@1aboveio/skills 1.0.19 → 1.0.21

package/skills/engineering/resolve-issues/references/implementation.md

@@ -27,7 +27,8 @@ the coordinator.
    not the backend suite.
 5. **Run focused checks locally; CI runs the rest.**
    Example: run the touched package's tests and typecheck, push, and let CI
-   run the full matrix. Never rebuild a release device campaign in a unit.
+   run the full matrix. Run release campaigns only at their assigned gate;
+   implement campaign automation when the current issue requests it.
 6. **Report in one short record and return.**
    Example: "Persists the Charge layout per installation. Ran charge tests
    and typecheck: pass. CI: pending. Pending: release device campaign
@@ -53,6 +54,55 @@ independent clone prepared before its first spawn; after that, never pass
 `git_clone_workspace:true` again, and use `sandbox:false` only when the caller
 accepts unrestricted writes.
 
+## Implementation owner
+
+Keep one implementation conversation per unit through local proof, independent review,
+review fixes and CI repairs. Its saved conversation outlives the active worker slot: launch
+each worker normally, single or batch as the assignment needs, and record the receipt as
+`implementationOwner` ([task-plan.md](task-plan.md#shape)). `retain_session` is optional
+protection from later cleanup, not a precondition for continuing: a completed conversation is
+resumed by its `runId` whether or not retention was requested, and the harness never asks for
+it on resume. Request it only when this caller needs the conversation protected through a long
+wait before cleanup, using the exact argument the launched tool advertises and never inventing
+one for a call that lacks it. A parked owner has no live process and reserves no slot. The
+coordinator still owns scheduling, plan writes, external CI, readiness and delivery;
+reviewers use separate conversations.
+
+`next-actions.mjs` supplies `continuation`, `workerKind`, and, for
+`owner-resume`, `owner`. Resume that completed attempt with
+`subagent_resume({id: owner.runId, prompt: <current brief>})`; record the new attempt ID
+without changing the conversation ID. Selection follows [continuation versus new launch](task-plan.md#worker-selection-on-resume): omit model/effort for ordinary continuation. Use only
+authorized, supported explicit overrides; when a required role-only fill cannot be expressed
+by the resume API, replace from that fill with the retained evidence instead of creating a
+pin from its resolved model ID. Clear `worker` when an attempt
+ends, but keep `implementationOwner` while review or CI is pending. Keep all counters and
+earlier results across attempts. `one-by-one` fixes findings sequentially in this owner.
+
+A missing history/workspace, an unusable saved owner, or an owner that cannot continue
+requires an explicit replacement reason and the retained checkpoint, failures and reproducer
+references in the replacement brief. Try the saved conversation first: a `retentionReleased`
+marker says only that optional protection lapsed, so it is not a replacement reason by itself
+and the conversation it names usually still resumes. Report lost continuity; never label a
+new conversation a resume. Existing recovery/stop rules still apply, and old plans without
+an owner use the fresh-worker path. Do not install or update the harness during a run merely
+to obtain continuation.
+
+### Settle session retention
+
+When this unit settles (merged, cancelled, deferred or handed back merge-ready), release any
+retention still held for its `implementationOwner`, `reviewSession` and `retiredSessions` with
+`subagent_release({id: <runId>})` before its normal workspace/resource cleanup. Only a
+conversation launched with `retain_session` has anything to release, so a normal launch skips
+this and a second release is not owed. Record the acknowledgement on that reference when it
+was actually held; an unavailable or refused release stays explicit rather than being
+recorded as done.
+
+Reopening is the ordinary case: resume the saved conversation even when its protection was
+released, because release stops protection and leaves the history in place. Start a fresh
+replacement only when continuation is genuinely unavailable, and carry the original
+checkpoint/findings/counters into it. The same rule covers a released unfinished review,
+keeping its round and existing full-review fallback.
+
 ## Brief
 
 Add to SKILL.md's brief list: whole-spec context and neighboring unit
@@ -83,8 +133,8 @@ handback step. Never edit `findings.json`.
 
 ## Per-unit loop
 
-On `resume` (in flight, no worker, code not done), restart the unit's
-implementer in its kept workspace with the brief and its findings entry.
+On `resume` (in flight, no worker, code not done), continue the unit's
+[implementation owner](#implementation-owner) in its kept workspace with the current brief.
 
 1. **Implement:** change only the unit's scope; commit coherent progress.
 2. **Validate:** prove the criteria with the repository's checks: the
@@ -107,8 +157,10 @@ implementer in its kept workspace with the brief and its findings entry.
    step, error message and evidence path the worker observed. An exit code alone is
    not a failure; keep the first failure separate from cleanup errors. Fix workers
    write the same file. Return
-   nothing else: no artifact hashes, version inventories, screenshots,
-   copied logs, or earlier attempts. For a continuation, include the current checkpoint,
+   only that result by default. When the issue or repository requires a checklist
+   or evidence document, produce it from actual results and link CI artifacts;
+   otherwise omit artifact hashes, inventories, screenshots and copied logs.
+   For a continuation, include the current checkpoint,
    outcome and relevant prior-result links in the existing integration notes; do not
    duplicate the full attempt history. After focused validation, the permitted push,
    and the result, return without waiting for external CI or PR monitoring. Report
@@ -119,13 +171,30 @@ implementer in its kept workspace with the brief and its findings entry.
    not prohibit long local tests or builds needed for the assigned validation.
 
 After 2 fix cycles without progress, or a stuck or late worker, follow
-[expire.md](expire.md). Start the next worker in the same workspace with the
-findings entry, the failing command and its output, and `git diff <base>`,
-never the old
-transcript.
+[expire.md](expire.md). Apply the next response through the retained owner where its
+completed conversation and required launch controls permit continuation. A replacement
+uses the same workspace and the findings entry, failing command/output and `git diff <base>`;
+record why it replaces the owner and retain its session reference as above. Give replacement
+workers those local facts rather than copying the old transcript. Keep all progress counters.
 
