@agent-native/core 0.210.1 → 0.211.0-nightly-20261020183616

package/src/templates/factory/.agents/skills/review-latest-feedback/SKILL.md

@@ -21,7 +21,25 @@ Four phases, in order. Phase 0 comes before any investigation, not after.
 2. **Fix** what the evidence actually proves, at the owning boundary.
 3. **Reply** with useful questions, then recap.
 
-Output is fixes. For every report root this task owns, keep one concise, current same-actor status reply after the latest human message. It names every verified `✅` scope and its evidence, every open scope, and each `🎫` action and owner (or why a mark does not apply). Add and read back root `✅` as soon as direct post-change proof verifies a scope, and root `🎫` as soon as another person or team must act. An `👀` alone never completes the status. Preserve all reaction history, and follow [`slack-reaction-replies.md`](references/slack-reaction-replies.md). Do not reply on person-assigned or `:mag:` items.
+Output is fixes. For every unheld in-scope report root this task owns, keep one concise, current same-actor status reply after the latest human message. It names every verified `✅` scope and its evidence, every open scope, and each `🎫` action and owner (or why a mark does not apply). Add and read back root `✅` as soon as direct post-change proof verifies a scope, and root `🎫` as soon as another person or team must act. An `👀` alone never completes the status. Preserve all reaction history, and follow [`slack-reaction-replies.md`](references/slack-reaction-replies.md). Do not reply on held, person-assigned, or `:mag:` items.
+
+### Read the root marks as history; use the reply for current status
+
+- `👀` records this workflow's claim. It does not mean the report is still open.
+- `✅` records a scope that passed direct post-change proof. Add it as soon as
+  any scope passes, even when another scope remains open; name the verified
+  scope and evidence in the status reply.
+- `🎫` records a distinct action another person must take, including a reporter
+  request. Keep the reaction as history after that action is completed,
+  answered, or abandoned; the current reply must say whether the action is
+  still open or historical.
+- Every owned root needs one current same-actor reply after the latest human
+  reply. Reuse it while the disposition and evidence remain current; do not
+  send a duplicate progress reply on every sweep. The reply names verified
+  scopes, open scopes, human actions and owners, and why either `✅` or `🎫` is
+  absent. An eye-only root is correct when no scope is verified and no separate
+  human action is pending; say whether the next step is this workflow's
+  investigation or no further action.
 
 ## Slack channels and ownership
 
@@ -34,44 +52,93 @@ channel. For a permalink, its channel ID identifies only where the exact linked
 root must appear; it does not limit the cutoff or channel scope. For an
 explicitly narrowed sweep, verify that the active request names every selected
 channel, then record its exact text and IDs in the separate scope-confirmation
-file. `#dev-agent-native-feedback` is not excluded.
+file. A request can select exactly two channels by linking one report in the
+first and directly asking for “the same in” the second, without saying “only.”
+The checker permits one adjacent-transposition typo in that target only when it
+uniquely matches a selected canonical channel; it rejects incidental or quoted
+mentions and prefixes. See [`channel-inventory.md`](references/channel-inventory.md)
+for the scope gate and its confirmation requirements. `#dev-agent-native-feedback`
+is not excluded.
 
 In every scoped channel, run the complete bot-inclusive `slack_search_public`
 scan with only the channel filter and that channel's inclusive lower bound.
-Exhaust every cursor; `slack_read_channel` cannot replace this inventory. Resolve
-each row to its true parent. Read each report's full thread, attachments, and
-root reactions before classifying, claiming, or skipping it. Follow
+Freeze one `windowEndTs` at sweep start and use it for every channel and
+owned-mark search. Messages newer than it belong to the next scheduled sweep;
+never move the boundary to chase arrivals. Exhaust every cursor;
+`slack_read_channel` cannot replace this inventory. Resolve
+each row to its true parent and read the root reactions before opening the thread.
+If another actor owns any workflow mark (`👀`, `✅`, or `🎫`), or this actor owns
+`:mag:`, apply the held-thread boundary below: do not read the thread, react, or
+reply. Otherwise read the report's full thread and attachments before
+classifying or claiming it. Follow
 [`channel-inventory.md`](references/channel-inventory.md) for exact query
-arguments, raw-page receipts, cap recovery, root classification, all-history
-searches for this actor's `👀`, `✅`, and `🎫`, and checker requirements.
+arguments, raw-page receipts, cap recovery, root classification, fixed-window
+source scans, bounded ownership searches for this actor's `👀`, `✅`, and `🎫`,
+and checker requirements. Owned-mark searches use Slack's exact syntax
+`hasmy::eyes:`, `hasmy::white_check_mark:`, or `hasmy::ticket:` with the channel
+filter and the same inclusive `after` and `before` as that channel's source
+scan. Do not widen a finite catch-up request into an all-history audit. A root
+older than `after` is in scope only when an in-window reply links to it. A
+missing trailing colon is not a valid ownership query.
 
