@feigi/fleet-ctl 3.23.5 → 3.23.7

package/agents/fleet-implementer-slow-high.agent.md

@@ -116,8 +116,8 @@ itself but this rule.
 **A subagent you dispatch gets its own directory under yours,
 `<scratch>/impl-<N>/<childName>/`, and you write that path, absolute, into its
 prompt — it writes nowhere else, and never derives a path of its own.**
-`<childName>` is a slug of the name you dispatch it under (omp's task `name`,
-Claude Code's `description`) — `[a-z0-9-]` only, never the raw field itself,
+`<childName>` is a slug of the name you dispatch it under (omp's task `name`) —
+`[a-z0-9-]` only, never the raw field itself,
 which can carry spaces and `/` and would split or nest the path in an
 unquoted shell command — unique among your children and never one of your
 own entries (`probe`, `mutate`, or any other name you write under

package/agents/fleet-implementer-slow-medium.agent.md

@@ -116,8 +116,8 @@ itself but this rule.
 **A subagent you dispatch gets its own directory under yours,
 `<scratch>/impl-<N>/<childName>/`, and you write that path, absolute, into its
 prompt — it writes nowhere else, and never derives a path of its own.**
-`<childName>` is a slug of the name you dispatch it under (omp's task `name`,
-Claude Code's `description`) — `[a-z0-9-]` only, never the raw field itself,
+`<childName>` is a slug of the name you dispatch it under (omp's task `name`) —
+`[a-z0-9-]` only, never the raw field itself,
 which can carry spaces and `/` and would split or nest the path in an
 unquoted shell command — unique among your children and never one of your
 own entries (`probe`, `mutate`, or any other name you write under

package/agents/fleet-implementer-smol-high.agent.md

@@ -116,8 +116,8 @@ itself but this rule.
 **A subagent you dispatch gets its own directory under yours,
 `<scratch>/impl-<N>/<childName>/`, and you write that path, absolute, into its
 prompt — it writes nowhere else, and never derives a path of its own.**
-`<childName>` is a slug of the name you dispatch it under (omp's task `name`,
-Claude Code's `description`) — `[a-z0-9-]` only, never the raw field itself,
+`<childName>` is a slug of the name you dispatch it under (omp's task `name`) —
+`[a-z0-9-]` only, never the raw field itself,
 which can carry spaces and `/` and would split or nest the path in an
 unquoted shell command — unique among your children and never one of your
 own entries (`probe`, `mutate`, or any other name you write under

package/agents/fleet-implementer-task-high.agent.md

@@ -116,8 +116,8 @@ itself but this rule.
 **A subagent you dispatch gets its own directory under yours,
 `<scratch>/impl-<N>/<childName>/`, and you write that path, absolute, into its
 prompt — it writes nowhere else, and never derives a path of its own.**
-`<childName>` is a slug of the name you dispatch it under (omp's task `name`,
-Claude Code's `description`) — `[a-z0-9-]` only, never the raw field itself,
+`<childName>` is a slug of the name you dispatch it under (omp's task `name`) —
+`[a-z0-9-]` only, never the raw field itself,
 which can carry spaces and `/` and would split or nest the path in an
 unquoted shell command — unique among your children and never one of your
 own entries (`probe`, `mutate`, or any other name you write under

package/agents/fleet-implementer-task-max.agent.md

@@ -116,8 +116,8 @@ itself but this rule.
 **A subagent you dispatch gets its own directory under yours,
 `<scratch>/impl-<N>/<childName>/`, and you write that path, absolute, into its
 prompt — it writes nowhere else, and never derives a path of its own.**
-`<childName>` is a slug of the name you dispatch it under (omp's task `name`,
-Claude Code's `description`) — `[a-z0-9-]` only, never the raw field itself,
+`<childName>` is a slug of the name you dispatch it under (omp's task `name`) —
+`[a-z0-9-]` only, never the raw field itself,
 which can carry spaces and `/` and would split or nest the path in an
 unquoted shell command — unique among your children and never one of your
 own entries (`probe`, `mutate`, or any other name you write under

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.23.5",
+  "version": "3.23.7",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/compute-spend.mjs

@@ -286,17 +286,19 @@ export function computeSpend({ agents = [], topN = 8 } = {}) {
 }
 
