@1aboveio/skills 1.0.19 → 1.0.20

package/skills/engineering/engineering-runtime/coherence/workflow.json

@@ -369,7 +369,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "93ac20a3d5d41b233b13e521ba1b65d0a3e339958422a56ffad00a844656a23f",
+      "contentDigest": "46f0a76cadebab0a7de8dabf7a93eb194c7f41e0c872fa9c1a04dec86ee0fd88",
       "digestExcludes": []
     },
     {
@@ -382,7 +382,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "915715a605bf78f6f69cb8c95f7227548a6d71a6ef0ce502b5b5c5a357676d19",
+      "contentDigest": "e1a794446b04b5b70d356ceb9bbbe2a3c518eac486286d5905da98a3d038de65",
       "digestExcludes": []
     },
     {
@@ -395,7 +395,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "1ef2fd2ad328c373c7c6fe42007908766860cd8051e1807739797303aaadeae4",
+      "contentDigest": "451349ddb0393831abe922cd66c77dd96ea6a4bdd6950c1546e507f5d056dc84",
       "digestExcludes": []
     },
     {
@@ -408,7 +408,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "3c9509027191a2b2612f3905defb5ed9c47580709ba77b46c0e8433d354c4d33",
+      "contentDigest": "b4c6ae8cb2e708e3695330e65567aab4a301b963d86a4b6706c324fd5e56a36e",
       "digestExcludes": []
     },
     {
@@ -421,7 +421,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "5e419edc77397a9021a24fc9da83d07c83aa786853dcb24916d8fb2655f81ea9",
+      "contentDigest": "2dc4ffd9d459c1c61ff9472caf6b318bd45531995d8b8f142e775252c496b22b",
       "digestExcludes": []
     },
     {
@@ -434,7 +434,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "ecee12f24d18d49ec1be030e3f831c3d07a66f37b0b16aa5efef365ca381e558",
+      "contentDigest": "25ac49e98ce28203feccc17b4f85c67627db9c979511cca349df9dd1fe156d58",
       "digestExcludes": []
     },
     {
@@ -447,7 +447,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "2fbd1a9e15087045fa80b47d9b6db8695009c900c2e4aeeab71207875b071c74",
+      "contentDigest": "bde840d0e6ea6d333c48b47f2635c31c54e1e86a1beee21e26d5a9788c5f7977",
       "digestExcludes": []
     },
     {
@@ -460,7 +460,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "8c33282acdf9a7b3ba3adf46065249126efdd8669487ad7def1b4302155db3dd",
+      "contentDigest": "be04047cebb486d9f0b56c59705210038c13ce8f3f10c5ecf7acb361f3a56d0c",
       "digestExcludes": []
     },
     {
@@ -473,7 +473,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "e612b320be1b3aee539a26494e2048e0bbdc1947166fa4cffbdfe8085a64b50a",
+      "contentDigest": "d7c62210fdfdfa3504a056a8977aa3b67370b65f92d5d32e001fd394fabd44bd",
       "digestExcludes": []
     },
     {
@@ -486,7 +486,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "53732d354995ca40c0325b2f860a4facf2e79b9d6d373fbc76a5ce5b3a1f1e29",
+      "contentDigest": "f1acfff02ba2ddb0e0d4ffbcd9b5411a394b3b38e9a48ab2ab01ba46fb9bed1f",
       "digestExcludes": []
     },
     {
@@ -499,7 +499,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "61f8b7f04887b86338984f03527fdaf66ec90df7ff89c19ee9dca6f362fe212a",
+      "contentDigest": "cd858ed046f7c4ecb10817307e906a8057db5b8fb5a8c8e9334ef04aff34b9b2",
       "digestExcludes": []
     },
     {
@@ -512,13 +512,13 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "ad9bdbfbaeb4c575f8fad5b53367403096594aafce8e686926ddb734c185155a",
+      "contentDigest": "c3cbfef912ac7448710a7ed5a5014a76928d0350e2032c264c3e0a3212468b6d",
       "digestExcludes": [
         "coherence/workflow.json"
       ]
     }
   ],
-  "releaseIdentity": "2ed547516d442d0bfad21952001956420f71a972849049507530f80ad16eda83",
+  "releaseIdentity": "b2e273424d4ceb9a24d78ad163daeb516538defae3f7e6ebea4f59edb055df9a",
   "lifecycleAuthority": "native-skills-cli",
   "repairRecipe": {
     "id": "engineering-workflow-dependency-first",

package/skills/engineering/ensure-coverage/SKILL.md

@@ -2,7 +2,7 @@
 name: ensure-coverage
 description: "Define or audit behavior-first test criteria — ACs, required test levels, mock/integration/E2E policy — across three axes: breadth (Coverage Ledger), depth (over-mocking), presentation (perceivability of browser surfaces). NOT judging whether a single test is any good (test-quality), authoring browser tests (e2e-test), reviewing a PR (better-review), or delivering issues (resolve-issues)."
 disable-model-invocation: true
-release-version: 0.49.1
+release-version: 0.50.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Ensure Coverage