 Only the invoking Slack actor's root marks are owned here. Another task's eye
 plus its current open status remains theirs; an explicit handoff naming this
 task and scope is required to transfer investigation. An eye is a permanent
 claim, not proof of open or completed work. A mark on a reply never claims or
-checks off its parent. Before exit, reconcile every owned root in the full
-inventory, including older marks: latest human reply, current status reply,
-verified scopes, open scopes, human/team actions, and exact root reactions.
-Never let a high eye count hide an unchecked verified scope or a missing
-current reply.
+checks off its parent. Before exit, reconcile every in-window root carrying
+this actor's `👀`, `✅`, or `🎫` found by the bounded searches. Also reconcile an
+older root when an in-window reply links to it. For every owned root, compare
+the latest human reply, current status, verified scopes, open scopes, human
+actions, and exact root reactions.
+Never let a high eye count hide a verified scope without `✅` or a missing
+current status reply.
+
+**Held-thread boundary:** A direct root reaction read showing another person's
+`👀`, `✅`, or `🎫` means the thread belongs to that workflow; this actor's
+`:mag:` means this actor opted out. Record the exact root, reaction owners, and
+one reason (`foreign_workflow_mark` or `mag_opt_out`) in `ownershipSkip`, with
+`Skipped` disposition. When this actor owns both `:mag:` and a workflow mark,
+use `mag_opt_out` and preserve the exact root reaction-owner record as history.
+Do not open/read that thread, inspect reply reactions, add or remove reactions,
+or post a reply. Apply the same skip to channel reply
+rows linked to that root. A linked pre-window root without source text remains
+`unclassified`; do not infer its original report from the reply. This explicit
+exception keeps ownership boundaries intact while allowing the rest of the
+window to be reconciled. A foreign `👀` without current status is still held;
+do not read it to decide whether its owner is active.
 
 Only Steve's `:mag:` and `:yes-party:` count (`U0GCV21HC`). When Steve invokes,
-exhaust `hasmy::mag:` and `hasmy::yes-party:` searches; otherwise inspect root
-reactions. `:mag:` opts out and wins over `:yes-party:`. The latter authorizes
-only an otherwise review-only item; it never overrides an assignment or another
+exhaust `hasmy::mag:` and `hasmy::yes-party:` searches within each channel's
+same inclusive cutoff; otherwise inspect root reactions in the requested
+window. `:mag:` opts out and wins over `:yes-party:`. The latter authorizes only
+an otherwise review-only item; it never overrides an assignment or another
 task's claim.
 
 ## Phase 0: claim and reconcile
 
 Resolve known duplicates before claiming. Check ownership, then add and read
 back this task's root `👀` before investigating an eligible unowned report.
-Reconcile every root this actor already owns, including eyes, checks, and
-handoffs from prior runs, before discovering new questions. Keep one concise
-canonical status by the same actor after the latest human message; read back the
-visible reply and root reactions after each write. Use
+Reconcile only owned roots inside this invocation's fixed window and older
+roots explicitly linked by an in-window reply. Never expand a finite sweep to
+all historical roots just because this actor owns an old mark; widen the range
+only when the invocation explicitly requests it or hands off exact roots. Finish
+this bounded reconciliation before discovering new questions. Keep one
+concise canonical status by the same actor after the latest human message; read
+back the visible reply and root reactions after each write. Use
 [`slack-reaction-replies.md`](references/slack-reaction-replies.md) for exact
 status and reaction rules.
 
+**Bounded exit gate:** enumerate the complete candidate set from the fixed
+source window, the three matching owned-mark searches, and older roots linked
+by in-window replies. For every unheld owned root, compare the latest human
+message, current status reply, verified scopes, open scopes, and root marks.
+Add and read back `✅` for each newly verified scope and `🎫` for each distinct
+pending human action; the status reply must follow the latest human message and
+name current evidence, remaining work, and owners. An `👀` with a verified
+scope missing `✅`, a pending human action missing `🎫`, or no current status is
+unfinished. Finish the complete bounded set once, then stop; do not chase
+unrelated historical marks.
+
 Split reports into distinct scopes. Add root `✅` as soon as any named scope
 passes direct post-change proof, even while its PR is open; say **Verified
 locally** and that merge is pending. Use **Fixed** only after merge and direct
@@ -97,11 +164,14 @@ action and owner. Use **Skipped** only for non-defects.
 