 // Per-TOOL attribution. Tokens are not billed per tool call, so this is a proxy
-// and is labelled as one everywhere it surfaces: a tool result arrives in a user
-// turn, and the NEXT assistant turn's cache_creation is the cost of writing that
-// result into the cache. When several results land before that turn, the cost is
-// split proportionally by result size, because that is what drove it.
+// and is labelled as one everywhere it surfaces: a tool result arrives as a
+// `toolResult` line, and the NEXT assistant turn's cache_creation is the cost
+// of writing that result into the cache. When several results land before that
+// turn, the cost is split proportionally by result size, because that is what
+// drove it.
 //
-// Those results arrive as CONSECUTIVE user turns, not as one turn carrying
-// several blocks: across 45,062 real result-bearing turns, not one carried two
-// tool_results. Parallel tool calls show up as N single-result turns in a row
-// (4,087 occurrences). So `pending` must ACCUMULATE across consecutive result
-// turns — replacing it dropped every batch but the last, losing 9.1% of all
-// attributions, and left the proportional split below unreachable on real data.
+// Those results arrive as CONSECUTIVE result lines, not as one turn carrying
+// several blocks: in omp transcripts each tool result sits on its own line
+// (measured on 176,027 results, recorded beside the reader in
+// member-record.mjs). Parallel tool calls show up as N single-result lines in a
+// row. So `pending` must ACCUMULATE across consecutive result lines —
+// replacing it dropped every batch but the last, and left the proportional
+// split below unreachable on real data.
 //
 // The proxy over-attributes slightly — that next turn also caches the assistant's
 // own preceding output — so treat these as shares, not absolutes. `resultChars`

package/scripts/compute-spend.test.mjs

@@ -44,12 +44,11 @@ const CONSECUTIVE = [
 ];
 const ORPHAN = [result(["orphan", 100]), { kind: "assistant", cacheWrite: 50, tools: [] }];
 
-test("CONSECUTIVE result turns accumulate — that, not the multi-block turn, is the real shape", () => {
-  // Regression. Parallel tool calls do NOT arrive as one user turn carrying two
-  // tool_result blocks: across 45,062 real result-bearing turns, none carried
-  // two. They arrive as N single-result turns in a row (4,087 occurrences).
-  // Replacing `pending` per result turn dropped every batch but the last —
-  // 9.1% of all attributions — and made the proportional split above dead code.
+test("CONSECUTIVE result entries accumulate — that, not one multi-result entry, is the real shape", () => {
+  // Regression: parallel tool calls arrive as N single-result entries in a row,
+  // not as one entry carrying several results (see the attributeTools comment).
+  // Replacing `pending` per result entry dropped every batch but the last, and
+  // made the proportional split unreachable.
   const tools = attributeTools(CONSECUTIVE);
   const by = Object.fromEntries(tools.map((t) => [t.tool, t.cacheWrite]));
   assert.equal(by.Read, 750);

package/scripts/dispatch-block-golden-prose.test.mjs

@@ -358,8 +358,8 @@ const REGION_BLOCKS = [
       "**A subagent you dispatch gets its own directory under yours,",
       "`<scratch>/impl-<N>/<childName>/`, and you write that path, absolute, into its",
       "prompt — it writes nowhere else, and never derives a path of its own.**",
-      "`<childName>` is a slug of the name you dispatch it under (omp's task `name`,",
-      "Claude Code's `description`) — `[a-z0-9-]` only, never the raw field itself,",
+      "`<childName>` is a slug of the name you dispatch it under (omp's task `name`) —",
+      "`[a-z0-9-]` only, never the raw field itself,",
       "which can carry spaces and `/` and would split or nest the path in an",
       "unquoted shell command — unique among your children and never one of your",
       "own entries (`probe`, `mutate`, or any other name you write under",

package/scripts/dispatch-block-pins-prose.test.mjs

@@ -373,7 +373,7 @@ test("the scratch-discipline block names the shared injected root, the per-membe
   // The name the path is keyed on, bound to what makes it collision-free.
   assert.match(
     b,
-    phrase("`<childName>` is a slug of the name you dispatch it under (omp's task `name`, Claude Code's `description`) — `[a-z0-9-]` only, never the raw field itself, which can carry spaces and `/` and would split or nest the path in an unquoted shell command — unique among your children and never one of your own entries (`probe`, `mutate`, or any other name you write under `<scratch>/impl-<N>/` yourself), so no child shares a directory with a sibling or with you"),
+    phrase("`<childName>` is a slug of the name you dispatch it under (omp's task `name`) — `[a-z0-9-]` only, never the raw field itself, which can carry spaces and `/` and would split or nest the path in an unquoted shell command — unique among your children and never one of your own entries (`probe`, `mutate`, or any other name you write under `<scratch>/impl-<N>/` yourself), so no child shares a directory with a sibling or with you"),
     "`<childName>` is no longer defined as a slugged, own-entry-safe dispatch name unique among the parent's children",
   );
 });