package/skills/engineering/golden-path/SKILL.md

@@ -3,7 +3,7 @@ name: golden-path
 description: "Golden-path E2E: the short list of user journeys whose failure blocks a release, kept in a repo as one contract (golden-paths.json) with a generated GOLDEN_PATHS.md and a generated GitHub Actions workflow, and run against a local build or a deployed URL for an ALIVE/DEAD verdict. Use to set golden paths up in a repo ('init golden paths', 'add golden-path CI'), to migrate an older smoke.manifest.json or a hand-built smoke setup ('audit', 'migrate smoke'), to add, change, or remove a golden path, to ask 'is the build alive?' or run them before a PR or release, or when a change touches a flow listed in GOLDEN_PATHS.md. NOT for writing the Playwright specs themselves (e2e-test), deciding what a change must prove (ensure-coverage), or general workflow YAML (github-actions)."
 dependencies:
   - e2e-test
-release-version: 0.49.1
+release-version: 0.50.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Golden path

package/skills/engineering/harness-runtime/SKILL.md

@@ -3,7 +3,7 @@ name: harness-runtime
 description: Internal import-only library shared by first-party engineering packages. Not a workflow skill; never select or invoke it as a user capability.
 disable-model-invocation: true
 user-invocable: false
-release-version: 0.49.1
+release-version: 0.50.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Harness Runtime

package/skills/engineering/resolve-issues/SKILL.md

@@ -8,7 +8,7 @@ dependencies:
   - better-review
   - golden-path
   - harness-runtime
-release-version: 0.49.1
+release-version: 0.50.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Resolve issues
@@ -63,8 +63,8 @@ preflight: ready label -> model fills -> plan draft
   -> when a unit's code is done, for that unit:
        rebase on its parent (stack, chain) or the target (wait)
        -> independent review, while CI runs -> review-verdict.mjs decides:
-          `pass`: review passes (P2 goes to the dropbox, never fixed
-          here; P3 is skipped); `fix`: only its fixBrief (P0/P1),
+          `pass`: review passes (route P2 by its contribution to delivery;
+          P3 is skipped); `fix`: its fixBrief (P0/P1) plus explicitly selected supporting P2,
           push, re-review; `review-again`: review again
        -> CI red: fix, push; after a passing review, carry it (no reviewer)
        -> review passed and CI green on one HEAD: mark ready
@@ -116,8 +116,10 @@ Read each procedure right before its stage; never substitute your own.
 - **The human.** Ask once, at the approval. Record every decision, correction, and scope change in
   `decisions` at once, and each standing instruction in `standingOrders`; re-read the standing orders on
   resume and before any push, enqueue, data write, or deletion. Default merge mode is `autonomous`.
-- **Proof.** Treat producer reports as claims until the reviewer or CI checks them. A check that exits 0 needs no
-  further evidence. A unit owes coding acceptance only: its criteria at its `proof.level` plus the required CI
+- **Proof.** Treat producer reports as claims until the reviewer or CI checks them. Tests and diagnostic probes
+  encode failure in their exit status under [Proof](references/implementation.md#proof); printing an exception
+  and returning 0 is not a passing check. Coordination CLIs keep their documented structured-verdict contracts.
+  A unit owes coding acceptance only: its criteria at its `proof.level` plus the required CI
   on its final HEAD. Integrated release acceptance (a device or system campaign the spec or repository assigns
   to a release or campaign gate) runs at that gate, never per unit; the handback links its owning issue. Produce
   no evidence documents; the plan, findings, and reviews are the only records.
@@ -169,7 +171,8 @@ efforts are run metadata, never a question.
 ### 2. Implement and open the PR
 
 Give each unit a branch, its prepared workspace, and an implementer with its findings entry
-and parents' contracts; state outcome and validation, not method. Refill
+and parents' contracts; retain its [implementation owner](references/implementation.md#implementation-owner)
+through review/CI fixes, separately from its active worker slot. State outcome and validation, not method. Refill
 slots at once. At a unit's first coherent commit its PR opens as a draft, so CI
 starts and the work is safe; later work goes to the same PR (in a Mergify stack
 repository, amend the one commit); review starts when its code is done
@@ -178,13 +181,13 @@ the unit's own PR branch need no approval.
 