 Phase 0 handles new human replies on owned roots first; never hide a newer
 reporter reply behind a mark. Then find prior unanswered questions using the
-exact bot disclosure and the saved channel reply cursor. On a first run, scan
-available history. Exhaust pages, use a one-day overlap for date-only cursors,
-resolve every hit to its parent, and read the full thread after checking
-reactions. Follow [`slack-reaction-replies.md`](references/slack-reaction-replies.md)
-for exact searches, legacy identity handling, and answer criteria.
+exact bot disclosure and the saved channel reply cursor, bounded by this
+invocation's fixed window. On a first run, use the same default five-day window;
+never scan all available history to initialize the cursor. Exhaust pages, use a
+one-day overlap for date-only cursors, resolve every hit to its parent, and read
+the full thread after checking reactions. An older root is eligible only when
+an in-window reply links to it. Follow
+[`slack-reaction-replies.md`](references/slack-reaction-replies.md) for exact
+searches, legacy identity handling, and answer criteria.
 
 A valid answer is a human post after the question, without this workflow's
 disclosure, that addresses the question. Rebuild the evidence and attempt the
@@ -316,15 +386,17 @@ send one concise disposition covering done, remaining, and next action/owner.
 Do not reply again to announce merge, publication, or live beta; answer direct
 reporter follow-ups. End Slack replies with `this was sent from a bot.`.
 
-Replies are one or two sentences: the change or question, its limit, and the next step. Never explain reactions, ledgers, or tickets. Never send **Open**/**pending** or a symptom recap. Ask for reporter input only when it changes the next step; never request supplied evidence or internal access. Keep hashes, branches, CI, publisher, and run details in the recap.
-
-That brevity rule is for a reporter-facing reply. Separately, every root this
-actor marks with `👀`, `✅`, or `🎫` still needs the current same-actor status
-reply required by the Slack reaction reference. One concise reply may serve both
-purposes when it answers the reporter and records the current disposition,
-verified/open scopes, owner/action, and any missing-proof reason. A Slack `🎫`
-reaction tracks a distinct unfinished human/team action; it does not mean an
-external tracker ticket was created or assigned. Never imply that it was.
+Reporter-facing replies are one or two sentences: the change or question, its limit, and the next step. Do not explain workflow mechanics, ledgers, or external tracker tickets. Never send **Open**/**pending** or a symptom recap. Ask for reporter input only when it changes the next step; never request supplied evidence or internal access. Keep hashes, branches, CI, publisher, and run details in the recap.
+
+Every root this actor marks with `👀`, `✅`, or `🎫` also needs the current
+same-actor status reply required by the Slack reaction reference. One concise
+reply may serve both purposes when it answers the reporter and records the
+current disposition, verified/open scopes, owner/action, and any reason a mark
+is absent. This status requirement takes precedence over the reporter-facing
+brevity rule only for those facts; do not explain ledger mechanics or external
+tracker tickets. A Slack `🎫` reaction tracks a distinct human action, not an
+external ticket, and remains as history after the action closes. Never imply
+that an external ticket was created or assigned.
 
 Keep publisher and beta checks in the internal recap after the disposition;
 they do not trigger a second reporter reply.

package/src/templates/factory/.agents/skills/review-latest-feedback/references/channel-inventory.md

@@ -3,15 +3,27 @@
 Use this procedure before investigating, claiming, or using a CI rollup in
 place of Slack source messages.
 
