@mattstack/rt-client 0.19.0 → 0.20.0

package/README.md

@@ -104,6 +104,7 @@ const stop = createRelay({                                     // one daemon sub
 | `chatPost` / `chatDm` / `chatDmOpen` / `chatRead` / `chatMessages` / `chatMark` | messages: post, DM, open a DM room without posting, read-and-advance, page, advance the cursor |
 | `paneList` / `panePeek` / `paneSpawn` / `paneAccounts` / `paneDirectories` | herdr panes: list with presence joined, peek a screen, start claude in a tab, cswap accounts, directory suggestions |
 | `chatInvite` | type `/chat:join <room>` into a pane; `accepted`, `queued` or `refused` |
+| `paneSend` | type a line into a pane; `accepted`, `queued` or `refused`, plus an optional `continuation` the daemon types once the pane's turn has ended |
 | `createRelay` / `subscribe` | the event stream; `daemonHealth` the reachability probe |
 
 Pass `{ sockPath }` as the trailing options to reach a non-default daemon

package/dist/client.d.ts

@@ -183,6 +183,9 @@ export declare function paneSend(a: Commands["pane:send"]["payload"], o?: RtClie
 /** Brings a herdr pane to the front. The daemon routes this to the tray, which
     owns the herdr focus and the native terminal-window raise. */
 export declare function paneFocus(a: Commands["pane:focus"]["payload"], o?: RtClientOptions): Promise<RtResponse<Commands["pane:focus"]["data"]>>;
+/** Never triggers a sweep; a plain read of the last one's snapshot. */
+export declare function reconcilerStatus(o?: RtClientOptions): Promise<RtResponse<Commands["reconciler:status"]["data"]>>;
+export declare function reconcilerClear(a: Commands["reconciler:clear"]["payload"], o?: RtClientOptions): Promise<RtResponse<Commands["reconciler:clear"]["data"]>>;
 export declare function gateOpen(a: Commands["gate:open"]["payload"], o?: RtClientOptions): Promise<RtResponse<Commands["gate:open"]["data"]>>;
 export declare function gateAnswer(a: Commands["gate:answer"]["payload"], o?: RtClientOptions): Promise<RtResponse<Commands["gate:answer"]["data"]>>;
 /** Daemon clamps its own wait to 240s (gates-store.ts); the client abort
@@ -218,7 +221,10 @@ export declare function herdAttend(a: Commands["herd:attend"]["payload"], o?: Rt
 export declare function herdWrapUp(a: Commands["herd:wrap-up"]["payload"], o?: RtClientOptions): Promise<RtResponse<Commands["herd:wrap-up"]["data"]>>;
 /** Runs `herdr session stop`, one CLI call under the runner's own 15s budget. */
 export declare function herdStopHidden(_a: Commands["herd:stop-hidden"]["payload"], o?: RtClientOptions): Promise<RtResponse<Commands["herd:stop-hidden"]["data"]>>;
-/** May spawn `herdr server` and wait for it to bind; budget matches bg-service's own 10s readyTimeoutMs plus margin. */
+/** A cold ensure spawns `herdr server`, waits out bg-service's own 10s
+    readyTimeoutMs, then runs its parity probes sequentially -- the 15s
+    default budget every other rt-client call inherits can lose that race,
+    so this is the one wrapper that widens its own. */
 export declare function bgEnsure(a?: Commands["bg:ensure"]["payload"], o?: RtClientOptions): Promise<RtResponse<Commands["bg:ensure"]["data"]>>;
 /** Never ensures/spawns; a plain read of the current state. */
 export declare function bgStatus(o?: RtClientOptions): Promise<RtResponse<Commands["bg:status"]["data"]>>;

