@iceinvein/agent-skills 0.18.3 → 0.20.0

package/skills/sluice/references/status.md

@@ -30,9 +30,13 @@ bash <skill-dir>/scripts/status.sh close
 
 `--dir <path>` reads another tree, which is what the statusline uses. A tree
 with a run of its own is read as itself; one with none resolves to the main
-worktree of its set, which is the tree a worktree is cut from and not the
-controller's own worktree, so once the run lives there `--dir <implementer
-worktree>` finds nothing. Statuses
+worktree of its set, and from there to whatever tree the run has since moved
+into. So any tree in the set reads the one run, wherever in the set it lives,
+and `--dir <implementer worktree>` finds it too. `show` prints a `tree` row
+naming where the run is whenever that is not the tree it was pointed at, since
+a run read from a tree it does not live in otherwise answers "where is this"
+with the tree the reader is already in. `show --json` stays the state file
+verbatim, and the row is not in it. Statuses
 are `todo`, `active`, `review`, `done` and `blocked`. A new id needs `--name`;
 after that every call is a bare flip, so keeping it current costs one command
 per transition rather than a paragraph. `close` archives the run under
@@ -56,9 +60,10 @@ is pointed at, `--dir` if given and the current tree otherwise, once; a base
 already on the row is kept. Issued from the controller's tree that is the
 controller's HEAD, which is what an implementer worktree cut from that branch
 starts at, so the default is right at dispatch. Where the implementer's tree
-has moved on, pass `--base $(git -C <implementer worktree> rev-parse --short
-HEAD)` rather than `--dir` that tree: with the run in your worktree, `--dir`
-pointed at the implementer's resolves to the main tree and finds no run.
+has moved on, point the command at that tree: `--dir <implementer worktree>`
+resolves the run through the set and takes the base from the tree it was
+pointed at, which is the one about to be built in. `--base $(git -C
+<implementer worktree> rev-parse --short HEAD)` says the same thing outright.
 
 `init` reports any other run live in a tree of the same set, without refusing:
 two sessions in two worktrees is legal, and a run stranded in the main tree
@@ -103,6 +108,24 @@ that already holds a run or that is not a work tree of the same repository. A
 submodule anchors on its own checkout, not the superproject's, and a directory
 that is no git work tree keeps its run exactly where it sits.
 
+`move` is half a step, and the half it cannot take is the session. The harness
+holds one working directory and no command here reaches it, so the controller
+goes on asking about the tree it is still sitting in: its statusline draws for
+that tree, so does the SessionStart hook, and so does every bare `git`, build
+and test command it runs. **Move the session into the tree the run went to**,
+with the harness's worktree tool where there is one, entering the worktree by
+path when it was cut by hand. `move` says so on the way out, because that is
+the moment it is still cheap.
+
+Until the session moves, the tree it came from reads the run rather than
+denying it: `move` leaves `.sluice/run.at` at the main worktree, one line
+naming the tree the run is in, and a tree with no run of its own follows it.
+The note lives at the main worktree and nowhere else, so a run moved twice
+forwards once rather than down a chain of trees, and it is followed only while
+the run it names is really there. `close` removes a note naming its own tree,
+because a note that outlived its run would hand the next run opened in that
+tree to whoever reads the main tree.
+
 One file for several writers is one file to contend on, so `init`, `task`,
 `preflight`, `final`, `pause`, `resume`, `close` and `move` take a lock first, `move` taking the
 destination tree's as well as its own: two flips issued at the same moment
@@ -290,11 +313,22 @@ every task done, a run idle for a day, and a turn where the harness says a
 stop hook already fired, which is what keeps it from looping. That last rule
 means it refuses once per turn and lets the next attempt through: a nudge, not
 a wall. The gate keys on the git top level of the session's working
-directory and nothing else, so the run has to live in the tree the session
-works in: open it after the worktree is cut, or `move` it there and then enter
-that worktree, since `move` relocates the run and not the session, and a run
-moved out from under a session still sitting in the main tree leaves that
-session unguarded for the rest of the run.
+directory: the run this tree answers for is the state beside it, or the state
+it forwarded into a worktree when `move` sent the run on without the session.
+Both are this tree's, and a controller that moved its run out and stayed put is
+guarded for the rest of the run rather than quietly let go at the moment it
+moved. The main-worktree fallback stays untaken, so a session in a worktree
+that merely reads the set's run is let stop as before.
+
+Once the run is in another tree the remedy changes with it. The refusal names
+that tree and says to move the session into it, and it stops offering `close`:
+from here that would archive a run live somewhere else, which may be another
+session's, and talking anyone into that is the one thing this hook must not do.
+The offer comes back when the run is in the tree the stop came from. None of
+this makes staying put correct: open the run after the worktree is cut, or
+`move` it and enter that worktree, since `move` relocates the run and not the
+session, and every bare `git`, build and test command meanwhile still lands in
+the tree the work left.
 