package/scripts/fan-out-authorization-prose.test.mjs

@@ -0,0 +1,80 @@
+// A reviewer that holds the dispatch tool still has to be TOLD the fan-out is
+// requested work, or it declines to dispatch the specialists and the run
+// silently downgrades to a thinner solo review. Two documents say so: run-team's
+// "Authorize the fan-out explicitly" paragraph, and member-lifecycle.md's
+// "Capability is not permission" section.
+//
+// What the rule rests on is the distinction itself — holding the tool is not
+// authorization to use it — and not on any standing instruction an omp member
+// inherits. The retired wording named such an instruction (`AgentTool`) and
+// rested the rule on that inheritance; reverting either document to it left
+// every other test green, because nothing read these two passages at all.
+//
+// Each passage is sliced to its own paragraph or section, never matched
+// file-wide: both documents discuss the fan-out in many other places, and a
+// file-wide match is satisfied by any of them while the rule's own wording is
+// gutted. Every match goes through `phrase()`, which tolerates a rewrap of the
+// same words — a pin that reds on a reflow discriminates nothing.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { between, paragraph, phrase } from "./prose-pin.mjs";
+
+const REPO = join(import.meta.dirname, "..");
+const read = (...p) => readFileSync(join(REPO, ...p), "utf8");
+
+const SKILL = read("skills", "run-team", "SKILL.md");
+const LIFECYCLE = read("skills", "run-team", "references", "member-lifecycle.md");
+
+// [label, passage, the sentence stating "holding the tool is not authorization",
+//  the sentence stating what the reviewer must be told]. The two documents word
+// the same rule differently, so each carries its own spelling.
+const PASSAGES = [
+  [
+    "run-team/SKILL.md's 'Authorize the fan-out explicitly' paragraph",
+    paragraph(SKILL, "Authorize the fan-out explicitly.", "run-team/SKILL.md"),
+    "holding the dispatch tool is not authorization to use it",
+    "State that the full specialist set IS the requested work",
+  ],
+  [
+    "member-lifecycle.md's 'Capability is not permission' section",
+    between(LIFECYCLE, "## Capability is not permission", "\n## ", "references/member-lifecycle.md"),
+    "Holding the dispatch tool does not authorize using it",
+    "reviewer prompt must state full specialist set IS requested work",
+  ],
+];
+
+test("both fan-out passages say holding the dispatch tool is not authorization to use it", () => {
+  for (const [label, passage, notAuthorization] of PASSAGES) {
+    assert.match(
+      passage,
+      phrase(notAuthorization),
+      `${label} no longer says "${notAuthorization}" — without it a reviewer that holds the dispatch tool reads the fan-out as optional and silently downgrades to a thinner solo review`,
+    );
+  }
+});
+
+test("both fan-out passages tell the controller to state the full specialist set IS the requested work", () => {
+  for (const [label, passage, , mustState] of PASSAGES) {
+    assert.match(
+      passage,
+      phrase(mustState),
+      `${label} no longer says "${mustState}" — the controller is no longer told what the reviewer prompt must carry`,
+    );
+  }
+});
+
+test("neither fan-out passage rests the rule on a standing instruction the member inherits", () => {
+  // The retired premise, not a spelling of it: any restatement that grounds the
+  // rule in an inherited do-not-dispatch instruction is the claim this ticket
+  // removed, whichever tool name it uses. `AgentTool` and the verb `inherits`
+  // are the two ways it was written.
+  for (const [label, passage] of PASSAGES) {
+    assert.doesNotMatch(
+      passage,
+      /AgentTool|\binherit/i,
+      `${label} grounds the fan-out rule in an inherited standing instruction again — omp members inherit no such instruction; the rule is that holding the tool is not authorization to use it`,
+    );
+  }
+});