 ### 3. Review
 
-Spawn one `better-review` reviewer once the unit's code is done, unless a
+Spawn one fresh `better-review` reviewer once the unit's code is done, unless a
 trusted complete result for that HEAD is posted on the PR; it runs alongside
 CI. From round 2, carry a HEAD that follows a pass, else pick the tier: a
 carry or skip writes its record and spawns no reviewer ([review.md](references/review.md#tier-then-verdict)).
 Merge [GitHub reviews](references/review.md#github-reviews) into its result,
 run `review-verdict.mjs`, and follow the `verdict` it prints (exit 0; 2 only if it could not run): `pass`; `fix`, give the
-`fixBrief` (P0/P1 only) to a fix worker as its `action` says, then review
+`fixBrief` (P0/P1), its retained reproducers and any selected supporting P2 under [dropbox routing](references/dropbox.md#supporting-p2-work) to the implementation owner as its `action` says, then review
 again; `review-again`; `handback`, defer the PR with its open findings; `wait`,
 request the awaited re-review; `decide`, answer the `decide` file
 ([expire.md](references/expire.md#decide-before-you-defer)) and rerun with `--decision`.

package/skills/engineering/resolve-issues/references/ci.md

@@ -105,7 +105,9 @@ provider shows that PR merged.
 
 Clean that unit's workspace and resources, then finish it, in every scheduler
 mode: `next-actions.mjs` prints `cleanup-workspace` until its cleanup settles.
-First record the intent through the [checkpoint mechanism](task-plan.md#checkpoints) (`lifecycle.cleanup`
+First [release any session retention still held](implementation.md#settle-session-retention)
+for it, even while other units remain active; a conversation launched without protection has
+nothing to release. Then record the intent through the [checkpoint mechanism](task-plan.md#checkpoints) (`lifecycle.cleanup`
 `{state: applying, headSha: <the unit's headSha>}`), then run:
 
 ```bash

package/skills/engineering/resolve-issues/references/delivery-progress.md

@@ -13,6 +13,12 @@ units keep their own checkpoints and continue in parallel within actual resource
   observation that would distinguish the remaining causes. Run the relevant host,
   integration or device check before another broad acceptance cycle. After a correction,
   run affected checks and the required delivery checks, not extra assurance work.
+- **Keep the repair's contract intact.** Reproduce the reported input/state and check
+  the observable result the existing criteria require. Reuse sufficient checks; an added
+  regression establishes the condition that reaches the failure. If that operation exposes
+  another failure of the same contract, continue the repair while preserving earlier
+  assertions. Return when affected criteria and required local checks pass, or an existing
+  stop/handback condition applies. This adds no fixed journey or test layer.
 - **Justify infrastructure before adding it.** State which existing criterion requires
   it, why the current path cannot provide that proof, and the smallest alternative.
   Record the choice in the existing decision/note, within current authorization. Routine
@@ -39,6 +45,13 @@ issue or automatic scheduler gate. They do not waive required validation.
 
 ## Every brief contains
 
+Use the full checklist for a fresh or replacement worker. For a retained conversation,
+send the new feedback, current checkpoint, latest failure/fix brief and local evidence,
+current standing orders and changed decisions, affected skill/proof pointers, and new
+result path. Re-read the saved source/criteria after context loss; do not resend the original
+role or whole assignment already in that session. This shorter continuation keeps the same
+acceptance bar, launch-authority rules and history; it is not a new setup or proof campaign.
+
 - the source and criteria, as a file already in the run directory
 - the plan's `standingOrders`, verbatim, and the decisions that answer this unit's questions
 - absolute run, workspace, and findings paths; for implementers, the unit's
@@ -51,6 +64,9 @@ issue or automatic scheduler gate. They do not waive required validation.
   test; retain the same checkpoint/history when changing workers
 - for a fix after a failed check or case, the last `failure` block (case, step, error,
   evidence path) verbatim, so the worker starts from the cause
+- for review fixes, the generated brief's `reproducers` with their original triggers,
+  source rounds/HEADs, command, workspace-relative cwd, expected result and retained evidence;
+  run them against the candidate, rather than replaying in the reviewer's old checkout
 - a concise worker-specific contract: business outcome and context, full acceptance,
   security and quality requirements, and principles relevant to the assigned work; a