 `pause --reason <text>` records why a run is standing still; `show` and the
 statusline carry it, and `resume` clears it. A pause with no reason is refused,

package/skills/sluice/scripts/session-start.sh

@@ -31,12 +31,63 @@ if [ ! -t 0 ]; then
 fi
 cwd="$PWD"
 source=""
+sid=""
 if [ -n "$input" ] && command -v jq >/dev/null 2>&1; then
 	got="$(printf '%s' "$input" | jq -r '.cwd // empty' 2>/dev/null || true)"
 	[ -n "$got" ] && cwd="$got"
 	source="$(printf '%s' "$input" | jq -r '.source // empty' 2>/dev/null || true)"
+	sid="$(printf '%s' "$input" | jq -r '.session_id // empty' 2>/dev/null || true)"
 fi
 
+# The baseline for stop-guard.sh's entry check. That guard asks whether the tree
+# moved while this session held it, and this hook runs at the only moment the
+# answer is still "not yet". Taken for every session, run or no run: a session
+# that routes nothing is exactly the one the guard is there to catch.
+#
+# It lives beside the transcripts rather than in the tree, because a session
+# that opens in someone's repo should not leave a directory behind in it, and
+# because a baseline is spent the moment its session ends. A stamp that is
+# missing, unreadable or stale costs the guard its check and nothing else, so
+# every failure here is silent.
+stamp_baseline() {
+	local sid="$1" src="$2" tree digest
+	[ -n "$sid" ] || return 0
+	case "$sid" in */* | .*) return 0 ;; esac
+	tree="$(git -C "$cwd" rev-parse --show-toplevel 2>/dev/null)" || return 0
+	[ -n "$tree" ] || return 0
+
+	local dir="${CLAUDE_CONFIG_DIR:-${HOME:-}/.claude}/sluice/stamps"
+	mkdir -p "$dir" 2>/dev/null || return 0
+
+	# This hook fires again on compact, resume and clear, all carrying the
+	# session id the first one carried, and they are not the same event.
+	#
+	# A compact happens inside a session that never let go of the tree, so its
+	# baseline still stands; re-stamping there would move it onto the work
+	# already done and read a half-finished session as an untouched tree, and a
+	# session long enough to compact is the one this exists for.
+	#
+	# A resume reopens a session that had stopped, and a clear throws away what
+	# it was doing. Both leave the old baseline describing a tree from some
+	# unbounded time ago, and everything that happened to it since, by a
+	# colleague or an editor or another session, would be charged to whoever
+	# reopens it. Those two start again, and give back the nudge the previous
+	# sitting may have spent.
+	case "$src" in
+		resume | clear) rm -f "$dir/$sid" "${dir%/stamps}/nudged/$sid" 2>/dev/null || true ;;
+		*) [ -e "$dir/$sid" ] && return 0 ;;
+	esac
+
+	# A stamp outlives nothing but its session, and the harness never deletes
+	# one. Without this the directory grows for the life of the machine.
+	find "$dir" "${dir%/stamps}/nudged" -type f -mtime +7 -delete 2>/dev/null || true
+
+	digest="$(bash "$here/tree-snapshot.sh" "$tree" 2>/dev/null)" || return 0
+	[ -n "$digest" ] || return 0
+	printf '%s\n%s\n' "$tree" "$digest" >"$dir/$sid" 2>/dev/null || true
+}
+stamp_baseline "$sid" "$source"
+
 # No gate of its own beyond the directory existing: status.sh anchors on the
 # main worktree of whatever tree it is given, which is what lets a session
 # opened in a subdirectory or a linked worktree find the run, and on a tree
@@ -47,7 +98,7 @@ fi
 shown="$(bash "$STATUS" show --dir "$cwd" 2>/dev/null)" || exit 0
 [ -n "$shown" ] || exit 0
 
