@nurix/etna 0.19.75 → 0.19.77

package/data/harness-index.json

@@ -1,5 +1,5 @@
 {
-    "fingerprint": "a4e2f407bbc6",
+    "fingerprint": "f747b8cde1b8",
     "harnesses": {
         "code": {
             "plugin": "code",

package/data/harnesses/code/agents/bookkeeper.md

@@ -29,6 +29,7 @@ Ground every edit in this ladder, in order. Never invent content; a fact you can
 
 ## Rules
 
+- **One drain at a time — check the claim board first.** Before touching the queue, read `.claude/state/claims.log` (tab-separated: timestamp · start/end · activity · session id). An open `bookkeeping-drain` claim — a `start` with no later `end` — that is under 20 minutes old and belongs to a session whose registry row (`.claude/state/sessions.tsv`) points at a recently-modified transcript means another drain is mid-flight: stop and report that instead of draining. Otherwise append your own `start` line before the pass and an `end` line after it, so a second bookkeeper can see you and a waiting session can see you finish. A stale claim (older, or holder gone) is yours to note and proceed past.
 - **Never edit frozen records** — committed changelog entries, `Status: Complete|Abandoned` plans, outcome-stamped runbooks. A finding that seems to require one gets a `needs-session:` row instead.
 - **Every touched doc goes through the `documentation` skill's rules** — present tense, two-natures, no history narration in truth documents.
 - **Resolution = deletion.** A finished row is removed from the queue, not annotated. Only `waived:` conversions (a reason plus `expires=YYYY-MM-DD`) and `needs-session:` rows survive your pass.

package/data/harnesses/code/agents/retro.md

@@ -1,6 +1,6 @@
 ---
 name: retro
-description: Session-distillation agent for the changelog. Reads the per-unit-of-work entries under `docs/history/changelog/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), and cross-project harness rules. Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on "run retro", "distill the changelog", "refinement retro", "/retro".
+description: Session-distillation agent for the changelog and the session gate logs. Reads the per-unit-of-work entries under `docs/history/changelog/` and the coordination events in `docs/history/sessions/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), cross-project harness rules, and recurring coordination patterns (contested files, commit contention, stale-claim steals). Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on "run retro", "distill the changelog", "refinement retro", "/retro".
 tools: Read, Glob, Grep, Bash, Write, Edit
 model: opus
 ---
@@ -12,7 +12,7 @@ You distill refinement history into documentation and harness feedback. Your inp
 ## Before starting
 
 1. Read `docs/memory/retro.md` if it exists — its opening `Last run:` stamp is your last-distilled marker (run date + last entry seen); below it live prior skill-efficacy tallies and suppressed findings. No file ⇒ first run ⇒ distill everything. **An unparseable or unrecognised marker is not an error** — treat it as "distill from the start of the folder" and re-stamp in the current format.
-2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Empty set ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
+2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Alongside the entries, scan the session gate logs (`docs/history/sessions/*.md`) dated after the marker for **coordination events** — lines whose kind is `coord` (commit-claim waits and steals, file-claim contacts, skipped queue writes). The log genre promises its failure stream to later intelligence, and you are that reader. Empty set (no entries and no coord events) ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
 3. **Skip entries carrying no field block.** An entry with no `Ask:`/`Skills:`/`Pin:` fields predates the format and holds no distillable signal; it is not a defect and never a finding.
 4. Read `docs/memory/` for cross-reference: a changelog discovery that also appears in memory is confirmed knowledge; a memory entry with no changelog trace is itself a promotion candidate.
 
@@ -25,6 +25,7 @@ Classify every finding into exactly one bucket. Work from the entries — recurr
 3. **Skill evolution** — tally each skill's `Skills:` verdicts across the entries: invoked / survived / overridden, override reasons aggregated. A skill overridden in most of its invocations is a finding. A refinement class recurring ≥3 times with no skill invoked is a candidate new skill.
 4. **Pin** — a `Pin: none — candidate:` entry that recurs, or any entry whose `Ask` carries a user taste quote or explicit approval with no enforced artifact guarding the behavior. Output the exact pin (test, token, guardrail, schema) and where it goes.
 5. **Harness rule** — a discovery true across projects, not of this repo (tooling collisions, platform ceilings, auth toil). Route to the shared rule file it belongs in.
+6. **Coordination** — a `coord` pattern recurring across sessions: one file drawing repeated cross-session contact (candidate ownership split, or a rendezvous artifact wanting a "discover rather than register" refactor), repeated commit-claim contention (sessions batching too much per commit), repeated stale-claim steals or skipped queue writes (a liveness or lock-health defect). A single event is operations, never a finding.
 
 ## Report & record
 

package/data/harnesses/code/codex/agents/bookkeeper.toml

@@ -27,6 +27,7 @@ Ground every edit in this ladder, in order. Never invent content; a fact you can
 
 ## Rules
 
+- **One drain at a time — check the claim board first.** Before touching the queue, read `.claude/state/claims.log` (tab-separated: timestamp · start/end · activity · session id). An open `bookkeeping-drain` claim — a `start` with no later `end` — that is under 20 minutes old and belongs to a session whose registry row (`.claude/state/sessions.tsv`) points at a recently-modified transcript means another drain is mid-flight: stop and report that instead of draining. Otherwise append your own `start` line before the pass and an `end` line after it, so a second bookkeeper can see you and a waiting session can see you finish. A stale claim (older, or holder gone) is yours to note and proceed past.
 - **Never edit frozen records** — committed changelog entries, `Status: Complete|Abandoned` plans, outcome-stamped runbooks. A finding that seems to require one gets a `needs-session:` row instead.
 - **Every touched doc goes through the `documentation` skill's rules** — present tense, two-natures, no history narration in truth documents.
 - **Resolution = deletion.** A finished row is removed from the queue, not annotated. Only `waived:` conversions (a reason plus `expires=YYYY-MM-DD`) and `needs-session:` rows survive your pass.

package/data/harnesses/code/codex/agents/retro.toml

@@ -1,6 +1,6 @@
 # dropped Claude tools: Read, Glob, Grep, Bash, Write, Edit
 name = "retro"
-description = "Session-distillation agent for the changelog. Reads the per-unit-of-work entries under `docs/history/changelog/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), and cross-project harness rules. Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on \"run retro\", \"distill the changelog\", \"refinement retro\", \"/retro\"."
+description = "Session-distillation agent for the changelog and the session gate logs. Reads the per-unit-of-work entries under `docs/history/changelog/` and the coordination events in `docs/history/sessions/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), cross-project harness rules, and recurring coordination patterns (contested files, commit contention, stale-claim steals). Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on \"run retro\", \"distill the changelog\", \"refinement retro\", \"/retro\"."
 developer_instructions = '''
 
 # Retro — changelog distillation
@@ -10,7 +10,7 @@ You distill refinement history into documentation and harness feedback. Your inp
 ## Before starting
 
 1. Read `docs/memory/retro.md` if it exists — its opening `Last run:` stamp is your last-distilled marker (run date + last entry seen); below it live prior skill-efficacy tallies and suppressed findings. No file ⇒ first run ⇒ distill everything. **An unparseable or unrecognised marker is not an error** — treat it as "distill from the start of the folder" and re-stamp in the current format.
-2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Empty set ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
+2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Alongside the entries, scan the session gate logs (`docs/history/sessions/*.md`) dated after the marker for **coordination events** — lines whose kind is `coord` (commit-claim waits and steals, file-claim contacts, skipped queue writes). The log genre promises its failure stream to later intelligence, and you are that reader. Empty set (no entries and no coord events) ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
 3. **Skip entries carrying no field block.** An entry with no `Ask:`/`Skills:`/`Pin:` fields predates the format and holds no distillable signal; it is not a defect and never a finding.
 4. Read `docs/memory/` for cross-reference: a changelog discovery that also appears in memory is confirmed knowledge; a memory entry with no changelog trace is itself a promotion candidate.
 