   reviewer gets review.md's two rules instead. Do not forward coordinator scheduling

package/skills/engineering/resolve-issues/references/done.md

@@ -15,6 +15,13 @@ nothing is left to settle.
 
 ## Clean before handoff
 
+[Release any session retention still held](implementation.md#settle-session-retention) for each
+unit before normal workspace cleanup; this also applies at each merge while other units
+continue. A launch that asked for none has nothing to release, and an acknowledgement is
+recorded only where protection was actually held. Record any
+resource intentionally kept under the existing lifecycle; never claim it was cleaned
+because its worker exited.
+
 Clean every delivered unit's workspace and resources before the report, in every
 scheduler mode ([workspaces.md](workspaces.md#cleanup-after-delivery-before-finish)).
 Its `lifecycle.cleanup` is `complete`, or `retained` with the current `headSha`

package/skills/engineering/resolve-issues/references/dropbox.md

@@ -8,8 +8,9 @@ Workers report problems; you route them.
 
 ## Route every problem
 
-Ask these in order; the first yes decides. Never route by the stated P-number:
-labels miss in both directions.
+Skip P3: no repair, dropbox entry or follow-up issue. For the remaining problems,
+ask these in order; the first yes decides. A P2 label alone does not decide whether
+work supports this delivery.
 
 1. **Could it hurt someone now?** Security, auth, tenancy, money, data loss,
    a failure users see, a flake that knocks other PRs out of the queue, or a
@@ -19,15 +20,17 @@ labels miss in both directions.
    Example: a reviewer notes, as P2, that a provider webhook amount is parsed
    without a check, "unreachable today". The input is external: file it now.
 2. **Does it stop this unit from being finished or proven?** Small and in the
-   unit's files: fix it in the unit. A question: take its automatic answer
+   unit's files: fix it in the unit; for P2, first record the explicit selection
+   under [Supporting P2 work](#supporting-p2-work). A question: take its automatic answer
    ([preflight.md](preflight.md#never-block-on-the-human)); defer it only when it is human-only. Anything else outside the unit's files, code or
    environment: an [infrastructure failure](expire.md#infrastructure-failures).
    Example: the shared test helper the unit's tests need is broken on the
    target: an infrastructure failure.
 3. **Did this unit cause it?** Fix it in the unit, however small; it costs
    less now than as an issue. `dropbox.mjs check` decides (`inDiff` true inside the
-   unit's diff), and `add` refuses an implementer entry there. A reviewer's
-   P2 never starts a fix round: it stays in the dropbox marked `inDiff`.
+   unit's diff), and `add` refuses an implementer entry there. For a reviewer's P2,
+   `inDiff` records location, not repair authorization: apply the supporting-work
+   test below; otherwise keep it in the dropbox.
 4. **Would fixing it change nothing** for behavior or for a reader? A style
    nit, a smell no documented rule names, hardening the
    code shows cannot trigger (internal input only, and this unit adds no new
@@ -44,6 +47,28 @@ labels miss in both directions.
 Record a blocking relation with `--blocks <#n | owner/name#n | issue URL>`:
 the posted issue says `Blocks #n` so a later run takes it first.
 
+## Supporting P2 work
+
+Select a P2 for the current unit only when it directly enables an existing
+authorized outcome, agreed verification or delivery. For example, include the
+unit's new regression module in its existing CI test list. Nearby cleanup,
+optional hardening and unrelated performance work stay deferred, even inside the diff.
+
+Record the finding/dropbox id, existing criterion and concrete reason in the plan's
+`decisions`, and include that selection in the implementer or fix brief. Keep P2
+nonblocking: its severity alone changes no verdict, fix counter or acceptance bar.
+Use the existing implementation or fix work when available. When review already
+passed, return the unit to implementation for the selected repair while retaining
+its passed review. After the repair push, use the existing post-pass carry and final
+CI rules; it does not reopen the blocking review loop.
+
+After the selected work is verified, record its SHA and check result in the unit's
+existing result/note and mark the dropbox entry with `--drop "fixed on <sha>; <check
+and result>"` so it is not filed as unfinished work. Leave the original review
+unchanged. If the work is not completed, retain its pending entry and report it
+truthfully. Shared-environment changes and changes to required checks keep their
+existing authorization boundaries.
+
 ## Commands
 