-echo "A sluice run is live in this tree. Its state, from .sluice/run.json:"
+echo "A sluice run is live. Its state, from .sluice/run.json:"
 echo
 echo "$shown"
 echo

package/skills/sluice/scripts/status.sh

@@ -23,8 +23,11 @@
 #   status.sh close
 #
 # --dir <path> selects the tree to read (default: $PWD). State lives at
-# <dir>/.sluice/run.json and closed runs at <dir>/.sluice/archive/. The
-# directory ignores itself, so no project needs a .gitignore line for it.
+# <dir>/.sluice/run.json and closed runs at <dir>/.sluice/archive/. A tree the
+# run has moved out of keeps <dir>/.sluice/run.at, one line naming the tree it
+# went to, so a session still sitting there resolves the run rather than reading
+# it as gone. The directory ignores itself, so no project needs a .gitignore
+# line for it.
 #
 # Exit: 0 ok, 1 the state could not be written, 2 no live run, 3 a run is
 # already live (here, or at move's destination), 4 bad arguments, 5 jq missing,
@@ -107,6 +110,15 @@ if [ -z "$SUB" ]; then
 	exit 4
 fi
 
+# One function rather than the same pipeline at three call sites, because they
+# have to agree: the tree resolution anchors on and the tree `move` and `close`
+# leave their forwarding note in are the same tree by definition, and a note
+# left anywhere else is a note nothing reads. Empty for a directory that is no
+# git work tree.
+main_tree() { # <dir>
+	git -C "$1" worktree list --porcelain 2>/dev/null | sed -n '1s/^worktree //p'
+}
+
 # A tree's own run comes first, and only a tree with none reads the set's. Two
 # layouts share this script and pull opposite ways. A deep run plans in the main
 # tree and cuts implementer worktrees after the plan: the run directory ignores
@@ -130,9 +142,29 @@ fi
 ORIG_DIR="$DIR"
 if [ "$SUB" != "init" ] && [ ! -f "$DIR/.sluice/run.json" ] \
 	&& [ "$(git -C "$DIR" rev-parse --is-inside-work-tree 2>/dev/null)" = "true" ]; then
-	MAIN_TREE="$(git -C "$DIR" worktree list --porcelain 2>/dev/null | sed -n '1s/^worktree //p')"
+	MAIN_TREE="$(main_tree "$DIR")"
 	if [ -n "${MAIN_TREE:-}" ] && [ -d "$MAIN_TREE" ]; then
 		DIR="$MAIN_TREE"
+
+		# Then forward, where the main tree's run has moved on into a worktree.
+		# A `move` is half a step: it relocates the state and cannot relocate the
+		# session, the harness holding one working directory that no command here
+		# reaches. So the controller's session goes on asking about the tree it
+		# still sits in, and per-tree resolution answers that the run is gone --
+		# to its statusline, to the SessionStart hook and to a bare `show`, all
+		# on a run that is live two directories away.
+		#
+		# The note lives at the main tree and nowhere else, so a run moved twice
+		# forwards once rather than down a chain, and so the tree every other
+		# tree in the set already resolves to is the tree that knows. It is
+		# followed only while the run it names is really there: a note outliving
+		# its run is stale, not a second answer.
+		if [ ! -f "$DIR/.sluice/run.json" ] && [ -f "$DIR/.sluice/run.at" ]; then
+			# `read`, not `cat`: a builtin, and the first line is the whole note.
+			AT=""
+			IFS= read -r AT <"$DIR/.sluice/run.at" 2>/dev/null || true
+			[ -n "$AT" ] && [ -f "$AT/.sluice/run.json" ] && DIR="$AT"
+		fi
 	fi
 fi
 
@@ -306,6 +338,16 @@ mk_dir() { # <directory to create under .sluice> [<tree whose .sluice it is, def
 	[ -e "$ignore" ] || printf '*\n' >"$ignore" 2>/dev/null || true
 }
 
+# Where the set's run went, written at the main tree for resolution to follow.
+# Not `mk_dir`, which exits: this runs after the state has already arrived in
+# the destination, and a note that could not be written is a blank statusline
+# in one tree rather than a move that failed. The caller reports it instead.
+leave_note() { # <main tree> <tree the run is now in>
+	mkdir -p "$1/.sluice" 2>/dev/null || return 1
+	[ -e "$1/.sluice/.gitignore" ] || printf '*\n' >"$1/.sluice/.gitignore" 2>/dev/null || true
+	printf '%s\n' "$2" >"$1/.sluice/run.at" 2>/dev/null
+}
+
 # Written through a temporary file so an interrupted write cannot leave the
 # run state half-serialised, which would read as a corrupted run rather than
 # as a failed command.
@@ -582,10 +624,28 @@ case "$SUB" in
 			exit 0
 		fi
 