@@ -23,6 +23,7 @@ Classify every finding into exactly one bucket. Work from the entries — recurr
 3. **Skill evolution** — tally each skill's `Skills:` verdicts across the entries: invoked / survived / overridden, override reasons aggregated. A skill overridden in most of its invocations is a finding. A refinement class recurring ≥3 times with no skill invoked is a candidate new skill.
 4. **Pin** — a `Pin: none — candidate:` entry that recurs, or any entry whose `Ask` carries a user taste quote or explicit approval with no enforced artifact guarding the behavior. Output the exact pin (test, token, guardrail, schema) and where it goes.
 5. **Harness rule** — a discovery true across projects, not of this repo (tooling collisions, platform ceilings, auth toil). Route to the shared rule file it belongs in.
+6. **Coordination** — a `coord` pattern recurring across sessions: one file drawing repeated cross-session contact (candidate ownership split, or a rendezvous artifact wanting a "discover rather than register" refactor), repeated commit-claim contention (sessions batching too much per commit), repeated stale-claim steals or skipped queue writes (a liveness or lock-health defect). A single event is operations, never a finding.
 
 ## Report & record
 

package/data/harnesses/code/harness.json

@@ -1,7 +1,7 @@
 {
   "harness": "code",
   "name": "code",
-  "version": "3.9.6",
+  "version": "3.10.3",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
@@ -15,5 +15,5 @@
     "docs/memory/main.md",
     ".mcp.json"
   ],
-  "digest": "f1da48ec8895"
+  "digest": "950e458df1d7"
 }

package/data/harnesses/code/hooks/awareness.mjs

@@ -32,6 +32,15 @@ import {
 } from "./lib/state.mjs";
 import { frozenStatus } from "./lib/frozen.mjs";
 import { approvedPackages } from "./lib/approved.mjs";
+import {
+  recordSession,
+  liveSiblings,
+  openActivityClaims,
+  recentForeignTouches,
+  releaseActivity,
+  pruneState,
+} from "./lib/claims.mjs";
+import { appendEvent } from "./lib/session-log.mjs";
 
 const today = () => new Date().toISOString().slice(0, 10);
 
@@ -185,15 +194,50 @@ function driftBanner(projectDir) {
   );
 }
 
-function sessionStart(projectDir) {
+function sessionStart(projectDir, payload = {}) {
   // Stamp the session's start so gitless repos still have a "modified since" horizon for the
-  // outcome detector's fallback scan (dirtyPaths). Overwritten per session; best-effort.
+  // outcome detector's fallback scan (dirtyPaths). The legacy shared stamp stays for its reader;
+  // the per-sid twin exists because two concurrent sessions clobber the shared one. Best-effort.
+  const sid = payload.session_id;
+  const stamp = new Date().toISOString() + "\n";
   try {
-    fs.writeFileSync(path.join(stateDir(projectDir), "session-started"), new Date().toISOString() + "\n");
+    fs.writeFileSync(path.join(stateDir(projectDir), "session-started"), stamp);
+    if (sid) {
+      const short = String(sid).replace(/[^a-zA-Z0-9-]/g, "").slice(0, 8);
+      fs.writeFileSync(path.join(stateDir(projectDir), `session-started-${short}`), stamp);
+    }
   } catch (e) {
     /* the stamp is a convenience for the fallback; git repos never need it */
   }
+  // The claim board's registry + eviction: announce this session (liveness reads the transcript's
+  // mtime), and prune state rows past retention — capture with no reader and no expiry is pollution.
+  try {
+    recordSession(projectDir, sid, payload.transcript_path);
+    pruneState(projectDir);
+  } catch (e) {
+    /* presence is a convenience */
+  }
   const lines = [];
+  // Presence, injected instead of excavated: who else is live in this checkout, what they touched
+  // recently, and any open activity claims — the awareness the operator used to carry by hand.
+  try {
+    const siblings = liveSiblings(projectDir, sid);
+    if (siblings.length) {
+      const touches = recentForeignTouches(projectDir, sid);
+      const parts = siblings.map((s) => {
+        const t = touches.find((f) => f.sid === s.sid);
+        const recent = t ? ` — recently: ${t.paths.slice(0, 3).map((p) => p.rel).join(", ")}${t.paths.length > 3 ? " …" : ""}` : "";
+        return `sid=${s.sid8} (active ${s.lastActiveMin}m ago${recent})`;
+      });
+      lines.push(`Concurrency: ${siblings.length} other live session(s) in this checkout · ${parts.join(" · ")} — treat their recent paths as claimed; scope commits with explicit pathspecs.`);
+    }
+    const claims = openActivityClaims(projectDir, sid).filter((c) => !c.mine);
+    if (claims.length) {
+      lines.push(`Open activity claims: ${claims.map((c) => `${c.activity} by sid=${c.sid8} (${c.ageMin}m${c.holderLive ? "" : ", holder gone — will be stolen on next contention"})`).join(" · ")}`);
+    }
+  } catch (e) {
+    /* presence is a convenience */
+  }
   const pm = detectPackageManager(projectDir);
   if (pm) lines.push(`Package manager: ${pm}`);
   const harness = harnessLine(projectDir);
@@ -208,7 +252,7 @@ function sessionStart(projectDir) {
     /* the banner is optional; the index below still injects */
   }
   const block = lines.length
-    ? "# Session context (generated — a convenience, never a gate)\n" + lines.slice(0, 10).join("\n")
+    ? "# Session context (generated — a convenience, never a gate)\n" + lines.slice(0, 12).join("\n")
     : "";
   const index = buildIndex(projectDir);
   const context = [block, index].filter(Boolean).join("\n\n");
@@ -479,6 +523,19 @@ function postToolUse(projectDir, payload) {
   const input = payload.tool_input || {};
   const rows = [];
   if (payload.tool_name === "Bash") {
+    // A completed `git commit` releases the claim compliance took at PreToolUse — the `end` line
+    // is what lets a waiting session verify the actor finished. Root resolution mirrors the
+    // gate's: an explicit `cd` in the command wins, so cross-repo commits release where they claimed.
+    if (/(?:^|&&|;|\|)\s*(?:sudo\s+)?git\s+commit\b/.test(input.command || "")) {
+      const cdMatch = /(?:^|&&|;)\s*cd\s+"?([^"\s;&]+)"?/.exec(input.command || "");
+      const root = cdMatch && path.isAbsolute(cdMatch[1]) && fs.existsSync(cdMatch[1]) ? cdMatch[1] : projectDir;
+      try {
+        releaseActivity(root, "commit", payload.session_id);
+        appendEvent(root, payload.session_id, "coord", "commit-claim", "released");
+      } catch (e) {
+        /* an unreleased claim goes stale in minutes; never fail the detector over it */
+      }
+    }
     detectRenames(projectDir, input.command, meta, rows);
     detectOutcomes(projectDir, meta, rows);
   } else {
@@ -507,7 +564,7 @@ function main() {
   const projectDir = resolveProjectDir(payload);
   const event = payload.hook_event_name || "SessionStart";
   if (event === "PostToolUse") postToolUse(projectDir, payload);
-  else sessionStart(projectDir);
+  else sessionStart(projectDir, payload);
 }
 