 ```bash
@@ -56,7 +81,7 @@ node $D add --dropbox <run>/dropbox.json --unit <id> --source implementer \
   --summary "<one line: what is wrong>" [--pr <url>] [--blocks <issue>] \
   --git <workspace> --base <review base>
 # coordinator, after every review round, before the verdict: adds every P2 (P3 is skipped),
-# then route each new entry; questions 1, 4, 5 change it:
+# then route each new entry, including any explicitly selected supporting work:
 node $D from-review --dropbox <run>/dropbox.json --review <run>/reviews/<unit>-r<N>.json \
   --pr <url> --git <unit review clone> --base <review base>
 node $D post --dropbox <run>/dropbox.json --repo <owner/name> --ids D3   # 1: file now

package/skills/engineering/resolve-issues/references/expire.md

@@ -235,15 +235,18 @@ missing, or names a step without a reason.
 | Review: `review-verdict.mjs` verdict `fix` | Follow its `action` ([review.md](review.md#fix-loop)). |
 | Review: `review-verdict.mjs` verdict `handback` (`not-converging`) | Stop fixing; mark the unit `blocked` (`blockedReason: review-handback`) and defer the PR with its open findings on its issue. |
 | Review: `review-verdict.mjs` verdict `decide`, or a worker's `decisionNeeded` | [Decide before you defer](#decide-before-you-defer). |
-| CI: a fix cycle without progress | Treat the failing check as the failing test: the next fix worker runs on the escalation model with that check as its only target. 2 cycles in a row without progress: `blocked` (`blockedReason: retry-ci`), deferred on its issue. |
+| CI: a fix cycle without progress | Treat the failing check as the failing test: continue the implementation owner with the required escalation fill and that check as its only target, using the [continuation/replacement selection](task-plan.md#worker-selection-on-resume) rather than fabricating a pin. 2 cycles in a row without progress: `blocked` (`blockedReason: retry-ci`), deferred on its issue. |
 | Too big for one attempt | Resume in the kept workspace while each resume makes [progress](#retry-by-failure-mode); after 2 in a row without verified checkpoint/failure-count progress, draft a split in `<run>/splits/`, file it into the spec's tree, and run the slices the sync adds ([preflight.md](preflight.md#put-every-filed-issue-in-the-tree)). |
 | A required proof the unit has no environment for yet | The unit builds it; see [Proof stays with its unit](#proof-stays-with-its-unit). |
 | Dependency | Fix the edge; resume when runnable. |
 | A capability the unit needs is missing and no unit builds it (a shared driver, fixture, or hook) | Build it inside the first unit that needs it; units that need it later get `dependsOn` on that unit. Only when that puts the unit past the size check's line limit, file it as its own issue beside them, with `blocked_by` on the units that use it, never on their parent issue. Example: three proof units each need a device-state reader: the first builds it, the other two depend on the first. |
 | [Human-only](#human-only) blocker | Take its automatic answer ([preflight.md](preflight.md#never-block-on-the-human)); when that defers it, mark `blocked` (`blockedReason: human-decision`, its `humanItem` and `humanNeed`), keep the work, and record what is needed on its owning issue; never ship part of the unit. |
 
-Continue in the kept workspace with the findings entry, never the old
-transcript. Record a queue stall with the
+Continue the retained owner in the kept workspace with the current checkpoint, findings
+and failure evidence. If its process state or required selection prevents continuation,
+use an explicit replacement under the [owner contract](implementation.md#implementation-owner),
+keeping its old session reference for settlement; replacement briefs use those local facts
+rather than an old transcript. Keep the response limits and history above. Record a queue stall with the
 provider pending as a wait and watch again. End the run only when
 `next-actions.mjs`, invoked with [live capacity](implementation.md#live-capacity), prints `finish`, and never claim the spec complete.
 

package/skills/engineering/resolve-issues/references/implementation.md

@@ -53,6 +53,55 @@ independent clone prepared before its first spawn; after that, never pass
 `git_clone_workspace:true` again, and use `sandbox:false` only when the caller
 accepts unrestricted writes.
 
+## Implementation owner
+
+Keep one implementation conversation per unit through local proof, independent review,
+review fixes and CI repairs. Its saved conversation outlives the active worker slot: launch
+each worker normally, single or batch as the assignment needs, and record the receipt as
+`implementationOwner` ([task-plan.md](task-plan.md#shape)). `retain_session` is optional
+protection from later cleanup, not a precondition for continuing: a completed conversation is
+resumed by its `runId` whether or not retention was requested, and the harness never asks for
+it on resume. Request it only when this caller needs the conversation protected through a long
+wait before cleanup, using the exact argument the launched tool advertises and never inventing
+one for a call that lacks it. A parked owner has no live process and reserves no slot. The
+coordinator still owns scheduling, plan writes, external CI, readiness and delivery;
+reviewers use separate conversations.
+
+`next-actions.mjs` supplies `continuation`, `workerKind`, and, for
+`owner-resume`, `owner`. Resume that completed attempt with
+`subagent_resume({id: owner.runId, prompt: <current brief>})`; record the new attempt ID
+without changing the conversation ID. Selection follows [continuation versus new launch](task-plan.md#worker-selection-on-resume): omit model/effort for ordinary continuation. Use only
+authorized, supported explicit overrides; when a required role-only fill cannot be expressed
+by the resume API, replace from that fill with the retained evidence instead of creating a
+pin from its resolved model ID. Clear `worker` when an attempt
+ends, but keep `implementationOwner` while review or CI is pending. Keep all counters and
+earlier results across attempts. `one-by-one` fixes findings sequentially in this owner.
+
+A missing history/workspace, an unusable saved owner, or an owner that cannot continue
+requires an explicit replacement reason and the retained checkpoint, failures and reproducer
+references in the replacement brief. Try the saved conversation first: a `retentionReleased`
+marker says only that optional protection lapsed, so it is not a replacement reason by itself
+and the conversation it names usually still resumes. Report lost continuity; never label a
+new conversation a resume. Existing recovery/stop rules still apply, and old plans without
+an owner use the fresh-worker path. Do not install or update the harness during a run merely
+to obtain continuation.
+
+### Settle session retention
+
+When this unit settles (merged, cancelled, deferred or handed back merge-ready), release any
+retention still held for its `implementationOwner`, `reviewSession` and `retiredSessions` with
+`subagent_release({id: <runId>})` before its normal workspace/resource cleanup. Only a
+conversation launched with `retain_session` has anything to release, so a normal launch skips
+this and a second release is not owed. Record the acknowledgement on that reference when it
+was actually held; an unavailable or refused release stays explicit rather than being
+recorded as done.
+
+Reopening is the ordinary case: resume the saved conversation even when its protection was
+released, because release stops protection and leaves the history in place. Start a fresh
+replacement only when continuation is genuinely unavailable, and carry the original
+checkpoint/findings/counters into it. The same rule covers a released unfinished review,
+keeping its round and existing full-review fallback.
+
 ## Brief
 
 Add to SKILL.md's brief list: whole-spec context and neighboring unit
@@ -83,8 +132,8 @@ handback step. Never edit `findings.json`.
 