+		# Where the run is, said only when that is not the tree the command was
+		# pointed at. A run read from a tree it does not live in answers "where
+		# is this" silently wrong otherwise: the reader takes the tree they are
+		# in, which after a `move` is the one tree the run is not in.
+		#
+		# A directory inside the tree holding the run is that tree, one level
+		# down, not somewhere else -- without that, the row would fire on every
+		# session that works from a subdirectory.
+		ELSEWHERE=""
+		run_tree="$(cd "$DIR" 2>/dev/null && pwd -P)"
+		asked="$(cd "$ORIG_DIR" 2>/dev/null && pwd -P)"
+		if [ -n "$run_tree" ] && [ -n "$asked" ]; then
+			case "$asked" in
+				"$run_tree" | "$run_tree"/*) ;;
+				*) ELSEWHERE="$run_tree" ;;
+			esac
+		fi
+
 		# Header and rows are laid out from the same widths, so the two cannot
 		# drift apart, and an over-long value is clipped with a marker rather
 		# than silently reading as the whole value.
-		jq -r --argjson now "$(date -u +%s)" '
+		jq -r --argjson now "$(date -u +%s)" --arg elsewhere "$ELSEWHERE" '
 			def dash: if . == null or . == "" then "-" else . end;
 			# Same reason as the statusline render: state written before the check
 			# on the way in, or edited by hand, holds bytes a terminal would act on
@@ -601,6 +661,7 @@ case "$SUB" in
 			                      $c[6]] | join(" "));
 			([.tasks[]? | select(.status == "done")] | length) as $done
 			| ["sluice \(.channel | clean) · \(.topic | clean) · \($done)/\(.tasks | length) done"]
+			+ (if $elsewhere == "" then [] else ["tree          \($elsewhere | clean)"] end)
 			+ ["plan          \(.plan | dash | clean)"]
 			+ ["record        \(.record | dash | clean)"]
 			# Past a day since the last write the run is idle, and that is said
@@ -797,7 +858,26 @@ case "$SUB" in
 			exit 3
 		fi
 		mv "$STATE" "$DEST_STATE" || { err "could not move $STATE to $DEST_STATE"; exit 1; }
+
+		# After the state has arrived, never before: a note pointing at a run
+		# that never got there is worse than no note, being indistinguishable
+		# from one pointing at a run that did.
+		NOTE_TREE="$(main_tree "$TO")"
+		if [ -n "$NOTE_TREE" ] && [ -d "$NOTE_TREE" ]; then
+			if [ "$NOTE_TREE" = "$TO" ]; then
+				# The run is back where resolution already looks, so a note would
+				# only point the main tree at itself.
+				rm -f "$NOTE_TREE/.sluice/run.at"
+			elif ! leave_note "$NOTE_TREE" "$TO"; then
+				err "note: the run moved, but $NOTE_TREE/.sluice/run.at could not be written, so a session in $NOTE_TREE will read no run until it moves to $TO"
+			fi
+		fi
+
 		echo "moved $(jq -r '.topic // "run"' "$DEST_STATE" 2>/dev/null || echo run) to $TO"
+		# The session is the half of the move no command can make. Left where it
+		# was, every bare git, build and test command it runs still lands in the
+		# tree the run just left.
+		echo "move this session there too, with the harness's worktree tool where it has one; every status.sh call from elsewhere needs --dir $TO"
 		;;
 
 	close)
@@ -844,6 +924,18 @@ case "$SUB" in
 			n=$((n + 1))
 		done
 		mv "$STATE" "$dest" || { err "could not archive $STATE"; exit 1; }
+
+		# A note naming this tree has outlived the run it forwarded to. Left
+		# behind, it does not go quiet: the next run opened in this tree inherits
+		# the forward and reads as the main tree's, though nobody there opened
+		# it. Only a note naming this tree is ours to remove -- one naming
+		# another tree belongs to a run this close knows nothing about.
+		NOTE_TREE="$(main_tree "$DIR")"
+		if [ -n "$NOTE_TREE" ] && [ -f "$NOTE_TREE/.sluice/run.at" ]; then
+			AT=""
+			IFS= read -r AT <"$NOTE_TREE/.sluice/run.at" 2>/dev/null || true
+			[ "$AT" = "$(cd "$DIR" && pwd -P)" ] && rm -f "$NOTE_TREE/.sluice/run.at"
+		fi
 		# The summary needs parseable state and close is the one command that
 		# does not, so an unreadable run still gets a line naming where it went.
 		[ -n "$summary" ] || summary="closed $(basename "$dest"): state was unreadable, no summary"

package/skills/sluice/scripts/statusline.sh

@@ -65,7 +65,11 @@ done
 d="$(cd "$DIR" 2>/dev/null && pwd -P)" || exit 0
 [ -n "$d" ] || exit 0
 