 try {

package/data/harnesses/code/hooks/compliance.mjs

@@ -14,6 +14,7 @@ import { frozenStatus } from "./lib/frozen.mjs";
 import { undischargedRows } from "./lib/ledger.mjs";
 import { appendEvent, unresolvedDenials, sessionLogPath, malformedEventLines } from "./lib/session-log.mjs";
 import { approvedPackages } from "./lib/approved.mjs";
+import { claimActivity, releaseActivity, recentForeignTouches } from "./lib/claims.mjs";
 
 function readSafe(file) {
   try {
@@ -119,6 +120,26 @@ function fileGate(projectDir, rel, toolName, sessionId) {
     return deny(projectDir, sessionId, "protected-file", rel, `BLOCKED — protected file. \`${rel}\` is on the protected list.`);
   }
 
+  // The file half of the claim board: a path another LIVE session touched minutes ago belongs to
+  // someone else right now. Advisory by design — one ask per sibling per session, never a wall —
+  // this is the presence protocol ("git status archaeology") moved into the gate that fires anyway.
+  try {
+    const holder = recentForeignTouches(projectDir, sessionId).find((f) => f.paths.some((p) => p.rel === rel));
+    if (holder) {
+      const recent = holder.paths.find((p) => p.rel === rel);
+      appendEvent(projectDir, sessionId, "coord", "file-claim", rel, `touched ${recent.ageMin}m ago by sid=${holder.sid8}`);
+      const asked = askOnce(
+        projectDir,
+        sessionId,
+        `foreign-claim:${holder.sid8}`,
+        `Another live session (sid=${holder.sid8}, active ${holder.lastActiveMin}m ago) touched \`${rel}\` ${recent.ageMin}m ago and may still be working there. Edit anyway? (Asked once per session for that sibling; scope commits with explicit pathspecs either way.)`
+      );
+      if (asked) return asked;
+    }
+  } catch (e) {
+    /* presence is a convenience — never let it block an edit on failure */
+  }
+
   const inDocs = rel.startsWith("docs/") || rel.startsWith(".claude/") || rel.endsWith(".md");
   if (!inDocs && SOURCE_LIKE.test(rel)) {
     for (const plan of openGatedPlans(projectDir)) {
@@ -312,7 +333,28 @@ function bashGate(projectDir, command, sessionId) {
   if (!command) return null;
 
   if (statement(String.raw`git\s+commit\b`).test(command)) {
-    return commitGate(projectDir, sessionId);
+    // The claim board serializes the commit sequence: disjoint files do not make disjoint
+    // commits — every session writes the same branch through the same index, so one committer
+    // at a time. A held claim is a plain wait (no denied/resolved pair to resolve — the retry
+    // clears it); a stale claim (holder dead or past TTL) is stolen loudly on the record.
+    const claim = claimActivity(projectDir, "commit", sessionId);
+    if (claim.held) {
+      appendEvent(projectDir, sessionId, "coord", "commit-claim", `waited — held by sid=${claim.held.sid8}`, `${claim.held.ageMin}m old`);
+      return decision(
+        "deny",
+        `WAIT — another session (sid=${claim.held.sid8}, claimed ${claim.held.ageMin}m ago) is mid-commit in this checkout. Re-run the commit in a moment; its completion (or staleness) releases the claim automatically. Do not delete .git/index.lock.`
+      );
+    }
+    if (claim.stole) {
+      appendEvent(projectDir, sessionId, "coord", "commit-claim", `stale claim by sid=${claim.stole.sid8} evicted`);
+    }
+    const gate = commitGate(projectDir, sessionId);
+    if (gate) {
+      // The commit is not happening — release immediately so a walled commit never holds the board.
+      releaseActivity(projectDir, "commit", sessionId);
+      return gate;
+    }
+    return null; // allowed — the awareness PostToolUse releases the claim when the command completes
   }
 
   // `git branch <name>` creates; flag-led forms (--show-current, --list, -d, -vv) query or manage

package/data/harnesses/code/hooks/lib/approved.mjs

@@ -13,6 +13,29 @@ function readSafe(file) {
   }
 }
 
+// A rule names its rejected alternatives in backticks — instruction-style § Negative space requires
+// it — so harvesting every backticked token adds the ban list to the approved set. Two shapes carry
+// a ban: a framework table's "Don't use" column, and the text after a bolded **never** or ❌.
+// A bare "never" does not count: "never against a hand-started dev server (Workers:
+// `@cloudflare/vitest-pool-workers`)" names the prescribed package, not a forbidden one.
+function approvedPart(line, banColumn) {
+  if (line.trimStart().startsWith("|")) {
+    if (banColumn < 0) return line;
+    const cells = line.split("|");
+    return cells.filter((_, i) => i !== banColumn).join("|");
+  }
+  const ban = line.search(/\*\*never\*\*|❌/i);
+  return ban === -1 ? line : line.slice(0, ban);
+}
+
+// The "Don't use" column index, held for the rows of the table that declared it.
+function banColumnOf(line, current) {
+  if (!line.trimStart().startsWith("|")) return -1;
+  const cells = line.split("|");
+  const header = cells.findIndex((c) => /don'?t use|never use/i.test(c));
+  return header === -1 ? current : header;
+}
+
 // Package names approved in .claude/hooks/approved-packages.md (plus testing.md frameworks and
 // general.md). Empty set ⇒ no rules installed ⇒ nothing to enforce.
 export function approvedPackages(projectDir) {
@@ -23,8 +46,13 @@ export function approvedPackages(projectDir) {
     path.join(projectDir, ".claude", "rules", "testing.md"),
   ];
   for (const src of sources) {
-    const text = readSafe(src);
-    for (const m of text.matchAll(/`(@?[a-z0-9][\w./-]*)`/g)) names.add(m[1]);
+    let banColumn = -1;
+    for (const line of readSafe(src).split("\n")) {
+      banColumn = banColumnOf(line, banColumn);
+      for (const m of approvedPart(line, banColumn).matchAll(/`(@?[a-z0-9][\w./-]*)`/g)) {
+        names.add(m[1]);
+      }
+    }
   }
   return names;
 }

