@1aboveio/skills 1.0.21 → 1.0.22

package/skills/engineering/resolve-issues/references/delivery-progress.md

@@ -45,7 +45,7 @@ issue or automatic scheduler gate. They do not waive required validation.
 
 ## Every brief contains
 
-Use the full checklist for a fresh or replacement worker. For a retained conversation,
+Use the full checklist for a fresh or replacement worker. For a continued conversation,
 send the new feedback, current checkpoint, latest failure/fix brief and local evidence,
 current standing orders and changed decisions, affected skill/proof pointers, and new
 result path. Re-read the saved source/criteria after context loss; do not resend the original

package/skills/engineering/resolve-issues/references/done.md

@@ -15,12 +15,9 @@ nothing is left to settle.
 
 ## Clean before handoff
 
-[Release any session retention still held](implementation.md#settle-session-retention) for each
-unit before normal workspace cleanup; this also applies at each merge while other units
-continue. A launch that asked for none has nothing to release, and an acknowledgement is
-recorded only where protection was actually held. Record any
-resource intentionally kept under the existing lifecycle; never claim it was cleaned
-because its worker exited.
+Clean each delivered unit's workspace and resources at its settlement; this also applies at
+each merge while other units continue. Record any resource intentionally kept under the
+existing lifecycle; never claim it was cleaned because its worker exited.
 
 Clean every delivered unit's workspace and resources before the report, in every
 scheduler mode ([workspaces.md](workspaces.md#cleanup-after-delivery-before-finish)).

package/skills/engineering/resolve-issues/references/expire.md

@@ -242,10 +242,10 @@ missing, or names a step without a reason.
 | A capability the unit needs is missing and no unit builds it (a shared driver, fixture, or hook) | Build it inside the first unit that needs it; units that need it later get `dependsOn` on that unit. Only when that puts the unit past the size check's line limit, file it as its own issue beside them, with `blocked_by` on the units that use it, never on their parent issue. Example: three proof units each need a device-state reader: the first builds it, the other two depend on the first. |
 | [Human-only](#human-only) blocker | Take its automatic answer ([preflight.md](preflight.md#never-block-on-the-human)); when that defers it, mark `blocked` (`blockedReason: human-decision`, its `humanItem` and `humanNeed`), keep the work, and record what is needed on its owning issue; never ship part of the unit. |
 
-Continue the retained owner in the kept workspace with the current checkpoint, findings
+Continue the saved owner in the kept workspace with the current checkpoint, findings
 and failure evidence. If its process state or required selection prevents continuation,
 use an explicit replacement under the [owner contract](implementation.md#implementation-owner),
-keeping its old session reference for settlement; replacement briefs use those local facts
+keeping the replaced reference as evidence; replacement briefs use those local facts
 rather than an old transcript. Keep the response limits and history above. Record a queue stall with the
 provider pending as a wait and watch again. End the run only when
 `next-actions.mjs`, invoked with [live capacity](implementation.md#live-capacity), prints `finish`, and never claim the spec complete.

package/skills/engineering/resolve-issues/references/implementation.md

@@ -56,51 +56,62 @@ accepts unrestricted writes.
 