package/dist/commands.d.ts

@@ -102,6 +102,8 @@ export interface EventsBusEvent {
     value gates-store.ts's release tracking (CAS winner or loser) reacts to. */
 export declare const GATE_BY_PANE = "pane";
 export type GateStatus = "open" | "answered" | "parked" | "closed";
+/** Reconciler's view of an agent's liveness; also the value `GateRow.executor` is stamped with. */
+export type ExecutorState = "live" | "blocked" | "hidden" | "gone" | "cleared" | "unknown";
 export type GateOption = string | {
     value: string;
     label: string;
@@ -128,6 +130,7 @@ export interface GateAnswer {
     }>;
     by: string;
     answeredAt: number;
+    overridden?: boolean;
 }
 export interface GateRow {
     id: string;
@@ -142,17 +145,29 @@ export interface GateRow {
     openedAt: number;
     parkedAt: number | null;
     closedAt: number | null;
-    closedReason: "abandoned" | "superseded" | "pruned" | null;
+    /** "resolved" is stamped only by the reconciler's auto-recovery close
+        (a blocked/gone pane came back); every other closer uses one of the
+        other three. */
+    closedReason: "abandoned" | "superseded" | "pruned" | "resolved" | null;
+    /** Set only when `closedReason` is "superseded": the id of the gate that superseded this one. */
+    supersededBy: string | null;
     agent: string | null;
     pane: string | null;
     nudge: {
         session: string;
     } | null;
     delivery: {
-        outcome: "delivered" | "dead-pane";
+        outcome: "delivered" | "dead-pane" | "confirmed" | "stuck";
         at: number;
     } | null;
     released: boolean;
+    owner: string | null;
+    escalatedAt: number | null;
+    /** Set by answer-time execution handling: an answered gate whose executor
+        couldn't be resumed. Cleared (absent) once resumption succeeds. */
+    execution?: "unassigned";
+    /** Stamped by the reconciler sweep for open/parked rows only. */
+    executor?: ExecutorState;
 }
 export interface GateSubscription {
     id: string;
@@ -164,6 +179,8 @@ export interface GateSubscription {
         at: number;
     } | null;
     dead: boolean;
+    scope: "prefix" | "owner";
+    ownerRef: string | null;
 }
 export interface HerdInfo {
     id: string;
@@ -206,7 +223,7 @@ export interface HerdStatusData {
         openGate: string | null;
         paneStatus: string | null;
         lastGateStatus: GateStatus | null;
-        lastGateDelivery: "delivered" | "dead-pane" | null;
+        lastGateDelivery: "delivered" | "dead-pane" | "confirmed" | "stuck" | null;
     }>;
     unread: number;
     lifecycleConnected: boolean;
@@ -217,6 +234,11 @@ export interface HerdStatusData {
         dead: boolean;
         lastDelivery: GateSubscription["lastDelivery"];
     } | null;
+    /** Whether the shepherd session's own inbox socket is reachable right now, probed fresh on every status call -- honest liveness, not the subscription row's bookkeeping. */
+    push: {
+        state: "reachable" | "unreachable";
+        lastDelivery: GateSubscription["lastDelivery"];
+    };
 }
 /**
  * Duplicated shape on purpose, same reasoning as EventsBusEvent above:
@@ -333,10 +355,14 @@ export interface InviteResult {
 }
 /** Duplicated shape on purpose: mirrors lib/daemon/inject.ts's InjectResult. */
 export type PaneDelivery = "accepted" | "queued" | "refused";
+/** `continuation` is present only when the daemon scheduled a second line for after the target's current turn. */
 export interface PaneSendResult {
     paneId: string;
     delivered: PaneDelivery;
     reason?: string;
+    continuation?: {
+        delivered: "deferred";
+    };
 }
 /** `attendTab` is set only for a `bg:` ref: focus for a background pane IS
     the attend flow (a visible tab running a terminal attach), and this is
@@ -419,6 +445,23 @@ export interface RunDetail {
     schemaAhead: boolean;
 }
 export type AgentSurface = "herdr" | "headless";
+/** The reconciler's per-agent snapshot: one row per agent it knows about, live or not. */
+export interface ExecutorView {
+    agentId: string;
+    repo: string | null;
+    subject: string | null;
+    surface: AgentSurface;
+    sessionId: string;
+    paneRef: string | null;
+    state: ExecutorState;
+    since: number;
+    openGateIds: string[];
+}
+export interface ReconcilerStatus {
+    sweptAt: number;
+    herdrReachable: boolean;
+    executors: ExecutorView[];
+}
 export interface AgentRecord {
     id: string;
     repo: string;
@@ -432,6 +475,12 @@ export interface AgentRecord {
     label?: string;
     caller?: string;
     handle?: string;
+    /** The gate-protocol subject stamped as RT_GATE_SUBJECT at launch. Left
+        undefined when the caller passed none (RT_GATE_SUBJECT still falls
+        back to "agent:<id>" at launch time); an explicit value is persisted
+        so a resume re-stamps the same one, AND gates whether the gate-fork
+        PreToolUse hook gets injected at all. */
+    subject?: string;
     paneId?: string;
     tabId?: string;
     workspaceId?: string;
@@ -616,9 +665,12 @@ export interface WorktreeCreateData {
 }
 export interface WorktreeDisposeData {
     disposed: string[];
+    /** `detail` is set only for a refusal whose bare `reason` code can't name
+        what a human needs to act on it (the run id and stage for `running-run`). */
     refused: Array<{
         tree: string;
         reason: string;
+        detail?: string;
     }>;
     recoverable: Array<{
         tree: string;
@@ -644,6 +696,7 @@ export interface WorktreeAdoptData {
     refused: Array<{
         tree: string;
         reason: string;
+        detail?: string;
     }>;
 }
 /** Duplicated shape on purpose: mirrors lib/endpoint/store.ts's EndpointClaim. */
@@ -1080,6 +1133,7 @@ export interface Commands {
             herdrSocket?: string;
             handle?: string;
             bg?: boolean;
+            subject?: string;
         };
         data: AgentRecord;
     };
@@ -1166,6 +1220,7 @@ export interface Commands {
             paneId: string;
             text: string;
             callerPane?: string;
+            continuation?: string;
         };
         data: PaneSendResult;
     };
@@ -1344,6 +1399,20 @@ export interface Commands {
         payload: Record<string, never>;
         data: unknown;
     };
+    /** Read-only: the last sweep's snapshot. Never triggers a sweep itself. */
+    "reconciler:status": {
+        payload: Record<string, never>;
+        data: ReconcilerStatus;
+    };
+    /** Manual override: marks the agent cleared and closes its open/parked gates (reconciler.ts's clear()). */
+    "reconciler:clear": {
+        payload: {
+            agentId: string;
+        };
+        data: {
+            cleared: true;
+        };
+    };
     "gate:open": {
         payload: {
             subject: string;
@@ -1368,12 +1437,21 @@ export interface Commands {
      * `conflict:true` and the WINNING row, so every consumer gets the winner
      * typed with no envelope hacks. `ok:false` is reserved for
      * not-found/closed/validation failures.
+     *
+     * Owner enforcement adds two structured rejections beyond the plain
+     * `{ok:false, error:string}` shape (see `GateAnswerResult` in
+     * `lib/daemon/handlers/gate.ts`): a herd-owned gate answered by anyone but
+     * the owning shepherd's session, the answering pane, or an explicit human
+     * `override` returns `{ok:false, error:"owned-by", owner}`; a closed gate
+     * returns `{ok:false, error:"gate-closed", reason, supersededBy?}`.
      */
     "gate:answer": {
         payload: {
             id: string;
             answers: GateAnswer["answers"];
             by: string;
+            session?: string;
+            override?: boolean;
         };
         data: {
             row: GateRow;
@@ -1430,6 +1508,8 @@ export interface Commands {
         payload: {
             subjectPrefix: string;
             session: string;
+            scope?: "owner";
+            ownerRef?: string;
         };
         data: {
             id: string;
@@ -1505,7 +1585,8 @@ export interface Commands {
         };
         data: {
             job: string;
-            status: "closed";
+            status: "closed"; /** Advisory: a resumable run can still write into this job's worktree after close, so this warns rather than blocking. */
+            warning?: string;
         };
     };
     /** `brief` is the brief TEXT, not a path: the CLI reads the file. It is stored at `<jobsRoot>/<herd>/<job>/job.md`, so a respawn with `dir` and no `brief` reads it back. */