package/data/harnesses/code/hooks/lib/claims.mjs

@@ -0,0 +1,203 @@
+// harness/code/hooks/lib/claims.mjs — the claim board: cross-session coordination through
+// machine-local state (.claude/state/), never through conversation. Two surfaces, per the
+// operator's design: an ACTIVITY log (claims.log — serialized activities like `commit`: an agent
+// records sid + start before acting, others read first and wait, completion is an `end` line so a
+// waiter can verify the actor finished) and a FILE log (touched.tsv, which already records
+// ts · path · docs · sid per edit — presence over files is *derived* from its recent rows rather
+// than registered separately, so the file half cannot drift from reality). Liveness is read from
+// the session registry (sessions.tsv): a session is live while its transcript file is recently
+// modified — no PIDs, no daemons. A stale claim (holder dead or past TTL) is stolen loudly, never
+// waited on forever: agents die mid-task as the normal case, so every claim is a lease.
+
+import fs from "node:fs";
+import path from "node:path";
+import { stateDir, withFileLock, atomicWrite } from "./state.mjs";
+
+const LIVE_WINDOW_MIN = 30; // transcript modified within this window ⇒ the session is live
+const CLAIM_TTL_MIN = 20; // an activity claim older than this is stale even if the holder lives
+const RETENTION_DAYS = 14; // registry + touched.tsv rows older than this are pruned
+
+function sid8(sessionId) {
+  return String(sessionId || "unknown").replace(/[^a-zA-Z0-9-]/g, "").slice(0, 8) || "unknown";
+}
+
+function minutesSince(iso) {
+  const t = Date.parse(iso);
+  return Number.isFinite(t) ? (Date.now() - t) / 60000 : Infinity;
+}
+
+function claimsFile(projectDir) {
+  return path.join(stateDir(projectDir), "claims.log");
+}
+
+function sessionsFile(projectDir) {
+  return path.join(stateDir(projectDir), "sessions.tsv");
+}
+
+// Record this session in the registry (idempotent per sid — the latest row wins on read).
+export function recordSession(projectDir, sessionId, transcriptPath) {
+  if (!sessionId) return;
+  const line = `${new Date().toISOString()}\t${sessionId}\t${transcriptPath || "-"}\n`;
+  fs.appendFileSync(sessionsFile(projectDir), line);
+}
+
+// Sessions other than `sessionId` whose transcript was modified inside the live window.
+// The transcript is the liveness signal: it grows on every event, needs no PID, and survives
+// the hook process (which is itself transient).
+export function liveSiblings(projectDir, sessionId) {
+  let text = "";
+  try {
+    text = fs.readFileSync(sessionsFile(projectDir), "utf8");
+  } catch (e) {
+    return [];
+  }
+  const latest = new Map(); // sid → { started, transcript }
+  for (const line of text.split("\n")) {
+    const [ts, sid, transcript] = line.split("\t");
+    if (ts && sid) latest.set(sid, { started: ts, transcript });
+  }
+  const out = [];
+  for (const [sid, rec] of latest) {
+    if (sid === sessionId) continue;
+    let ageMin = Infinity;
+    try {
+      ageMin = (Date.now() - fs.statSync(rec.transcript).mtimeMs) / 60000;
+    } catch (e) {
+      continue; // transcript gone — not live
+    }
+    if (ageMin <= LIVE_WINDOW_MIN) out.push({ sid, sid8: sid8(sid), lastActiveMin: Math.round(ageMin) });
+  }
+  return out;
+}
+
+function parseClaims(projectDir) {
+  let text = "";
+  try {
+    text = fs.readFileSync(claimsFile(projectDir), "utf8");
+  } catch (e) {
+    return new Map();
+  }
+  const open = new Map(); // activity → { sid, since }
+  for (const line of text.split("\n")) {
+    const [ts, event, activity, sid] = line.split("\t");
+    if (!ts || !activity) continue;
+    if (event === "start") open.set(activity, { sid, since: ts });
+    else if (event === "end") open.delete(activity);
+  }
+  return open;
+}
+
+// Open activity claims, annotated with age and holder liveness — for the presence banner.
+export function openActivityClaims(projectDir, sessionId) {
+  const live = new Set(liveSiblings(projectDir, "").map((s) => s.sid));
+  const out = [];
+  for (const [activity, rec] of parseClaims(projectDir)) {
+    out.push({
+      activity,
+      sid: rec.sid,
+      sid8: sid8(rec.sid),
+      ageMin: Math.round(minutesSince(rec.since)),
+      mine: rec.sid === sessionId,
+      holderLive: live.has(rec.sid) || rec.sid === sessionId,
+    });
+  }
+  return out;
+}
+
+// Claim an activity for this session. Returns { ok } on success (with `stole` when a stale
+// claim was evicted), or { held: { sid8, ageMin } } when another live session holds it fresh.
+// The read-check-append runs under the claims lock so two claimants cannot both see "free".
+export function claimActivity(projectDir, activity, sessionId) {
+  const lock = path.join(stateDir(projectDir), "claims.lock");
+  const res = withFileLock(lock, () => {
+    const open = parseClaims(projectDir);
+    const current = open.get(activity);
+    if (current && current.sid !== sessionId) {
+      const ageMin = minutesSince(current.since);
+      const holderLive = liveSiblings(projectDir, sessionId).some((s) => s.sid === current.sid);
+      if (ageMin <= CLAIM_TTL_MIN && holderLive) {
+        return { held: { sid8: sid8(current.sid), ageMin: Math.round(ageMin) } };
+      }
+      // Stale: holder dead or past TTL — evict loudly and take over.
+      fs.appendFileSync(
+        claimsFile(projectDir),
+        `${new Date().toISOString()}\tend\t${activity}\t${current.sid}\tstale-steal by ${sid8(sessionId)}\n`
+      );
+    }
+    if (!current || current.sid !== sessionId) {
+      fs.appendFileSync(claimsFile(projectDir), `${new Date().toISOString()}\tstart\t${activity}\t${sessionId}\t-\n`);
+    }
+    return {
+      ok: true,
+      stole: current && current.sid !== sessionId ? { sid8: sid8(current.sid) } : null,
+    };
+  });
+  // Lock unavailable: fail open — the claim board is a convenience, never a wall on its own.
+  return res.ok ? res.result : { ok: true, unlocked: true };
+}
+
+// Mark this session's claim on an activity complete (the `end` line a waiter reads).
+export function releaseActivity(projectDir, activity, sessionId) {
+  const lock = path.join(stateDir(projectDir), "claims.lock");
+  withFileLock(lock, () => {
+    const current = parseClaims(projectDir).get(activity);
+    if (current && current.sid === sessionId) {
+      fs.appendFileSync(claimsFile(projectDir), `${new Date().toISOString()}\tend\t${activity}\t${sessionId}\t-\n`);
+    }
+    return true;
+  });
+}
+
+// The file half of the board, derived: paths other LIVE sessions touched inside the window,
+// grouped per sibling — the mechanization of "someone else is working there right now".
+export function recentForeignTouches(projectDir, sessionId, windowMin = 45) {
+  let text = "";
+  try {
+    text = fs.readFileSync(path.join(projectDir, ".claude", "state", "touched.tsv"), "utf8");
+  } catch (e) {
+    return [];
+  }
+  const live = new Map(liveSiblings(projectDir, sessionId).map((s) => [s.sid, s]));
+  const bySid = new Map(); // sid → { paths: Map(path → lastMin) }
+  for (const line of text.split("\n")) {
+    const [ts, rel, , sid] = line.split("\t");
+    if (!ts || !rel || !sid || sid === sessionId || !live.has(sid)) continue;
+    const ageMin = minutesSince(ts);
+    if (ageMin > windowMin) continue;
+    if (!bySid.has(sid)) bySid.set(sid, new Map());
+    const paths = bySid.get(sid);
+    paths.set(rel, Math.min(paths.get(rel) ?? Infinity, ageMin));
+  }
+  return [...bySid.entries()].map(([sid, paths]) => ({
+    sid,
+    sid8: sid8(sid),
+    lastActiveMin: live.get(sid).lastActiveMin,
+    paths: [...paths.entries()]
+      .sort((a, b) => a[1] - b[1])
+      .map(([rel, ageMin]) => ({ rel, ageMin: Math.round(ageMin) })),
+  }));
+}
+
+// Evict rows past retention from touched.tsv and sessions.tsv — the capture doctrine's eviction
+// half: both files have named readers (the sid-scoped gates, the presence banner) that only read
+// recent rows, so older rows are pollution. Claims.log stays whole inside retention too.
+export function pruneState(projectDir) {
+  const cutoff = Date.now() - RETENTION_DAYS * 86400000;
+  for (const name of ["touched.tsv", "sessions.tsv", "claims.log"]) {
+    const file = path.join(stateDir(projectDir), name);
+    let text;
+    try {
+      text = fs.readFileSync(file, "utf8");
+    } catch (e) {
+      continue;
+    }
+    const kept = text.split("\n").filter((line) => {
+      const ts = Date.parse(line.split("\t")[0]);
+      return !Number.isFinite(ts) ? false : ts >= cutoff;
+    });
+    const next = kept.join("\n") + (kept.length ? "\n" : "");
+    if (next !== text) {
+      withFileLock(path.join(stateDir(projectDir), "claims.lock"), () => atomicWrite(file, next));
+    }
+  }
+}