 ## Implementation owner
 
+On Pi, read the shared [saved conversation contract](../../harness-runtime/references/subagent-sessions.md)
+for the active schema check, discovery scope, and conversation lifecycle. The rules below
+bind that contract to unit ownership and review repairs.
+
 Keep one implementation conversation per unit through local proof, independent review,
 review fixes and CI repairs. Its saved conversation outlives the active worker slot: launch
 each worker normally, single or batch as the assignment needs, and record the receipt as
-`implementationOwner` ([task-plan.md](task-plan.md#shape)). `retain_session` is optional
-protection from later cleanup, not a precondition for continuing: a completed conversation is
-resumed by its `runId` whether or not retention was requested, and the harness never asks for
-it on resume. Request it only when this caller needs the conversation protected through a long
-wait before cleanup, using the exact argument the launched tool advertises and never inventing
-one for a call that lacks it. A parked owner has no live process and reserves no slot. The
-coordinator still owns scheduling, plan writes, external CI, readiness and delivery;
-reviewers use separate conversations.
-
-`next-actions.mjs` supplies `continuation`, `workerKind`, and, for
-`owner-resume`, `owner`. Resume that completed attempt with
-`subagent_resume({id: owner.runId, prompt: <current brief>})`; record the new attempt ID
-without changing the conversation ID. Selection follows [continuation versus new launch](task-plan.md#worker-selection-on-resume): omit model/effort for ordinary continuation. Use only
-authorized, supported explicit overrides; when a required role-only fill cannot be expressed
-by the resume API, replace from that fill with the retained evidence instead of creating a
-pin from its resolved model ID. Clear `worker` when an attempt
-ends, but keep `implementationOwner` while review or CI is pending. Keep all counters and
-earlier results across attempts. `one-by-one` fixes findings sequentially in this owner.
+`implementationOwner` ([task-plan.md](task-plan.md#shape)): the native `sessionId` and that
+attempt's `runId`, kept as separate fields. A parked owner has no live process and reserves
+no slot. The coordinator still owns scheduling, plan writes, external CI, readiness and
+delivery; reviewers use separate conversations.
+
+Continuation is a spawn into the saved session, not a resume call:
+`subagent_spawn({session_id: owner.sessionId, prompt: <current brief>})` continues that exact
+native session and returns a new attempt `runId` with the same `sessionId`. Record the new
+`runId` as `implementationOwner.runId` and keep the `sessionId`. Never pass an attempt `runId`
+as `session_id`, and never invent a session id a receipt does not hold: a first launch can show
+similar-looking ids, which is not evidence they are interchangeable. Continue from a completed
+attempt: a running or orphaned writer settles first. A conversation started
+from another foreground session still continues: the launch origin does not restrict
+continuation. `subagent_list()` covers the caller's folder and descendants across foreground
+sessions; `all: true` searches globally.
+In a batch, the job's own selector continues that job's session.
+
+`next-actions.mjs` supplies `continuation`, `workerKind`, and, for `owner-resume` or
+`owner-recovery`, `owner`.
+Selection follows [continuation versus new launch](task-plan.md#worker-selection-on-resume):
+omit model/effort for ordinary continuation. Use only authorized, supported explicit
+overrides; when a required role-only fill cannot be expressed by the continuation call,
+replace from that fill with the retained evidence instead of creating a pin from its resolved
+model ID. `session_name` selects an existing conversation by an exact, unambiguous name
+within the caller's folder and descendants; it does not name a new conversation. Fresh
+launches omit both session selectors and may use an advertised fresh-launch naming control.
+A workflow that records ids continues
+`implementationOwner.sessionId` rather than looking a session up by name. Clear `worker` when
+an attempt ends, but keep `implementationOwner` while review or CI is pending. Keep all
+counters and earlier results across attempts. `one-by-one` fixes findings sequentially in this
+owner.
 
 A missing history/workspace, an unusable saved owner, or an owner that cannot continue
 requires an explicit replacement reason and the retained checkpoint, failures and reproducer
-references in the replacement brief. Try the saved conversation first: a `retentionReleased`
-marker says only that optional protection lapsed, so it is not a replacement reason by itself
-and the conversation it names usually still resumes. Report lost continuity; never label a
-new conversation a resume. Existing recovery/stop rules still apply, and old plans without
-an owner use the fresh-worker path. Do not install or update the harness during a run merely
-to obtain continuation.
-
-### Settle session retention
-
-When this unit settles (merged, cancelled, deferred or handed back merge-ready), release any
-retention still held for its `implementationOwner`, `reviewSession` and `retiredSessions` with
-`subagent_release({id: <runId>})` before its normal workspace/resource cleanup. Only a
-conversation launched with `retain_session` has anything to release, so a normal launch skips
-this and a second release is not owed. Record the acknowledgement on that reference when it
-was actually held; an unavailable or refused release stays explicit rather than being
-recorded as done.
-
-Reopening is the ordinary case: resume the saved conversation even when its protection was
-released, because release stops protection and leaves the history in place. Start a fresh
-replacement only when continuation is genuinely unavailable, and carry the original
-checkpoint/findings/counters into it. The same rule covers a released unfinished review,
+references in the replacement brief. Report lost continuity; never label a new conversation a
+resume. Existing recovery/stop rules still apply, and old plans without an owner use the
+fresh-worker path. Do not install or update the harness during a run merely to obtain
+continuation.
+
+A plan written before this contract may hold `implementationOwner {runId}` and no `sessionId`.
+`next-actions.mjs` prints `continuation: "owner-recovery"` for it: first match that exact
+`runId` in `subagent_list({all: true})` or in the verified spawn receipt. A match that names
+its session continues that session and records both ids; with no match, launch an explicit
+replacement with the retained evidence and say why. A `retentionReleased` field left on an old
+plan is inert history: no step reads it, reverses it, or owes a release for it.
+
+Reopening is the ordinary case: continue the saved session; there is no release step in the way.
+Start a fresh replacement only when continuation is genuinely unavailable, and carry the
+original checkpoint/findings/counters into it. The same rule covers an unfinished review,
 keeping its round and existing full-review fallback.
 
 ## Brief
@@ -171,10 +182,10 @@ On `resume` (in flight, no worker, code not done), continue the unit's
    not prohibit long local tests or builds needed for the assigned validation.
 
 After 2 fix cycles without progress, or a stuck or late worker, follow
-[expire.md](expire.md). Apply the next response through the retained owner where its
+[expire.md](expire.md). Apply the next response through the saved owner where its
 completed conversation and required launch controls permit continuation. A replacement
 uses the same workspace and the findings entry, failing command/output and `git diff <base>`;
-record why it replaces the owner and retain its session reference as above. Give replacement
+record why it replaces the owner and keep the replaced reference as evidence. Give replacement
 workers those local facts rather than copying the old transcript. Keep all progress counters.
 