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 export { rtCommand, DEFAULT_SOCK } from "./transport.ts";
 export type { RtResponse, RtClientOptions } from "./transport.ts";
-export { readProjectMRs, readDiscussions, readMrsByBranch, readBranchCache, resolveForgeToken, listRuns, getRun, abandonRun, chatJoin, chatLeave, chatAck, chatClaim, chatRelease, chatPost, chatRead, chatRooms, chatWho, chatMark, chatMessages, chatSignIn, chatSignOut, chatAway, chatBack, chatBuddies, chatDm, chatArchive, chatDmOpen, eventsHead, eventsEmit, eventsWait, eventsList, agentStart, agentResume, agentGet, agentList, paneList, panePeek, paneSpawn, paneAccounts, paneDirectories, chatInvite, paneSend, paneFocus, gateOpen, gateAnswer, gateWait, gateList, gatePark, gateClose, gateSubscribe, gateUnsubscribe, gateSubscriptions, herdStart, herdSpawn, herdAsk, herdMilestone, herdAnswer, herdReport, herdGates, herdStatus, herdList, herdResume, herdClose, herdAttend, herdWrapUp, herdStopHidden, bgEnsure, bgStatus, bgStop, bgRelease, } from "./client.ts";
+export { readProjectMRs, readDiscussions, readMrsByBranch, readBranchCache, resolveForgeToken, listRuns, getRun, abandonRun, chatJoin, chatLeave, chatAck, chatClaim, chatRelease, chatPost, chatRead, chatRooms, chatWho, chatMark, chatMessages, chatSignIn, chatSignOut, chatAway, chatBack, chatBuddies, chatDm, chatArchive, chatDmOpen, eventsHead, eventsEmit, eventsWait, eventsList, agentStart, agentResume, agentGet, agentList, paneList, panePeek, paneSpawn, paneAccounts, paneDirectories, chatInvite, paneSend, paneFocus, reconcilerStatus, reconcilerClear, gateOpen, gateAnswer, gateWait, gateList, gatePark, gateClose, gateSubscribe, gateUnsubscribe, gateSubscriptions, herdStart, herdSpawn, herdAsk, herdMilestone, herdAnswer, herdReport, herdGates, herdStatus, herdList, herdResume, herdClose, herdAttend, herdWrapUp, herdStopHidden, bgEnsure, bgStatus, bgStop, bgRelease, } from "./client.ts";
 export { COMMAND_NAMES, GATE_BY_PANE, gateOptionValue, gateOptionLabel } from "./commands.ts";
-export type { Discussion, DemandDecl, ProjectMRsScope, ProjectMRsData, DiscussionsData, MrByBranchEntry, MrByBranchData, BranchEnrichment, Commands, CommandName, ForgeSlug, ForgeTokenData, Attention, RunSummary, RunStageRow, RunFieldRow, RunDecisionRow, RunDetail, WakeMode, ChatMember, ChatMessage, ChatClaimOutcome, RoomSummary, BuddyStatus, PresenceRow, AgentRecord, AgentSurface, AgentStatus, ChatPane, PaneAccount, PaneDirectory, InviteResult, PaneDelivery, PaneSendResult, PaneFocusResult, GateStatus, GateOption, GateOrigin, GateQuestion, GateAnswer, GateRow, GateSubscription, HerdInfo, HerdListRow, HerdJobInfo, HerdStatusData, } from "./commands.ts";
+export type { Discussion, DemandDecl, ProjectMRsScope, ProjectMRsData, DiscussionsData, MrByBranchEntry, MrByBranchData, BranchEnrichment, Commands, CommandName, ForgeSlug, ForgeTokenData, Attention, RunSummary, RunStageRow, RunFieldRow, RunDecisionRow, RunDetail, WakeMode, ChatMember, ChatMessage, ChatClaimOutcome, RoomSummary, BuddyStatus, PresenceRow, AgentRecord, AgentSurface, AgentStatus, ExecutorState, ExecutorView, ReconcilerStatus, ChatPane, PaneAccount, PaneDirectory, InviteResult, PaneDelivery, PaneSendResult, PaneFocusResult, GateStatus, GateOption, GateOrigin, GateQuestion, GateAnswer, GateRow, GateSubscription, HerdInfo, HerdListRow, HerdJobInfo, HerdStatusData, } from "./commands.ts";
 export { subscribe, createRelay, DEFAULT_WS_URL } from "./relay.ts";
 export type { RelayEventType } from "./relay.ts";
 export { daemonHealth } from "./health.ts";