package/data/harnesses/code/hooks/lib/state.mjs

@@ -21,6 +21,74 @@ export function queueFile(projectDir) {
   return path.join(projectDir, ...QUEUE_PATH);
 }
 
+// --- The write cell -------------------------------------------------------
+// Every queue mutation is a whole-file read-modify-write, and the queue is shared by every
+// session's hooks in this checkout — measured under two concurrent writers, the bare
+// readFileSync→writeFileSync path silently loses rows and can tear-wipe the file (a concurrent
+// reader catches a truncated file mid-write and writes the fragment back). The cell closes both:
+// mutual exclusion via a create-exclusive lockfile (stale-evicted by age — the holder is a
+// transient hook process, so age is the only honest liveness signal), and torn-read immunity via
+// temp-file + atomic rename. On lock timeout the caller SKIPS its write and records that it did
+// (fail open: a coordination guard must never become an outage; auto: rows are recomputable).
+
+const SLEEP_BUF = new Int32Array(new SharedArrayBuffer(4));
+
+function sleepMs(ms) {
+  Atomics.wait(SLEEP_BUF, 0, 0, ms);
+}
+
+// Run fn while holding the lockfile. Returns { ok: true, result } or { ok: false } on timeout.
+export function withFileLock(lockPath, fn, { retries = 40, delayMs = 25, staleMs = 10000 } = {}) {
+  for (let i = 0; i < retries; i++) {
+    let fd = null;
+    try {
+      fd = fs.openSync(lockPath, "wx");
+    } catch (e) {
+      try {
+        if (Date.now() - fs.statSync(lockPath).mtimeMs > staleMs) fs.unlinkSync(lockPath);
+      } catch (e2) {
+        /* raced another evictor or already gone — retry */
+      }
+      sleepMs(delayMs);
+      continue;
+    }
+    try {
+      return { ok: true, result: fn() };
+    } finally {
+      try {
+        fs.closeSync(fd);
+        fs.unlinkSync(lockPath);
+      } catch (e) {
+        /* already evicted as stale — nothing to release */
+      }
+    }
+  }
+  return { ok: false };
+}
+
+// Write via temp-file + rename so no reader ever sees a truncated file.
+export function atomicWrite(file, text) {
+  const tmp = path.join(path.dirname(file), `.${path.basename(file)}.tmp-${process.pid}`);
+  fs.writeFileSync(tmp, text);
+  fs.renameSync(tmp, file);
+}
+
+function queueLock(projectDir) {
+  return path.join(stateDir(projectDir), "bookkeeping.lock");
+}
+
+// A skipped write is a coordination outcome — record it where the next SessionStart looks.
+function recordSkippedWrite(projectDir, what) {
+  try {
+    fs.appendFileSync(
+      path.join(stateDir(projectDir), "hook-failures.log"),
+      `${new Date().toISOString()} state.mjs lock-timeout: skipped ${what}\n`
+    );
+  } catch (e) {
+    /* nowhere to write — fail open stays absolute */
+  }
+}
+
 const ROW_RE = /^-\s+(auto|note|needs-session|waived):\s+(.*)$/;
 
 // Parse the queue text into rows: { kind, date, body, raw }. Non-row lines are ignored.
@@ -72,48 +140,65 @@ export function formatNeedsSessionRow({ date, description, refs }) {
 
 // Append rows to the queue, creating the file with its genre header when absent.
 // Dedupes on the row text before the `| sid=` tail, so a re-fired detector never stacks duplicates.
+// Runs inside the write cell; a healed header covers the one wipe residue a torn write can leave
+// (file present, header gone — recreation used to trigger only on file-absent).
 export function appendRows(projectDir, rowLines) {
   if (!rowLines || rowLines.length === 0) return 0;
   const file = queueFile(projectDir);
-  let text = "";
-  try {
-    text = fs.readFileSync(file, "utf8");
-  } catch (e) {
-    fs.mkdirSync(path.dirname(file), { recursive: true });
-    text = QUEUE_HEADER + "\n";
+  const res = withFileLock(queueLock(projectDir), () => {
+    let text = "";
+    try {
+      text = fs.readFileSync(file, "utf8");
+    } catch (e) {
+      fs.mkdirSync(path.dirname(file), { recursive: true });
+      text = QUEUE_HEADER + "\n";
+    }
+    if (!text.startsWith("# Bookkeeping")) text = QUEUE_HEADER + "\n" + text;
+    const key = (line) => line.split("| sid=")[0].trim();
+    const existing = new Set(parseQueue(text).map((r) => key(r.raw)));
+    const fresh = rowLines.filter((line) => !existing.has(key(line)));
+    if (fresh.length === 0) return 0;
+    if (!text.endsWith("\n")) text += "\n";
+    atomicWrite(file, text + fresh.join("\n") + "\n");
+    return fresh.length;
+  });
+  if (!res.ok) {
+    recordSkippedWrite(projectDir, `append of ${rowLines.length} queue row(s)`);
+    return 0;
   }
-  const key = (line) => line.split("| sid=")[0].trim();
-  const existing = new Set(parseQueue(text).map((r) => key(r.raw)));
-  const fresh = rowLines.filter((line) => !existing.has(key(line)));
-  if (fresh.length === 0) return 0;
-  if (!text.endsWith("\n")) text += "\n";
-  fs.writeFileSync(file, text + fresh.join("\n") + "\n");
-  return fresh.length;
+  return res.result;
 }
 
