun the size check.
 5. Split a still-held slice again only while splitting makes progress: its
    largest slice is smaller than the one before.
    Example: a 7,287-line unit split into 3,455 and 2,150 lines; a held
@@ -295,7 +331,8 @@ Example: `/resolve-issues` answered "run the rest" files nothing;
 Show the board: units, delivery mode, verdict and reasons by consideration,
 each unit's behaviors, missing prerequisites, proof and suite, environment
 checks, held units with splits, the pending device record, the
-issues missing `ready-for-agent`, and handback steps. Ask
+issues missing `ready-for-agent`, and handback steps. Show each role's resolved
+model and effort as run metadata; no question asks for one. Ask
 in one interaction, with the native single-choice tool when there is one:
 
 0. **Ready label** (only after step 0 `unlabeled`): list the `missing` issues,
@@ -304,20 +341,18 @@ in one interaction, with the native single-choice tool when there is one:
    proceed, record it in `decisions`; on stop, end the run with the list.
    **Compaction hook** (only when `install-hooks.mjs --check` printed `missing:`):
    install it (recommended), or run without it.
-1. **Implementer:** the payload's `options`, recommended first, each with its
-   reviewer. A pinned implementer is already decided: show it, don't ask.
-2. **Target branch:** up to four fetched heads, provisional first.
-3. **Merge mode:** `autonomous` (recommended): merge each
+1. **Target branch:** up to four fetched heads, provisional first.
+2. **Merge mode:** `autonomous` (recommended): merge each
    reviewed, green PR, fixing blockers outside the plan
    ([expire.md](expire.md#infrastructure-failures)); or
    `supervised`: hand each back merge-ready.
-4. **Scheduler mode:** how much `next-actions.mjs` prescribes, recorded as
+3. **Scheduler mode:** how much `next-actions.mjs` prescribes, recorded as
    the plan's `schedulerMode`. `full` (recommended): do every step it
    prints. `narrow`: it prints whether the run is done, the units with work,
    and the guards; you choose each unit's step. `off`: it prints only whether
    the run is done; you plan every step. In every mode the run ends only when
    it reports done.
-5. **Plan:**
+4. **Plan:**
    - `ok`/`warn`: proceed or trim.
    - `hold`: file the splits and run them with the rest (recommended when a
      held unit has a split), run the rest, proceed anyway, or trim; offer to
@@ -336,18 +371,18 @@ in one interaction, with the native single-choice tool when there is one:
    grew to 7,544 lines and was closed. Re-cut as two issues, it merged as
    437 and 341 lines.
 
-Record each answer in `decisions`, sync the catalog, then:
+Record each answer in `decisions`, then:
 
-- New target: fetch it, continue the explorer to recheck the findings, rerun
+- New target: fetch it, reassess affected findings using step 4's owner routing, rerun
   the size check; ask again only if it worsens to `hold` or `stop`.
-- Trim: drop the scope, continue the explorer to remove its questions and
+- Trim: drop the scope, remove its findings, questions and
   handback items, rerun the size check.
 - File the splits: follow [File a split](#file-a-split); ask again only if
   the size check returns `stop`.
 - Move to later: mark the units `blocked` (`blockedReason: human-decision`, `humanItem: 1`, the human's words as `humanNeed`); they stay in
   this run's plan and resume with it (one run per spec). Never start a
   separate follow-up run for the same spec.
-- Answer: record it, continue the explorer to set the question
+- Answer: record it, set the question
   `resolved: true`, rerun the size check.
 - Run the rest: mark held units `blocked` (`blockedReason: size-hold`) with the split path;
   their dependents stay not started (`pending`).
@@ -389,7 +424,6 @@ asking nothing at any point:
 |---|---|
 | Ready label | Proceed: show the `missing` issues as a warning on the board and in the handback |
 | Compaction hook | Run without it: warn on the board with the install command |
-| Implementer | The first `options` entry (the pinned one, when pinned) |
 | Target branch | The default branch |
 | Merge mode | `autonomous` |
 | Scheduler mode | `full`, unless the invocation names `scheduler=narrow` or `scheduler=off` |

package/skills/engineering/resolve-issues/references/review.md

@@ -9,10 +9,21 @@ restate its rules in the brief beyond the two below.
 ## Brief
 
 - Reviewer model: a different id from the implementer's
-  ([preflight.md](preflight.md#1-model-slots)). Take its model id and effort from
-  the plan's recorded reviewer slot, a model or effort the human named included,
-  and pass them as structured launch arguments (the spawn's model and effort
-  fields), never as brief text and never a model id hardcoded here.
+  ([preflight.md](preflight.md#1-model-slots)). Launch the reviewer with the
+  plan's recorded reviewer fill — its `launch`, `instructions`, `selection` and
+  native `catalogRevision` or portable `catalogDigest`
+  ([task-plan.md](task-plan.md#worker-selection-on-resume)) — as
+  structured launch arguments, never as brief text and never a model id
+  hardcoded here. On Pi that `launch` is what the live role resolver receives,
+  `{ role }` unless an explicit task override or this host's own preference
+  asked for a model or effort; never rebuild a pin from a recorded model id. On
+  another host it is the recorded payload, carrying only the controls that host
+  advertised. Check independence from what actually launched, not from the
+  recorded ids: the catalog preflight checks planned independence only, since
+  runtime prepares each launch without knowing the implementer's model. Verify
+  actual launch provenance yourself, on Pi and on other hosts, and block the
+  round if the actual reviewer matches the implementer or its actual identity
+  cannot be established, rather than yielding a review.
 - Context: spec, repository standards, target branch, unit branch and HEAD,
   parent PR when stacked or chained, exploration path, and the contracts the unit
   provides and builds on.
@@ -103,16 +114,18 @@ completed commands and findings, and why the review stopped. Resolve an open
 `executionIncident` first; ask the reviewer to record missing continuation details.
 
 For the same valid HEAD and scope, resume the same reviewer in the same round
-using its result file, review clone and retained context. Give it the unfinished
-work rather than repeating the whole assignment; preserve completed valid passes.
-A wrong HEAD or invalid scope must be corrected, not carried as completed proof.
+using its result file, review clone, recorded launch and retained context. Give it
+the unfinished work rather than repeating the whole assignment; preserve completed
+valid passes. A wrong HEAD or invalid scope must be corrected, not carried as
+completed proof.
 
 If that reviewer cannot continue, state why replacement is necessary, which
 retained evidence the replacement reads, and what it redoes before launching it.
 The replacement reviews every pass with `tier: "full"`. Keep the round number,
 `fixRound`, unit `attempt` and earlier round files; incompleteness neither resets
-history nor counts as progress. Use the plan's recorded model and effort in
-structured launch arguments as [the brief](#brief) requires.
+history nor counts as progress. Launch the replacement from the same recorded
+reviewer fill, in the same structured launch arguments as [the brief](#brief)
+requires; never invent or re-pick a model id for it.
 
 ## GitHub reviews