 ## Proof
 
+- **Implement the acceptance contract.** Read the issue's Acceptance Criteria and
+  the preflight mapping. Reuse sufficient tests and add missing assertions at the
+  lowest level that exercises the required behavior. Ensure CI selects and executes
+  them in the assigned lane. Return test/criterion references and pending CI or manual
+  obligations in the existing result; the coordinator qualifies acceptance.
+- **Make diagnostic failures executable.** Reuse the existing test runner/assertions.
+  A standalone probe exits nonzero for an unexpected exception, failed assertion or
+  result outside the expected contract. A catch used to add context rethrows or sets
+  a nonzero exit; log capture and cleanup preserve that failure status. For shell
+  pipelines, preserve the tested command's failure, for example with `set -o pipefail`.
+  An expected-exception test passes only when it asserts the expected exception and
+  relevant contract details; no exception or the wrong exception fails. Assess the
+  process status under that contract, rather than having the model classify log text.
+  Coordination commands that exit 0 to return a structured verdict keep that protocol;
+  read their verdict as documented. Record the command, status and failing step in
+  the existing result/failure fields; no new harness or evidence document is needed.
 - Prove `browser` and `emulator` levels with the existing end-to-end suite;
   with none, the unit builds the journey its proof needs
   ([expire.md](expire.md#proof-stays-with-its-unit)).
@@ -165,12 +234,11 @@ transcript.
   failure ([expire.md](expire.md#infrastructure-failures)): one bounded
   investigation that fixes what the run can; a shared blocker issue only
   when the cause stays unfound or its fix is human-only. Keep the rest moving.
-- Keep `proof.physical` and integrated release acceptance out of the unit's
-  acceptance. A device campaign, all-ABI or signed build, or cross-feature
-  journey the spec or repository assigns to a release or campaign gate runs
-  at that gate: never rebuild it in the unit. Report it as pending in the
-  result; the coordinator records it once in its owning issue, never as
-  passed.
+- Keep `proof.physical` and explicitly assigned later release acceptance pending
+  at their named gate and owning issue. Build the automated tests the current issue
+  requests even when CI runs them as a campaign. If the current issue requests the
+  campaign's result, test implementation alone is not completion. Report manual or
+  unavailable checks as pending, never passed.
 
 ## Scheduling
 
@@ -323,11 +391,15 @@ parent another child holds.
    line's PRs bottom first (`--base <targetBranch>` when it is not the default
    branch); with the Mergify stack hooks installed, push with the `mergify`
    skill's `stack-push.mjs` instead. Keep the body to one short record:
-   `Closes #<issue>`, the behavior delivered, the checks run with their
+   the issue link, the behavior delivered, the checks run with their
    results, and any outstanding blocker or pending obligation as an issue
    link; add the parent PR in `stack` and `chain` mode. CI posts its own run link; cite
    CI-generated artifacts where provenance is required, never hashes or
    logs copied by hand.
+   Use `Closes #<issue>` only when merging this PR will satisfy that issue's own
+   acceptance contract. With outstanding manual or post-merge acceptance, use
+   `Refs #<issue>` in both the PR body and commit message so merging automation
+   does not close the original issue. The coordinator closes it after acceptance.
 3. Record the PR URL and `headSha`; once the code is done, start review while CI runs. Mark the
    PR ready only when review passes and CI is green on the same HEAD
    ([ci.md](ci.md)).

package/skills/engineering/resolve-issues/references/preflight.md

@@ -155,6 +155,12 @@ Example: epic #12's #20 (signed release and go/no-go) and #21
 (physical acceptance) stay out of the plan; the run ends when its code units
 land instead of waiting on them.
 
+An automated browser or emulator acceptance campaign is implementable work, including
+when it proves already-merged features. Include its tests, CI execution and requested
+results in scope. For mixed automated/manual criteria, keep the automation unit and
+record the human-only remainder with its owner; report the original issue incomplete
+until that remainder passes. Exclusion records a pending obligation, not acceptance.
+
 ## 4. Assess the plan
 
 Follow [exploration.md](exploration.md#choose-the-owner) on the provisional

package/skills/engineering/resolve-issues/references/review.md

@@ -8,6 +8,13 @@ restate its rules in the brief beyond the two below.
 
 ## Brief
 
+- Start a fresh reviewer conversation after each completed review round; the existing
+  scope script still chooses delta/full/skip, so freshness adds no review round or test
+  campaign. Give it retained records and code evidence as claims to verify, not an
+  implementer transcript. Launch it normally and keep its attempt reference as
+  `reviewSession`, separate from `implementationOwner`, so an unfinished same-HEAD round
+  can continue in that saved conversation; `retain_session` is optional protection, not
+  what makes it continuable. A round after a completed review is a fresh conversation.
 - Reviewer model: a different id from the implementer's
   ([preflight.md](preflight.md#1-model-slots)). Launch the reviewer with the
   plan's recorded reviewer fill — its `launch`, `instructions`, `selection` and
@@ -119,9 +126,23 @@ the unfinished work rather than repeating the whole assignment; preserve complet
 valid passes. A wrong HEAD or invalid scope must be corrected, not carried as
 completed proof.
 