package/dist/index.js

@@ -5,7 +5,7 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 import { homedir } from "os";
 import { join } from "path";
 function defaultSock() {
-  return join(process.env.HOME ?? homedir(), ".mattstack", "rt", "rt.sock");
+  return process.env.RT_DAEMON_SOCK || join(process.env.HOME ?? homedir(), ".mattstack", "rt", "rt.sock");
 }
 var DEFAULT_SOCK = defaultSock();
 async function rtCommand(cmd, payload, opts = {}) {
@@ -205,7 +205,7 @@ function eventsList(payload, o = {}) {
 }
 function agentStart(a, o = {}) {
   const payload = { repo: a.repo, cwd: a.cwd };
-  for (const k of ["prompt", "surface", "model", "effort", "account", "label", "caller", "workspace", "tab", "extraArgs", "env", "herdrSocket", "handle", "bg"]) {
+  for (const k of ["prompt", "surface", "model", "effort", "account", "label", "caller", "workspace", "tab", "extraArgs", "env", "herdrSocket", "handle", "bg", "subject"]) {
     if (a[k] !== undefined)
       payload[k] = a[k];
   }
@@ -265,6 +265,8 @@ function paneSend(a, o = {}) {
   const payload = { paneId: a.paneId, text: a.text };
   if (a.callerPane !== undefined)
     payload.callerPane = a.callerPane;
+  if (a.continuation !== undefined)
+    payload.continuation = a.continuation;
   return rtCommand("pane:send", payload, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 30000 });
 }
 function paneFocus(a, o = {}) {
@@ -273,6 +275,12 @@ function paneFocus(a, o = {}) {
     payload.callerWorkspace = a.callerWorkspace;
   return rtCommand("pane:focus", payload, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 1e4 });
 }
+function reconcilerStatus(o = {}) {
+  return rtCommand("reconciler:status", {}, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 1e4 });
+}
+function reconcilerClear(a, o = {}) {
+  return rtCommand("reconciler:clear", { agentId: a.agentId }, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 1e4 });
+}
 function gateOpen(a, o = {}) {
   const payload = { subject: a.subject, kind: a.kind, questions: a.questions };
   for (const k of ["meta", "agent", "pane", "nudge", "context", "origin"])
@@ -281,7 +289,11 @@ function gateOpen(a, o = {}) {
   return rtCommand("gate:open", payload, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 1e4 });
 }
 function gateAnswer(a, o = {}) {
-  return rtCommand("gate:answer", { id: a.id, answers: a.answers, by: a.by }, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 1e4 });
+  const payload = { id: a.id, answers: a.answers, by: a.by };
+  for (const k of ["session", "override"])
+    if (a[k] !== undefined)
+      payload[k] = a[k];
+  return rtCommand("gate:answer", payload, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 1e4 });
 }
 function gateWait(a, o = {}) {
   const payload = { id: a.id };
@@ -303,7 +315,11 @@ function gateClose(a, o = {}) {
   return rtCommand("gate:close", { id: a.id, reason: a.reason }, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 1e4 });
 }
 function gateSubscribe(a, o = {}) {
-  return rtCommand("gate:subscribe", { subjectPrefix: a.subjectPrefix, session: a.session }, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 1e4 });
+  const payload = { subjectPrefix: a.subjectPrefix, session: a.session };
+  for (const k of ["scope", "ownerRef"])
+    if (a[k] !== undefined)
+      payload[k] = a[k];
+  return rtCommand("gate:subscribe", payload, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 1e4 });
 }
 function gateUnsubscribe(a, o = {}) {
   return rtCommand("gate:unsubscribe", { id: a.id }, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 1e4 });
@@ -383,7 +399,7 @@ function bgEnsure(a = {}, o = {}) {
   const payload = {};
   if (a.claim !== undefined)
     payload.claim = a.claim;
-  return rtCommand("bg:ensure", payload, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 15000 });
+  return rtCommand("bg:ensure", payload, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 30000 });
 }
 function bgStatus(o = {}) {
   return rtCommand("bg:status", {}, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 1e4 });
@@ -470,6 +486,8 @@ var COMMAND_NAMES = [
   "endpoint:status",
   "repos:locate",
   "freshness:reconcile",
+  "reconciler:status",
+  "reconciler:clear",
   "gate:open",
   "gate:answer",
   "gate:wait",
@@ -705,6 +723,9 @@ function formatPaneRef(paneId, server) {
   if (server === "visible") {
     return paneId;
   }
+  if (paneId.startsWith(BG_PREFIX)) {
+    return paneId;
+  }
   return BG_PREFIX + paneId;
 }
 // src/settings/resolve.ts
@@ -777,7 +798,7 @@ var REGISTRY = [
     merge: "deep",
     repoScoped: true,
     migrated: true,
-    description: "Per-repo worktree pool config (onDeck size, ready steps, name pool); root/branchFormat/ready computed-or-empty in the reader."
+    description: "Per-repo worktree pool config (onDeck size, ready steps, name pool, staleClaimDays); root/branchFormat/ready computed-or-empty in the reader."
   },
   {
     key: "rt.worktreeReadyApproval",
@@ -819,7 +840,7 @@ var REGISTRY = [
     scopes: ["user"],
     default: [],
     merge: "replace",
-    description: "Event-bus glob rules that raise a desktop notification: [{pattern, category, title, message, subjectPrefix?, url?}]. pattern is matched against the events-bus topic (Bun.Glob semantics); title/message may interpolate `{field}` from the event payload, plus the computed `{question}` field (the event payload's first question label, `payload.questions[0].label`, empty string when absent); optional subjectPrefix matches the event payload's subject as a prefix. The optional url is interpolated the same way as title/message and becomes the notification's Open target; a gate rule should set it. A fresh key, not an ownership-latch port, so a default is fine here."
+    description: 'Event-bus glob rules that raise a desktop notification: [{pattern, category, title, message, subjectPrefix?, url?, owner?}]. pattern is matched against the events-bus topic (Bun.Glob semantics); title/message may interpolate `{field}` from the event payload, plus the computed `{question}` field (the event payload\'s first question label, `payload.questions[0].label`, empty string when absent); optional subjectPrefix matches the event payload\'s subject as a prefix. The optional url is interpolated the same way as title/message and becomes the notification\'s Open target; a gate rule should set it. The optional owner field (only literal "human" is valid) suppresses events whose payload.owner starts with "herd:", allowing gate rules to skip herd-owned events. A typical setup pairs a gate/opened rule with owner: "human" (human-owned gates notify) and a gate/escalated rule without owner (all escalations notify, whether human or herd). A fresh key, not an ownership-latch port, so a default is fine here.'
   },
   {
     key: "rt.cron",
@@ -1020,6 +1041,14 @@ var REGISTRY = [
     merge: "replace",
     description: 'The machine\'s intended flavor, "dev" or "prod". Normally written by `rt settings dev-mode` after a successful handoff; a manual `rt settings set` is the blessed repair escape hatch — the daemon park loop converges on whatever this says. Unset ⇒ derived from the dev wrapper\'s presence.'
   },
+  {
+    key: "setup.waived",
+    type: "array",
+    scopes: ["machine"],
+    default: [],
+    merge: "replace",
+    description: "Finish-gated setup rows the user skipped on this Mac through `rt setup waive` (today only tool.fast-browser-extension); the wizard's Finish no longer waits on them. Machine-only: a loaded Chrome extension is a per-profile fact and the choice is per machine, so it never travels with a team or user store."
+  },
   {
     key: "rt.integrations",
     type: "object",
@@ -1138,7 +1167,7 @@ var REGISTRY = [
     type: "array",
     scopes: ["team"],
     merge: "replace",
-    description: "Board tabs ({id, label, source, slackChannel?, reviewSkill?}), editable from the board's settings modal. source.kind 'authors' is the classic roster board; 'codeowners' lists MRs from any author blocked on an unapproved CODEOWNERS section. Absent = one implicit authors tab (fallback lives in the board reader, never here)."
+    description: "Board tabs ({id, label, source, slackChannel?, reviewSkill?}), editable from the board's settings modal. source.kind 'authors' is the classic roster board; 'codeowners' lists any author's open MRs carrying a CODE_OWNER rule for the section, until merge/close. Absent = one implicit authors tab (fallback lives in the board reader, never here)."
   },
   {
     key: "board.staleAfterDays",
@@ -1381,6 +1410,14 @@ var REGISTRY = [
     scopes: ["user", "machine"],
     merge: "replace",
     description: "Opaque extra claude arguments appended to every rt agent launch (escape hatch)."
+  },
+  {
+    key: "rt.gates.escalationTtlMinutes",
+    type: "number",
+    scopes: ["user"],
+    default: 10,
+    merge: "replace",
+    description: `Minutes an open herd-owned gate waits before the escalation sweep surfaces it to the human (topic gate/escalated/<id>). Fires on either trigger: the TTL elapses (reason "ttl"), or the owning herd's shepherd subscription is gone or dead before the TTL (reason "owner-dead"). 0 escalates any eligible gate on the first sweep after it opens. A fresh key, not an ownership-latch port, so a default is fine here.`
   }
 ];
 