package/scripts/finisher-name-prose.test.mjs

@@ -60,7 +60,7 @@ test("both member-naming lists name every member, the finisher included", () =>
     assert.deepEqual(
       missing,
       [],
-      `${label}'s member-naming list no longer names ${missing.join(", ")} — a controller reading it names that member something else, and a misnamed member loses the Agent tool with no error`,
+      `${label}'s member-naming list no longer names ${missing.join(", ")} — a controller reading it names that member something else, and a misnamed member is invisible to the ledger and unreachable by \`hub send\``,
     );
   }
 });

package/scripts/member-record.mjs

@@ -1,8 +1,8 @@
 // The member-telemetry adapter. ONE per-member
-// record shape, TWO readers a tree walk chooses by content, never by
-// caller-supplied config: board.mjs (the live spend panel) and
+// record shape, ONE transcript reader (`foldOmpTranscript`, `readOmpMember`):
+// board.mjs (the live spend panel) and
 // member-outcomes.mjs (the scraper) build on the primitives here rather than
-// each inlining a transcript layout, so the fold-back arithmetic, the cwd
+// each inlining a transcript layout, so the per-turn fold, the cwd
 // encoder and the ticket/PR extraction each live in exactly one place.
 //
 // The record: harness, session, role, agent, model, thinking,
@@ -39,16 +39,16 @@ import { classifyRole, canonicalMemberName, CANONICAL_MEMBER_NAME_PREFIXES } fro
 // callers who need to encode a cwd that is not guaranteed to exist — every
 // caller but board.mjs's own live panel — pass their own resolver.
 //
-// Encodes the way the fleet's own tooling reads it back: every
-// non-alphanumeric character with `-`, so `-Users-x-claude` decodes to
-// `/Users/x/.claude`, not `-Users-x.claude`. Home-relative paths become
-// `~/...`-style (`-` under $HOME) joined by `-` with DOTS PRESERVED
-// (`.claude` -> `-.claude`); non-home paths are realpath-resolved (so `/tmp/x`,
+// Encodes the way omp's own session directory naming does, by path SEGMENT:
+// the segments are split on the path separator, empty ones dropped, and joined
+// with `-`; every other character is kept, dots and underscores included.
+// Home-relative paths become `-` plus their segments
+// (`/Users/x/.claude/a_b` under home `/Users/x` -> `-.claude-a_b`);
+// non-home paths are realpath-resolved (so `/tmp/x`,
 // a symlink to `/private/tmp/x` on macOS, encodes under the resolved name)
-// and double-dash-wrapped. Both forms are measured against real
-// `~/.omp/agent/sessions/*` directory names - a
-// `~/dev/fleet-plugin`, `--private-tmp-fx685-scratch--` all exist on disk
-// today.
+// and wrapped in `--` (`/opt/a.b` -> `--opt-a.b--`). Both forms are measured
+// against real `~/.omp/agent/sessions/*` directory names: `-dev-fleet-plugin`
+// and `--private-tmp-fix685-scratch--` both exist on disk today.
 export function encodeProjectDir(cwd, { home = process.env.HOME, realpath = realpathSync } = {}) {
   const rel = relative(home, cwd);
   const isHome = !rel.startsWith("..") && !isAbsolute(rel);
@@ -188,7 +188,7 @@ function specialistPr(name) {
 // signals a corrupted or foreign file, not a harness to dispatch to.
 //
 // Both halves of that signature are checked, not just the blocklist half: a
-// line carrying neither Claude's keys NOR omp's own `type` field (e.g. a
+// line carrying neither a `sessionId`/`parentUuid` key NOR omp's own `type` field (e.g. a
 // foreign/corrupted `{"foo":"bar"}`) used to sail past the blocklist-only
 // check below and fold into a fabricated all-null/zero member record instead
 // of the refusal this comment already promised. `type` is the one envelope