+At the start of a sweep, capture one Slack timestamp as `windowEndTs`. Use it
+as the inclusive `before` argument on the source scan and all three `hasmy`
+ownership searches in every scoped channel. Use the same inclusive `after` on
+the source scan and ownership searches. Record the bounds in `scanQuery` and
+each owned search's `query`. Keep `after` fixed through the sweep. Keep the
+exact upper bound for the whole sweep; page-cap recovery slices may narrow only
+`before` using the existing one-microsecond boundary rule. Messages newer than
+`windowEndTs` belong to the next scheduled sweep. Never advance either bound to
+chase arrivals or expand a finite catch-up request into an all-history audit.
+
 - For the exhaustive channel source scan, use `slack_search_public` with only
-  `filters=in:<#CHANNEL>`, `after=<channel cutoff>`, `keywords=[]`, an empty
+  `filters=in:<#CHANNEL>`, `after=<channel cutoff>`,
+  `before=<windowEndTs>`, `keywords=[]`, an empty
   `natural_language_query`, `include_bots=true`, `include_context=false`,
   `content_types=messages`, `limit=20`, `sort=timestamp`, `sort_dir=desc`, and
   `response_format=detailed`. Do not add lexical, semantic, date, author, or
   reaction filters: they silently hide reports. Record these exact arguments
   under that channel's `scanQuery`; the inventory checker rejects a missing or
-  narrowed query. `after` is inclusive and must equal that channel's effective
-  cutoff. Follow every `next_cursor` newest-first to Slack exhaustion, even
+  narrowed query. `after` and `before` are inclusive and must equal that
+  channel's effective lower cutoff and the sweep's fixed upper bound. Follow
+  every `next_cursor` newest-first to Slack exhaustion, even
   after reaching the cutoff, because later pages can contain replies to older
   roots. Page and
   source-row timestamps must descend across the full chain. This is separate
@@ -50,9 +62,18 @@ place of Slack source messages.
   `ts >= effectiveCutoffTs`, and record the exact `oldest` in `oldestQuery`.
 - Record `scope.channelIds` as the exact IDs requested and scanned. The default
   sweep lists all three default feedback channels. For an explicitly narrowed
-  invocation, inspect the active user request itself; it must explicitly limit
-  scope and name every selected channel by exact ID or `#channel-name`. A
-  permalink or time anchor does not narrow channel scope. Ask the user if the
+  invocation, inspect the active user request itself. It can name the exact
+  channel set with an explicit limit such as “only” and exact IDs or
+  `#channel-name`s. It can also select exactly two channels by linking one
+  report permalink in the first channel and directly asking for “the same in
+  channel-name” (with or without `#`) in the second; that direct linked-report
+  form selects exactly those two channels and does not need an exclusivity
+  word. It requires exactly one linked root and one direct “same in” target. In
+  that clause only, accept a single adjacent transposition in the channel name
+  only when it uniquely resolves to one canonical channel in the requested
+  set. Do not infer scope from incidental or quoted channel mentions or a
+  channel-name prefix. A permalink or time anchor by itself does not narrow
+  channel scope. Ask the user if the
   requested channels are unclear. Store the exact instruction in
   `scope.userRequest` and `scope.narrowingJudgment`, then create a separate
   `.tmp/feedback-scope-confirmation.json` from that active request with
@@ -85,10 +106,12 @@ place of Slack source messages.
   `administrative` decision, and a human rationale tied to that text. This is
   an attributed human triage judgment; the checker verifies its presence and
   source-text linkage but cannot prove the interpretation is correct.
-  For every classified root, including administrative posts, capture a
+  For every unheld classified root, including administrative posts, capture a
   complete thread read and make `sourceText` exactly match its `rootText`.
-  Search output can confuse user-authored `Files:` or `Reactions:` lines with
-  connector metadata, so do not classify from a truncated search excerpt.
+  A held root keeps the exact channel-scan `sourceText` and direct reaction
+  evidence but has no thread-derived fields. Search output can confuse
+  user-authored `Files:` or `Reactions:` lines with connector metadata, so do
+  not classify from a truncated search excerpt.
   For a canonical Slack message permalink, inspect its `thread_ts` query value:
   if it differs from the message's `ts`, the message is a reply and that value
   is its root. A self-valued `thread_ts` or a canonical root permalink without
@@ -194,9 +217,9 @@ place of Slack source messages.
   root message.
   Read and capture a complete, oldest-first `threadSnapshot` after the final
   channel page for every in-scope classified root, including administrative
-  posts, unmarked roots, and roots with no replies. The checker rejects a
-  classified root without this read or with `rootText` that differs from its
-  `sourceText`.
+  posts, unmarked roots, and roots with no replies, except roots held by the
+  reaction ownership boundary below. The checker rejects a classified root
+  without this read or with `rootText` that differs from its `sourceText`.
   Supplemental roots must strictly predate the oldest `sourceTimestamps` entry
   across every scanned page, as well as `cutoffTs`; a root inside the scanned
   source range must have its own source-manifest row even when it predates the
@@ -205,8 +228,8 @@ place of Slack source messages.
   `ts === threadParentTs` and must not be duplicated in `threadRoots`. A
   supplemental root exists to resolve an in-window reply;
   its presence does not make the older report a new in-scope claim. Read its
-  exact root reactions and complete thread, then apply the ownership gate to
-  the root itself. Do not add `👀`, `✅`, or `🎫`, or post a status, just because
+  exact root reactions, then apply the ownership gate before opening the thread.
+  Do not add `👀`, `✅`, or `🎫`, or post a status, just because
   an unowned older root appears as context. If this actor already owns a mark
   on that older root, reconcile its current status and scopes as usual; record
   another actor's marks as ownership evidence and leave them untouched. Their
@@ -214,29 +237,53 @@ place of Slack source messages.
   shows an open disposition; a later closed status makes that eye historical.
   Keep
   the root disposition and any open scope in the audit row without claiming it.
-  The inventory checker still requires a complete, oldest-first
-  `threadSnapshot` for each supplemental root, including unowned roots, so a
-  reply cannot predate or otherwise contradict its reported root.
-- After the regular bounded channel scans, discover this actor's older owned
-  roots with three separate unbounded `slack_search_public` queries per scoped
-  channel: `in:<#CHANNEL> hasmy::eyes`,
-  `in:<#CHANNEL> hasmy::white_check_mark`, and
-  `in:<#CHANNEL> hasmy::ticket`. Use the same bot-inclusive detailed search
-  arguments as the channel scan, but omit `after`, `before`, keywords, semantic
-  search, and all other filters. Follow every cursor to explicit exhaustion. If
-  Slack caps a cursor before exhaustion, preserve that capped page and record
-  the exact `page_limit_exceeded` response in that search's
+  For an unheld supplemental root, the inventory checker still requires a
+  complete, oldest-first `threadSnapshot`, so a reply cannot predate or
+  otherwise contradict its reported root.
+- **Held thread:** If the exact root reaction read shows another actor owns any