 ## Proof

package/skills/engineering/resolve-issues/references/review.md

@@ -11,10 +11,10 @@ restate its rules in the brief beyond the two below.
 - Start a fresh reviewer conversation after each completed review round; the existing
   scope script still chooses delta/full/skip, so freshness adds no review round or test
   campaign. Give it retained records and code evidence as claims to verify, not an
-  implementer transcript. Launch it normally and keep its attempt reference as
-  `reviewSession`, separate from `implementationOwner`, so an unfinished same-HEAD round
-  can continue in that saved conversation; `retain_session` is optional protection, not
-  what makes it continuable. A round after a completed review is a fresh conversation.
+  implementer transcript. Launch it normally and keep its `sessionId` and latest attempt
+  `runId` as `reviewSession`, separate from `implementationOwner`, so an unfinished
+  same-HEAD round can continue in that saved session; a round after a completed review is a
+  fresh conversation.
 - Reviewer model: a different id from the implementer's
   ([preflight.md](preflight.md#1-model-slots)). Launch the reviewer with the
   plan's recorded reviewer fill — its `launch`, `instructions`, `selection` and
@@ -126,23 +126,22 @@ the unfinished work rather than repeating the whole assignment; preserve complet
 valid passes. A wrong HEAD or invalid scope must be corrected, not carried as
 completed proof.
 
-On Pi, use `subagent_resume({id: reviewSession.runId, prompt: <unfinished work>})`
-when that attempt completed as a process and its saved conversation is available;
-update only its attempt reference, keeping this review's round, HEAD and counter.
-A killed/lost attempt or an unavailable continuation follows replacement below. Once the
-review record is complete, the next required review is a fresh conversation. Clear an
-unpinned `reviewSession` directly. If it holds retention, release that protection before
-clearing; on failure, save its exact reference and error in `retiredSessions` before clearing
-so settlement can retry while the fresh review proceeds. Never use a reviewer as the
-implementation owner.
+On Pi, use `subagent_spawn({session_id: reviewSession.sessionId, prompt: <unfinished work>})`
+when that attempt completed as a process and its saved session is available; it returns a new
+attempt `runId` on the same session, so record that `runId` and keep the `sessionId`, preserving
+this review's round, HEAD and counter. A saved record holding only `runId` needs recovery first:
+match that exact attempt in `subagent_list({all: true})` or the verified spawn receipt, continue
+the session it names, and replace it with retained evidence if nothing matches; never pass the
+attempt id as `session_id`. A killed/lost attempt or an unavailable continuation follows
+replacement below. Once the review record is complete, the next required review is a fresh
+conversation. Clear `reviewSession` when the round completes; keep a replaced reviewer's
+reference in `retiredSessions` as evidence, with no release operation owed. Never use a
+reviewer as the implementation owner.
 
 If that reviewer cannot continue, state why replacement is necessary, which
-retained evidence the replacement reads, and what it redoes before launching it.
-A `retentionReleased` marker on the old reference is not a reason by itself: released
-protection leaves the saved conversation in place, so try it again before replacing it.
-While an old reference is still worth resuming or still needs release, keep it as an entry
-in `retiredSessions` ([task-plan.md](task-plan.md#shape)) rather than dropping it; a later
-release of the new session does not release the old conversation. The replacement reviews every pass with `tier: "full"`. Keep the round number,
+retained evidence the replacement reads, and what it redoes before launching it. A
+`retentionReleased` field on an old reference is inert history, not a replacement reason.
+The replacement reviews every pass with `tier: "full"`. Keep the round number,
 `fixRound`, unit `attempt` and earlier round files; incompleteness neither resets
 history nor counts as progress. Launch the replacement from the same recorded
 reviewer fill, in the same structured launch arguments as [the brief](#brief)

package/skills/engineering/resolve-issues/references/shared-modules.md

@@ -157,7 +157,13 @@ and substitute nothing.
 
 **A blocked result ends the run.** `ok: false` — no resolver, no capabilities,
 a declined request, an unadvertised launch control, a missing native selection —
-means report its `code` and `reason` and start nothing. Never reuse an earlier
+means report its `code` and `reason` and start nothing. An unsupported control
+required by the fresh-launch fill is the same block. A missing continuation selector
+alone makes the saved conversation unavailable: report the active schema and use the
+[explicit evidenced replacement](implementation.md#implementation-owner) from the
+authorized fresh-launch fill. It does not block other runnable units. Refreshing a stale
+runtime (`/reload`) is the user's action; never fabricate a call or install/update the
+harness mid-run. Never reuse an earlier
 pick, never fall back to the skill-owned catalog, and never let the reviewer share
 the implementer's model id: the catalog enforces independence, and re-picking a
 replacement here would silently break it.