-# Four answers end the walk. A state file is a run, wherever it was found. A
+# Five answers end the walk. A state file is a run, wherever it was found. So is
+# a forwarding note beside where one used to be: the run moved out into a
+# worktree, this tree is where the session that moved it is still sitting, and
+# testing only the state file blanked its bar on a live run -- ahead of the
+# `.git` directory below, which would otherwise answer for this tree first. A
 # `.git` that is a regular file is a linked worktree or a submodule, which may
 # hold no state of its own and still belong to a set that does, so it is a maybe
 # and status.sh resolves it. A `.git` that is a directory is the top of an
@@ -78,6 +82,7 @@ d="$(cd "$DIR" 2>/dev/null && pwd -P)" || exit 0
 # would put the gate's cost in the same range as the render it is avoiding.
 while :; do
 	[ -f "$d/.sluice/run.json" ] && break
+	[ -f "$d/.sluice/run.at" ] && break
 	[ -f "$d/.git" ] && break
 	[ -d "$d/.git" ] && exit 0
 	[ "$d" = "${HOME:-}" ] && exit 0

package/skills/sluice/scripts/stop-guard.sh

@@ -10,9 +10,9 @@
 # Every stop that is a real stop is let through: no run, a channel other than
 # deep, pre-flight not yet answered (that stop is owed), a blocked task, a run
 # paused on purpose with `status.sh pause --reason`, every task done (the
-# handback), a run idle for a day, a run that lives in another tree than the
-# session's, and any attempt where the harness says a stop hook already fired
-# this turn, which is what keeps this from looping. One refusal per turn, then:
+# handback), a run idle for a day, a run another tree owns rather than one this
+# tree moved out, and any attempt where the harness says a stop hook already
+# fired this turn, which is what keeps this from looping. One refusal per turn, then:
 # a nudge with the state in it rather than a wall.
 #
 # Reads the harness's stop JSON on stdin for `cwd` and `stop_hook_active`. To
@@ -45,30 +45,147 @@ fi
 
