@iceinvein/agent-skills 0.19.0 → 0.20.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iceinvein/agent-skills",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Install agent skills into AI coding tools",
   "author": "iceinvein",
   "license": "MIT",

package/skills/index.json

@@ -283,7 +283,7 @@
     "name": "sluice",
     "description": "Routes work by change shape into four channels (bypass, fast, main, deep) and applies only the rules each channel needs, so a one-line fix does not pay the cost of a multi-subsystem build. Carries seven rules as one-liners in the router and the full treatment in references read only on friction. Checks the finished plan with plan.sh validate rather than trusting it to memory, seeds the run state from it, keeps a deep run's task breakdown in .sluice/run.json so a statusline segment, one status command and a SessionStart hook can answer where the run is (the hook prints a live run at every session start, compaction included), and closes each run with a ledger read out of the session transcript: elapsed, tools, tokens, and what each dispatched agent cost where the transcript recorded it. Claude Code only; stands down where the superpowers pipeline governs the repo.",
     "type": "prompt",
-    "version": "0.20.0"
+    "version": "0.21.0"
   },
   {
     "name": "temporal-coupling-detector",

package/skills/sluice/SKILL.md

@@ -102,7 +102,10 @@ your partner states a preference. Get the design signed off before code.
 Take the design stop through the harness's plan mode where there is one. Its
 gate is enforced rather than requested and it holds edits shut while it is open,
 so nothing gets built against a design nobody signed. It carries the first stop
-only; pre-flight still wants answers, and an approval is not one.
+only; pre-flight still wants answers, and an approval is not one. Where there is
+no plan mode, nothing is holding the draft: write the design to its file before
+you end the turn on it, because a design that lives only in the message you just
+sent is gone at the next compaction.
 
 The run's state goes in `.sluice/run.json`, written a command at a time by
 `scripts/status.sh`. That is what makes the breakdown readable from outside the

package/skills/sluice/evals/README.md

@@ -23,19 +23,18 @@ Execution, where the run is already past both stops:
 
 ## Running
 
-Six cases scaffold a small Node repo and then change it, so they need the
+Seven cases scaffold a small Node repo and then change it, so they need the
 scaffold flag and a tool grant. From the repo root:
 
 ```bash
 claude plugin eval skills/sluice --scaffold --allow-tools Bash Write Edit
 ```
 
-`--case` takes one glob and is not repeatable, so the two cases that need
-less run one command each:
+`--case` takes one glob and is not repeatable, so the one case that needs
+less runs on its own:
 
 ```bash
 claude plugin eval skills/sluice --case 'bypass-*'
-claude plugin eval skills/sluice --case 'superpowers-*' --scaffold
 ```
 
 Useful while iterating on graders: `--ablation none` drops the no-plugin arm
@@ -70,10 +69,32 @@ only from the case's own directory.
 
 ## Verification status
 
-`bypass-question-stays-silent` and `superpowers-conflict-stands-down` have each
-been run once (`--runs 1 --ablation none`) and scored 1.00, so the fixture's
-`CLAUDE.md` does reach the child session. The six scaffold-and-write cases have
-been checked for grader reachability under the full flag set and produce no
-warnings, and their fixtures were run directly to confirm the plan validates and
-the suite starts green, but no agent has been run against them end to end.
-Expect to tune their `llm` rubrics on the first real pass.
+Every case has been run end to end at least once and scored 1.00. The two that
+needed the least (`bypass-question-stays-silent`, `superpowers-conflict-stands-down`)
+were run at `--runs 1 --ablation none`; the other six were run the same way, and
+`deep-plan-across-subsystems` and `main-new-interface` twice each after the
+fixes below.
+
+Three defects the first full pass turned up, all in the suite rather than in
+sluice:
+
+- `announces-<channel>-channel` matched `<channel> channel` anywhere in the
+  trace, and the trace carries SKILL.md's routing table, which names all four.
+  Those graders passed whenever the skill loaded. They now anchor on the
+  announcement opening an assistant message, the same anchor `run-stats.sh`
+  meters by. `fast-flag-on-existing-command` and
+  `explicit-instruction-collapses-to-fast` still carry the old pattern.
+- `deep-plan-across-subsystems` shipped no `fixture.sh`, so the run landed in an
+  empty tree and the case flipped between designing against the prompt alone and
+  stopping to ask where the repo was. It has a fixture now: three callers
+  through one upstream client. Its `no-implementation-yet` grader went with it,
+  because `file_exists: 'src/**', exists: false` reported absent against a tree
+  holding four source files.
+- `shape-agreed-before-building` was an `llm` grader over the trace, and the
+  judge is given a head-and-tail window of it. In a run this long the shape
+  statement lands in the dropped middle, so the judge voted FAIL six times out
+  of six on runs that had stated the shape plainly. `focus` accepts only
+  `last_message`, `trace` or a file, and `main` agrees in a message rather than
+  a file, so there was no slice to point it at. It is a regex over the
+  chronological trace now, which pins the order but not whether a
+  recommendation came with the shape.