+On Pi, use `subagent_resume({id: reviewSession.runId, prompt: <unfinished work>})`
+when that attempt completed as a process and its saved conversation is available;
+update only its attempt reference, keeping this review's round, HEAD and counter.
+A killed/lost attempt or an unavailable continuation follows replacement below. Once the
+review record is complete, the next required review is a fresh conversation. Clear an
+unpinned `reviewSession` directly. If it holds retention, release that protection before
+clearing; on failure, save its exact reference and error in `retiredSessions` before clearing
+so settlement can retry while the fresh review proceeds. Never use a reviewer as the
+implementation owner.
+
 If that reviewer cannot continue, state why replacement is necessary, which
 retained evidence the replacement reads, and what it redoes before launching it.
-The replacement reviews every pass with `tier: "full"`. Keep the round number,
+A `retentionReleased` marker on the old reference is not a reason by itself: released
+protection leaves the saved conversation in place, so try it again before replacing it.
+While an old reference is still worth resuming or still needs release, keep it as an entry
+in `retiredSessions` ([task-plan.md](task-plan.md#shape)) rather than dropping it; a later
+release of the new session does not release the old conversation. The replacement reviews every pass with `tier: "full"`. Keep the round number,
 `fixRound`, unit `attempt` and earlier round files; incompleteness neither resets
 history nor counts as progress. Launch the replacement from the same recorded
 reviewer fill, in the same structured launch arguments as [the brief](#brief)
@@ -221,10 +242,10 @@ the PR author; `github-reviews.mjs` reads them and decides what blocks.
 
 - **P0/P1** block (`better-review`'s severity table defines them): fix on the
   unit branch, validate, review again.
-- **P2** never blocks, never reaches a fix worker, and never starts a round.
-  Its dropbox entry is its whole disposition. Route each new entry by the
-  [dropbox questions](dropbox.md#route-every-problem): file it now, drop it,
-  or make it a decision when one says so.
+- **P2** never blocks or starts a blocking-fix round by severity alone. Route each
+  entry by the [dropbox questions](dropbox.md#route-every-problem); explicitly selected
+  [supporting P2 work](dropbox.md#supporting-p2-work) may be fixed in the unit.
+  Keep unrelated P2 in the dropbox; preserve the severity and review verdict.
 - **P3** is skipped: no dropbox entry, no issue, no round. A P3 that still
   reaches the result file (a posted result, an older reviewer) is ignored.
 - Dispose of every P0-P2 finding: `resolved` on the reviewed HEAD, or `deferred`
@@ -232,13 +253,24 @@ the PR author; `github-reviews.mjs` reads them and decides what blocks.
 
 ## Fix loop
 
-Give the fix worker only the `fixBrief`, and act on its `action`:
+Give the [implementation owner](implementation.md#implementation-owner) the `fixBrief`
+and act on its `action`. Keep the generated `reproducers` intact: their source rounds,
+HEADs and original triggers identify earlier witnesses, not passing results on this
+candidate. Read the retained cases and run against the candidate workspace at their
+relative `cwd`; preserve their input/state and expected contract when adapting a checkout
+path. `reproducerGaps` identifies malformed historical metadata without supplying a runnable
+command: inspect the original record, establish a valid candidate-local case, and report any
+remaining gap without rewriting history. Findings without an executable witness retain their
+existing requirement evidence.
+Add only supporting P2
+explicitly selected under [dropbox routing](dropbox.md#supporting-p2-work), with the
+recorded criterion and reason; the generated blocker list remains P0/P1 only.
 
 | `action` | When | Fix worker |
 |---|---|---|
 | `fix` | first blocking round | Make the smallest complete fix for each finding's `rule` and close every applicable row in its `paths`; do not require centralization. |
 | `test-first` | a P0/P1 survived the last fix | On the escalation model, for each `recurring` finding, before changing code: name the broken rule and its concrete open paths, reuse sufficient tests and add focused cases for missing proof, and see the open cases fail. Fix the rule until the applicable cases pass. A table-driven test may cover several paths; no new architecture is required. |
-| `one-by-one` | the last fix introduced new P0/P1 | One fix worker per finding, in turn, each with the smallest change that closes every row of its `paths` at the rule's owner. |
+| `one-by-one` | the last fix introduced new P0/P1 | The implementation owner fixes findings sequentially in its continued session, each with the smallest change that closes every row of its `paths` at the rule's owner. |
 
 **Fix the broken rule on every applicable path, without requiring a refactor.**
 A shared owner is useful when it makes the fix smaller and clearer; it is not a
@@ -251,8 +283,9 @@ different-person sign-in cases without inventing unrelated event combinations.
 Have each fix worker run the checks its change affects and return the
 commands and results; push, and let CI run. Then pick the new HEAD's
 [tier](#tier-then-verdict): a fix is delta or full, never skip, so spawn the
-next round's reviewer with the previous result file and the `fixBrief`. Deferred P2
-return only if now rated P1. Record `reviewedHead` only on a `pass` verdict. A later
+next round's fresh reviewer with the previous result file and the `fixBrief`, naming any
+supporting P2 changed in that patch. Deferred P2 return as findings only if now rated
+P1; evaluate changed supporting work as part of the fix diff. Record `reviewedHead` only on a `pass` verdict. A later
 commit, a CI fix included, needs its own `pass`: a [carry](#carry-after-a-pass) when this round passed.
 