package/skills/engineering/resolve-issues/references/task-plan.md

@@ -92,9 +92,9 @@ Fleet `status`: `pending`, `in-flight`, `succeeded`, `failed`,
 | `attempt`, `retries`, `escalations` | Attempt number; cycle counts; escalation-model attempts |
 | `worker`, `workerSince`, `clock` | Slot identifier of any worker running for the unit (implementer, reviewer, fix), `null` when none; when that worker started (ISO time, for [stuck-worker checks](expire.md#waits)); attempt and cumulative wall time |
 | `workerKind` | `implement`, `fix`, or `review`, set with `worker`; the [live-capacity scheduler](implementation.md#live-capacity) (`next-actions.mjs`) prints `worker-kind` for any other kind or none. An infrastructure diagnosis or a test-first worker is a `fix` worker. The explorer is the `explore` fleet row's worker, never a unit's; a merge-queue watcher is not a worker |
-| `implementationOwner` | Optional saved implementation conversation: `{runId, sessionId?, cwd?, kind?, retentionReleased?}`. `runId` is its latest attempt; `kind` is `implement` (default) or `fix`, never `review`; `cwd`, when recorded, matches `workspace`. Save spawn/resume receipts here, independently of `worker`; a parked owner occupies no slot. The scheduler emits `owner-resume` for a usable owner or an explicit `ownerUnavailable` reason for replacement; `retentionReleased: true` only records that optional cleanup protection lapsed, so it never makes the owner unusable and the saved conversation stays the resume target while the harness holds it. Old plans remain readable. See [ownership](implementation.md#implementation-owner). |
-| `reviewSession` | Optional `{runId, sessionId?, head, round, retentionReleased?}` for the current unfinished review. Keep it only for same-HEAD/same-scope continuation, and clear it when that round completes so the next completed-review round starts fresh. A `retentionReleased` marker is history, not a reason to replace: try the same round's saved conversation while it exists. It is never an implementation owner or a slot reservation. |
-| `retiredSessions` | Optional references kept beside a replaced implementation owner or unfinished reviewer: `{runId, sessionId?, kind, retentionReleased?, reason?}`. Only for a conversation still worth resuming or still holding protection that must be released later; an ordinary resume or replacement needs no entry here, and a later release of the new session does not release an older conversation. |
+| `implementationOwner` | Saved implementation conversation: `{sessionId, runId?, cwd?, kind?}`. `sessionId` is the native session to continue and is what `subagent_spawn({session_id})` takes; `runId` is that session's latest attempt, never a `session_id`. `kind` is `implement` (default) or `fix`, never `review`; `cwd`, when recorded, matches `workspace`. Save the spawn receipt here, independently of `worker`; a parked owner occupies no slot. The scheduler emits `owner-resume` for a usable owner, `owner-recovery` for a legacy record that holds only an attempt id, or an explicit `ownerUnavailable` reason for replacement. `retentionReleased` on an old plan is inert history: nothing reads or releases it. Old plans remain readable. See [ownership](implementation.md#implementation-owner). |
+| `reviewSession` | Optional `{sessionId, runId?, head, round}` for the current unfinished review: the same session/attempt split, continued only for the same HEAD and scope. Clear it when that round completes, so the next completed-review round starts fresh. It is never an implementation owner or a slot reservation. |
+| `retiredSessions` | Optional references kept beside a replaced implementation owner or unfinished reviewer: `{sessionId?, runId?, kind, reason?}`. Only as evidence for the replacement brief and for the record; no release operation is owed. |
 | `estimatedLines` | Preflight assessment estimate |
 | `sizeCheck` | Measures, `verdict` (the size check's per-unit verdict; `stop` means held), scope and proof verdicts, split or verification path; `runWhole: true` once a recommendation to run a held unit whole is accepted |
 | `note` | SHA, expiry reason code, failure and response, or blocker; for active debugging, the immediate acceptance checkpoint, baseline/result link and next distinguishing test ([delivery progress](../SKILL.md#delivery-progress)) |
@@ -160,13 +160,21 @@ recommendation's reason; its human's words are the invocation.
 ### Worker selection on resume
 
 Distinguish resuming the workflow from continuing one saved conversation. For an ordinary
-same-conversation `subagent_resume`, pass its attempt ID and new feedback, omitting role,
-model and effort so the harness preserves its recorded recipe. The resume tool's schema
-may differ from spawn: do not replay a role selector it cannot accept. A required changed
-selection can continue only through controls both explicitly authorized and advertised by
-that API; otherwise record why replacement is needed and launch fresh from the required
-fill with its retained evidence. A resolved role default alone never authorizes a model pin.
-Keep the original model/effort as run evidence and preserve all review/progress counters.
+same-conversation continuation call `subagent_spawn({session_id: <saved sessionId>, prompt:
+<new feedback>})`: it continues that exact native session and returns a new attempt id, so omit
+role, model and effort and let the harness preserve its recorded recipe. An attempt `runId` is
+never a `session_id`, and no session id is invented for a record that lacks one. A batch carries
+its selector per job: each job in `subagent_spawn_batch({shared, jobs})` names its own session;
+the shared part does not. There is no public resume, release or retain-session call in this
+contract, so never invoke one. If only the continuation selector is missing, report the
+actual schema and lost continuity, then use the explicit evidenced replacement from the
+authorized fresh-launch fill. If that fresh fill requires an unsupported control, the
+catalog's blocked-result rule applies. `/reload` is the user's action; never install or
+update the harness mid-run to gain a capability. A required changed selection can continue only through controls both explicitly
+authorized and advertised by that call; otherwise record why replacement is needed and launch
+fresh from the required fill with its retained evidence. A resolved role default alone never
+authorizes a model pin. Keep the original model/effort as run evidence and preserve all
+review/progress counters.
 