+  workflow mark (`👀`, `✅`, or `🎫`), or this actor owns `:mag:`, do not open or
+  read the thread, inspect reply reactions, react, or reply. Record an
+  `ownershipSkip` with the root timestamp and `foreign_workflow_mark` or
+  `mag_opt_out`; use `Skipped` and leave thread-derived fields empty. If this
+  actor also owns a workflow mark, use `mag_opt_out` and preserve the exact
+  direct root reaction-owner record as history. The checker treats it as held
+  and requires no thread snapshot or status. Mark every
+  channel reply linked to that root with the same skip reference. The checker
+  requires direct root reaction evidence and the matching skip reason, but no
+  full-thread snapshot. For a linked pre-window root without source text, use
+  `unclassified`; do not guess from its in-window reply. This boundary also
+  applies when the other actor's eye has no visible status reply: ownership is
+  not permission to inspect. The direct root-reaction read must still be fresh
+  and after the final source page; it is the only read allowed for a held root.
+  Preserve the source's exact file ID, name, and MIME type when its raw search
+  result includes `Files:`. If that result omits file metadata, leave the held
+  root's `files` field absent to represent unknown; do not record `[]`. For an
+  unheld root, use the full thread read to record files and require the source
+  row and snapshot to agree.
+- After each bounded channel scan, run three separate bounded ownership
+  searches for this actor's `👀`, `✅`, and `🎫` with `slack_search_public`. Each
+  query uses only `in:<#CHANNEL> hasmy::EMOJI:` plus the same inclusive `after`
+  and `before` as the source scan. These searches cover only this invocation's
+  finite window; do not search unrelated channel history. An older root is in
+  scope only when an in-window reply links to it. Resolve that reply's true
+  parent, read the older root's exact reactions, and apply the held-thread gate
+  before opening it. Reconcile every candidate in the window and each linked
+  older root; unheld roots need exact reaction and full-thread evidence in the
+  source or supplemental-root audit. A candidate missing either audit is
+  unresolved, not outside scope.
+  If Slack caps a cursor before exhaustion, preserve that capped page and
+  record the exact `page_limit_exceeded` response in that search's
   `pageLimitRecoveries[]`, including its failed cursor and request args, raw
   response, read time, and the capped page's oldest result as `boundaryTs`.
-  Restart the same exact `hasmy` query at `cursor: null` with an inclusive
-  `before` exactly one microsecond below that boundary. Keep that `before` on
-  every page in the restarted cursor slice and in each raw request wrapper; the
-  base `filters` query remains unchanged. Follow the restarted slice to
-  exhaustion, and repeat this recovery for every later cap. The checker proves
-  each failed cursor against exactly one restarted slice, checks the boundary
-  and read order, and requires explicit exhaustion. If Slack does not let you
-  recover a capped tail, report the historical ownership search as incomplete;
-  do not claim every owned mark was reconciled.
+  Restart the same `hasmy` query at `cursor: null` with the same fixed `after`
+  and a `before` exactly one microsecond below that boundary. Keep both bounds
+  on every page in the restarted cursor slice and in each raw request wrapper.
+  Follow the restarted slice to exhaustion and repeat this recovery for every
+  later cap. The checker proves each failed cursor against exactly one
+  restarted slice, checks the boundary and read order, and requires explicit
+  exhaustion. If Slack does not let you recover a capped tail, report the
+  bounded ownership search as incomplete; do not claim every in-window owned
+  mark was reconciled.
   Record each exact query and page in `ownedMarkSearches`; save raw wrappers
   named `owned-marks-{channelName}-{eyes|white_check_mark|ticket}-00.json` and
   continue numbering for each cursor page. Each wrapper preserves exact
@@ -252,16 +299,19 @@ place of Slack source messages.
   evidence; if the exact read fails or is incomplete, leave ownership
   unresolved rather than treating the query as confirmation. A result with
   `ts !== root` is reply-level evidence: resolve and preserve its parent, but
-  never count it as a root checkoff. Verify reply reactions from the exact
-  reply read-back in its complete thread snapshot; if that historical reply
-  cannot be read back, report reply-level reconciliation as incomplete.
-  Deduplicate confirmed roots across the three searches. For any
-  exact-readback-confirmed root missing from the bounded source pages and
-  `threadRootAudits`, add a
-  full root audit row to `ownedRootAudits`; an in-scope root must instead
-  appear in the source pages. Reconcile each discovered root's latest human
-  message, status reply, scopes, and exact current reaction state. Read its
-  full thread after the final ownership-search page and preserve every raw
+  never count it as a root checkoff. For an unheld root, verify reply reactions
+  from the exact reply read-back in its complete thread snapshot; if that
+  historical reply cannot be read back, report reply-level reconciliation as
+  incomplete. For a held root, preserve the reply parent and matching skip
+  reason without opening the thread.
+  Deduplicate confirmed roots across the three searches. Every in-window root
+  candidate must appear in the source pages. An older root linked by an
+  in-window reply belongs in `threadRoots` and `threadRootAudits`. If a bounded
+  search hit has no matching source row or linked supplemental root, rerun the
+  source scan and include the missing evidence; do not invent an audit row.
+  Reconcile each unheld discovered root's latest human message, status reply,
+  scopes, and exact current reaction state. Read its full thread after the final
+  ownership-search page and preserve every raw
   `slack_read_thread` page under `thread-{channelName}-{rootTs}-00.json` and
   contiguous page numbers. Each wrapper records exact request `args`,
   requested `cursor`, raw response, and `readAt`; the raw response must
@@ -387,9 +437,13 @@ place of Slack source messages.
   and every source `{ ts, root }` row with the reviewed inventory and raw Slack
   responses. If it finds a mismatch,
   rebuild the inventory from the captured Slack pages and rerun the check; never
-  edit the receipt to fit the inventory. Each receipt page must also be fresh
-  within the checker's 15-minute window, so repeat the complete channel scan and
-  required final thread/reaction reads before recap when that window expires.
+  edit the receipt to fit the inventory. Source and ownership-search pages are
+  immutable evidence for the fixed `after`/`before` interval; their age does not
+  restart the sweep. The 15-minute freshness window applies to current root and
+  reply reaction reads and full-thread snapshots. If one expires, reread only
+  that exact state. After one targeted retry, if a required current-state read
+  is still stale or unavailable, mark the inventory incomplete and stop; do
+  not restart the channel-wide search or loop.
   It rejects any root mark this actor owns without a current same-actor
   status reply, a
   assigned-human handoff without that person's explicit acceptance, an
@@ -434,19 +488,18 @@ verified disposition may retain the eye as history. Never remove or clean up a
 reaction. Slack thread replies appear under the root's reply count, not as
 separate channel posts; do not broadcast routine status replies.
 