 ## Per-unit loop
 
-On `resume` (in flight, no worker, code not done), restart the unit's
-implementer in its kept workspace with the brief and its findings entry.
+On `resume` (in flight, no worker, code not done), continue the unit's
+[implementation owner](#implementation-owner) in its kept workspace with the current brief.
 
 1. **Implement:** change only the unit's scope; commit coherent progress.
 2. **Validate:** prove the criteria with the repository's checks: the
@@ -119,13 +168,25 @@ implementer in its kept workspace with the brief and its findings entry.
    not prohibit long local tests or builds needed for the assigned validation.
 
 After 2 fix cycles without progress, or a stuck or late worker, follow
-[expire.md](expire.md). Start the next worker in the same workspace with the
-findings entry, the failing command and its output, and `git diff <base>`,
-never the old
-transcript.
+[expire.md](expire.md). Apply the next response through the retained owner where its
+completed conversation and required launch controls permit continuation. A replacement
+uses the same workspace and the findings entry, failing command/output and `git diff <base>`;
+record why it replaces the owner and retain its session reference as above. Give replacement
+workers those local facts rather than copying the old transcript. Keep all progress counters.
 
 ## Proof
 
+- **Make diagnostic failures executable.** Reuse the existing test runner/assertions.
+  A standalone probe exits nonzero for an unexpected exception, failed assertion or
+  result outside the expected contract. A catch used to add context rethrows or sets
+  a nonzero exit; log capture and cleanup preserve that failure status. For shell
+  pipelines, preserve the tested command's failure, for example with `set -o pipefail`.
+  An expected-exception test passes only when it asserts the expected exception and
+  relevant contract details; no exception or the wrong exception fails. Assess the
+  process status under that contract, rather than having the model classify log text.
+  Coordination commands that exit 0 to return a structured verdict keep that protocol;
+  read their verdict as documented. Record the command, status and failing step in
+  the existing result/failure fields; no new harness or evidence document is needed.
 - Prove `browser` and `emulator` levels with the existing end-to-end suite;
   with none, the unit builds the journey its proof needs
   ([expire.md](expire.md#proof-stays-with-its-unit)).

package/skills/engineering/resolve-issues/references/review.md

@@ -8,6 +8,13 @@ restate its rules in the brief beyond the two below.
 
 ## Brief
 
+- Start a fresh reviewer conversation after each completed review round; the existing
+  scope script still chooses delta/full/skip, so freshness adds no review round or test
+  campaign. Give it retained records and code evidence as claims to verify, not an
+  implementer transcript. Launch it normally and keep its attempt reference as
+  `reviewSession`, separate from `implementationOwner`, so an unfinished same-HEAD round
+  can continue in that saved conversation; `retain_session` is optional protection, not
+  what makes it continuable. A round after a completed review is a fresh conversation.
 - Reviewer model: a different id from the implementer's
   ([preflight.md](preflight.md#1-model-slots)). Launch the reviewer with the
   plan's recorded reviewer fill — its `launch`, `instructions`, `selection` and
@@ -119,9 +126,23 @@ the unfinished work rather than repeating the whole assignment; preserve complet
 valid passes. A wrong HEAD or invalid scope must be corrected, not carried as
 completed proof.
 
+On Pi, use `subagent_resume({id: reviewSession.runId, prompt: <unfinished work>})`
+when that attempt completed as a process and its saved conversation is available;
+update only its attempt reference, keeping this review's round, HEAD and counter.
+A killed/lost attempt or an unavailable continuation follows replacement below. Once the
+review record is complete, the next required review is a fresh conversation. Clear an
+unpinned `reviewSession` directly. If it holds retention, release that protection before
+clearing; on failure, save its exact reference and error in `retiredSessions` before clearing
+so settlement can retry while the fresh review proceeds. Never use a reviewer as the
+implementation owner.
+
 If that reviewer cannot continue, state why replacement is necessary, which
 retained evidence the replacement reads, and what it redoes before launching it.
-The replacement reviews every pass with `tier: "full"`. Keep the round number,
+A `retentionReleased` marker on the old reference is not a reason by itself: released
+protection leaves the saved conversation in place, so try it again before replacing it.
+While an old reference is still worth resuming or still needs release, keep it as an entry
+in `retiredSessions` ([task-plan.md](task-plan.md#shape)) rather than dropping it; a later
+release of the new session does not release the old conversation. The replacement reviews every pass with `tier: "full"`. Keep the round number,
 `fixRound`, unit `attempt` and earlier round files; incompleteness neither resets
 history nor counts as progress. Launch the replacement from the same recorded
 reviewer fill, in the same structured launch arguments as [the brief](#brief)
@@ -221,10 +242,10 @@ the PR author; `github-reviews.mjs` reads them and decides what blocks.
 