 **A fresh or replacement launch repeats the saved fill, never a reconstruction of it.** On Pi the
 launch authority stays the live role resolver ([shared-modules.md](shared-modules.md#model-slots)):

package/skills/engineering/resolve-issues/scripts/next-actions.mjs

@@ -75,27 +75,29 @@
 //                   fetch failed, it prints `sync` instead. A run never finishes on a tree it
 //                   could not read
 //
-// A unit's optional `implementationOwner` is the retained implement-or-fix conversation that outlives
-// the worker slot, recorded from the harness as { runId, sessionId?, cwd?, kind }: `runId` is the
-// attempt to resume, `kind` ("implement" or "fix", default "implement") says which worker owned it,
-// and `sessionId` and `cwd` (the unit's workspace) identify that conversation and its tree. It is
-// independent of `worker`, which records whichever worker is active now, so the owner survives the
-// review phase and a later fix continues the same conversation instead of starting over.
+// A unit's optional `implementationOwner` is the implement-or-fix conversation that outlives the
+// worker slot, recorded from the harness as { sessionId, runId?, cwd?, kind }: `sessionId` is the
+// native conversation to continue, `runId` is its latest attempt, `kind` ("implement" or "fix",
+// default "implement") says which worker owned it, and `cwd` (the unit's workspace) is its tree. It
+// is independent of `worker`, which records whichever worker is active now, so the owner survives
+// the review phase and a later fix continues the same session instead of starting over.
 //
 // Every action that spawns a worker therefore carries the structured continuation the coordinator
-// launches, beside its name: `continuation: "fresh"` for a first start or a new worker, launched
-// normally, with no retention argument (a saved conversation stays continuable by its id;
-// `retain_session: true` is optional protection a caller adds only for a long wait before cleanup).
-// Implement and fix sessions become the unit's owner; `continuation: "owner-resume"` with
-// `owner: { runId, kind, sessionId?, cwd? }` for a fix, a restack, or an unfinished implementation
-// whose owner is still usable (subagent_resume({ id: owner.runId, ... }) returns a new attempt on
-// the same conversation). `workerKind` names the slot the action launches. A review round is
-// always a fresh reviewer: a finished review
-// is never resumed, and a review recorded as an owner is not usable. An owner without a `runId`,
-// with a `kind` outside implement and fix, or whose `cwd` is not the unit's workspace is not usable,
-// so a fresh action reports ownerUnavailable rather than claiming continuity. A `retentionReleased`
-// marker records that optional protection lapsed, so it never makes an owner unusable. A completed
-// worker holds no slot: the owner is a reference, never an occupancy.
+// launches, beside its name. `continuation: "fresh"` is a first start or a new worker, launched
+// normally with no session argument. Implement and fix sessions become the unit's owner;
+// `continuation: "owner-resume"` with `owner: { sessionId, runId?, kind, cwd? }` for a fix, a
+// restack, or an unfinished implementation continues that exact session with
+// subagent_spawn({ session_id: owner.sessionId, prompt }), which returns a new attempt id and keeps
+// the session. An attempt `runId` is never passed as `session_id`. A plan written before that
+// contract may hold only `runId`; it prints `continuation: "owner-recovery"` so the coordinator
+// matches that exact attempt in subagent_list({ all: true }) or a verified receipt, and otherwise
+// replaces it with the retained evidence. `workerKind` names the slot the action launches. A review
+// round is always a fresh reviewer: a finished review is never resumed, and a review recorded as
+// an owner is not usable. An owner with neither a `sessionId` nor a `runId`, with a `kind` outside
+// implement and fix, or whose `cwd` is not the unit's workspace is not usable, so a fresh action
+// reports ownerUnavailable rather than claiming continuity. A `retentionReleased` field on an old
+// plan is inert history: no action reads or reverses it. A completed worker holds no slot: the
+// owner is a reference, never an occupancy.
 //
 // Text output ends with one short line pointing to the skill path. With --resume or --rules it
 // ends with RULES instead, the rules a compaction summary most often drops (in narrow and off
@@ -205,23 +207,27 @@ export function normalizeCapacity(input) {
 const hasWorker = (u) => u.worker !== undefined && u.worker !== null && u.worker !== ''
 const codeDone = (u) => u.stage === 'done'
 