 cwd="$PWD"
 active="false"
+sid=""
+transcript=""
 if [ -n "$input" ]; then
 	got="$(printf '%s' "$input" | jq -r '.cwd // empty' 2>/dev/null || true)"
 	[ -n "$got" ] && cwd="$got"
 	active="$(printf '%s' "$input" | jq -r '.stop_hook_active // false' 2>/dev/null || echo false)"
+	sid="$(printf '%s' "$input" | jq -r '.session_id // empty' 2>/dev/null || true)"
+	transcript="$(printf '%s' "$input" | jq -r '.transcript_path // empty' 2>/dev/null || true)"
 fi
 [ "$active" = "true" ] && exit 0
 [ -d "$cwd" ] || exit 0
+
+# ---- entry check --------------------------------------------------------
+# The run guard below only arms once .sluice/run.json exists, and that file
+# only exists once the skill has been invoked. So the session that never
+# routed at all, the one this whole guard is for, walks straight past it in
+# silence. This catches that session from the other end: the tree moved while
+# it held it, and no channel was ever announced.
+#
+# The comparison is against where the tree stood when the session opened, not
+# against whether it is dirty now. A session that opens on someone's
+# work-in-progress and only answers questions changed nothing, and nudging it
+# would teach its partner to ignore the nudge.
+#
+# Refused once and then never again for this session: the check cannot tell
+# a partner who routed afterwards from one who read the nudge and chose to
+# carry on, and only the first of those is worth a second refusal.
+#
+# The stamp is per session and the tree it watches is not, so anything else
+# writing to the tree reads as this session's work: a second session, the
+# partner's own editor, an install touching a lockfile, a build emitting
+# something the tree does not ignore. There is nothing in a git tree that
+# attributes a change to who made it, so this is not fixable here, only
+# bounded: one refusal per session, and a reason that offers "not mine" as an
+# answer and takes it.
+entry_nudge() {
+	local stamps tree line_tree line_digest now
+	[ -n "$sid" ] || return 0
+	case "$sid" in */* | .*) return 0 ;; esac
+
+	# Two directories rather than one name and one suffixed name: sharing a
+	# namespace means a session id ending in `.nudged` silently disarms the
+	# session whose id is its prefix.
+	local root="${CLAUDE_CONFIG_DIR:-${HOME:-}/.claude}/sluice"
+	stamps="$root/stamps"
+	[ -f "$stamps/$sid" ] || return 0
+	[ -f "$root/nudged/$sid" ] && return 0
+
+	tree="$(git -C "$cwd" rev-parse --show-toplevel 2>/dev/null)" || return 0
+	[ -n "$tree" ] || return 0
+
+	line_tree="$(sed -n '1p' "$stamps/$sid" 2>/dev/null)"
+	line_digest="$(sed -n '2p' "$stamps/$sid" 2>/dev/null)"
+	[ -n "$line_tree" ] && [ -n "$line_digest" ] || return 0
+	# A session that moved trees carries a baseline for the one it left, and
+	# reading this tree's changes against it would be reading someone else's.
+	[ "$line_tree" = "$tree" ] || return 0
+
+	# A tree that cannot be read is unknown, not moved. Losing git's exit
+	# status here would turn a held lock or a rebase in flight into a refused
+	# turn over a tree nobody touched.
+	now="$(bash "$here/tree-snapshot.sh" "$tree" 2>/dev/null)" || return 0
+	[ -n "$now" ] || return 0
+	[ "$now" = "$line_digest" ] && return 0
+
+	# Whether the session routed is read exactly the way run-stats.sh reads it,
+	# from a copy of its `marker` and `lead` patterns and its `invokes_sluice`:
+	# a gate that disagreed with the meter would refuse turns the ledger
+	# reports as a run. The copy is kept in step with that file by hand.
+	#
+	# Lines are parsed one at a time and unparseable ones dropped, because the
+	# harness is still appending to this file while the hook reads it and the
+	# last line is regularly half written. Slurping would fail on that whole
+	# file and read a routed session as an unrouted one.
+	[ -f "$transcript" ] || return 0
+	jq -e -n -R '
+		def marker: "^[*_#>[:space:]]*(fast|main|deep)[[:space:]]+channel";
+		def lead: "^[^.!?\n]{0,100}[:=][[:space:]]*[*_]*(fast|main|deep)[[:space:]]+channel";
+		def texts: [ .message.content[]? | select(.type == "text") | .text ] | join("\n");
+		def invokes_sluice: [ .message.content[]?
+			| select(.type == "tool_use" and .name == "Skill")
+			| .input.skill? // empty ] | any(. == "sluice");
+		[ inputs | fromjson? // empty ]
+		| any(.[];
+			(.type == "assistant") and (((.isMeta == true) or (.isSidechain == true)) | not)
+			and ((texts | test(marker; "i") or test(lead; "i")) or invokes_sluice))
+	' "$transcript" >/dev/null 2>&1
+	case "$?" in
+		# 0 routed, 1 not. Anything else is jq failing rather than an answer
+		# about this session, and an unanswered question is not a refusal.
+		0) return 0 ;;
+		1) ;;
+		*) return 0 ;;
+	esac
+
+	mkdir -p "$root/nudged" 2>/dev/null || true
+	: >"$root/nudged/$sid" 2>/dev/null || true
+	jq -n '{
+		decision: "block",
+		reason: "sluice: this session has changed the tree since it opened and no channel was ever announced, so the work is running with none of the rules that its shape calls for and nothing to meter it from. Invoke the sluice skill now, route what you have been doing, and say which channel it is. If it genuinely changed nothing you own (a scratch file, or an edit that was not yours), say so and stop; this will not ask twice."
+	}'
+	return 1
+}
+
+if ! entry_nudge; then
+	exit 0
+fi
+
 [ -f "$STATUS" ] || exit 0
 
-# The session's own tree, and only that. status.sh lets a tree with no run of
-# its own read the main worktree's, for a controller that moved after init; a
-# Stop in such a tree may be an unrelated session, and a remedy printed to it
-# would reach into somebody else's run. So the run has to sit in the tree the
-# session's cwd belongs to, or there is nothing here to guard.
+# The run the session's own tree answers for, and only that: the state beside
+# it, or the state it forwarded into a worktree when `move` sent the run on
+# without the session. status.sh also lets a tree with no run of its own read
+# the main worktree's, and that one is not taken here: a Stop in such a tree may
+# be an unrelated session, and a remedy printed to it would reach into somebody
+# else's run.
+#
+# The forward is read here rather than left to status.sh's resolution because
+# the two questions differ. Resolution answers "which run can this tree read",
+# which is the right question for a render and the wrong one for a refusal. The
+# tree named in the note is then passed as `--dir`, so what follows asks about
+# one named tree and carries no layout knowledge of its own.
 top="$(git -C "$cwd" rev-parse --show-toplevel 2>/dev/null)"
 [ -n "$top" ] || top="$cwd"
-[ -f "$top/.sluice/run.json" ] || exit 0
+if [ -f "$top/.sluice/run.json" ]; then
+	tree="$top"
+elif [ -f "$top/.sluice/run.at" ]; then
+	tree=""
+	IFS= read -r tree <"$top/.sluice/run.at" 2>/dev/null || exit 0
+	# A note outliving the run it named is stale, not a run to refuse a stop over.
+	[ -n "$tree" ] && [ -f "$tree/.sluice/run.json" ] || exit 0
+else
+	exit 0
+fi
 