package/scripts/reaping-reap-authorizers-prose.test.mjs

@@ -0,0 +1,112 @@
+// reaping.md's reap section said reap.sh's `git update-ref -d` is
+// "authorized by that cherry check and only by it". The script halts the
+// delete on a second thing too: a fresh worktree check (`wt_holding`) over a
+// listing re-read right before it, which keeps a `[gone]` branch the cherry
+// check cleared whenever a worktree holds it or cannot be resolved. A sentence
+// naming the cherry check as the only authorizer is false as written.
+//
+// The reap-side twin of reaping-release-authorizers-prose.test.mjs, which pins
+// the release section's authorizer list. Kept apart so each section's pin can
+// be edited independently.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { between, bullet, phrase, unemphasized } from "./prose-pin.mjs";
+
+const REPO = join(import.meta.dirname, "..");
+const REAPING = readFileSync(
+  join(REPO, "skills", "run-team", "references", "reaping.md"),
+  "utf8",
+);
+const SCRIPT = readFileSync(join(REPO, "scripts", "reap.sh"), "utf8");
+
+const reapSection = () =>
+  between(
+    REAPING,
+    "## Why the reap is shaped the way it is",
+    "## Why a second sweep, over worktrees rather than branches",
+    "reaping.md",
+  );
+
+// The bullet that names the delete, bounded to its own list item: it ends at
+// the next list marker, so a sibling bullet (the holder-check bullet sits
+// right after it) cannot supply the words, and rewording that sibling does
+// not move the bound.
+const deleteBullet = () =>
+  bullet(
+    reapSection(),
+    "- **The delete is `git update-ref -d`'s compare-and-swap",
+    "\n- ",
+    "reaping.md's reap section",
+  );
+
+// The clause that lists the authorizers: from "authorized by" to the
+// sentence after the bold lead, which explains the compare-and-swap. Sliced
+// emphasis-tolerantly, and every assertion below reads it through
+// `unemphasized()`, so a `**` moved onto or into the clause stays green: the
+// slice only locates the clause, and `phrase()` is matched against raw text.
+const authorizers = () =>
+  between(
+    deleteBullet(),
+    "authorized by that cherry check",
+    "Tip read before the cherry",
+    "reaping.md's reap delete bullet",
+    { emphasisTolerant: true },
+  );
+
+test("reaping.md: the reap delete's authorizer clause names the fresh worktree-holds-branch check", () => {
+  // ONE contiguous span, not keywords: "fresh" and the negation each
+  // satisfied somewhere in the slice pass a clause with either one gutted
+  // ("a check that no worktree holds the branch" has no freshness; "a fresh
+  // check ... that a worktree holds the branch" has the opposite meaning).
+  // Only a span binds the two to each other.
+  assert.match(
+    unemphasized(authorizers()),
+    phrase("a fresh check, re-read immediately before the delete, that no worktree holds the branch"),
+    "reaping.md's reap section names what authorizes the `update-ref` delete but not the fresh worktree check — reap.sh keeps a branch the cherry check cleared whenever a worktree holds it",
+  );
+});
+
+test("reaping.md: the reap delete's authorizer clause does not make any one check the only authorizer", () => {
+  // The exclusivity the defect carried, in the spellings of it a reword can
+  // restore after the new words: "only by it", "only by them", "nothing
+  // else", "solely", "alone". Pinned on its own because the presence pin
+  // above stays green with any of them restored. A word list, so a spelling
+  // outside it goes unseen; `\s+` keeps a reflow between its words green.
+  assert.doesNotMatch(
+    unemphasized(authorizers()),
+    /\bonly\s+by\b|\bnothing\s+else\b|\bsolely\b|\balone\b/,
+    "reaping.md's reap section says one check alone authorizes the `update-ref` delete — reap.sh's worktree check stops that delete too",
+  );
+});
+
+test("reaping.md: the reap delete's authorizer clause still names the cherry check", () => {
+  // Input the new assertions must ACCEPT: naming the worktree check must not
+  // cost the clause the check it already had.
+  assert.match(unemphasized(deleteBullet()), phrase("authorized by that cherry check"));
+});
+
+// reap.sh's executable lines, comments and `echo` diagnostics dropped. The
+// check's name and the delete command both recur in comments: an indexOf over
+// the raw text lands on either and reads as the code, so a real delete moved
+// above the check, or the check commented out, stays green. Only whole-line
+// comments drop here, so each pattern below is anchored at the start of its
+// statement: a command spelled after a `#` inside a live line is not live.
+const liveLines = () => SCRIPT.split("\n").filter((l) => !/^\s*(?:#|echo\b)/.test(l));
+
+// The one live line matching `re`. Exactly one: a first-hit search would
+// bind the pin to whichever copy comes first.
+const liveLineOf = (re, what) => {
+  const hits = liveLines().flatMap((l, i) => (re.test(l) ? [i] : []));
+  assert.equal(hits.length, 1, `reap.sh: expected exactly one live line that ${what}, found ${hits.length}`);
+  return hits[0];
+};
+
+test("reap.sh: the worktree check the prose names sits before the delete", () => {
+  // The prose names a check the script runs; pin that the script still does,
+  // and runs it before the delete, so the prose cannot outlive the check.
+  const check = liveLineOf(/^\s*if\s+wt_holding\s+"refs\/heads\/\$b"/, "runs wt_holding on the branch");
+  const del = liveLineOf(/^\s*if\s+!\s+err=\$\(git\s+update-ref\s+--no-deref\s+-d\s+"refs\/heads\/\$b"\s+"\$tip"/, "runs `git update-ref -d` on the branch at its tip");
+  assert.ok(check < del, "reap.sh runs its worktree check after the delete, not before it");
+});