 // Delete queue rows matching the predicate (used by the detector to auto-resolve
 // rows whose finding the session has since addressed). Returns the count removed.
 export function resolveRows(projectDir, predicate) {
   const file = queueFile(projectDir);
-  let text;
-  try {
-    text = fs.readFileSync(file, "utf8");
-  } catch (e) {
-    return 0;
-  }
-  let removed = 0;
-  const kept = text.split(/\r?\n/).filter((line) => {
-    const m = ROW_RE.exec(line.trim());
-    if (!m) return true;
-    const row = { kind: m[1], body: m[2].trim(), raw: line };
-    if (predicate(row)) {
-      removed += 1;
-      return false;
+  const res = withFileLock(queueLock(projectDir), () => {
+    let text;
+    try {
+      text = fs.readFileSync(file, "utf8");
+    } catch (e) {
+      return 0;
     }
-    return true;
+    let removed = 0;
+    const kept = text.split(/\r?\n/).filter((line) => {
+      const m = ROW_RE.exec(line.trim());
+      if (!m) return true;
+      const row = { kind: m[1], body: m[2].trim(), raw: line };
+      if (predicate(row)) {
+        removed += 1;
+        return false;
+      }
+      return true;
+    });
+    if (removed > 0) atomicWrite(file, kept.join("\n"));
+    return removed;
   });
-  if (removed > 0) fs.writeFileSync(file, kept.join("\n"));
-  return removed;
+  if (!res.ok) {
+    recordSkippedWrite(projectDir, "resolve pass");
+    return 0;
+  }
+  return res.result;
 }
 
 // Unexpired waived rows for a finding kind (the dead-glob allowlist CI honors).

package/data/harnesses/code/rules/changelog.md

@@ -10,8 +10,6 @@ Every unit of work leaves one record — `docs/history/changelog/YYYY-MM-DD-{thr
 | The user asks for a changelog | The entry for the work in hand. No commit required |
 | A commit is made | Every non-exempt commit is covered by an entry — the `commit` skill writes or completes it (no `commit` skill in the runtime ⇒ write the entry from the `documentation` skill's `templates/changelog-entry.md` and stage it with the commit) |
 
-An entry is owed only by work that changes promised behavior or takes a design decision; mechanical and cosmetic commits — a typo, a copy tweak, a config value, a log line — take only their `docs/history/CHANGELOG.md` row, no entry file. The failure fields (`Ask:`, `Skills:`, `Pin:`) are required only when non-none.
-
 Route the lesson by who pays for losing it: product context — what changed and why — belongs in the entry; anything the **next session would re-pay** — a library's API drifted from what the model expects, a validator's quirk, a tooling workaround — goes to `docs/memory/main.md` as well, because a changelog is read by people tracing history and memory is read by every session before it repeats the mistake.
 
 ## Lifecycle

package/data/harnesses/code/rules/cloudflare.md

@@ -6,30 +6,37 @@ Conventions for Cloudflare Workers — `wrangler.jsonc` setup, vars and secrets,
 
 ### 1.1 Wrangler version
 
-- Use Wrangler **v4** — v3's bundled config schema is missing newer keys (e.g. `secrets_store_secrets`), so editors flag valid config as invalid.
-- **No `package.json`** (dep-free worker): use `npx wrangler@4` in every command and doc — the `@4` is the pin. Don't create a `package.json` just to record it.
+- Use Wrangler **v4**. If an editor flags valid config as invalid, check the wrangler version first.
+- **No `package.json`** (dep-free worker): use `npx wrangler@4` in every command and doc. Never create a `package.json` just to record the version.
 - **`package.json` exists**: pin wrangler to the exact version tested against (not `^4.0.0`), reinstall, and verify with `wrangler deploy --dry-run` before pushing.
 
 ### 1.2 Config format
 
 - Use `wrangler.jsonc` (not `wrangler.toml`).
-- Include `"$schema": "node_modules/wrangler/config-schema.json"` so the editor validates against the exact installed wrangler version.
+- Include `"$schema": "node_modules/wrangler/config-schema.json"`.
 
 ### 1.3 Comments in jsonc
 
 None by default. Keep a comment only when it captures a non-obvious **WHY** — a hidden constraint, workaround, or account-specific quirk. Never narrate what a key already says.
 
-### 1.4 workers.dev URLs
+### 1.4 Public entry points — workers.dev & preview URLs
 
-- **Don't expose on `workers.dev` by default** — it is a public, guessable, internet-facing domain (`<worker>.<account>.workers.dev`), indexed and reachable by anyone the moment the Worker deploys. Default to `"workers_dev": false`; when a deploy is requested and no custom domain or route exists yet, warn the user that enabling `workers.dev` makes the Worker public, and enable it only if they confirm they want that.
-- Set `"workers_dev": false` once a custom domain is wired up, so the custom domain is the only entry point.
-- Pair with a `routes` entry using `custom_domain: true` so Cloudflare manages the DNS record and cert.
+- **Don't expose on `workers.dev` by default** — it is public and guessable (`<worker>.<account>.workers.dev`). Default to `"workers_dev": false`; when a deploy is requested and no custom domain or route exists yet, warn the user that enabling it makes the Worker public and enable it only on confirmation.
+- **`preview_urls` is a second public door** (`<version>-<worker>.<account>.workers.dev`) — `workers_dev` alone is not the whole switch. Set `"preview_urls": false` with it.
+- Pair a custom domain with a `routes` entry using `custom_domain: true`. **The zone must be in the same account as the Worker** — a route pointing at a zone the account doesn't hold fails at deploy, so check the zone before writing the route.
+- **Declare both keys explicitly, in the same edit that adds the route** — never leave them to the implicit default, and never delete them as redundant once a route exists.
 
-### 1.5 Observability
+> **Adding a route cuts over atomically — you cannot stage it.** The moment a `routes` entry lands, an absent `workers_dev` key disables `workers.dev` on that same deploy; "add the route now, turn it off once the custom domain answers" is not a sequence wrangler will execute. Where the certificate is slow to provision, that gap is downtime — confirm the outage window with the user before cutting over.
 
-Default block for every Worker:
+Deleting a route is likewise a cutover: `workers.dev` does not return until `"workers_dev": true` is set explicitly, and a torn-down hostname `404`s rather than redirecting — callers holding the old URL get no forwarding.
+
+### 1.5 Default config
+
+Every Worker carries these keys. Deviate only where a rule below says to.
 
 ```jsonc
+"workers_dev": false,
+"preview_urls": false,
 "observability": {
     "logs": {
         "enabled": false,
@@ -38,14 +45,15 @@ Default block for every Worker:
 }
 ```
 
-`enabled: false` avoids per-log billing; `invocation_logs: true` keeps the cheap per-request audit trail. **Bootstrap override:** a new Worker (especially cron-only) runs with `enabled: true` until a few real runs look clean — with logs off, `console.log` is visible only live via `npx wrangler tail` and nothing persists after a failed run. Flip back once stable.
+- `workers_dev` / `preview_urls` — entry-point policy and cutover mechanics: §1.4.
+- **Bootstrap override:** a new Worker (especially cron-only) runs `logs.enabled: true` until a few real runs look clean, then flips back — with logs off, `console.log` is live-only via `npx wrangler tail` and nothing persists after a failed run.
 