-After any long investigation, CI/deploy wait, or handoff, a newest-first scan
-from the saved high-water mark can identify new activity. Immediately before
-recap, however, rerun the exact original channel-wide `slack_search_public`
-query for every scoped channel, including its recorded `scanQuery.after`, and
-follow every cursor to Slack exhaustion. Replace the saved page responses,
-timestamps, source manifests, and source rows. Do not
-append a delta to an older page chain or refresh its `readAt` without rereading
-the page. Resolve every newly found reply to its actual root, refresh root
-reactions, and reconcile human answers before replacement. Then reopen every
-marked root thread after the last channel page, read all replies, and refresh
-reply-level workflow reaction owners. If this final scan or any thread read is
-older than 15 minutes, repeat the full bounded scan and marked-thread reads
-before checking the inventory. Only a complete fresh pass can certify coverage.
+After a long investigation, CI/deploy wait, or handoff, do one final exhaustive
+pass of the exact original channel-wide query for every scoped channel, using
+the same recorded `scanQuery.after` and `scanQuery.before`. Replace the saved
+page responses, timestamps, source manifests, and source rows; never append a
+delta or refresh `readAt` without rereading the page. This is one bounded
+reconciliation pass, not a moving high-water mark. Resolve newly found replies
+to their actual roots and reconcile them inside the fixed interval. Then reread
+current root reactions and full threads for marked roots after the final source
+and ownership-search pages. If an exact current-state read expires, reread that
+target once. If it still cannot pass freshness, mark coverage incomplete and
+stop; do not restart the global scan. Activity newer than `windowEndTs` is for
+the next scheduled sweep.
 