package/skills/run-team/SKILL.md

@@ -1271,12 +1271,10 @@ for d in "$HOME/.omp/agent/sessions/$PROJECT_DIR"/*/; do
 done
 ```
 
-`encodeProjectDir` (`scripts/board.mjs`) encodes the cwd the way omp's own
-session directory naming does — every non-alphanumeric character becomes
-`-`, with a leading dot segment's dot PRESERVED rather than folded into the
-dash run (`member-record.test.mjs`'s regression case: `.claude` becomes
-`-.claude`, not `--claude`) — and hand-guessing that path is why the fleet's
-own panel once rendered nothing here. The trailing `/` on the glob matters:
+`encodeProjectDir` (defined in `scripts/member-record.mjs`, re-exported by
+`scripts/board.mjs`) encodes the cwd exactly as omp names its session
+directories — see its comment for the rule — and hand-guessing that path is why
+the fleet's own panel once rendered nothing here. The trailing `/` on the glob matters:
 the same encoded-cwd directory also holds this cwd's own top-level session
 transcripts as loose FILES sibling to the per-session directories, and a
 glob without it would try to scrape one of those as if it were a session.
@@ -1737,10 +1735,9 @@ It blocks, then prints one line. Which line it is, is the whole protocol:
   Run the tick above **with `--fold-unchanged`** and act on what it prints.
   Then arm the beat again.
 - `… Ns of Ms remain → re-issue this command now, do not end your turn` — no
-  command blocks for a whole interval (omp backgrounds one at
-  60s, which is why the
-  CI gate tells you to re-issue `gh run watch`). Issue it again. That is still
-  one blocking call per turn, never an idle turn.
+  command blocks for a whole interval (omp backgrounds one at 60s, which is
+  why the CI gate holds its wait in one `eval` cell polling `gh run view`).
+  Issue it again. That is still one blocking call per turn, never an idle turn.
 
 The interval doubles while the fleet asks for nothing and stops at `--ceiling`,
 so a quiet night costs ~26 wakes instead of ~96. **The ceiling is a real bound,
@@ -2981,8 +2978,9 @@ its own survivors, so the zero is what tells the tick no fix-applier is owed —
 and it reaches a finisher through the same gate as any other PR.
 
 **Authorize the fan-out explicitly.** State that the full specialist set IS the
-requested work — otherwise the reviewer inherits the standing "do not call the
-AgentTool unless requested" and silently downgrades to a thinner solo review.
+requested work — holding the dispatch tool is not authorization to use it, and
+a reviewer not told so declines the fan-out and silently downgrades to a
+thinner solo review.
 Nothing computes the count here, so apply the heuristic yourself: two or three
 specialists for annotation-only or single-file, the full set for production code.
 See references/member-lifecycle.md.

package/skills/run-team/references/member-lifecycle.md

@@ -1,6 +1,6 @@
 # Member lifecycle: naming, fresh context, recovery
 
-Why member name load-bearing, why every member single-use, how killed/idle/truncated member recovered. Assertions these justify live in SKILL.md's "Rules that fail silently", Phase 3, Reviewers, Failure handling sections; evidence here.
+Why member name load-bearing, why every member single-use, how a member's job outcome (`completed`/`failed`/`cancelled`) and peer liveness (`running`/`idle`/`parked`) decide its recovery. Assertions these justify live in SKILL.md's "Rules that fail silently", Phase 3, Reviewers, Failure handling sections; evidence here.
 
 ## Every member is named
 
@@ -12,7 +12,7 @@ The name is the ledger token and the hub address (`hub send <name>`, `agent://<n
 
 ## Capability is not permission
 
-Members inherit standing *"Do not call the AgentTool unless the user requested it."* Else reviewer declines to dispatch specialists — correctly — you get thinner solo review, no error, no signal. Having tool (capability) not authorization to use it (permission); reviewer prompt must state full specialist set IS requested work.
+Holding the dispatch tool does not authorize using it: a reviewer not told the fan-out is requested work declines to dispatch specialists, and you get thinner solo review, no error, no signal. Having tool (capability) not authorization to use it (permission); reviewer prompt must state full specialist set IS requested work.
 
 ## The coordination contract
 

package/skills/run-team/references/reaping.md