@@ -2234,6 +2271,8 @@ export {
   resolveNameToIdentity,
   resolveForgeToken,
   repoNameForPath,
+  reconcilerStatus,
+  reconcilerClear,
   readStore,
   readProjectMRs,
   readMrsByBranch,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mattstack/rt-client",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "type": "module",
   "exports": {
     ".": {

package/src/client.ts

@@ -356,7 +356,7 @@ export function agentStart(
   a: Commands["agent:start"]["payload"], o: RtClientOptions = {},
 ): Promise<RtResponse<AgentRecord>> {
   const payload: Record<string, unknown> = { repo: a.repo, cwd: a.cwd };
-  for (const k of ["prompt", "surface", "model", "effort", "account", "label", "caller", "workspace", "tab", "extraArgs", "env", "herdrSocket", "handle", "bg"] as const) {
+  for (const k of ["prompt", "surface", "model", "effort", "account", "label", "caller", "workspace", "tab", "extraArgs", "env", "herdrSocket", "handle", "bg", "subject"] as const) {
     if (a[k] !== undefined) payload[k] = a[k];
   }
   return rtCommand<AgentRecord>("agent:start", payload, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 30_000 });
@@ -432,6 +432,7 @@ export function paneSend(
 ): Promise<RtResponse<Commands["pane:send"]["data"]>> {
   const payload: Record<string, unknown> = { paneId: a.paneId, text: a.text };
   if (a.callerPane !== undefined) payload.callerPane = a.callerPane;
+  if (a.continuation !== undefined) payload.continuation = a.continuation;
   return rtCommand<Commands["pane:send"]["data"]>("pane:send", payload, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 30_000 });
 }
 
@@ -446,6 +447,20 @@ export function paneFocus(
   return rtCommand<Commands["pane:focus"]["data"]>("pane:focus", payload, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 10_000 });
 }
 
+// ─── Reconciler (executor state; lib/daemon/reconciler.ts) ────────────────
+
+/** Never triggers a sweep; a plain read of the last one's snapshot. */
+export function reconcilerStatus(o: RtClientOptions = {}): Promise<RtResponse<Commands["reconciler:status"]["data"]>> {
+  return rtCommand<Commands["reconciler:status"]["data"]>("reconciler:status", {}, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 10_000 });
+}
+
+export function reconcilerClear(
+  a: Commands["reconciler:clear"]["payload"],
+  o: RtClientOptions = {},
+): Promise<RtResponse<Commands["reconciler:clear"]["data"]>> {
+  return rtCommand<Commands["reconciler:clear"]["data"]>("reconciler:clear", { agentId: a.agentId }, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 10_000 });
+}
+
 // ─── Gates (BOARD-20/21 gate facility) ─────────────────────────────────────
 
 export function gateOpen(
@@ -461,7 +476,9 @@ export function gateAnswer(
   a: Commands["gate:answer"]["payload"],
   o: RtClientOptions = {},
 ): Promise<RtResponse<Commands["gate:answer"]["data"]>> {
-  return rtCommand<Commands["gate:answer"]["data"]>("gate:answer", { id: a.id, answers: a.answers, by: a.by }, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 10_000 });
+  const payload: Record<string, unknown> = { id: a.id, answers: a.answers, by: a.by };
+  for (const k of ["session", "override"] as const) if (a[k] !== undefined) payload[k] = a[k];
+  return rtCommand<Commands["gate:answer"]["data"]>("gate:answer", payload, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 10_000 });
 }
 
 /** Daemon clamps its own wait to 240s (gates-store.ts); the client abort
@@ -503,7 +520,9 @@ export function gateSubscribe(
   a: Commands["gate:subscribe"]["payload"],
   o: RtClientOptions = {},
 ): Promise<RtResponse<Commands["gate:subscribe"]["data"]>> {
-  return rtCommand<Commands["gate:subscribe"]["data"]>("gate:subscribe", { subjectPrefix: a.subjectPrefix, session: a.session }, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 10_000 });
+  const payload: Record<string, unknown> = { subjectPrefix: a.subjectPrefix, session: a.session };
+  for (const k of ["scope", "ownerRef"] as const) if (a[k] !== undefined) payload[k] = a[k];
+  return rtCommand<Commands["gate:subscribe"]["data"]>("gate:subscribe", payload, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 10_000 });
 }
 
 export function gateUnsubscribe(
@@ -645,14 +664,17 @@ export function herdStopHidden(
 
 // ─── Background server (daemon-owned background herdr session) ────────────
 
-/** May spawn `herdr server` and wait for it to bind; budget matches bg-service's own 10s readyTimeoutMs plus margin. */
+/** A cold ensure spawns `herdr server`, waits out bg-service's own 10s
+    readyTimeoutMs, then runs its parity probes sequentially -- the 15s
+    default budget every other rt-client call inherits can lose that race,
+    so this is the one wrapper that widens its own. */
 export function bgEnsure(
   a: Commands["bg:ensure"]["payload"] = {},
   o: RtClientOptions = {},
 ): Promise<RtResponse<Commands["bg:ensure"]["data"]>> {
   const payload: Record<string, unknown> = {};
   if (a.claim !== undefined) payload.claim = a.claim;
-  return rtCommand<Commands["bg:ensure"]["data"]>("bg:ensure", payload, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 15_000 });
+  return rtCommand<Commands["bg:ensure"]["data"]>("bg:ensure", payload, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 30_000 });
 }
 
 /** Never ensures/spawns; a plain read of the current state. */

package/src/commands.ts

@@ -95,6 +95,8 @@ export interface EventsBusEvent { id: number; topic: string; payload: unknown; e
 export const GATE_BY_PANE = "pane";
 
 export type GateStatus = "open" | "answered" | "parked" | "closed";
+/** Reconciler's view of an agent's liveness; also the value `GateRow.executor` is stamped with. */
+export type ExecutorState = "live" | "blocked" | "hidden" | "gone" | "cleared" | "unknown";
 export type GateOption = string | { value: string; label: string };
 export interface GateOrigin {
   paneId?: string;
@@ -110,7 +112,7 @@ export function gateOptionValue(o: GateOption): string {
 export function gateOptionLabel(o: GateOption): string {
   return typeof o === "string" ? o : (o.label || o.value);
 }
-export interface GateAnswer { answers: Record<string, string | string[] | { value: string | string[]; note?: string }>; by: string; answeredAt: number }
+export interface GateAnswer { answers: Record<string, string | string[] | { value: string | string[]; note?: string }>; by: string; answeredAt: number; overridden?: boolean }
 export interface GateRow {
   id: string; subject: string; kind: string;
   questions: GateQuestion[]; meta: Record<string, unknown> | null;
@@ -118,11 +120,23 @@ export interface GateRow {
   origin?: GateOrigin | null;
   status: GateStatus; answer: GateAnswer | null;
   openedAt: number; parkedAt: number | null; closedAt: number | null;
-  closedReason: "abandoned" | "superseded" | "pruned" | null;
+  /** "resolved" is stamped only by the reconciler's auto-recovery close
+      (a blocked/gone pane came back); every other closer uses one of the
+      other three. */
+  closedReason: "abandoned" | "superseded" | "pruned" | "resolved" | null;
+  /** Set only when `closedReason` is "superseded": the id of the gate that superseded this one. */
+  supersededBy: string | null;
   agent: string | null; pane: string | null;
   nudge: { session: string } | null;
-  delivery: { outcome: "delivered" | "dead-pane"; at: number } | null;
+  delivery: { outcome: "delivered" | "dead-pane" | "confirmed" | "stuck"; at: number } | null;
   released: boolean;
+  owner: string | null;
+  escalatedAt: number | null;
+  /** Set by answer-time execution handling: an answered gate whose executor
+      couldn't be resumed. Cleared (absent) once resumption succeeds. */
+  execution?: "unassigned";
+  /** Stamped by the reconciler sweep for open/parked rows only. */
+  executor?: ExecutorState;
 }
 