 ### 1.6 Project structure & dependencies
 
 - Main entry file: `index.ts`. Reusable helpers: `helper.ts`.
-- TypeScript under `strict: true` — wrangler bundles it natively, no separate build step; a minimal `tsconfig.json` ships even in dep-free Workers.
+- TypeScript under `strict: true` — no build step, and a minimal `tsconfig.json` ships even in dep-free Workers.
 - Don't run `npm run build` or `npm run deploy` in examples.
-- **`package.json` / `package-lock.json` are opt-in, not default.** Create them only when code under `src/` imports an npm package at runtime — a Worker on built-in Web/Workers APIs alone needs no manifest; run wrangler, linters, and one-offs via `npx <tool>`. Add both files the moment the first real dep lands. `node_modules/` stays in `.gitignore` either way.
+- **`package.json` / `package-lock.json` are opt-in.** Create them only when code under `src/` imports an npm package at runtime; add both the moment the first real dep lands. Run wrangler, linters, and one-offs via `npx <tool>`. `node_modules/` stays in `.gitignore` either way.
 
 ### 1.7 Environment & configuration
 
@@ -68,15 +76,15 @@ Access in code: `await env.CLICKUP_KEY.get()`.
 
 - Repo/dir: `cf-<name>` (e.g. `cf-extract-design`).
 - Worker name: `<name>` — repo name minus the `cf-` prefix.
-- R2 bucket, D1 database, and KV namespace names: equal to the worker name. One name, one resource set.
+- R2 bucket, D1 database, and KV namespace names: equal to the worker name.
 
 ### 1.10 Vars & secrets
 
-**Non-secret vars live in the `vars` block in `wrangler.jsonc`** — checked in, one source of truth. Vars are configuration, not runtime state; do not move them to the dashboard. A single-tenant application Worker (one deployment — e.g. Apollo) declares them at the top level; a multi-tenant Worker declares per-tenant vars under each `env.<tenant>` block (§11).
+**Non-secret vars live in the `vars` block in `wrangler.jsonc`**, checked in. Never move them to the dashboard. A single-tenant application Worker declares them at the top level; a multi-tenant Worker declares per-tenant vars under each `env.<tenant>` block (§11).
 
 **Secrets never touch git.** Local dev: a gitignored `.dev.vars` (`KEY=VALUE` dotenv, auto-loaded by `wrangler dev`) with a committed `.dev.vars.example` listing the keys and placeholder values. Production: `wrangler secret put <NAME>`, a gitignored `.secrets` file pushed with `wrangler secret bulk .secrets` (or shipped with a deploy via `wrangler deploy --secrets-file .secrets`), or the Secrets Store (§1.8). Never log or echo a secret value.
 
-**No `keep_vars`.** Leave it unset (default `false`) — each deploy reconciles vars to exactly what the config declares. `keep_vars` only guards plaintext vars set out-of-band in the dashboard; it never touches secrets — `wrangler secret put` secrets survive every deploy regardless. Only the multi-tenant pattern sets `keep_vars: true` (§11).
+**No `keep_vars`** — leave it unset. It guards only plaintext vars set out-of-band in the dashboard and never touches secrets; `wrangler secret put` secrets survive every deploy regardless, so never add it to protect them. Only the multi-tenant pattern sets `keep_vars: true` (§11).
 
 **Never name a deployed-value file `.env` or `.env.<anything>`** — `wrangler dev` auto-loads a root `.env` as local dev vars, so a prod-valued `.env` silently becomes the local environment on a fresh clone or in CI. Committed `*.example` files carry keys with placeholder values only.
 
@@ -84,11 +92,11 @@ Access in code: `await env.CLICKUP_KEY.get()`.
 
 ### 1.11 Deploys
 
-**Never auto-deploy.** `wrangler deploy` (any variant — `--env`, `versions upload`, etc.) runs only when the user explicitly asks for a deploy. Building, dry-running (`wrangler deploy --dry-run`), and local dev (`wrangler dev`) are fine unprompted; pushing to Cloudflare is not — finish the change, then tell the user it's ready to deploy.
+**Never auto-deploy.** `wrangler deploy` (any variant — `--env`, `versions upload`) runs only when the user explicitly asks. Building, dry-running (`wrangler deploy --dry-run`), and `wrangler dev` are fine unprompted. Finish the change, then tell the user it's ready to deploy.
 
 ## 2. Code & Helpers
 
-- Use `generateUuidV7()` in `helper.ts` for IDs (time-sortable UUIDv7).
+- Use `generateUuidV7()` in `helper.ts` for IDs.
 - Only `await` what's needed (e.g. `request.json()`, `do.fetch(...)`).
 
 ## 3. fetch() Structure
@@ -160,13 +168,13 @@ Follows the shared database naming and column-type vocabulary; what earns a tabl
 
 ## 11. Multi-tenant Workers (native environments)
 
-Rare — only when **one Worker codebase ships as several independent tenants** (separate Workers, domains, and data stores from a single `src/`, e.g. `~/dev/auth` → `auth-nuplay`, `auth-nustack`). Use **native wrangler environments**, never one Worker that switches tenant at runtime. For a single-tenant application Worker, §1.10 applies and this section does not.
+Rare — only when **one Worker codebase ships as several independent tenants**: separate Workers, domains, and data stores from a single `src/`. Use **native wrangler environments**, never one Worker that switches tenant at runtime. For a single-tenant application Worker, §1.10 applies and this section does not.
 
 - **One config, `env.<tenant>` blocks.** The top-level block is **local dev** (`wrangler dev`): a `*-dev` name and placeholder D1/KV ids, simulated locally. Each `env.<tenant>` block is **one production tenant**; deploy it with `wrangler deploy --env <tenant>`.
 - **Named environments never inherit** `vars` / `d1_databases` / `kv_namespaces` / `routes` / `secrets_store_secrets` / `assets` from the top level — **each `env.<tenant>` declares them in full**. Dropping a binding from an env block disables that capability for that one tenant.
-- **Per-tenant non-secret vars live in `env.<tenant>.vars`** — still checked in; one file holds every tenant's config side by side.
+- **Per-tenant non-secret vars live in `env.<tenant>.vars`**, checked in.
 - **Local-dev vars** come from a gitignored `.vars.local`, injected as `--var` by the dev script (the top-level block carries no in-config `vars`).
 - **Per-tenant secrets, never in git** — `wrangler secret put <NAME> --env <tenant>`, or a gitignored per-tenant `.secrets` (e.g. `worker/tenants/<tenant>/.secrets`) pushed with `wrangler secret bulk --env <tenant>`, plus a committed `.secrets.example`. Secrets Store bindings are declared inside each env block.
 - **`keep_vars: true`** (top level) keeps a per-tenant deploy **additive**: tenants inject their non-secret vars via `--var` (or the dashboard), and without it a deploy would wipe them. On secrets it changes nothing (§1.10).
 