 A `decide` verdict pauses the fix loop on a question: a spec finding came back after a

package/skills/engineering/resolve-issues/references/task-plan.md

@@ -92,6 +92,9 @@ Fleet `status`: `pending`, `in-flight`, `succeeded`, `failed`,
 | `attempt`, `retries`, `escalations` | Attempt number; cycle counts; escalation-model attempts |
 | `worker`, `workerSince`, `clock` | Slot identifier of any worker running for the unit (implementer, reviewer, fix), `null` when none; when that worker started (ISO time, for [stuck-worker checks](expire.md#waits)); attempt and cumulative wall time |
 | `workerKind` | `implement`, `fix`, or `review`, set with `worker`; the [live-capacity scheduler](implementation.md#live-capacity) (`next-actions.mjs`) prints `worker-kind` for any other kind or none. An infrastructure diagnosis or a test-first worker is a `fix` worker. The explorer is the `explore` fleet row's worker, never a unit's; a merge-queue watcher is not a worker |
+| `implementationOwner` | Optional saved implementation conversation: `{runId, sessionId?, cwd?, kind?, retentionReleased?}`. `runId` is its latest attempt; `kind` is `implement` (default) or `fix`, never `review`; `cwd`, when recorded, matches `workspace`. Save spawn/resume receipts here, independently of `worker`; a parked owner occupies no slot. The scheduler emits `owner-resume` for a usable owner or an explicit `ownerUnavailable` reason for replacement; `retentionReleased: true` only records that optional cleanup protection lapsed, so it never makes the owner unusable and the saved conversation stays the resume target while the harness holds it. Old plans remain readable. See [ownership](implementation.md#implementation-owner). |
+| `reviewSession` | Optional `{runId, sessionId?, head, round, retentionReleased?}` for the current unfinished review. Keep it only for same-HEAD/same-scope continuation, and clear it when that round completes so the next completed-review round starts fresh. A `retentionReleased` marker is history, not a reason to replace: try the same round's saved conversation while it exists. It is never an implementation owner or a slot reservation. |
+| `retiredSessions` | Optional references kept beside a replaced implementation owner or unfinished reviewer: `{runId, sessionId?, kind, retentionReleased?, reason?}`. Only for a conversation still worth resuming or still holding protection that must be released later; an ordinary resume or replacement needs no entry here, and a later release of the new session does not release an older conversation. |
 | `estimatedLines` | Preflight assessment estimate |
 | `sizeCheck` | Measures, `verdict` (the size check's per-unit verdict; `stop` means held), scope and proof verdicts, split or verification path; `runWhole: true` once a recommendation to run a held unit whole is accepted |
 | `note` | SHA, expiry reason code, failure and response, or blocker; for active debugging, the immediate acceptance checkpoint, baseline/result link and next distinguishing test ([delivery progress](../SKILL.md#delivery-progress)) |
@@ -142,7 +145,10 @@ what a later launch of the slot repeats; a pair of model ids is not.
 (`open`, `resolved`, `deferred`), `resolvedHead`, `dropboxId` or `followUpUrl`. Copy them
 from `review-verdict.mjs`: on `fix` its `fix` list as `open`; on `pass` its
 `deferred` list as `deferred` and every open P0/P1 as `resolved`. Never defer
-a P0/P1.
+a P0/P1. For selected [supporting P2 work](dropbox.md#supporting-p2-work), record the
+selection in `decisions`; after verification, mark its plan finding `resolved` with
+`resolvedHead` and put the check/result in the unit's existing note/result. Preserve
+the original review and retire its pending dropbox entry as documented there.
 
 `decisions` entry: id, timestamp, the human's words, what it changes,
 `supersedes` when it replaces one, and `answers`: the run-relative file of each
@@ -153,7 +159,16 @@ recommendation's reason; its human's words are the invocation.
 
 ### Worker selection on resume
 
-**A launch repeats the saved fill, never a reconstruction of it.** On Pi the
+Distinguish resuming the workflow from continuing one saved conversation. For an ordinary
+same-conversation `subagent_resume`, pass its attempt ID and new feedback, omitting role,
+model and effort so the harness preserves its recorded recipe. The resume tool's schema
+may differ from spawn: do not replay a role selector it cannot accept. A required changed
+selection can continue only through controls both explicitly authorized and advertised by
+that API; otherwise record why replacement is needed and launch fresh from the required
+fill with its retained evidence. A resolved role default alone never authorizes a model pin.
+Keep the original model/effort as run evidence and preserve all review/progress counters.
+
+**A fresh or replacement launch repeats the saved fill, never a reconstruction of it.** On Pi the
 launch authority stays the live role resolver ([shared-modules.md](shared-modules.md#model-slots)):
 its `launch` is `{ role }` unless an explicit task override or this host's own
 preference asked for a model or effort, and a resolved role default is never

package/skills/engineering/resolve-issues/scripts/dropbox.mjs

@@ -20,7 +20,8 @@
 //   --line, any change to the file counts)? Prints { inDiff, do }: `inDiff` true means fix it in this unit.
 // add: append one entry; the coordinator is the only writer. An implementer entry inside the
 //   unit's diff is refused (`refused` in the output) because the unit caused it. A review entry inside the diff
-//   is kept and marked `inDiff`: the review loop never fixes P2. The same location, kind and
+//   is kept and marked `inDiff`: the coordinator selects supporting work by the delivery
+//   criterion, not location or severity alone. The same location, kind and
 //   summary (or, for a review, the same unit and finding id) is one entry. `--decision` records
 //   a question for the human: never posted, listed in the handback. Prints { id, duplicate, inDiff }.
 // from-review: add every P2 in a review result that has no followUpUrl or dropboxId, and