 - **P0/P1** block (`better-review`'s severity table defines them): fix on the
   unit branch, validate, review again.
-- **P2** never blocks, never reaches a fix worker, and never starts a round.
-  Its dropbox entry is its whole disposition. Route each new entry by the
-  [dropbox questions](dropbox.md#route-every-problem): file it now, drop it,
-  or make it a decision when one says so.
+- **P2** never blocks or starts a blocking-fix round by severity alone. Route each
+  entry by the [dropbox questions](dropbox.md#route-every-problem); explicitly selected
+  [supporting P2 work](dropbox.md#supporting-p2-work) may be fixed in the unit.
+  Keep unrelated P2 in the dropbox; preserve the severity and review verdict.
 - **P3** is skipped: no dropbox entry, no issue, no round. A P3 that still
   reaches the result file (a posted result, an older reviewer) is ignored.
 - Dispose of every P0-P2 finding: `resolved` on the reviewed HEAD, or `deferred`
@@ -232,13 +253,24 @@ the PR author; `github-reviews.mjs` reads them and decides what blocks.
 
 ## Fix loop
 
-Give the fix worker only the `fixBrief`, and act on its `action`:
+Give the [implementation owner](implementation.md#implementation-owner) the `fixBrief`
+and act on its `action`. Keep the generated `reproducers` intact: their source rounds,
+HEADs and original triggers identify earlier witnesses, not passing results on this
+candidate. Read the retained cases and run against the candidate workspace at their
+relative `cwd`; preserve their input/state and expected contract when adapting a checkout
+path. `reproducerGaps` identifies malformed historical metadata without supplying a runnable
+command: inspect the original record, establish a valid candidate-local case, and report any
+remaining gap without rewriting history. Findings without an executable witness retain their
+existing requirement evidence.
+Add only supporting P2
+explicitly selected under [dropbox routing](dropbox.md#supporting-p2-work), with the
+recorded criterion and reason; the generated blocker list remains P0/P1 only.
 
 | `action` | When | Fix worker |
 |---|---|---|
 | `fix` | first blocking round | Make the smallest complete fix for each finding's `rule` and close every applicable row in its `paths`; do not require centralization. |
 | `test-first` | a P0/P1 survived the last fix | On the escalation model, for each `recurring` finding, before changing code: name the broken rule and its concrete open paths, reuse sufficient tests and add focused cases for missing proof, and see the open cases fail. Fix the rule until the applicable cases pass. A table-driven test may cover several paths; no new architecture is required. |
-| `one-by-one` | the last fix introduced new P0/P1 | One fix worker per finding, in turn, each with the smallest change that closes every row of its `paths` at the rule's owner. |
+| `one-by-one` | the last fix introduced new P0/P1 | The implementation owner fixes findings sequentially in its continued session, each with the smallest change that closes every row of its `paths` at the rule's owner. |
 
 **Fix the broken rule on every applicable path, without requiring a refactor.**
 A shared owner is useful when it makes the fix smaller and clearer; it is not a
@@ -251,8 +283,9 @@ different-person sign-in cases without inventing unrelated event combinations.
 Have each fix worker run the checks its change affects and return the
 commands and results; push, and let CI run. Then pick the new HEAD's
 [tier](#tier-then-verdict): a fix is delta or full, never skip, so spawn the
-next round's reviewer with the previous result file and the `fixBrief`. Deferred P2
-return only if now rated P1. Record `reviewedHead` only on a `pass` verdict. A later
+next round's fresh reviewer with the previous result file and the `fixBrief`, naming any
+supporting P2 changed in that patch. Deferred P2 return as findings only if now rated
+P1; evaluate changed supporting work as part of the fix diff. Record `reviewedHead` only on a `pass` verdict. A later
 commit, a CI fix included, needs its own `pass`: a [carry](#carry-after-a-pass) when this round passed.
 
 A `decide` verdict pauses the fix loop on a question: a spec finding came back after a