 Channel history does not include the contents of existing thread replies. In
 that final pass, also enumerate every distinct root thread carrying this
@@ -492,21 +545,22 @@ read time as `reactionReadAt`; when this sweep writes a reaction, record
 also requires each owned root reaction read and the full-thread reaction reads
 to follow the final channel page.
 
-The normal inventory check also requires every source, owned-mark search, and
-thread page or snapshot to have been read within the last 15 minutes, allows at
-most one minute of local clock skew, and requires owned-root reaction and thread
-read-backs to follow all three exhaustive mark searches. An old, complete
-inventory is stale: rerun the channel scan and historical mark searches, then
-read every marked root thread again before recap. This freshness gate prevents
-a complete earlier scan from silently omitting reports or replies that arrived
-during investigation.
+The inventory checker requires source pages to use one recorded inclusive
+`after`/`before` window and ownership-census pages to use the fixed `before`
+upper bound with no `after`. Both page chains must remain in cursor order and
+have valid local ISO read times. Their age does not invalidate those fixed
+bounds. Current root and reply reaction reads and full-thread snapshots must be
+within 15 minutes, allow at most one minute of local clock skew, and follow the
+final source and ownership-search pages. Refresh only a stale current-state
+target; if one targeted reread is still stale or unavailable, mark coverage
+incomplete and stop instead of repeating the full sweep.
 
 The inventory checker requires a complete `threadSnapshot` for every in-scope
-classified root, every supplemental root included to resolve an in-scope reply,
-and every older root discovered by the exhaustive owned-mark searches. It checks
-raw thread page cursor exhaustion, Slack's reply count, exact source text,
-attachments, and snapshot order, and rejects a newer human or sweep reply than
-the recorded status. A failed check means the sweep is not reconciled.
+classified root and every supplemental root included to resolve an in-scope
+reply, except roots recorded under the held-thread boundary. For unheld roots it
+checks raw thread page cursor exhaustion, Slack's reply count, exact source
+text, attachments, and snapshot order, and rejects a newer human or sweep reply
+than the recorded status. A failed check means the sweep is not reconciled.
 
 A grouped CI report or attachment is a discovery index, never a replacement for
 the channel-message inventory.

package/src/templates/factory/.agents/skills/review-latest-feedback/references/slack-reaction-replies.md

@@ -2,12 +2,19 @@
 
 Use the connected Slack integration for every Slack read and write. Never use a browser, screenshots, or UI automation to operate Slack.
 
-At sweep exit, reconcile every report root in the scoped inventory that has
-this task's `👀`, `✅`, or `🎫`, including marks left by earlier runs. Capture
+At sweep exit, reconcile every unheld report root in the scoped inventory that
+has this task's `👀`, `✅`, or `🎫`, including marks left by earlier runs. A
+root is held when a direct reaction read shows another actor owns any workflow
+mark or this actor owns `:mag:`. For held roots, record the root and safe-skip
+reason, then stop: do not open the thread, inspect reply reactions, write any
+reaction, or post a status. When this actor owns both `:mag:` and a workflow
+mark, use `mag_opt_out` and preserve the exact direct root reaction-owner
+record as history; the root remains held without a thread read or status reply.
+Capture
 the exact Slack actor ID used by the connected tool at sweep start. A mark is
 owned by this task only when its reaction owner ID matches that actor ID. Each
-owned root needs a current disposition and a matching status reply by that same
-actor under that same parent, even when the root has only `✅` or `🎫`. A
+unheld owned root needs a current disposition and a matching status reply by
+that same actor under that same parent, even when the root has only `✅` or `🎫`. A
 same-run fix gets its final reply after verification; continuing work gets a
 concrete progress reply. An earlier generic “taking a look” does not satisfy
 this update. If an existing reply already names the exact canonical disposition
@@ -30,6 +37,23 @@ includes human handoffs, the status reply must name each handoff's recorded
 owner and action; include its scope when the report context does not make it
 clear.
 