-run="$(bash "$STATUS" show --json --dir "$top" 2>/dev/null)" || exit 0
+run="$(bash "$STATUS" show --json --dir "$tree" 2>/dev/null)" || exit 0
 [ -n "$run" ] || exit 0
 
 # One JSON object out, read back with jq: the topic is user text, and word
 # splitting it would truncate at the first space and glob on the rest.
-verdict="$(printf '%s' "$run" | jq -c --argjson now "$(date -u +%s)" '
+verdict="$(printf '%s' "$run" | jq -c --argjson now "$(date -u +%s)" --arg tree "$tree" --arg here "$top" '
 	(.tasks // []) as $t
 	| ([$t[] | select(.status == "done")] | length) as $done
 	| ([$t[] | select(.status == "blocked")] | length) as $blocked
@@ -84,18 +201,33 @@ verdict="$(printf '%s' "$run" | jq -c --argjson now "$(date -u +%s)" '
 	  # A run nobody has written to for a day is a stale run, not a live one;
 	  # refusing its stop would press an abandoned plan on whoever opened here.
 	  elif $idle_h >= 24 then {block: false}
-	  # The topic lands in a reason the harness prints, so a control byte in it
-	  # would be acted on by the terminal rather than read. State written before
-	  # status.sh refused those, or edited by hand, can still hold one.
+	  # The topic and the tree land in a reason the harness prints, so a control
+	  # byte in either would be acted on by the terminal rather than read. State
+	  # written before status.sh refused those, or edited by hand, can still hold
+	  # one, and so can a path.
 	  else {block: true, progress: "\($done)/\($t | length)",
-	        topic: (.topic // "run" | gsub("[\u0000-\u001f\u007f]"; ""))}
+	        topic: (.topic // "run" | gsub("[\u0000-\u001f\u007f]"; "")),
+	        tree: ($tree | gsub("[\u0000-\u001f\u007f]"; "")),
+	        elsewhere: ($tree != $here)}
 	  end
 ' 2>/dev/null)" || exit 0
 
 [ "$(printf '%s' "$verdict" | jq -r '.block' 2>/dev/null)" = "true" ] || exit 0
 
+# Two remedies, because the last line of the local one is wrong once the run
+# has moved: `close` from here would archive a run that is live in another tree
+# and may be another session's, which is the one thing this hook must never talk
+# anyone into. What replaces it is the step `move` could not take -- the session
+# following the run -- because a controller guarded here is a controller sitting
+# in the tree its own run left.
 printf '%s' "$verdict" | jq 2>/dev/null '{
 	decision: "block",
-	reason: ("sluice: the deep run \(.topic) is \(.progress) done with tasks still to go and nothing marked blocked or paused, so ending the turn here hands a live run back with nothing for your partner to decide. Continue: run status.sh ready and dispatch the next wave in this same message. If a task genuinely needs them, mark it: status.sh task <id> --status blocked. If the run has to stand still for a reason, record it: status.sh pause --reason \"<why>\", then say so and stop. If this run is not the work you were asked to do, it was left open: status.sh close.")
+	reason: ("sluice: the deep run \(.topic) is \(.progress) done with tasks still to go and nothing marked blocked or paused, so ending the turn here hands a live run back with nothing for your partner to decide."
+		+ (if .elsewhere then " The run lives in \(.tree), not in this tree: `move` relocated the run and not this session. If it is yours, move this session into that tree -- the worktree tool in your harness enters one that already exists -- and go on from there." else "" end)
+		+ " Continue: run status.sh ready and dispatch the next wave in this same message. If a task genuinely needs them, mark it: status.sh task <id> --status blocked. If the run has to stand still for a reason, record it: status.sh pause --reason \"<why>\", then say so and stop."
+		+ (if .elsewhere
+		   then " If the run is not yours, it belongs to the session working in \(.tree): say so and stop, rather than closing it from here."
+		   else " If this run is not the work you were asked to do, it was left open: status.sh close."
+		   end))
 }'
 exit 0