package/skills/sluice/evals/deep-plan-across-subsystems/case.yaml

@@ -0,0 +1,4 @@
+schema_version: "1.1"
+name: deep-plan-across-subsystems
+context:
+  scaffold_script: fixture.sh

package/skills/sluice/evals/deep-plan-across-subsystems/fixture.sh

@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+# Smallest repo that makes the rate limiter a real three-subsystem change: a
+# CLI, a webhook handler and a worker, each calling the same upstream client,
+# and nothing between them and the API.
+set -euo pipefail
+
+mkdir -p src/cli src/webhook src/worker src/upstream tests
+
+cat > package.json <<'JSON'
+{
+  "name": "relay",
+  "version": "0.4.0",
+  "type": "module",
+  "scripts": {
+    "test": "node --test \"tests/*.test.js\""
+  }
+}
+JSON
+
+cat > src/upstream/client.js <<'JS'
+const BASE = "https://api.upstream.example";
+
+export async function call(path, body, fetchImpl = fetch) {
+  const response = await fetchImpl(`${BASE}${path}`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+  });
+
+  if (!response.ok) {
+    throw new Error(`upstream ${response.status} on ${path}`);
+  }
+
+  return response.json();
+}
+JS
+
+cat > src/cli/push.js <<'JS'
+import { call } from "../upstream/client.js";
+
+export async function push(records, log = console.log) {
+  for (const record of records) {
+    await call("/v1/records", record);
+    log(`pushed ${record.id}`);
+  }
+}
+JS
+
+cat > src/webhook/handler.js <<'JS'
+import { call } from "../upstream/client.js";
+
+export async function handle(event) {
+  const result = await call("/v1/events", { type: event.type, payload: event.payload });
+  return { status: 202, id: result.id };
+}
+JS
+
+cat > src/worker/backfill.js <<'JS'
+import { call } from "../upstream/client.js";
+
+export async function backfill(queue) {
+  let sent = 0;
+
+  while (queue.length > 0) {
+    await call("/v1/records", queue.shift());
+    sent += 1;
+  }
+
+  return sent;
+}
+JS
+
+cat > tests/upstream.test.js <<'JS'
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { call } from "../src/upstream/client.js";
+
+function fakeFetch(ok, body) {
+  return async () => ({ ok, status: ok ? 200 : 429, json: async () => body });
+}
+
+test("a successful call returns the parsed body", async () => {
+  const result = await call("/v1/records", { id: "a" }, fakeFetch(true, { id: "a" }));
+  assert.deepEqual(result, { id: "a" });
+});
+
+test("a rejected call reports the status and the path", async () => {
+  await assert.rejects(
+    () => call("/v1/records", { id: "a" }, fakeFetch(false)),
+    /upstream 429 on \/v1\/records/,
+  );
+});
+JS
+
+cat > README.md <<'MD'
+# relay
+
+Three callers, one upstream API: `src/cli/push.js`, `src/webhook/handler.js`
+and `src/worker/backfill.js` all go through `src/upstream/client.js`.
+`npm test` runs the suite.
+MD
+
+git init --quiet
+git add -A
+git -c user.email=fixture@example.com -c user.name=fixture commit --quiet -m "relay 0.4.0"

package/skills/sluice/evals/deep-plan-across-subsystems/graders/announces-deep-channel.md

@@ -1,6 +1,10 @@
 ---
 type: regex
-pattern: 'deep channel'
+# The trace carries SKILL.md's own routing table, which names every channel, so
+# `contains` passes whenever the skill loads. Anchor on how the agent says it
+# instead, the same anchor run-stats.sh meters: the words open an assistant
+# message, or follow a label such as "Sluice:" on the same line.
+pattern: '"text":"(?:[^.!?\n"]{0,100}[:=]\s*)?[\s*_#>\\]*deep channel'
 flags: i
 target: trace
 weight: 2

package/skills/sluice/evals/deep-plan-across-subsystems/graders/no-implementation-yet.md

@@ -1,6 +1,10 @@
 ---
-type: file_exists
-path: 'src/**'
-exists: false
+type: llm
+focus: { source: file, path: src/upstream/client.js }
 weight: 2
 ---
+
+This is the upstream client after a turn that was asked to plan a shared rate limiter. Every caller reaches the upstream API through it, so it is the file a limiter has to land in.
+
+PASS if it is still the fixture's client and nothing else: a `call()` that posts the body, throws on a non-ok response, and returns the parsed JSON.
+FAIL if any limiting has been built into it: a token bucket, a counter, a budget check, a store or Redis client, a sleep, a queue, or a wrapper that decides whether the call may proceed.