 export interface GateSubscription {
@@ -132,6 +146,8 @@ export interface GateSubscription {
   createdAt: number;
   lastDelivery: { outcome: "delivered" | "failed"; at: number } | null;
   dead: boolean;
+  scope: "prefix" | "owner";
+  ownerRef: string | null;
 }
 
 export interface HerdInfo { id: string; repo: string; room: string; workspace: string; shepherdSession: string; shepherdHandle: string; herdrSocket: string | null; hidden: boolean; status: "active" | "wrapped"; createdAt: number; wrappedAt: number | null }
@@ -141,12 +157,14 @@ export interface HerdJobInfo { herd: string; name: string; worktree: string; bra
 /** `lastGateStatus`/`lastGateDelivery` come from the job's `lastGate` row: an `answered` gate whose delivery is `dead-pane` is the "answered, worker not woken" case the shepherd must act on. */
 export interface HerdStatusData {
   herd: HerdInfo;
-  jobs: Array<HerdJobInfo & { openGate: string | null; paneStatus: string | null; lastGateStatus: GateStatus | null; lastGateDelivery: "delivered" | "dead-pane" | null }>;
+  jobs: Array<HerdJobInfo & { openGate: string | null; paneStatus: string | null; lastGateStatus: GateStatus | null; lastGateDelivery: "delivered" | "dead-pane" | "confirmed" | "stuck" | null }>;
   unread: number;
   lifecycleConnected: boolean;
   hiddenUp: boolean | null;
   /** The shepherd session's own `herd:<id>/` subscription row, or null when none is live. */
   subscription: { id: string; dead: boolean; lastDelivery: GateSubscription["lastDelivery"] } | null;
+  /** Whether the shepherd session's own inbox socket is reachable right now, probed fresh on every status call -- honest liveness, not the subscription row's bookkeeping. */
+  push: { state: "reachable" | "unreachable"; lastDelivery: GateSubscription["lastDelivery"] };
 }
 
 /**
@@ -243,7 +261,8 @@ export interface InviteResult { paneId: string; delivered: "accepted" | "queued"
 
 /** Duplicated shape on purpose: mirrors lib/daemon/inject.ts's InjectResult. */
 export type PaneDelivery = "accepted" | "queued" | "refused";
-export interface PaneSendResult { paneId: string; delivered: PaneDelivery; reason?: string }
+/** `continuation` is present only when the daemon scheduled a second line for after the target's current turn. */
+export interface PaneSendResult { paneId: string; delivered: PaneDelivery; reason?: string; continuation?: { delivered: "deferred" } }
 /** `attendTab` is set only for a `bg:` ref: focus for a background pane IS
     the attend flow (a visible tab running a terminal attach), and this is
     that tab's id. */
@@ -297,11 +316,36 @@ export interface RunDetail { run: RunSummary; stages: RunStageRow[]; fields: Run
 
 export type AgentSurface = "herdr" | "headless";
 
+/** The reconciler's per-agent snapshot: one row per agent it knows about, live or not. */
+export interface ExecutorView {
+  agentId: string;
+  repo: string | null;
+  subject: string | null;
+  surface: AgentSurface;
+  sessionId: string;
+  paneRef: string | null;
+  state: ExecutorState;
+  since: number;
+  openGateIds: string[];
+}
+
+export interface ReconcilerStatus {
+  sweptAt: number;
+  herdrReachable: boolean;
+  executors: ExecutorView[];
+}
+
 export interface AgentRecord {
   id: string; repo: string; cwd: string; provider: string;
   surface: AgentSurface; sessionId: string;
   model?: string; effort?: string; account?: string;
   label?: string; caller?: string; handle?: string;
+  /** The gate-protocol subject stamped as RT_GATE_SUBJECT at launch. Left
+      undefined when the caller passed none (RT_GATE_SUBJECT still falls
+      back to "agent:<id>" at launch time); an explicit value is persisted
+      so a resume re-stamps the same one, AND gates whether the gate-fork
+      PreToolUse hook gets injected at all. */
+  subject?: string;
   paneId?: string; tabId?: string; workspaceId?: string;
   extraArgs?: string; exitCode?: number; resultPath?: string;
   createdAt: number; lastResumedAt?: number; finishedAt?: number;
@@ -405,7 +449,9 @@ export interface WorktreeProvisionData {
 export interface WorktreeCreateData { tree: string; path: string }
 export interface WorktreeDisposeData {
   disposed: string[];
-  refused: Array<{ tree: string; reason: string }>;
+  /** `detail` is set only for a refusal whose bare `reason` code can't name
+      what a human needs to act on it (the run id and stage for `running-run`). */
+  refused: Array<{ tree: string; reason: string; detail?: string }>;
   recoverable: Array<{ tree: string; path: string; until: string }>;
 }
 export interface WorktreeRestoreData {
@@ -414,7 +460,7 @@ export interface WorktreeRestoreData {
 export interface WorktreeFreshenData { ran: string[] }
 export interface WorktreeAdoptData {
   main: string; claimed: string[]; unmanaged: string[]; disposed: string[];
-  refused: Array<{ tree: string; reason: string }>;
+  refused: Array<{ tree: string; reason: string; detail?: string }>;
 }
 
 /** Duplicated shape on purpose: mirrors lib/endpoint/store.ts's EndpointClaim. */
@@ -558,7 +604,7 @@ export interface Commands {
   "chat:dm-open": { payload: { from: string; to: string; sessionId?: string }; data: { room: string; created: boolean } };
 