-// A unit's usable implementation owner, normalized to { runId, kind, sessionId?, cwd? }, or null.
-// Usable means it names the attempt to resume (`runId`), its `kind` is an implement or fix worker
-// (never a reviewer: a finished review is never resumed for the next round), and, when both are
-// recorded, its `cwd` is the unit's workspace (a conversation cannot be resumed in another tree).
-// A plan that records nothing here keeps today's behavior: a fresh worker.
+// A unit's saved implementation owner, normalized to { runId?, kind, sessionId?, cwd? }, or null.
+// `sessionId` is the native conversation to continue and `runId` its latest attempt; an owner with
+// a session (and optionally its attempt) is usable, while a legacy owner with only an attempt is
+// recoverable, not usable: the coordinator matches that exact attempt to its session first. Its
+// `kind` must be an implement or fix worker (never a reviewer: a finished review is never resumed
+// for the next round), and, when both are recorded, its `cwd` is the unit's workspace (a
+// conversation cannot be continued in another tree). A plan that records nothing here keeps
+// today's behavior: a fresh worker.
 export function implementationOwnerOf(unit) {
   const saved = unit?.implementationOwner
   if (!saved || typeof saved !== 'object' || Array.isArray(saved)) return null
   if (saved.cwd !== undefined && saved.cwd !== null && typeof saved.cwd !== 'string') return null
   const runId = typeof saved.runId === 'string' ? saved.runId.trim() : ''
   const kind = saved.kind === undefined ? 'implement' : saved.kind
-  if (!runId || !IMPLEMENTATION_OWNER_KINDS.includes(kind)) return null
+  if (!IMPLEMENTATION_OWNER_KINDS.includes(kind)) return null
+  const sessionId = typeof saved.sessionId === 'string' ? saved.sessionId.trim() : ''
+  if (!runId && !sessionId) return null
   const cwd = typeof saved.cwd === 'string' ? saved.cwd.trim() : ''
   const workspace = typeof unit.workspace === 'string' ? unit.workspace.trim() : ''
   if (cwd && workspace && cwd !== workspace) return null
-  const sessionId = typeof saved.sessionId === 'string' ? saved.sessionId.trim() : ''
-  return { runId, kind, ...(sessionId ? { sessionId } : {}), ...(cwd ? { cwd } : {}) }
+  return { ...(runId ? { runId } : {}), kind, ...(sessionId ? { sessionId } : {}), ...(cwd ? { cwd } : {}) }
 }
 