package/skills/sluice/evals/main-new-interface/graders/announces-main-channel.md

@@ -1,6 +1,10 @@
 ---
 type: regex
-pattern: 'main channel'
+# The trace carries SKILL.md's own routing table, which names every channel, so
+# `contains` passes whenever the skill loads. Anchor on how the agent says it
+# instead, the same anchor run-stats.sh meters: the words open an assistant
+# message, or follow a label such as "Sluice:" on the same line.
+pattern: '"text":"(?:[^.!?\n"]{0,100}[:=]\s*)?[\s*_#>\\]*main channel'
 flags: i
 target: trace
 weight: 2

package/skills/sluice/evals/main-new-interface/graders/shape-agreed-before-building.md

@@ -1,10 +1,13 @@
 ---
-type: llm
-focus: trace
+type: regex
+# The judge only ever sees a head-and-tail window of the trace, and in a run
+# this long the shape statement falls in the dropped middle, so an llm grader
+# here votes on evidence that cannot contain the thing it is asked about. The
+# trace is chronological, so pin the order directly: an assistant message that
+# names all three step operations and a path under src/, and only then a write
+# into src/. What this cannot see is whether a recommendation came with it,
+# which the rubric it replaces did ask for.
+pattern: '"text":"(?=(?:\\.|[^"\\])*?\bbuild\b)(?=(?:\\.|[^"\\])*?\bupload\b)(?=(?:\\.|[^"\\])*?\bactivate\b)(?=(?:\\.|[^"\\])*?src/)(?:\\.|[^"\\])*?"[\s\S]*?"name":"(?:Write|Edit)"[\s\S]{0,400}?src/'
+target: trace
 weight: 2
 ---
-
-The agent was asked to put deploy behind a pluggable target seam, which is a new interface the repo does not have.
-
-PASS if, before writing the implementation, the agent stated the shape it intended to build: it named the seam and the operations on it, and where it recommended landing it. A single recommended approach counts; so does naming two options with one recommended.
-FAIL if it started editing files with no statement of the shape first, or if it listed options with no recommendation and ended its turn waiting for an answer.

package/skills/sluice/evals/main-new-interface/prompt.md

@@ -2,8 +2,8 @@
 name: main-new-interface
 description: Adding a port the repo does not have is the main channel. Pins the announcement and agreeing the shape before building.
 tags: [routing, main, scaffold, write]
-max_turns: 30
-timeout_seconds: 900
+max_turns: 80
+timeout_seconds: 2400
 allowed_tools: [Read, Glob, Grep, Skill, Write, Edit, Bash]
 expected_outcome: Announces the main channel, states the port's shape and a recommendation before implementing, then builds it test-first with the suite green.
 ---

package/skills/sluice/references/deep-channel.md

@@ -156,9 +156,13 @@ the run record section gives. Those are the durable files, the ones a session
 resuming next week reads, and none of them is the one you drafted in.
 
 Where plan mode is unavailable, the prose stop is what you have and it is the
-same stop: end the turn on the design and let the next instruction start the
-plan. Nothing else about this section changes, because the obligation was never
-the mode's, only the enforcement was.
+same stop, with one thing you now do yourself: nothing is holding the draft, so
+write the design to `docs/specs/YYYY-MM-DD-<topic>.md` before you end the turn
+on it. A design that exists only in the message you just sent is gone at the
+next compaction, which is what the durable files are for. Write it, end the turn
+on it, and let the next instruction start the plan. Nothing else about this
+section changes, because the obligation was never the mode's, only the
+enforcement was.
 
 ## Pre-flight
 
@@ -230,7 +234,9 @@ down to a single question is still a stop.
 
 **Write the answers down before Task 1's first edit, in the tree the work runs
 in.** The order on the instruction that follows the stop: cut the worktree
-first, when that was the answer, through the harness's worktree tool. A fresh
+first, when that was the answer, through the harness's worktree tool, which
+puts this session inside it: everything below is issued from there, and issued
+from the main tree instead it lands in the tree the work is not in. A fresh
 worktree branches from the remote's default branch, so nothing uncommitted or
 unpushed in the main tree comes across, and `docs/` may not exist there yet.
 Move the design and plan into it yourself, each into its own directory since
@@ -341,13 +347,18 @@ reads the run state rather than the plan: it sees what has actually landed.
   `Flips`. The invariant it establishes is what later tasks are checked
   against, and whatever landed beside it was checked against nothing.
 - Isolate the workspace before a multi-task plan: the harness's worktree
-  tool, not `git worktree` yourself. Implementing straight onto main or
+  tool, not `git worktree` yourself. That tool moves this session into the
+  worktree, which `git worktree add` does not: cut by hand, the files are
+  isolated and the session is still in the tree they came from, so every bare
+  `git`, build and test command you run lands in the wrong one. Enter it by
+  path if it already exists. Implementing straight onto main or
   master needs your partner's say-so, which pre-flight is where you got, and
   it forecloses concurrent implementers for the whole run. Cut it before the
   run opens, so the state lives in it. A worktree cut after `init` still reads
   the main tree's run, so nothing breaks for you, but the run stays in the main
   tree where the next session to start a `deep` run finds it blocking `init`;
-  `status.sh move --to <worktree>` puts it where it belongs.
+  `status.sh move --to <worktree>` puts it where it belongs, and the session
+  has to follow it there.
 - **The agent that built the task commits it**, once its own tests pass, and
   only the paths in its `Touches`. Never `git add -A`: the tree is shared, and
   on a branch you did not isolate it holds work that is not this task's. The