   // ─── Agent handoff (rt agent) ────────────────────────────────────────────
-  "agent:start": { payload: { repo: string; cwd: string; prompt?: string; surface?: AgentSurface; model?: string; effort?: string; account?: string; label?: string; caller?: string; workspace?: string; tab?: string; extraArgs?: string; env?: Record<string, string>; herdrSocket?: string; handle?: string; bg?: boolean }; data: AgentRecord };
+  "agent:start": { payload: { repo: string; cwd: string; prompt?: string; surface?: AgentSurface; model?: string; effort?: string; account?: string; label?: string; caller?: string; workspace?: string; tab?: string; extraArgs?: string; env?: Record<string, string>; herdrSocket?: string; handle?: string; bg?: boolean; subject?: string }; data: AgentRecord };
   "agent:resume": { payload: { id: string; prompt?: string; surface?: AgentSurface; workspace?: string; tab?: string }; data: AgentRecord };
   "agent:get": { payload: { id: string }; data: AgentRecord };
   "agent:list": { payload: { repo?: string }; data: { agents: AgentRecord[] } };
@@ -571,7 +617,7 @@ export interface Commands {
     payload: { cwd: string; account?: string; model?: string; effort?: string; prompt?: string; workspace?: string };
     data: { pane: ChatPane; ready: boolean };
   };
-  "pane:send": { payload: { paneId: string; text: string; callerPane?: string }; data: PaneSendResult };
+  "pane:send": { payload: { paneId: string; text: string; callerPane?: string; continuation?: string }; data: PaneSendResult };
   /** `callerWorkspace` (HERDR_WORKSPACE_ID) is required only for a `bg:`
       ref, whose focus opens an attend tab in the caller's own workspace. */
   "pane:focus": { payload: { paneId: string; callerWorkspace?: string }; data: PaneFocusResult };
@@ -609,6 +655,12 @@ export interface Commands {
   "repos:locate": { payload: { newPath: string; repo?: string; dryRun?: boolean }; data: unknown };
   "freshness:reconcile": { payload: Record<string, never>; data: unknown };
 
+  // ─── Reconciler (executor state; lib/daemon/reconciler.ts) ───────────────
+  /** Read-only: the last sweep's snapshot. Never triggers a sweep itself. */
+  "reconciler:status": { payload: Record<string, never>; data: ReconcilerStatus };
+  /** Manual override: marks the agent cleared and closes its open/parked gates (reconciler.ts's clear()). */
+  "reconciler:clear": { payload: { agentId: string }; data: { cleared: true } };
+
   // ─── Gate facility (BOARD-20/21) ─────────────────────────────────────────
   "gate:open": { payload: { subject: string; kind: string; questions: GateQuestion[]; meta?: Record<string, unknown>; agent?: string; pane?: string; nudge?: { session: string }; context?: string; origin?: GateOrigin }; data: { id: string; supersededId: string | null } };
   /**
@@ -616,8 +668,15 @@ export interface Commands {
    * `conflict:true` and the WINNING row, so every consumer gets the winner
    * typed with no envelope hacks. `ok:false` is reserved for
    * not-found/closed/validation failures.
+   *
+   * Owner enforcement adds two structured rejections beyond the plain
+   * `{ok:false, error:string}` shape (see `GateAnswerResult` in
+   * `lib/daemon/handlers/gate.ts`): a herd-owned gate answered by anyone but
+   * the owning shepherd's session, the answering pane, or an explicit human
+   * `override` returns `{ok:false, error:"owned-by", owner}`; a closed gate
+   * returns `{ok:false, error:"gate-closed", reason, supersededBy?}`.
    */
-  "gate:answer": { payload: { id: string; answers: GateAnswer["answers"]; by: string }; data: { row: GateRow; conflict?: true } };
+  "gate:answer": { payload: { id: string; answers: GateAnswer["answers"]; by: string; session?: string; override?: boolean }; data: { row: GateRow; conflict?: true } };
   /** `ok:false "not-found"` on an unknown id is terminal; the CLI loop must not re-enter on it.
    *  `timeout` carries no row (nothing settled); `answered`/`closed` always carry the settled row. */
   "gate:wait": { payload: { id: string; waitMs?: number }; data: { status: "timeout" } | { status: "answered" | "closed"; row: GateRow } };
@@ -626,7 +685,7 @@ export interface Commands {
   "gate:list": { payload: { open?: boolean; subjectPrefix?: string; kind?: string; limit?: number; cursor?: number }; data: { gates: GateRow[]; cursor: number } };
   "gate:park": { payload: { id: string }; data: { ok: true } };
   "gate:close": { payload: { id: string; reason: "abandoned" | "superseded" | "pruned" }; data: { ok: true } };
-  "gate:subscribe": { payload: { subjectPrefix: string; session: string }; data: { id: string } };
+  "gate:subscribe": { payload: { subjectPrefix: string; session: string; scope?: "owner"; ownerRef?: string }; data: { id: string } };
   "gate:unsubscribe": { payload: { id: string }; data: { removed: boolean } };
   /** The shepherd's gap-recovery liveness check and the observability window
    *  onto delivery outcomes (dead marks included). */
@@ -638,7 +697,7 @@ export interface Commands {
   "herd:status": { payload: { herd: string }; data: HerdStatusData };
   /** Active herds only unless `all`, so a shepherd's "which herd am I on" question has one answer. */
   "herd:list":   { payload: { all?: boolean }; data: { herds: HerdListRow[] } };
-  "herd:close":  { payload: { herd: string; job: string }; data: { job: string; status: "closed" } };
+  "herd:close":  { payload: { herd: string; job: string }; data: { job: string; status: "closed"; /** Advisory: a resumable run can still write into this job's worktree after close, so this warns rather than blocking. */ warning?: string } };
   /** `brief` is the brief TEXT, not a path: the CLI reads the file. It is stored at `<jobsRoot>/<herd>/<job>/job.md`, so a respawn with `dir` and no `brief` reads it back. */
   "herd:spawn":  { payload: { herd: string; job: string; brief?: string; dir?: string; model?: string; effort?: string; account?: string; disposable?: boolean }; data: { herd: string; job: string; pane: string; worktree: string; branch: string | null; tree: string | null; /** null = no provisioning ran (--dir); false = cold create, worth announcing. */ wasOnDeck: boolean | null; agentId: string; sessionId: string; handle: string } };
   "herd:gates":  { payload: { herd: string }; data: { gates: GateRow[] } };
@@ -752,6 +811,8 @@ export const COMMAND_NAMES: readonly CommandName[] = [
   "endpoint:status",
   "repos:locate",
   "freshness:reconcile",
+  "reconciler:status",
+  "reconciler:clear",
   "gate:open",
   "gate:answer",
   "gate:wait",