 export function workspaceCleanupSettled(unit) {
@@ -390,14 +396,17 @@ export function nextActions(plan, reviews = {}, capacity, { resume = false, now,
   // A new review round starts fresh even when the preceding session remains available.
   const continuationFor = (u, workerKind) => {
     const owner = workerKind === 'review' ? null : implementationOwnerOf(u)
-    if (owner) return { continuation: 'owner-resume', workerKind, owner }
+    if (owner?.sessionId) return { continuation: 'owner-resume', workerKind, owner }
+    if (owner) return { continuation: 'owner-recovery', workerKind, owner }
     const ownerUnavailable = workerKind !== 'review' && u.implementationOwner != null
       ? 'Saved implementationOwner is malformed, names another role, or does not match the unit workspace; record replacement and retain its evidence.' : undefined
     return { continuation: 'fresh', workerKind, ...(ownerUnavailable ? { ownerUnavailable } : {}) }
   }
   // Appended to an owner-resumed action: the work is the same, so the action keeps its name; only
-  // the launch changes, and it is a resume rather than a second worker for the unit.
-  const ownerNote = (id, owner) => `; launch it as a resume of unit ${id}'s implementation owner: subagent_resume({ id: ${JSON.stringify(owner.runId)}, prompt: <that brief or task> }) returns a new attempt on the same conversation${owner.sessionId ? ` (session ${owner.sessionId})` : ''}${owner.cwd ? ` in ${owner.cwd}` : ''}; record the returned id as implementationOwner.runId and keep the owner through review`
+  // the launch changes, and it continues one saved session rather than starting a second one.
+  const ownerNote = (id, owner) => `; launch it as a continuation of unit ${id}'s implementation owner: subagent_spawn({ session_id: ${JSON.stringify(owner.sessionId)}, prompt: <that brief or task> }) continues that exact session and returns a new attempt id${owner.cwd ? ` in ${owner.cwd}` : ''}; record the returned id as implementationOwner.runId, confirm the receipt's session id is still that conversation, and keep sessionId ${JSON.stringify(owner.sessionId)} (an attempt id is never a session_id), keeping the owner through review`
+  // Appended when a legacy owner saved only its attempt: recover its session before replacing it.
+  const recoveryNote = (id, owner) => `; before replacing unit ${id}'s implementation owner, match its recorded attempt id ${JSON.stringify(owner.runId)} exactly in subagent_list({ all: true }) (the default list covers only this folder) or in the verified spawn receipt; a match that names its session continues with subagent_spawn({ session_id: <that session id>, prompt: <that brief or task> }) and records the returned run id and that sessionId; with no match, launch a fresh replacement from the saved fill with the retained evidence and say why continuity was lost. Never pass ${JSON.stringify(owner.runId)} as session_id`
   const managed = (u) => plan.workspaceLifecycle === 1 || u.lifecycle?.version === 1
   for (const u of units) {
     if (TERMINAL.has(u.status) && hasWorker(u) && (u.status !== 'blocked' || reasonOk(u))) {
@@ -406,7 +415,7 @@ export function nextActions(plan, reviews = {}, capacity, { resume = false, now,
     }
     if (!managed(u) || u.status !== 'succeeded' || !u.workspace) continue
     if (!hasWorker(u) && !workspaceCleanupSettled(u)) {
-      add('cleanup-workspace', u, `unit ${u.id} landed: release any retain_session protection it still holds and record that acknowledgement (implementation.md#settle-session-retention), then record lifecycle.cleanup with state applying and headSha ${u.headSha ?? '(record the delivered HEAD first)'}, then run cleanup-runs.mjs cleanup --run <run> --unit ${u.id} --revision <saved planRevision> --apply --json; inspect and persist the returned lifecycle. A refusal is retained with its reason, never complete; do this before finish and alongside independent units`)
+      add('cleanup-workspace', u, `unit ${u.id} landed: record lifecycle.cleanup with state applying and headSha ${u.headSha ?? '(record the delivered HEAD first)'}, then run cleanup-runs.mjs cleanup --run <run> --unit ${u.id} --revision <saved planRevision> --apply --json; inspect and persist the returned lifecycle. A refusal is retained with its reason, never complete; do this before finish and alongside independent units`)
     }
   }
   const chainReady = []
@@ -704,7 +713,8 @@ export function nextActions(plan, reviews = {}, capacity, { resume = false, now,
     if (!workerKind) continue
     const continuation = continuationFor(byId.get(a.unit), workerKind)
     Object.assign(a, continuation)
-    if (continuation.owner) a.detail += ownerNote(a.unit, continuation.owner)
+    if (continuation.continuation === 'owner-resume') a.detail += ownerNote(a.unit, continuation.owner)
+    if (continuation.continuation === 'owner-recovery') a.detail += recoveryNote(a.unit, continuation.owner)
     if (continuation.ownerUnavailable) a.detail += `; ${continuation.ownerUnavailable}`
   }
   const busy = units.filter(hasWorker).length

package/skills/engineering/resolve-release/SKILL.md

@@ -4,7 +4,7 @@ description: "Slash/explicit-only (/resolve-release). Full GitHub Flow release f
 disable-model-invocation: true
 metadata:
   workflow-role: coordinator
-release-version: 0.50.1
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Resolve release

package/skills/engineering/resolve-release/references/publish.md

@@ -208,10 +208,18 @@ Success is stdout equal to `<nextVersion>`. An `E404` means "not published
 yet" and the watcher continues. Any other npm error is inconclusive — stop
 rather than treating it as unpublished or published.
 
-When a GitHub Actions workflow is the npm publisher, `gh run list` /
-`gh run watch` for the tag SHA is the wait; `npm view` remains the proof the
-artifact exists. A release flow's `registry` is passed as `--registry` to every
-npm command, and its `after-publish` steps run once the artifact is proven.
+When a GitHub Actions workflow is the npm publisher, the run is not the wait and a green run is
+not a publish: `npm view` remains the only proof the artifact exists. If you need the run for
+diagnosis, find it once by commit (`gh run list --commit <mergedSha> --limit 5 --json
+databaseId,headSha,status,conclusion`, and refuse a run whose `headSha` is not `<mergedSha>`),
+then read it with bounded `gh run view <id> --json status,conclusion,jobs` polls and treat a
+**job or step transition** as the signal. `gh run watch` repaints a status line and an elapsed
+clock every 30 seconds, so a step that stopped moving looks exactly like one that is working and
+the step names scroll out of view; a log that grows on every tick is not evidence a publish is
+progressing. Report the slow or stuck step by name, with its URL. (The `github-actions` skill's
+`scripts/watch-run.mjs` does this polling when that skill is installed.) A release flow's
+`registry` is passed as `--registry` to every npm command, and its `after-publish` steps run once
+the artifact is proven.
 