package/skills/sluice/references/status.md

@@ -30,9 +30,13 @@ bash <skill-dir>/scripts/status.sh close
 
 `--dir <path>` reads another tree, which is what the statusline uses. A tree
 with a run of its own is read as itself; one with none resolves to the main
-worktree of its set, which is the tree a worktree is cut from and not the
-controller's own worktree, so once the run lives there `--dir <implementer
-worktree>` finds nothing. Statuses
+worktree of its set, and from there to whatever tree the run has since moved
+into. So any tree in the set reads the one run, wherever in the set it lives,
+and `--dir <implementer worktree>` finds it too. `show` prints a `tree` row
+naming where the run is whenever that is not the tree it was pointed at, since
+a run read from a tree it does not live in otherwise answers "where is this"
+with the tree the reader is already in. `show --json` stays the state file
+verbatim, and the row is not in it. Statuses
 are `todo`, `active`, `review`, `done` and `blocked`. A new id needs `--name`;
 after that every call is a bare flip, so keeping it current costs one command
 per transition rather than a paragraph. `close` archives the run under
@@ -56,9 +60,10 @@ is pointed at, `--dir` if given and the current tree otherwise, once; a base
 already on the row is kept. Issued from the controller's tree that is the
 controller's HEAD, which is what an implementer worktree cut from that branch
 starts at, so the default is right at dispatch. Where the implementer's tree
-has moved on, pass `--base $(git -C <implementer worktree> rev-parse --short
-HEAD)` rather than `--dir` that tree: with the run in your worktree, `--dir`
-pointed at the implementer's resolves to the main tree and finds no run.
+has moved on, point the command at that tree: `--dir <implementer worktree>`
+resolves the run through the set and takes the base from the tree it was
+pointed at, which is the one about to be built in. `--base $(git -C
+<implementer worktree> rev-parse --short HEAD)` says the same thing outright.
 
 `init` reports any other run live in a tree of the same set, without refusing:
 two sessions in two worktrees is legal, and a run stranded in the main tree
@@ -103,6 +108,24 @@ that already holds a run or that is not a work tree of the same repository. A
 submodule anchors on its own checkout, not the superproject's, and a directory
 that is no git work tree keeps its run exactly where it sits.
 
+`move` is half a step, and the half it cannot take is the session. The harness
+holds one working directory and no command here reaches it, so the controller
+goes on asking about the tree it is still sitting in: its statusline draws for
+that tree, so does the SessionStart hook, and so does every bare `git`, build
+and test command it runs. **Move the session into the tree the run went to**,
+with the harness's worktree tool where there is one, entering the worktree by
+path when it was cut by hand. `move` says so on the way out, because that is
+the moment it is still cheap.
+
+Until the session moves, the tree it came from reads the run rather than
+denying it: `move` leaves `.sluice/run.at` at the main worktree, one line
+naming the tree the run is in, and a tree with no run of its own follows it.
+The note lives at the main worktree and nowhere else, so a run moved twice
+forwards once rather than down a chain of trees, and it is followed only while
+the run it names is really there. `close` removes a note naming its own tree,
+because a note that outlived its run would hand the next run opened in that
+tree to whoever reads the main tree.
+
 One file for several writers is one file to contend on, so `init`, `task`,
 `preflight`, `final`, `pause`, `resume`, `close` and `move` take a lock first, `move` taking the
 destination tree's as well as its own: two flips issued at the same moment
@@ -290,11 +313,22 @@ every task done, a run idle for a day, and a turn where the harness says a
 stop hook already fired, which is what keeps it from looping. That last rule
 means it refuses once per turn and lets the next attempt through: a nudge, not
 a wall. The gate keys on the git top level of the session's working
-directory and nothing else, so the run has to live in the tree the session
-works in: open it after the worktree is cut, or `move` it there and then enter
-that worktree, since `move` relocates the run and not the session, and a run
-moved out from under a session still sitting in the main tree leaves that
-session unguarded for the rest of the run.
+directory: the run this tree answers for is the state beside it, or the state
+it forwarded into a worktree when `move` sent the run on without the session.
+Both are this tree's, and a controller that moved its run out and stayed put is
+guarded for the rest of the run rather than quietly let go at the moment it
+moved. The main-worktree fallback stays untaken, so a session in a worktree
+that merely reads the set's run is let stop as before.
+
+Once the run is in another tree the remedy changes with it. The refusal names
+that tree and says to move the session into it, and it stops offering `close`:
+from here that would archive a run live somewhere else, which may be another
+session's, and talking anyone into that is the one thing this hook must not do.
+The offer comes back when the run is in the tree the stop came from. None of
+this makes staying put correct: open the run after the worktree is cut, or
+`move` it and enter that worktree, since `move` relocates the run and not the
+session, and every bare `git`, build and test command meanwhile still lands in
+the tree the work left.
 