package/skills/engineering/resolve-issues/scripts/next-actions.mjs

@@ -5,7 +5,7 @@
 //   next-actions.mjs --run <run dir> [--capacity-json '<snapshot>' | --slots N] [--quiet-minutes 45] [--resume] [--sync] [--json] [--peek] [--mode full|narrow|off] [--rules] [--exit-due]
 //
 // Reads <run>/task-plan.json (units with status, stage, worker, workerSince, workspace,
-// dependsOn, pr, headSha, reviewedHead) and <run>/reviews/<unit>-r<N>.json (+ .fix.json; its head, complete, and
+// implementationOwner, dependsOn, pr, headSha, reviewedHead) and <run>/reviews/<unit>-r<N>.json (+ .fix.json; its head, complete, and
 // external.awaiting, and whether it holds a P0/P1). A unit with `worker`
 // set is busy. Actions, in priority order:
 //
@@ -75,6 +75,28 @@
 //                   fetch failed, it prints `sync` instead. A run never finishes on a tree it
 //                   could not read
 //
+// A unit's optional `implementationOwner` is the retained implement-or-fix conversation that outlives
+// the worker slot, recorded from the harness as { runId, sessionId?, cwd?, kind }: `runId` is the
+// attempt to resume, `kind` ("implement" or "fix", default "implement") says which worker owned it,
+// and `sessionId` and `cwd` (the unit's workspace) identify that conversation and its tree. It is
+// independent of `worker`, which records whichever worker is active now, so the owner survives the
+// review phase and a later fix continues the same conversation instead of starting over.
+//
+// Every action that spawns a worker therefore carries the structured continuation the coordinator
+// launches, beside its name: `continuation: "fresh"` for a first start or a new worker, launched
+// normally, with no retention argument (a saved conversation stays continuable by its id;
+// `retain_session: true` is optional protection a caller adds only for a long wait before cleanup).
+// Implement and fix sessions become the unit's owner; `continuation: "owner-resume"` with
+// `owner: { runId, kind, sessionId?, cwd? }` for a fix, a restack, or an unfinished implementation
+// whose owner is still usable (subagent_resume({ id: owner.runId, ... }) returns a new attempt on
+// the same conversation). `workerKind` names the slot the action launches. A review round is
+// always a fresh reviewer: a finished review
+// is never resumed, and a review recorded as an owner is not usable. An owner without a `runId`,
+// with a `kind` outside implement and fix, or whose `cwd` is not the unit's workspace is not usable,
+// so a fresh action reports ownerUnavailable rather than claiming continuity. A `retentionReleased`
+// marker records that optional protection lapsed, so it never makes an owner unusable. A completed
+// worker holds no slot: the owner is a reference, never an occupancy.
+//
 // Text output ends with one short line pointing to the skill path. With --resume or --rules it
 // ends with RULES instead, the rules a compaction summary most often drops (in narrow and off
 // modes, a one-line rules reminder for that mode).
@@ -120,6 +142,13 @@ import { BLOCKING } from './review-verdict.mjs'
 // No skill-owned concurrency default: the caller supplies fresh host capacity.
 // The only workers a unit runs (SKILL.md, Your role). A watcher is not a worker.
 export const WORKER_KINDS = Object.freeze(['implement', 'fix', 'review'])
+// The worker each worker-spawning action launches, in the plan's `workerKind` vocabulary. These are
+// the actions that carry a structured continuation (`continuation`, `workerKind`, `owner`) for the
+// coordinator.
+export const WORKER_ACTION_KINDS = Object.freeze({ 'fill-slot': 'implement', resume: 'implement', 'start-fix': 'fix', restack: 'fix', 'start-review': 'review' })
+// The kinds that may own a unit's implementation. A review is never resumed for the next round, so
+// it is not one.
+export const IMPLEMENTATION_OWNER_KINDS = Object.freeze(['implement', 'fix'])
 export const SKILL_PATH = join(dirname(dirname(fileURLToPath(import.meta.url))), 'SKILL.md')
 // Printed after every text call, and by rehydrate.mjs after a compaction.
 export const RULES = 'Per unit, run only implement, fix, and review workers, recorded as workerKind: no planning, architecture, product, or setup workers. You own preflight findings; use an optional explorer on the fleet explore row only for concrete planning unknowns (exploration.md). You coordinate: never edit product code. In full mode take every step from next-actions.mjs; in every mode the run ends only when it reports done. A HEAD after a passing review is carried; any other new HEAD takes the tier rereview-scope.mjs picks, never yours. Decide before you defer: a question a worker or review raises is answered and recorded, then the unit continues; retrying or deferring never answers it. Never block on the human: take the automatic answer and keep going. Fix the root cause, never only its symptom. Before each scheduling pass, refresh subagent_settings and pass its snapshot with --capacity-json; do not reuse a run-start budget or subtract workflow workers again.'
@@ -176,6 +205,25 @@ export function normalizeCapacity(input) {
 const hasWorker = (u) => u.worker !== undefined && u.worker !== null && u.worker !== ''
 const codeDone = (u) => u.stage === 'done'
 