package/skills/engineering/resolve-issues/references/task-plan.md

@@ -92,6 +92,9 @@ Fleet `status`: `pending`, `in-flight`, `succeeded`, `failed`,
 | `attempt`, `retries`, `escalations` | Attempt number; cycle counts; escalation-model attempts |
 | `worker`, `workerSince`, `clock` | Slot identifier of any worker running for the unit (implementer, reviewer, fix), `null` when none; when that worker started (ISO time, for [stuck-worker checks](expire.md#waits)); attempt and cumulative wall time |
 | `workerKind` | `implement`, `fix`, or `review`, set with `worker`; the [live-capacity scheduler](implementation.md#live-capacity) (`next-actions.mjs`) prints `worker-kind` for any other kind or none. An infrastructure diagnosis or a test-first worker is a `fix` worker. The explorer is the `explore` fleet row's worker, never a unit's; a merge-queue watcher is not a worker |
+| `implementationOwner` | Optional saved implementation conversation: `{runId, sessionId?, cwd?, kind?, retentionReleased?}`. `runId` is its latest attempt; `kind` is `implement` (default) or `fix`, never `review`; `cwd`, when recorded, matches `workspace`. Save spawn/resume receipts here, independently of `worker`; a parked owner occupies no slot. The scheduler emits `owner-resume` for a usable owner or an explicit `ownerUnavailable` reason for replacement; `retentionReleased: true` only records that optional cleanup protection lapsed, so it never makes the owner unusable and the saved conversation stays the resume target while the harness holds it. Old plans remain readable. See [ownership](implementation.md#implementation-owner). |
+| `reviewSession` | Optional `{runId, sessionId?, head, round, retentionReleased?}` for the current unfinished review. Keep it only for same-HEAD/same-scope continuation, and clear it when that round completes so the next completed-review round starts fresh. A `retentionReleased` marker is history, not a reason to replace: try the same round's saved conversation while it exists. It is never an implementation owner or a slot reservation. |
+| `retiredSessions` | Optional references kept beside a replaced implementation owner or unfinished reviewer: `{runId, sessionId?, kind, retentionReleased?, reason?}`. Only for a conversation still worth resuming or still holding protection that must be released later; an ordinary resume or replacement needs no entry here, and a later release of the new session does not release an older conversation. |
 | `estimatedLines` | Preflight assessment estimate |
 | `sizeCheck` | Measures, `verdict` (the size check's per-unit verdict; `stop` means held), scope and proof verdicts, split or verification path; `runWhole: true` once a recommendation to run a held unit whole is accepted |
 | `note` | SHA, expiry reason code, failure and response, or blocker; for active debugging, the immediate acceptance checkpoint, baseline/result link and next distinguishing test ([delivery progress](../SKILL.md#delivery-progress)) |
@@ -142,7 +145,10 @@ what a later launch of the slot repeats; a pair of model ids is not.
 (`open`, `resolved`, `deferred`), `resolvedHead`, `dropboxId` or `followUpUrl`. Copy them
 from `review-verdict.mjs`: on `fix` its `fix` list as `open`; on `pass` its
 `deferred` list as `deferred` and every open P0/P1 as `resolved`. Never defer
-a P0/P1.
+a P0/P1. For selected [supporting P2 work](dropbox.md#supporting-p2-work), record the
+selection in `decisions`; after verification, mark its plan finding `resolved` with
+`resolvedHead` and put the check/result in the unit's existing note/result. Preserve
+the original review and retire its pending dropbox entry as documented there.
 
 `decisions` entry: id, timestamp, the human's words, what it changes,
 `supersedes` when it replaces one, and `answers`: the run-relative file of each
@@ -153,7 +159,16 @@ recommendation's reason; its human's words are the invocation.
 
 ### Worker selection on resume
 
-**A launch repeats the saved fill, never a reconstruction of it.** On Pi the
+Distinguish resuming the workflow from continuing one saved conversation. For an ordinary
+same-conversation `subagent_resume`, pass its attempt ID and new feedback, omitting role,
+model and effort so the harness preserves its recorded recipe. The resume tool's schema
+may differ from spawn: do not replay a role selector it cannot accept. A required changed
+selection can continue only through controls both explicitly authorized and advertised by
+that API; otherwise record why replacement is needed and launch fresh from the required
+fill with its retained evidence. A resolved role default alone never authorizes a model pin.
+Keep the original model/effort as run evidence and preserve all review/progress counters.
+
+**A fresh or replacement launch repeats the saved fill, never a reconstruction of it.** On Pi the
 launch authority stays the live role resolver ([shared-modules.md](shared-modules.md#model-slots)):
 its `launch` is `{ role }` unless an explicit task override or this host's own
 preference asked for a model or effort, and a resolved role default is never

package/skills/engineering/resolve-issues/scripts/dropbox.mjs

@@ -20,7 +20,8 @@
 //   --line, any change to the file counts)? Prints { inDiff, do }: `inDiff` true means fix it in this unit.
 // add: append one entry; the coordinator is the only writer. An implementer entry inside the
 //   unit's diff is refused (`refused` in the output) because the unit caused it. A review entry inside the diff
-//   is kept and marked `inDiff`: the review loop never fixes P2. The same location, kind and
+//   is kept and marked `inDiff`: the coordinator selects supporting work by the delivery
+//   criterion, not location or severity alone. The same location, kind and
 //   summary (or, for a review, the same unit and finding id) is one entry. `--decision` records
 //   a question for the human: never posted, listed in the handback. Prints { id, duplicate, inDiff }.
 // from-review: add every P2 in a review result that has no followUpUrl or dropboxId, and