 `pause --reason <text>` records why a run is standing still; `show` and the
 statusline carry it, and `resume` clears it. A pause with no reason is refused,

package/skills/sluice/scripts/session-start.sh

@@ -98,7 +98,7 @@ stamp_baseline "$sid" "$source"
 shown="$(bash "$STATUS" show --dir "$cwd" 2>/dev/null)" || exit 0
 [ -n "$shown" ] || exit 0
 
-echo "A sluice run is live in this tree. Its state, from .sluice/run.json:"
+echo "A sluice run is live. Its state, from .sluice/run.json:"
 echo
 echo "$shown"
 echo

package/skills/sluice/scripts/status.sh

@@ -23,8 +23,11 @@
 #   status.sh close
 #
 # --dir <path> selects the tree to read (default: $PWD). State lives at
-# <dir>/.sluice/run.json and closed runs at <dir>/.sluice/archive/. The
-# directory ignores itself, so no project needs a .gitignore line for it.
+# <dir>/.sluice/run.json and closed runs at <dir>/.sluice/archive/. A tree the
+# run has moved out of keeps <dir>/.sluice/run.at, one line naming the tree it
+# went to, so a session still sitting there resolves the run rather than reading
+# it as gone. The directory ignores itself, so no project needs a .gitignore
+# line for it.
 #
 # Exit: 0 ok, 1 the state could not be written, 2 no live run, 3 a run is
 # already live (here, or at move's destination), 4 bad arguments, 5 jq missing,
@@ -107,6 +110,15 @@ if [ -z "$SUB" ]; then
 	exit 4
 fi
 
+# One function rather than the same pipeline at three call sites, because they
+# have to agree: the tree resolution anchors on and the tree `move` and `close`
+# leave their forwarding note in are the same tree by definition, and a note
+# left anywhere else is a note nothing reads. Empty for a directory that is no
+# git work tree.
+main_tree() { # <dir>
+	git -C "$1" worktree list --porcelain 2>/dev/null | sed -n '1s/^worktree //p'
+}
+
 # A tree's own run comes first, and only a tree with none reads the set's. Two
 # layouts share this script and pull opposite ways. A deep run plans in the main
 # tree and cuts implementer worktrees after the plan: the run directory ignores
@@ -130,9 +142,29 @@ fi
 ORIG_DIR="$DIR"
 if [ "$SUB" != "init" ] && [ ! -f "$DIR/.sluice/run.json" ] \
 	&& [ "$(git -C "$DIR" rev-parse --is-inside-work-tree 2>/dev/null)" = "true" ]; then
-	MAIN_TREE="$(git -C "$DIR" worktree list --porcelain 2>/dev/null | sed -n '1s/^worktree //p')"
+	MAIN_TREE="$(main_tree "$DIR")"
 	if [ -n "${MAIN_TREE:-}" ] && [ -d "$MAIN_TREE" ]; then
 		DIR="$MAIN_TREE"
+
+		# Then forward, where the main tree's run has moved on into a worktree.
+		# A `move` is half a step: it relocates the state and cannot relocate the
+		# session, the harness holding one working directory that no command here
+		# reaches. So the controller's session goes on asking about the tree it
+		# still sits in, and per-tree resolution answers that the run is gone --
+		# to its statusline, to the SessionStart hook and to a bare `show`, all
+		# on a run that is live two directories away.
+		#
+		# The note lives at the main tree and nowhere else, so a run moved twice
+		# forwards once rather than down a chain, and so the tree every other
+		# tree in the set already resolves to is the tree that knows. It is
+		# followed only while the run it names is really there: a note outliving
+		# its run is stale, not a second answer.
+		if [ ! -f "$DIR/.sluice/run.json" ] && [ -f "$DIR/.sluice/run.at" ]; then
+			# `read`, not `cat`: a builtin, and the first line is the whole note.
+			AT=""
+			IFS= read -r AT <"$DIR/.sluice/run.at" 2>/dev/null || true
+			[ -n "$AT" ] && [ -f "$AT/.sluice/run.json" ] && DIR="$AT"
+		fi
 	fi
 fi
 