+// A unit's usable implementation owner, normalized to { runId, kind, sessionId?, cwd? }, or null.
+// Usable means it names the attempt to resume (`runId`), its `kind` is an implement or fix worker
+// (never a reviewer: a finished review is never resumed for the next round), and, when both are
+// recorded, its `cwd` is the unit's workspace (a conversation cannot be resumed in another tree).
+// A plan that records nothing here keeps today's behavior: a fresh worker.
+export function implementationOwnerOf(unit) {
+  const saved = unit?.implementationOwner
+  if (!saved || typeof saved !== 'object' || Array.isArray(saved)) return null
+  if (saved.cwd !== undefined && saved.cwd !== null && typeof saved.cwd !== 'string') return null
+  const runId = typeof saved.runId === 'string' ? saved.runId.trim() : ''
+  const kind = saved.kind === undefined ? 'implement' : saved.kind
+  if (!runId || !IMPLEMENTATION_OWNER_KINDS.includes(kind)) return null
+  const cwd = typeof saved.cwd === 'string' ? saved.cwd.trim() : ''
+  const workspace = typeof unit.workspace === 'string' ? unit.workspace.trim() : ''
+  if (cwd && workspace && cwd !== workspace) return null
+  const sessionId = typeof saved.sessionId === 'string' ? saved.sessionId.trim() : ''
+  return { runId, kind, ...(sessionId ? { sessionId } : {}), ...(cwd ? { cwd } : {}) }
+}
+
 export function workspaceCleanupSettled(unit) {
   const result = unit.lifecycle?.cleanup
   return typeof unit.headSha === 'string' && unit.headSha.length > 0 && result?.headSha === unit.headSha &&
@@ -338,6 +386,18 @@ export function nextActions(plan, reviews = {}, capacity, { resume = false, now,
   }
   const actions = []
   const add = (action, u, detail) => actions.push({ action, unit: String(u.id), detail })
+  // Keep owners through delivery and their saved conversations through later repair.
+  // A new review round starts fresh even when the preceding session remains available.
+  const continuationFor = (u, workerKind) => {
+    const owner = workerKind === 'review' ? null : implementationOwnerOf(u)
+    if (owner) return { continuation: 'owner-resume', workerKind, owner }
+    const ownerUnavailable = workerKind !== 'review' && u.implementationOwner != null
+      ? 'Saved implementationOwner is malformed, names another role, or does not match the unit workspace; record replacement and retain its evidence.' : undefined
+    return { continuation: 'fresh', workerKind, ...(ownerUnavailable ? { ownerUnavailable } : {}) }
+  }
+  // Appended to an owner-resumed action: the work is the same, so the action keeps its name; only
+  // the launch changes, and it is a resume rather than a second worker for the unit.
+  const ownerNote = (id, owner) => `; launch it as a resume of unit ${id}'s implementation owner: subagent_resume({ id: ${JSON.stringify(owner.runId)}, prompt: <that brief or task> }) returns a new attempt on the same conversation${owner.sessionId ? ` (session ${owner.sessionId})` : ''}${owner.cwd ? ` in ${owner.cwd}` : ''}; record the returned id as implementationOwner.runId and keep the owner through review`
   const managed = (u) => plan.workspaceLifecycle === 1 || u.lifecycle?.version === 1
   for (const u of units) {
     if (TERMINAL.has(u.status) && hasWorker(u) && (u.status !== 'blocked' || reasonOk(u))) {
@@ -346,7 +406,7 @@ export function nextActions(plan, reviews = {}, capacity, { resume = false, now,
     }
     if (!managed(u) || u.status !== 'succeeded' || !u.workspace) continue
     if (!hasWorker(u) && !workspaceCleanupSettled(u)) {
-      add('cleanup-workspace', u, `unit ${u.id} landed: record lifecycle.cleanup with state applying and headSha ${u.headSha ?? '(record the delivered HEAD first)'}, then run cleanup-runs.mjs cleanup --run <run> --unit ${u.id} --revision <saved planRevision> --apply --json; inspect and persist the returned lifecycle. A refusal is retained with its reason, never complete; do this before finish and alongside independent units`)
+      add('cleanup-workspace', u, `unit ${u.id} landed: release any retain_session protection it still holds and record that acknowledgement (implementation.md#settle-session-retention), then record lifecycle.cleanup with state applying and headSha ${u.headSha ?? '(record the delivered HEAD first)'}, then run cleanup-runs.mjs cleanup --run <run> --unit ${u.id} --revision <saved planRevision> --apply --json; inspect and persist the returned lifecycle. A refusal is retained with its reason, never complete; do this before finish and alongside independent units`)
     }
   }
   const chainReady = []
@@ -637,6 +697,16 @@ export function nextActions(plan, reviews = {}, capacity, { resume = false, now,
   // One restack per unit per pass: the first reason found; the next pass sees the new HEAD.
   const restacked = new Set()
   for (let i = 0; i < actions.length; i++) if (actions[i].action === 'restack') { if (restacked.has(actions[i].unit)) actions.splice(i--, 1); else restacked.add(actions[i].unit) }
+  // One place attaches each worker action's continuation, so no site can spawn a worker without
+  // saying whether it starts fresh or resumes the unit's owner.
+  for (const a of actions) {
+    const workerKind = WORKER_ACTION_KINDS[a.action]
+    if (!workerKind) continue
+    const continuation = continuationFor(byId.get(a.unit), workerKind)
+    Object.assign(a, continuation)
+    if (continuation.owner) a.detail += ownerNote(a.unit, continuation.owner)
+    if (continuation.ownerUnavailable) a.detail += `; ${continuation.ownerUnavailable}`
+  }
   const busy = units.filter(hasWorker).length
   // The Harness already counted our workers along with other work and reservations.
   // Without a capacity source every worker-needing action is due: the harness spawn limit governs.
@@ -652,9 +722,14 @@ export function nextActions(plan, reviews = {}, capacity, { resume = false, now,
       const reviewReady = a.action !== 'start-review' || u.lifecycle?.resources?.some((r) => r.role === 'review' && r.state === 'ready')
       const needsPreparation = managed(u) && (u.lifecycle?.workspace?.state !== 'ready' || !reviewReady)
       const removalPending = managed(u) && u.lifecycle?.cleanup?.state === 'applying'
-      const admitted = removalPending ? { action: 'recover-workspace', unit: a.unit,
+      // A gating action keeps the worker action's continuation, so the launch stays explicit after
+      // the workspace is prepared or its cleanup is resolved.
+      const launch = { unit: a.unit, continuation: a.continuation, workerKind: a.workerKind,
+        ...(a.owner ? { owner: a.owner } : {}),
+        ...(a.ownerUnavailable ? { ownerUnavailable: a.ownerUnavailable } : {}) }
+      const admitted = removalPending ? { action: 'recover-workspace', ...launch,
         detail: `before ${a.action} for unit ${a.unit}, resolve its applying cleanup: inspect cleanup-runs.mjs recover --repo <repo-root> --json, collect any running cleanup operation's terminal result, and verify its receipt and every owned resource before updating lifecycle. Never admit a worker while removal of its environment is unresolved` }
-        : needsPreparation ? { action: 'prepare-workspace', unit: a.unit,
+        : needsPreparation ? { action: 'prepare-workspace', ...launch,
         detail: `before ${a.action} for unit ${a.unit}, record its exact workspace, branch, base SHA and lifecycle preparation intent${reviewReady ? '' : ', including its one review clone'}; run cleanup-runs.mjs prepare --run <run> --unit ${a.unit} --revision <saved planRevision> --apply --json and persist its returned ready identity. Reuse an existing matching workspace; never reset, replace or create another one on retry` } : a
       due.push(unlimited ? { ...admitted, detail: `${admitted.detail} [needs a free worker slot]` } : admitted)
       free--