package/skills/sluice/scripts/tree-snapshot.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# Print one digest of where a git tree stands, for stop-guard.sh's entry check.
+#
+# Usage: tree-snapshot.sh <tree>
+# Exit 0 printed a digest, non-zero the tree could not be read. Prints nothing
+# on failure, and a caller that cannot read the tree has no comparison to make
+# rather than a change to report: an interrupted index, a lock held by another
+# git, or a rebase in flight are all "unknown", never "moved".
+#
+# It lives in its own file because two hooks compute it at two different moments
+# and a difference between their two copies would not read as a bug, it would
+# read as the tree having moved. That is the whole measurement.
+#
+# Three signals, because each covers a way of finishing work that the others
+# call standing still:
+#
+#   HEAD                        a session that committed leaves a clean tree
+#   diff HEAD                   a session that rewrote a file already modified
+#                               leaves the porcelain's shape untouched
+#   status --porcelain -uall    a session that filled an untracked directory
+#                               leaves one collapsed `?? build/` either way
+#
+# What it still misses, and why each is left:
+#
+#   - the content of a file that was already untracked when the session opened.
+#     Listing untracked paths is cheap and hashing their contents is not, and
+#     this runs at the end of every turn.
+#   - anything inside a nested repository. `status` does not descend into a
+#     directory carrying its own .git, so a session spent editing a scratch
+#     clone or a vendored checkout reads as a tree nobody touched.
+#   - who made the change. Nothing in a git tree records that, so a branch
+#     switch, a pull, or another session writing to the same tree all read as
+#     this session's work. stop-guard.sh bounds that rather than fixing it.
+
+set -uo pipefail
+
+tree="${1-}"
+[ -n "$tree" ] || exit 1
+command -v cksum >/dev/null 2>&1 || exit 1
+
+# `git diff HEAD` has no meaning before the first commit, and a repo without one
+# is a repo whose every file is untracked, which the porcelain covers. So an
+# unresolvable HEAD is carried as "no-head" rather than refused.
+#
+# It would be better to refuse when HEAD is unresolvable because the ref store
+# cannot be read, as opposed to because no commit exists yet, since the first is
+# a tree this script cannot describe. git gives no way to tell them apart:
+# `rev-parse --verify --quiet` exits 1 for both, and `for-each-ref` returns
+# empty for both, hiding an unreadable ref exactly as it reports an absent one.
+# Refusing on both would disarm the check permanently in any repo before its
+# first commit, which is an ordinary place to be writing code. Carrying both
+# costs a single nudge, and only in a tree whose refs broke partway through the
+# session it had already been read in.
+head="$(git -C "$tree" rev-parse --verify --quiet HEAD 2>/dev/null)" || head=""
+
+# Streamed into cksum rather than gathered into variables first. A diff is
+# unbounded, and this runs at the end of every turn until the session is either
+# routed or nudged: an 80MB file rewritten peaks at 334MB resident streamed,
+# against 622MB for a 61MB one held in a shell variable and then piped. What is
+# left is git loading the blobs, which is the price of reading content at all
+# and is the same for --numstat. Streaming also keeps NUL bytes intact, which a
+# command substitution silently drops, and dropping them would hide a change
+# confined to them.
+#
+# `exit 1` inside the group reaches the caller through pipefail, and the digest
+# cksum prints from a truncated read is discarded with it: a caller that cannot
+# read the tree needs no answer, and a short answer is a wrong one.
+digest="$( {
+	printf '%s\n' "${head:-no-head}"
+	git -C "$tree" status --porcelain -uall 2>/dev/null || exit 1
+	[ -n "$head" ] && { git -C "$tree" diff HEAD 2>/dev/null || exit 1; }
+	true
+} | cksum )" || exit 1
+
+printf '%s\n' "$digest"

package/skills/sluice/skill.json

@@ -1,6 +1,6 @@
 {
   "name": "sluice",
-  "version": "0.19.3",
+  "version": "0.21.0",
   "description": "Routes work by change shape into four channels (bypass, fast, main, deep) and applies only the rules each channel needs, so a one-line fix does not pay the cost of a multi-subsystem build. Carries seven rules as one-liners in the router and the full treatment in references read only on friction. Checks the finished plan with plan.sh validate rather than trusting it to memory, seeds the run state from it, keeps a deep run's task breakdown in .sluice/run.json so a statusline segment, one status command and a SessionStart hook can answer where the run is (the hook prints a live run at every session start, compaction included), and closes each run with a ledger read out of the session transcript: elapsed, tools, tokens, and what each dispatched agent cost where the transcript recorded it. Claude Code only; stands down where the superpowers pipeline governs the repo.",
   "author": "iceinvein",
   "type": "prompt",