@@ -306,6 +338,16 @@ mk_dir() { # <directory to create under .sluice> [<tree whose .sluice it is, def
 	[ -e "$ignore" ] || printf '*\n' >"$ignore" 2>/dev/null || true
 }
 
+# Where the set's run went, written at the main tree for resolution to follow.
+# Not `mk_dir`, which exits: this runs after the state has already arrived in
+# the destination, and a note that could not be written is a blank statusline
+# in one tree rather than a move that failed. The caller reports it instead.
+leave_note() { # <main tree> <tree the run is now in>
+	mkdir -p "$1/.sluice" 2>/dev/null || return 1
+	[ -e "$1/.sluice/.gitignore" ] || printf '*\n' >"$1/.sluice/.gitignore" 2>/dev/null || true
+	printf '%s\n' "$2" >"$1/.sluice/run.at" 2>/dev/null
+}
+
 # Written through a temporary file so an interrupted write cannot leave the
 # run state half-serialised, which would read as a corrupted run rather than
 # as a failed command.
@@ -582,10 +624,28 @@ case "$SUB" in
 			exit 0
 		fi
 
+		# Where the run is, said only when that is not the tree the command was
+		# pointed at. A run read from a tree it does not live in answers "where
+		# is this" silently wrong otherwise: the reader takes the tree they are
+		# in, which after a `move` is the one tree the run is not in.
+		#
+		# A directory inside the tree holding the run is that tree, one level
+		# down, not somewhere else -- without that, the row would fire on every
+		# session that works from a subdirectory.
+		ELSEWHERE=""
+		run_tree="$(cd "$DIR" 2>/dev/null && pwd -P)"
+		asked="$(cd "$ORIG_DIR" 2>/dev/null && pwd -P)"
+		if [ -n "$run_tree" ] && [ -n "$asked" ]; then
+			case "$asked" in
+				"$run_tree" | "$run_tree"/*) ;;
+				*) ELSEWHERE="$run_tree" ;;
+			esac
+		fi
+
 		# Header and rows are laid out from the same widths, so the two cannot
 		# drift apart, and an over-long value is clipped with a marker rather
 		# than silently reading as the whole value.
-		jq -r --argjson now "$(date -u +%s)" '
+		jq -r --argjson now "$(date -u +%s)" --arg elsewhere "$ELSEWHERE" '
 			def dash: if . == null or . == "" then "-" else . end;
 			# Same reason as the statusline render: state written before the check
 			# on the way in, or edited by hand, holds bytes a terminal would act on
@@ -601,6 +661,7 @@ case "$SUB" in
 			                      $c[6]] | join(" "));
 			([.tasks[]? | select(.status == "done")] | length) as $done
 			| ["sluice \(.channel | clean) · \(.topic | clean) · \($done)/\(.tasks | length) done"]
+			+ (if $elsewhere == "" then [] else ["tree          \($elsewhere | clean)"] end)
 			+ ["plan          \(.plan | dash | clean)"]
 			+ ["record        \(.record | dash | clean)"]
 			# Past a day since the last write the run is idle, and that is said
@@ -797,7 +858,26 @@ case "$SUB" in
 			exit 3
 		fi
 		mv "$STATE" "$DEST_STATE" || { err "could not move $STATE to $DEST_STATE"; exit 1; }
+
+		# After the state has arrived, never before: a note pointing at a run
+		# that never got there is worse than no note, being indistinguishable
+		# from one pointing at a run that did.
+		NOTE_TREE="$(main_tree "$TO")"
+		if [ -n "$NOTE_TREE" ] && [ -d "$NOTE_TREE" ]; then
+			if [ "$NOTE_TREE" = "$TO" ]; then
+				# The run is back where resolution already looks, so a note would
+				# only point the main tree at itself.
+				rm -f "$NOTE_TREE/.sluice/run.at"
+			elif ! leave_note "$NOTE_TREE" "$TO"; then
+				err "note: the run moved, but $NOTE_TREE/.sluice/run.at could not be written, so a session in $NOTE_TREE will read no run until it moves to $TO"
+			fi
+		fi
+
 		echo "moved $(jq -r '.topic // "run"' "$DEST_STATE" 2>/dev/null || echo run) to $TO"
+		# The session is the half of the move no command can make. Left where it
+		# was, every bare git, build and test command it runs still lands in the
+		# tree the run just left.
+		echo "move this session there too, with the harness's worktree tool where it has one; every status.sh call from elsewhere needs --dir $TO"
 		;;
 