@@ -22,7 +22,7 @@ Every precondition recomputed **inside** same command as delete:
 - **`for-each-ref`, not `git branch | grep`.** `%(upstream:track)` emits exactly `[gone]` as own field. Nothing to pattern-match, no `-v`/`-vv` trap.
 - **Recompute per branch, in this command.** Branch list from earlier tool call already false: one observed run listed 28 gone branches, two calls later 27 reaped by concurrent session. Benign direction is no-op; dangerous one is worktree that gained work *after* check.
 - **`git cherry origin/main`, not `git diff main..`.** Against `origin/main` — local `main` you never fast-forwarded reads every merged branch as unmerged. Any `+` line is commit that exists nowhere else.
-- **The delete is `git update-ref -d`'s compare-and-swap on a tip read once (ADR 0018), authorized by that cherry check and only by it.** Tip read before the cherry, cherry runs against that SHA, delete refuses unless ref still equals it — commit landing between check and delete is kept with git's own `cannot lock ref`, never force-deleted, as it was under `git branch -D` until #2219. `--no-deref`, so symref branch deletes the symref, not its target (measured). Branch's config section removed after, as `-D` did — left behind, re-created branch of same name inherits dead upstream and reads `[gone]` at once. `git branch -d` would refuse everything here: upstream gone, so falls back to comparing against `HEAD`, a possibly-behind local `main`. Never delete branch whose cherry output you did not just read.
+- **The delete is `git update-ref -d`'s compare-and-swap on a tip read once (ADR 0018), authorized by that cherry check and by a fresh check, re-read immediately before the delete, that no worktree holds the branch.** Tip read before the cherry, cherry runs against that SHA, delete refuses unless ref still equals it — commit landing between check and delete is kept with git's own `cannot lock ref`, never force-deleted, as it was under `git branch -D` until #2219. `--no-deref`, so symref branch deletes the symref, not its target (measured). Branch's config section removed after, as `-D` did — left behind, re-created branch of same name inherits dead upstream and reads `[gone]` at once. `git branch -d` would refuse everything here: upstream gone, so falls back to comparing against `HEAD`, a possibly-behind local `main`. Never delete branch whose cherry output you did not just read.
 - **A branch any worktree holds is a KEEP, checked right before the delete.** `update-ref` consults no worktree; `-D` did. So listing is re-read and worktree.sh's `wt_holding` asks: held by a `branch` line, or by detached worktree stopped mid `rebase -i` / mid `bisect` on it (admin dir's `head-name` / `BISECT_START`) — both routes `-D` refused on (#2218). Worktree it cannot resolve, or listing that will not re-read, is a KEEP. `--apply` only, like the delete: dry run cannot predict this refusal — not the same limitation `-D`'s dry run had, since an unrelated worktree elsewhere in the listing that this check cannot resolve keeps every `[gone]` branch in the pass (see below), a repo-wide case `-D` never produced.
 - **A cherry that cannot answer is a KEEP.** Capture git's output; never pipe git itself: `cmd | grep -q` takes grep's exit status, never cmd's, so a `git cherry` that dies (rc 128 — one unreadable loose object is enough) prints nothing, grep exits 1, and a dead probe reads identical to "nothing unmerged" (verified, git 2.50.1). Unanswerable probe authorizes no delete — same fail-closed shape as `worktree remove` below. Read the `+` anchored, too: the capture folds stderr in, so an unanchored match reads a `+` in a diagnostic as a commit. Pinned by a test.
 - **A worktree registry that cannot be read is a KEEP, for every `[gone]` branch in that pass.** The lookup decides whether the dirty, ignored-files and removal checks run at all; an unread registry reads identical to "no worktree", and `-D`, the delete then, needed no answer from the registry to delete a branch that has none — so failing open force-deleted merged branches blind (#622). The holder check before the delete asks only whether a worktree holds the branch, never those other questions, so the lookup still fails closed on its own. The listing is re-read per branch, so one repo-level failure keeps every `[gone]` branch in the pass, each with git's own cause. Reap runs after every merge pass, so the next one retries: nothing is lost, nothing is reaped blind.