package/skills/engineering/resolve-issues/scripts/review-verdict.mjs

@@ -28,8 +28,8 @@
 // codes below for one release (DEPRECATED: read `verdict` instead). Old exit codes:
 //   0  pass: no P0/P1 on --head (or a confirmed skip); record `reviewedHead`; ready
 //      once CI is green
-//   1  fix: the printed `fixBrief` file holds the P0/P1 findings only; it is
-//      the fix worker's whole finding list. `action` says how to fix, from a
+//   1  fix: the printed `fixBrief` file holds the P0/P1 blocker list. The coordinator
+//      may also name supporting P2 work selected in the plan. `action` says how to fix, from a
 //      comparison with the previous round's file (`<unit>-r<N-1>.json` beside
 //      it, or --prior):
 //        fix         first blocking round: fix each finding's rule across its
@@ -39,8 +39,8 @@
 //                    focused cases for missing proof, see the open cases fail,
 //                    then fix until all pass, with the
 //                    escalation model
-//        one-by-one  only new P0/P1, introduced by the last fix: one finding
-//                    per fix worker, in turn, the smallest change that closes
+//        one-by-one  only new P0/P1, introduced by the last fix: the owner fixes
+//                    findings in turn, the smallest change that closes
 //                    every row across the applicable paths
 //   5  wait: no P0/P1 is open, but a GitHub reviewer whose changes request a fix brief
 //      already carried has not re-reviewed (`awaiting`, from github-reviews.mjs merge);
@@ -66,7 +66,7 @@
 // on a skip record too, which carries only the reviewer's approval.
 
 import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
-import { basename, dirname, join } from 'node:path'
+import { basename, dirname, isAbsolute, join } from 'node:path'
 
 import { execFileSync } from 'node:child_process'
 
@@ -101,10 +101,26 @@ const isCarry = (review) => reviewTier(review) === 'skip' && review?.carry === A
 // A blocking finding names its rule and every path that must hold it, at least one open; a P0/P1
 // with every row closed is resolved and belongs out of the file. Checked on the current review
 // only, so earlier records written without the fields stay readable as priors.
+function reproducerProblems(repro, label) {
+  const problems = []
+  if (!isRecord(repro) || !isText(repro.command) || !isText(repro.expected)) {
+    problems.push(`${label}.reproducer needs a command and expected result`)
+  }
+  if (!isText(repro?.cwd) || isAbsolute(repro.cwd) || repro.cwd.startsWith('\\') || /^[A-Za-z]:/.test(repro.cwd)
+    || repro.cwd.replaceAll('\\', '/').split('/').includes('..')) {
+    problems.push(`${label}.reproducer.cwd must be relative to the candidate workspace, without parent traversal`)
+  }
+  if (isRecord(repro) && Object.hasOwn(repro, 'evidence') && !isText(repro.evidence)) {
+    problems.push(`${label}.reproducer.evidence must name retained evidence when present`)
+  }
+  return problems
+}
+
 function blockingShapeProblems(f, label) {
   const problems = []
   if (!isText(f?.trigger)) problems.push(`${label} (P0/P1) has no trigger`)
   if (!isText(f?.rule)) problems.push(`${label} (P0/P1) has no rule`)
+  if (Object.hasOwn(f, 'reproducer')) problems.push(...reproducerProblems(f.reproducer, label))
   if (!Array.isArray(f?.paths) || f.paths.length === 0) return [...problems, `${label} (P0/P1) has no paths rows`]
   for (const [j, row] of f.paths.entries()) {
     if (!isText(row?.path)) problems.push(`${label}.paths[${j}] has no path`)
@@ -213,6 +229,35 @@ export function roundsWithoutNewLow(review, history = []) {
   return since
 }
 