 	close)
@@ -844,6 +924,18 @@ case "$SUB" in
 			n=$((n + 1))
 		done
 		mv "$STATE" "$dest" || { err "could not archive $STATE"; exit 1; }
+
+		# A note naming this tree has outlived the run it forwarded to. Left
+		# behind, it does not go quiet: the next run opened in this tree inherits
+		# the forward and reads as the main tree's, though nobody there opened
+		# it. Only a note naming this tree is ours to remove -- one naming
+		# another tree belongs to a run this close knows nothing about.
+		NOTE_TREE="$(main_tree "$DIR")"
+		if [ -n "$NOTE_TREE" ] && [ -f "$NOTE_TREE/.sluice/run.at" ]; then
+			AT=""
+			IFS= read -r AT <"$NOTE_TREE/.sluice/run.at" 2>/dev/null || true
+			[ "$AT" = "$(cd "$DIR" && pwd -P)" ] && rm -f "$NOTE_TREE/.sluice/run.at"
+		fi
 		# The summary needs parseable state and close is the one command that
 		# does not, so an unreadable run still gets a line naming where it went.
 		[ -n "$summary" ] || summary="closed $(basename "$dest"): state was unreadable, no summary"

package/skills/sluice/scripts/statusline.sh

@@ -65,7 +65,11 @@ done
 d="$(cd "$DIR" 2>/dev/null && pwd -P)" || exit 0
 [ -n "$d" ] || exit 0
 
-# Four answers end the walk. A state file is a run, wherever it was found. A
+# Five answers end the walk. A state file is a run, wherever it was found. So is
+# a forwarding note beside where one used to be: the run moved out into a
+# worktree, this tree is where the session that moved it is still sitting, and
+# testing only the state file blanked its bar on a live run -- ahead of the
+# `.git` directory below, which would otherwise answer for this tree first. A
 # `.git` that is a regular file is a linked worktree or a submodule, which may
 # hold no state of its own and still belong to a set that does, so it is a maybe
 # and status.sh resolves it. A `.git` that is a directory is the top of an
@@ -78,6 +82,7 @@ d="$(cd "$DIR" 2>/dev/null && pwd -P)" || exit 0
 # would put the gate's cost in the same range as the render it is avoiding.
 while :; do
 	[ -f "$d/.sluice/run.json" ] && break
+	[ -f "$d/.sluice/run.at" ] && break
 	[ -f "$d/.git" ] && break
 	[ -d "$d/.git" ] && exit 0
 	[ "$d" = "${HOME:-}" ] && exit 0

package/skills/sluice/scripts/stop-guard.sh

@@ -10,9 +10,9 @@
 # Every stop that is a real stop is let through: no run, a channel other than
 # deep, pre-flight not yet answered (that stop is owed), a blocked task, a run
 # paused on purpose with `status.sh pause --reason`, every task done (the
-# handback), a run idle for a day, a run that lives in another tree than the
-# session's, and any attempt where the harness says a stop hook already fired
-# this turn, which is what keeps this from looping. One refusal per turn, then:
+# handback), a run idle for a day, a run another tree owns rather than one this
+# tree moved out, and any attempt where the harness says a stop hook already
+# fired this turn, which is what keeps this from looping. One refusal per turn, then:
 # a nudge with the state in it rather than a wall.
 #
 # Reads the harness's stop JSON on stdin for `cwd` and `stop_hook_active`. To
@@ -155,21 +155,37 @@ fi
 
 [ -f "$STATUS" ] || exit 0
 
-# The session's own tree, and only that. status.sh lets a tree with no run of
-# its own read the main worktree's, for a controller that moved after init; a
-# Stop in such a tree may be an unrelated session, and a remedy printed to it
-# would reach into somebody else's run. So the run has to sit in the tree the
-# session's cwd belongs to, or there is nothing here to guard.
+# The run the session's own tree answers for, and only that: the state beside
+# it, or the state it forwarded into a worktree when `move` sent the run on
+# without the session. status.sh also lets a tree with no run of its own read
+# the main worktree's, and that one is not taken here: a Stop in such a tree may
+# be an unrelated session, and a remedy printed to it would reach into somebody
+# else's run.
+#
+# The forward is read here rather than left to status.sh's resolution because
+# the two questions differ. Resolution answers "which run can this tree read",
+# which is the right question for a render and the wrong one for a refusal. The
+# tree named in the note is then passed as `--dir`, so what follows asks about
+# one named tree and carries no layout knowledge of its own.
 top="$(git -C "$cwd" rev-parse --show-toplevel 2>/dev/null)"
 [ -n "$top" ] || top="$cwd"
-[ -f "$top/.sluice/run.json" ] || exit 0
+if [ -f "$top/.sluice/run.json" ]; then
+	tree="$top"
+elif [ -f "$top/.sluice/run.at" ]; then
+	tree=""
+	IFS= read -r tree <"$top/.sluice/run.at" 2>/dev/null || exit 0
+	# A note outliving the run it named is stale, not a run to refuse a stop over.
+	[ -n "$tree" ] && [ -f "$tree/.sluice/run.json" ] || exit 0
+else
+	exit 0
+fi
 