+Interpret the three root reactions independently from the current disposition:
+
+- `👀` is a permanent claim/history mark, not an open/closed indicator.
+- `✅` is permanent history for named scopes that passed direct post-change
+  proof. Add it as soon as any scope passes; do not wait for other scopes or
+  merge. Keep it if later evidence changes the scope's status, and explain the
+  historical mark in the current reply and inventory.
+- `🎫` is permanent history for a distinct human action, including an
+  unassigned team action or reporter request. Keep it after completion,
+  answer, or four-day abandonment; label it historical in the current reply
+  and inventory when it no longer blocks progress.
+
+The current status reply is the source for whether work remains open. When a
+root has only `👀`, say that no scope has passed the proof bar for `✅`, whether
+the next step belongs to this workflow, and why no separate human action needs
+`🎫`. Reuse a current reply rather than posting again on every sweep.
+
 An evidence-only addendum or a correction is not a current status. When your
 newest own reply is one of those, edit that reply into the full canonical
 disposition when possible; otherwise send one final status after the latest
@@ -101,10 +125,13 @@ slack_search: "this was sent from a bot." in:<#CHANNEL>
   sort=timestamp sort_dir=asc include_context=true max_context_length=300
 ```
 
-Also scan channel messages from the saved reply cursor; on the first run, scan
-available history. Since `after:` is date-only, start one day before the cursor,
-exhaust pages, resolve hits to their root, and advance the cursor only through
-processed messages. Read inherited threads carrying any of this actor's root marks (`👀`, `✅`,
+Also scan channel messages from the saved reply cursor within the current
+invocation's fixed window; on the first run, use the default five-day window,
+not all available history. Since `after:` is date-only, start one day before
+the later of the saved cursor and window start, exhaust pages, resolve hits to
+their root, and advance the cursor only through processed messages. An older
+root is eligible only when an in-window reply links to it. Read inherited
+threads carrying any of this actor's root marks (`👀`, `✅`,
 or `🎫`): a checkmark closes only its verified scope, not a newer reporter
 answer or another open scope. Do not reply or react on another actor's root when work is handed off for investigation; that handoff permits local investigation only. A separate explicit authorization is required to post a status or reporter reply there.
 
@@ -130,9 +157,10 @@ human/team actions, including actions with no named owner yet. The eye alone
 does not mean work remains open. One root `✅` covers every verified scope
 listed in `fixedScopes[]`; one root `🎫` covers every action listed in
 `handoffs[]`, including unassigned, accepted, and completed actions. Completion
-evidence changes its status, not the historical `🎫` reaction. For every root
-carrying any of this actor's marks, post or reuse a current status in that root's thread;
-unclaimed items and another actor's marks are not ours to reply to. Reconcile
+evidence changes its status, not the historical `🎫` reaction. For every
+unheld root carrying any of this actor's marks, post or reuse a current status
+in that root's thread; unclaimed items, held roots, and another actor's marks
+are not ours to reply to. Reconcile
 each report as one unit: send or verify its current same-thread status reply,
 then immediately update and read back each applicable root reaction before
 advancing to the next report. Add `✅` as soon as any reported scope passes the

package/src/templates/headless/.agents/skills/actions/references/action-fields.md

@@ -95,9 +95,9 @@ MCP clients see no `outputSchema` by default. Set `mcpOutputSchema: true` (requi
 
 `authorize` decides whether the caller may run the action at all. It wraps
 `run`, so it holds at **all six dispatch sites** — agent tool, HTTP, frontend
-hook, MCP, A2A, CLI — unlike `needsApproval`, which is honoured only in the
-agent loop. Use `authorize` for "not everyone may do this"; use `needsApproval`
-to ask a human to bless one call a permitted caller is already allowed to make.
+hook, MCP, A2A, CLI. Use `authorize` for "not everyone may do this"; use
+`needsApproval` to ask a human to bless one call a permitted caller is already
+allowed to make.
 
 ```ts
 import { coachAccess } from "../lib/access.js"; // defineAppRoles(...)
@@ -140,4 +140,6 @@ export default defineAction({
 
 When the gate is truthy and the call isn't yet approved, the loop emits an `approval_required` event and **stops the turn — `run()` never executes**. A predicate gates conditionally (e.g. only external recipients) and **fails closed**: a throw is treated as "approval required". It receives its own copy of the prepared snapshot of the validated arguments, defaults applied, and the approval binds to the snapshot's hash, so an approved call runs only with the arguments that were approved (a Date binds by its time). The human approves via the chat UI's Approve affordance, which re-issues the turn with the call's `approvalKey`, and only then does the action run.
 
+Approval is given in the app, so HTTP never grants it. The HTTP action route and the generated Workers entry run a gated call only for the proven app UI (a frontend call from the signed-in user, same origin, holding the short-lived UI capability; `isProvenUiRequest`, the proof `uiOnly` uses) or the app's MCP directory widget. Every other HTTP caller (bearer or API key, MCP OAuth token, org service token, A2A, extension iframe, mobile app) gets `409 approval_required`, and a service identity can never approve. The shared client presents the capability with every write from a signed-in session (minted once per user, reused for nine minutes, never for reads or public pages), so a gated button works on its first request. A call without proof gets `403 ui_capability_required`; the client then re-mints and retries once, which is only the fallback for an expired or rejected capability. Every surface evaluates the gate through `preparedCallNeedsApproval`, so a throwing predicate asks there too. A caller that must run unattended needs a different action, never a bypass of the gate.
+
 **Keep approvals rare** — the default is off and almost every action should leave it off. The canonical example is Mail's `send-email` (`needsApproval: true`). See the `security` skill and the Human Approval doc.