+// Preserve concrete witnesses for the still-broken rule, including earlier triggers.
+// These are source references, not claims that the candidate has passed them.
+function fixReproducers(blocking, records) {
+  const ids = new Set(blocking.map((finding) => finding.id))
+  const lastPass = records.findLastIndex((record) => isRecord(record)
+    && Array.isArray(record.findings) && reviewCompletionProblems(record).length === 0
+    && !record.findings.some((finding) => BLOCKING.includes(finding?.severity)))
+  const seen = new Set()
+  const out = []
+  const gaps = []
+  for (const record of records.slice(lastPass + 1)) {
+    for (const finding of Array.isArray(record?.findings) ? record.findings : []) {
+      if (!ids.has(finding?.id) || !BLOCKING.includes(finding.severity) || !Object.hasOwn(finding, 'reproducer')) continue
+      const key = JSON.stringify([finding.id, finding.trigger, finding.reproducer])
+      if (seen.has(key)) continue
+      seen.add(key)
+      const problems = reproducerProblems(finding.reproducer, finding.id)
+      if (problems.length) {
+        gaps.push({ finding: finding.id, round: record.round, head: record.head,
+          trigger: finding.trigger, reason: problems.join('; ') })
+        continue
+      }
+      out.push({ finding: finding.id, round: record.round, head: record.head,
+        trigger: finding.trigger, reproducer: structuredClone(finding.reproducer) })
+    }
+  }
+  return { reproducers: out, reproducerGaps: gaps }
+}
+
 // How to act on a blocking round. better-review keeps a still-open finding's id across
 // rounds, so a shared id means the last fix did not resolve it.
 // `history` is every record before `prior`, oldest first, or a function that reads them; it is
@@ -294,7 +339,12 @@ export function reviewVerdict(review, head, prior = null, { confirmSkip, earlier
     return awaiting.length ? { verdict: 'wait', ...base, ...skipped } : { verdict: 'pass', reviewedHead: head, ...base, ...skipped }
   }
   if (skip && blocking.some((f) => !GITHUB_ID.test(String(f.id)))) throw new ReviewIncomplete('a skip record cannot hold findings; spawn the reviewer')
-  return { ...fixAction(review, blocking, prior, history, { decision }), ...base, fix: blocking }
+  let retainedHistory
+  const readHistoryOnce = () => retainedHistory ??= typeof history === 'function' ? history() : history
+  const action = fixAction(review, blocking, prior, readHistoryOnce, { decision })
+  const witnesses = action.verdict === 'fix'
+    ? fixReproducers(blocking, [...readHistoryOnce(), prior, review]) : {}
+  return { ...action, ...base, fix: blocking, ...witnesses }
 }
 
 // The record --carry writes for `head`: the previous round's approval, carried with no
@@ -333,12 +383,13 @@ export function carryRecord(prior, head, identity = {}) {
 }
 
 const INSTRUCTIONS = {
-  'fix': 'Fix only these findings. For each, make the smallest complete fix for its `rule` across the applicable paths and close every row in its `paths`. Use a shared owner when useful, but do not require a refactor; focused fixes on individual paths are acceptable.',
+  'fix': 'Fix these blocking findings. For each, make the smallest complete fix for its `rule` across the applicable paths and close every row in its `paths`. Use a shared owner when useful, but do not require a refactor; focused fixes on individual paths are acceptable.',
   'test-first': 'The findings listed in `recurring` survived a fix: the last fix closed one path and missed others. For each, before changing code: name the rule the bug breaks; list every code path that can break it, including the trigger of this finding id in each earlier round\'s review file beside this one; reuse sufficient tests and add focused cases from the concrete triggers, then run them to see it fail on each open path. One table-driven test may cover several paths. Then make the smallest complete fix across the applicable paths until every test passes. Use a shared owner when useful, but do not require a refactor; focused fixes on individual paths are acceptable. "Fixed" is every path\'s test passing. Fix the rest as usual.',
-  'one-by-one': 'The last fix introduced these findings. Fix them one at a time, one fix worker each, with the smallest complete change that closes every row of its `paths`. Use a shared owner when useful, but do not require a refactor; focused fixes on individual paths are acceptable. Touch nothing else.',
+  'one-by-one': 'The last fix introduced these findings. Fix them sequentially in this assignment, with the smallest complete change that closes every row of its `paths`. Use a shared owner when useful, but do not require a refactor; focused fixes on individual paths are acceptable.',
 }
 
-// The fix worker's brief carries only P0/P1 findings; P2/P3 never reach it.
+// The generated blocker list stays P0/P1. Supporting P2 selections come from the
+// coordinator's plan decision and accompanying brief; P3 is always skipped.
 export function fixBriefOf(result) {
   const fixRound = hasFixRound(result) ? result.fixRound : result.round
   if (!isCounter(result.round) || !isCounter(fixRound) || fixRound > result.round) {
@@ -350,9 +401,11 @@ export function fixBriefOf(result) {
     fixRound,
     head: result.head,
     action: result.action,
-    instruction: `${INSTRUCTIONS[result.action]}${result.decision ? ` Decision ${result.decision} in the plan's \`decisions\` settles what the recurring spec finding requires: fix it as that decision reads.` : ''} Every other finding is out of scope: a P2 is deferred to the dropbox or a follow-up issue, and a P3 is skipped.`,
+    instruction: `${INSTRUCTIONS[result.action]}${result.decision ? ` Decision ${result.decision} in the plan's \`decisions\` settles what the recurring spec finding requires: fix it as that decision reads.` : ''} Read each retained reproducer before using it; run against the candidate workspace at its workspace-relative cwd, preserving the recorded trigger and expected contract. Earlier results are baseline evidence, not candidate passes. A reproducerGaps entry is a source reference, not a runnable command: inspect its original review and establish a valid candidate-local case, retaining the original evidence and reporting any remaining gap. Keep subsequent failures of the affected operation in this repair until its existing criteria pass or an existing stop condition applies. Also perform only supporting P2 work explicitly selected by the coordinator in the plan and accompanying brief, naming the existing authorized outcome, verification or delivery it enables. P2 remains nonblocking; defer unselected P2 to the dropbox or a follow-up issue. Skip P3. Preserve the acceptance bar and existing authorization boundaries.`,
     ...(result.decision ? { decision: result.decision } : {}),
     recurring: result.recurring,
+    reproducers: result.reproducers ?? [],
+    reproducerGaps: result.reproducerGaps ?? [],
     fix: result.fix,
   }
 }

package/skills/engineering/resolve-release/SKILL.md

@@ -4,7 +4,7 @@ description: "Slash/explicit-only (/resolve-release). Full GitHub Flow release f
 disable-model-invocation: true
 metadata:
   workflow-role: coordinator
-release-version: 0.49.1
+release-version: 0.50.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Resolve release