-run="$(bash "$STATUS" show --json --dir "$top" 2>/dev/null)" || exit 0
+run="$(bash "$STATUS" show --json --dir "$tree" 2>/dev/null)" || exit 0
 [ -n "$run" ] || exit 0
 
 # One JSON object out, read back with jq: the topic is user text, and word
 # splitting it would truncate at the first space and glob on the rest.
-verdict="$(printf '%s' "$run" | jq -c --argjson now "$(date -u +%s)" '
+verdict="$(printf '%s' "$run" | jq -c --argjson now "$(date -u +%s)" --arg tree "$tree" --arg here "$top" '
 	(.tasks // []) as $t
 	| ([$t[] | select(.status == "done")] | length) as $done
 	| ([$t[] | select(.status == "blocked")] | length) as $blocked
@@ -185,18 +201,33 @@ verdict="$(printf '%s' "$run" | jq -c --argjson now "$(date -u +%s)" '
 	  # A run nobody has written to for a day is a stale run, not a live one;
 	  # refusing its stop would press an abandoned plan on whoever opened here.
 	  elif $idle_h >= 24 then {block: false}
-	  # The topic lands in a reason the harness prints, so a control byte in it
-	  # would be acted on by the terminal rather than read. State written before
-	  # status.sh refused those, or edited by hand, can still hold one.
+	  # The topic and the tree land in a reason the harness prints, so a control
+	  # byte in either would be acted on by the terminal rather than read. State
+	  # written before status.sh refused those, or edited by hand, can still hold
+	  # one, and so can a path.
 	  else {block: true, progress: "\($done)/\($t | length)",
-	        topic: (.topic // "run" | gsub("[\u0000-\u001f\u007f]"; ""))}
+	        topic: (.topic // "run" | gsub("[\u0000-\u001f\u007f]"; "")),
+	        tree: ($tree | gsub("[\u0000-\u001f\u007f]"; "")),
+	        elsewhere: ($tree != $here)}
 	  end
 ' 2>/dev/null)" || exit 0
 
 [ "$(printf '%s' "$verdict" | jq -r '.block' 2>/dev/null)" = "true" ] || exit 0
 
+# Two remedies, because the last line of the local one is wrong once the run
+# has moved: `close` from here would archive a run that is live in another tree
+# and may be another session's, which is the one thing this hook must never talk
+# anyone into. What replaces it is the step `move` could not take -- the session
+# following the run -- because a controller guarded here is a controller sitting
+# in the tree its own run left.
 printf '%s' "$verdict" | jq 2>/dev/null '{
 	decision: "block",
-	reason: ("sluice: the deep run \(.topic) is \(.progress) done with tasks still to go and nothing marked blocked or paused, so ending the turn here hands a live run back with nothing for your partner to decide. Continue: run status.sh ready and dispatch the next wave in this same message. If a task genuinely needs them, mark it: status.sh task <id> --status blocked. If the run has to stand still for a reason, record it: status.sh pause --reason \"<why>\", then say so and stop. If this run is not the work you were asked to do, it was left open: status.sh close.")
+	reason: ("sluice: the deep run \(.topic) is \(.progress) done with tasks still to go and nothing marked blocked or paused, so ending the turn here hands a live run back with nothing for your partner to decide."
+		+ (if .elsewhere then " The run lives in \(.tree), not in this tree: `move` relocated the run and not this session. If it is yours, move this session into that tree -- the worktree tool in your harness enters one that already exists -- and go on from there." else "" end)
+		+ " Continue: run status.sh ready and dispatch the next wave in this same message. If a task genuinely needs them, mark it: status.sh task <id> --status blocked. If the run has to stand still for a reason, record it: status.sh pause --reason \"<why>\", then say so and stop."
+		+ (if .elsewhere
+		   then " If the run is not yours, it belongs to the session working in \(.tree): say so and stop, rather than closing it from here."
+		   else " If this run is not the work you were asked to do, it was left open: status.sh close."
+		   end))
 }'
 exit 0

package/skills/sluice/skill.json

@@ -1,6 +1,6 @@
 {
   "name": "sluice",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "Routes work by change shape into four channels (bypass, fast, main, deep) and applies only the rules each channel needs, so a one-line fix does not pay the cost of a multi-subsystem build. Carries seven rules as one-liners in the router and the full treatment in references read only on friction. Checks the finished plan with plan.sh validate rather than trusting it to memory, seeds the run state from it, keeps a deep run's task breakdown in .sluice/run.json so a statusline segment, one status command and a SessionStart hook can answer where the run is (the hook prints a live run at every session start, compaction included), and closes each run with a ledger read out of the session transcript: elapsed, tools, tokens, and what each dispatched agent cost where the transcript recorded it. Claude Code only; stands down where the superpowers pipeline governs the repo.",
   "author": "iceinvein",
   "type": "prompt",