 ## Release flow steps
 

package/skills/engineering/resolve-release/references/workspace-npm.md

@@ -84,10 +84,12 @@ Before each dispatch, check that the workflow's `main` ref still resolves to
 the verified merged SHA and that the version is not already published with a
 different provenance. Dispatch the discovered workflow with its documented
 package input. Record the returned run ID; verify that run's head SHA and input
-identify the approved merge and package. Watch the run in the background, then
-independently verify the exact version in the public registry, its attestation
-resolves to the merged SHA, and its package-scoped tag peels to that SHA. The
-workflow, not the agent, creates package tags/releases. A successful workflow
+identify the approved merge and package. Watch the run's job/step transitions in
+the background (bounded `gh run view --json status,conclusion,jobs` reads: a step
+transition is the signal, a repainted status line is not), then independently
+verify the exact version in the public registry, its attestation resolves to the
+merged SHA, and its package-scoped tag peels to that SHA. The workflow, not the
+agent, creates package tags/releases. A successful workflow
 without registry/provenance/tag proof is not a completed publish. Only then
 dispatch a dependent bundle. If a dispatch fails or an already-published
 version has different provenance, stop; do not overwrite a version or tag.

package/skills/engineering/rush-issues/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   workflow-role: coordinator
 dependencies:
   - resolve-issues
-release-version: 0.50.1
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Rush issues (shortcut of resolve-issues)

package/skills/engineering/rush-release/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   workflow-role: coordinator
 dependencies:
   - resolve-release
-release-version: 0.50.1
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Rush release (shortcut of resolve-release)

package/skills/engineering/test-quality/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: test-quality
 description: "Seven principles for tests that catch real bugs, and an audit that reports weak, redundant, and not-coverage tests without fixing them. Use when writing, changing, or reviewing tests, or when asked whether tests are useful, redundant, over-mocked, flaky, only assert static text, or test config files, or asked to make a slow test suite faster without losing coverage, or when the user asks to write the testing conventions into a repo's CONTRIBUTING.md. NOT defining what a spec must prove (ensure-coverage) or authoring browser tests (e2e-test)."
-release-version: 0.50.1
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Test Quality

package/skills/risk-compliance/compliance-audit/SKILL.md

@@ -2,7 +2,7 @@
 name: compliance-audit
 version: 2.9.0
 description: "Audit operations against financial-compliance checklists (AML/KYC, VARS, PCI-DSS, TPA oversight, onboarding, transaction monitoring). Produces tracker.md (with a tracker.xlsx export) and phase-trail.md with layered validation; cites evidence by original filename. Input: reg-parser or the built-in VARS checklist."
-release-version: 0.50.1
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Compliance Audit

package/skills/risk-compliance/contract-compare/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: contract-compare
 description: "Compare two or more contracts side-by-side for structured diff, gap analysis, and benchmarking. Use when: comparing contracts or agreements, contract diff, compare terms, vendor-vs-vendor, compare our template vs theirs, compliance gap between contracts. NOT for single-contract risk review — use contract-review for that."
-release-version: 0.50.1
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Contract Compare

package/skills/risk-compliance/contract-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: contract-review
 description: "Review contracts for legal, commercial, and compliance risks via convert → chunk review → merge → validate (+ optional mandate preprocessing). Use for reviewing, auditing, or checking any contract, agreement, NDA, MSA, or SLA; input a file path (PDF/DOCX/TXT) or pasted text."
-release-version: 0.50.1
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Contract Review

package/skills/risk-compliance/doc-authenticity/SKILL.md

@@ -3,7 +3,7 @@ name: doc-authenticity
 version: 0.4.1
 description: "Screen PDF documents and raster images for fabrication, tampering, Photoshop or other image-editor use, and content validity. Detects file type, runs format-specific authenticity forensics, classifies bank statements, conversation logs, invoices, agreements, and other documents, then applies type-specific validity checks. Produces separate authenticity (NO_EVIDENCE_OF_MODIFICATION / SUSPICIOUS / LIKELY_MODIFIED / INCONCLUSIVE) and validity (VALID / INVALID / INCONCLUSIVE) verdicts. Use whenever a user asks whether a document, screenshot, scan, statement, invoice, contract, chat log, receipt, or payment evidence is genuine, original, edited, Photoshopped, manipulated, fake, or valid."
 disable-model-invocation: true
-release-version: 0.50.1
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Document and Image Authenticity

package/skills/risk-compliance/fraud-detection/SKILL.md

@@ -12,7 +12,7 @@ description: >
   impact, and a business report. Use for fraud, scam, mule, account-takeover,
   chargeback, dispute, transfer, collection, or payout risk analysis even when the
   user does not name this skill.
-release-version: 0.50.1
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Fraud Detection

package/skills/risk-compliance/payment-analysis/SKILL.md

@@ -14,7 +14,7 @@ description: >
   transactions" — even if they do not say payment-analysis. Do NOT use for
   fraud rule discovery (fraud-detection) or TLD / MCC-miscoding
   clusters (tld-detection).
-release-version: 0.50.1
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Payment Analysis

package/skills/risk-compliance/portfolio-payment-analysis/SKILL.md

@@ -5,7 +5,7 @@ description: >
   and investigate selected merchants' authorization, settlement and disputes,
   including descriptor mapping and overlapping exports. Portfolio-level payment
   overviews belong to payment-analysis; fraud rule discovery belongs to fraud-detection.
-release-version: 0.50.1
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Portfolio payment analysis