package/src/index.ts

@@ -45,6 +45,8 @@ export {
   chatInvite,
   paneSend,
   paneFocus,
+  reconcilerStatus,
+  reconcilerClear,
   gateOpen,
   gateAnswer,
   gateWait,
@@ -104,6 +106,9 @@ export type {
   AgentRecord,
   AgentSurface,
   AgentStatus,
+  ExecutorState,
+  ExecutorView,
+  ReconcilerStatus,
   ChatPane,
   PaneAccount,
   PaneDirectory,

package/src/pane-ref.ts

@@ -24,5 +24,10 @@ export function formatPaneRef(paneId: string, server: PaneServer): string {
   if (server === "visible") {
     return paneId;
   }
+  // Idempotent: herdr pane ids (w<N>:p<N>) can never start with "bg:", so an
+  // already-formatted ref passes through unchanged instead of nesting.
+  if (paneId.startsWith(BG_PREFIX)) {
+    return paneId;
+  }
   return BG_PREFIX + paneId;
 }

package/src/settings/registry-defs.ts

@@ -42,7 +42,7 @@ export const REGISTRY: readonly SettingDef[] = [
     merge: "deep",
     repoScoped: true,
     migrated: true,
-    description: "Per-repo worktree pool config (onDeck size, ready steps, name pool); root/branchFormat/ready computed-or-empty in the reader.",
+    description: "Per-repo worktree pool config (onDeck size, ready steps, name pool, staleClaimDays); root/branchFormat/ready computed-or-empty in the reader.",
   },
   {
     key: "rt.worktreeReadyApproval",
@@ -85,7 +85,7 @@ export const REGISTRY: readonly SettingDef[] = [
     scopes: ["user"],
     default: [],
     merge: "replace",
-    description: "Event-bus glob rules that raise a desktop notification: [{pattern, category, title, message, subjectPrefix?, url?}]. pattern is matched against the events-bus topic (Bun.Glob semantics); title/message may interpolate `{field}` from the event payload, plus the computed `{question}` field (the event payload's first question label, `payload.questions[0].label`, empty string when absent); optional subjectPrefix matches the event payload's subject as a prefix. The optional url is interpolated the same way as title/message and becomes the notification's Open target; a gate rule should set it. A fresh key, not an ownership-latch port, so a default is fine here.",
+    description: "Event-bus glob rules that raise a desktop notification: [{pattern, category, title, message, subjectPrefix?, url?, owner?}]. pattern is matched against the events-bus topic (Bun.Glob semantics); title/message may interpolate `{field}` from the event payload, plus the computed `{question}` field (the event payload's first question label, `payload.questions[0].label`, empty string when absent); optional subjectPrefix matches the event payload's subject as a prefix. The optional url is interpolated the same way as title/message and becomes the notification's Open target; a gate rule should set it. The optional owner field (only literal \"human\" is valid) suppresses events whose payload.owner starts with \"herd:\", allowing gate rules to skip herd-owned events. A typical setup pairs a gate/opened rule with owner: \"human\" (human-owned gates notify) and a gate/escalated rule without owner (all escalations notify, whether human or herd). A fresh key, not an ownership-latch port, so a default is fine here.",
   },
   {
     key: "rt.cron",
@@ -295,6 +295,15 @@ export const REGISTRY: readonly SettingDef[] = [
     merge: "replace",
     description: "The machine's intended flavor, \"dev\" or \"prod\". Normally written by `rt settings dev-mode` after a successful handoff; a manual `rt settings set` is the blessed repair escape hatch — the daemon park loop converges on whatever this says. Unset ⇒ derived from the dev wrapper's presence.",
   },
+  {
+    key: "setup.waived",
+    type: "array",
+    scopes: ["machine"],
+    default: [],
+    merge: "replace",
+    description:
+      "Finish-gated setup rows the user skipped on this Mac through `rt setup waive` (today only tool.fast-browser-extension); the wizard's Finish no longer waits on them. Machine-only: a loaded Chrome extension is a per-profile fact and the choice is per machine, so it never travels with a team or user store.",
+  },
   {
     key: "rt.integrations",
     type: "object",
@@ -427,7 +436,7 @@ export const REGISTRY: readonly SettingDef[] = [
     type: "array",
     scopes: ["team"],
     merge: "replace",
-    description: "Board tabs ({id, label, source, slackChannel?, reviewSkill?}), editable from the board's settings modal. source.kind 'authors' is the classic roster board; 'codeowners' lists MRs from any author blocked on an unapproved CODEOWNERS section. Absent = one implicit authors tab (fallback lives in the board reader, never here).",
+    description: "Board tabs ({id, label, source, slackChannel?, reviewSkill?}), editable from the board's settings modal. source.kind 'authors' is the classic roster board; 'codeowners' lists any author's open MRs carrying a CODE_OWNER rule for the section, until merge/close. Absent = one implicit authors tab (fallback lives in the board reader, never here).",
   },
 
   // --- board (user) ----------------------------------------------------------
@@ -687,4 +696,14 @@ export const REGISTRY: readonly SettingDef[] = [
     merge: "replace",
     description: "Opaque extra claude arguments appended to every rt agent launch (escape hatch).",
   },
+
+  // --- gates (escalation) ----------------------------------------------------
+  {
+    key: "rt.gates.escalationTtlMinutes",
+    type: "number",
+    scopes: ["user"],
+    default: 10,
+    merge: "replace",
+    description: "Minutes an open herd-owned gate waits before the escalation sweep surfaces it to the human (topic gate/escalated/<id>). Fires on either trigger: the TTL elapses (reason \"ttl\"), or the owning herd's shepherd subscription is gone or dead before the TTL (reason \"owner-dead\"). 0 escalates any eligible gate on the first sweep after it opens. A fresh key, not an ownership-latch port, so a default is fine here.",
+  },
 ];

package/src/transport.ts

@@ -38,8 +38,13 @@ export interface RtClientOptions {
 // lib/, so this literal cannot import rtDir(). repo-tools/lib/rt-paths.ts is
 // the authority — change there first, mirror here (same convention as
 // settings/paths.ts's call-time `home()`).
+//
+// RT_DAEMON_SOCK wins over the HOME-derived default (same pattern as
+// lib/daemon-client.ts's RT_APP_SOCKET for tray.sock): an isolated daemon
+// (per-agent launch, an e2e run) points every rt-client caller, including
+// the `rt` CLI's own subcommands, at its own socket without repointing HOME.
 function defaultSock(): string {
-  return join(process.env.HOME ?? homedir(), ".mattstack", "rt", "rt.sock");
+  return process.env.RT_DAEMON_SOCK || join(process.env.HOME ?? homedir(), ".mattstack", "rt", "rt.sock");
 }
 
 /**