-`.gitignore`: `.vars.local`, `.secrets`, `.secrets.*`, `.env`, `.env.*`
+`.gitignore`: §1.10's list, with `.vars.local` in place of `.dev.vars`.

package/data/harnesses/code/rules/frontend.md

@@ -25,6 +25,6 @@ Every package compiles under `strict: true` and `noUncheckedIndexedAccess: true`
 
 Shared libraries (`@nurix/components`, etc.) are generic on purpose — that's what types `cell(row)`, checks `slug` against `keyof TData`, and ties `data`/`columns` together; **never** widen to `any` to dodge it. State the row type **once per file** and let inference carry it — repeating `fn<Type>(…)` / `<Comp<Type>>` per call site is cosmetic (same safety, same emitted JS):
 
-- **Bind a repeated factory once** (preferred): `const col = defineColumn<BriefRow>;` → `col({...})`. Canonical: `modules/briefs/BriefsListPage.tsx`.
-- **Infer JSX type args from props:** `<Table data={rows} columns={columns} />`, not `<Table<BriefRow> …>`.
-- **Anchor with a collection annotation** when nothing else can: `const columns: ColumnDefinition<BriefRow>[] = [...]`.
+- **Bind a repeated factory once** (preferred): `const col = defineColumn<Row>;` → `col({...})`.
+- **Infer JSX type args from props:** `<Table data={rows} columns={columns} />`, not `<Table<Row> …>`.
+- **Anchor with a collection annotation** when nothing else can: `const columns: ColumnDefinition<Row>[] = [...]`.

package/data/harnesses/code/rules/general.md

@@ -4,13 +4,13 @@ Runtime versions, package policy, the API response envelope, and GitHub Actions
 
 ## Runtime Versions
 
-- **Node.js:** the version pinned in `.nvmrc` / `package.json` `engines` — **never** a hardcoded number, **never** the runner's default. Workflows use `node-version-file: .nvmrc`.
+- **Node.js:** the version pinned in `.nvmrc` / `package.json` `engines` — never a hardcoded number anywhere.
 - **Package manager:** detect from the lockfile — **never** hardcode one.
 - **PostgreSQL:** 17 · **Redis:** 7.x (latest)
 
 ## Packages
 
-**Only packages in the approved table** — `.claude/hooks/approved-packages.md`, enforced by the PreToolUse install gate, which names the file on a block. The table changes only by explicit user decision. Test packages install at `latest`; fake data comes from `@ngneat/falso` — **never** `@faker-js/faker` / `chance`.
+**Only packages in the approved table** — `.claude/hooks/approved-packages.md`, enforced by the PreToolUse install gate, which names the file on a block. The table changes only by explicit user decision.
 
 ## API Response Envelope
 
@@ -37,4 +37,4 @@ Pin the major, and check it against the action's releases — a major behind sti
 | `actions/checkout` | v7 | Repo checkout |
 | `actions/setup-node` | v7 | Node toolchain + npm cache |
 
-Set `node-version` via `node-version-file: .nvmrc`, **never** a hardcoded number and **never** the runner's default.
+Set `node-version` via `node-version-file: .nvmrc`, **never** the runner's default.

package/data/harnesses/delivery/agents/retro.md

@@ -1,6 +1,6 @@
 ---
 name: retro
-description: Session-distillation agent for the changelog. Reads the per-unit-of-work entries under `docs/history/changelog/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), and cross-project harness rules. Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on "run retro", "distill the changelog", "refinement retro", "/retro".
+description: Session-distillation agent for the changelog and the session gate logs. Reads the per-unit-of-work entries under `docs/history/changelog/` and the coordination events in `docs/history/sessions/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), cross-project harness rules, and recurring coordination patterns (contested files, commit contention, stale-claim steals). Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on "run retro", "distill the changelog", "refinement retro", "/retro".
 tools: Read, Glob, Grep, Bash, Write, Edit
 model: opus
 ---
@@ -12,7 +12,7 @@ You distill refinement history into documentation and harness feedback. Your inp
 ## Before starting
 
 1. Read `docs/memory/retro.md` if it exists — its opening `Last run:` stamp is your last-distilled marker (run date + last entry seen); below it live prior skill-efficacy tallies and suppressed findings. No file ⇒ first run ⇒ distill everything. **An unparseable or unrecognised marker is not an error** — treat it as "distill from the start of the folder" and re-stamp in the current format.
-2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Empty set ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
+2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Alongside the entries, scan the session gate logs (`docs/history/sessions/*.md`) dated after the marker for **coordination events** — lines whose kind is `coord` (commit-claim waits and steals, file-claim contacts, skipped queue writes). The log genre promises its failure stream to later intelligence, and you are that reader. Empty set (no entries and no coord events) ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
 3. **Skip entries carrying no field block.** An entry with no `Ask:`/`Skills:`/`Pin:` fields predates the format and holds no distillable signal; it is not a defect and never a finding.
 4. Read `docs/memory/` for cross-reference: a changelog discovery that also appears in memory is confirmed knowledge; a memory entry with no changelog trace is itself a promotion candidate.
 
@@ -25,6 +25,7 @@ Classify every finding into exactly one bucket. Work from the entries — recurr
 3. **Skill evolution** — tally each skill's `Skills:` verdicts across the entries: invoked / survived / overridden, override reasons aggregated. A skill overridden in most of its invocations is a finding. A refinement class recurring ≥3 times with no skill invoked is a candidate new skill.
 4. **Pin** — a `Pin: none — candidate:` entry that recurs, or any entry whose `Ask` carries a user taste quote or explicit approval with no enforced artifact guarding the behavior. Output the exact pin (test, token, guardrail, schema) and where it goes.
 5. **Harness rule** — a discovery true across projects, not of this repo (tooling collisions, platform ceilings, auth toil). Route to the shared rule file it belongs in.
+6. **Coordination** — a `coord` pattern recurring across sessions: one file drawing repeated cross-session contact (candidate ownership split, or a rendezvous artifact wanting a "discover rather than register" refactor), repeated commit-claim contention (sessions batching too much per commit), repeated stale-claim steals or skipped queue writes (a liveness or lock-health defect). A single event is operations, never a finding.
 
 ## Report & record
 

package/data/harnesses/delivery/codex/agents/retro.toml

@@ -1,6 +1,6 @@
 # dropped Claude tools: Read, Glob, Grep, Bash, Write, Edit
 name = "retro"
-description = "Session-distillation agent for the changelog. Reads the per-unit-of-work entries under `docs/history/changelog/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), and cross-project harness rules. Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on \"run retro\", \"distill the changelog\", \"refinement retro\", \"/retro\"."
+description = "Session-distillation agent for the changelog and the session gate logs. Reads the per-unit-of-work entries under `docs/history/changelog/` and the coordination events in `docs/history/sessions/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), cross-project harness rules, and recurring coordination patterns (contested files, commit contention, stale-claim steals). Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on \"run retro\", \"distill the changelog\", \"refinement retro\", \"/retro\"."
 developer_instructions = '''
 
 # Retro — changelog distillation
@@ -10,7 +10,7 @@ You distill refinement history into documentation and harness feedback. Your inp
 ## Before starting
 
 1. Read `docs/memory/retro.md` if it exists — its opening `Last run:` stamp is your last-distilled marker (run date + last entry seen); below it live prior skill-efficacy tallies and suppressed findings. No file ⇒ first run ⇒ distill everything. **An unparseable or unrecognised marker is not an error** — treat it as "distill from the start of the folder" and re-stamp in the current format.
-2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Empty set ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
+2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Alongside the entries, scan the session gate logs (`docs/history/sessions/*.md`) dated after the marker for **coordination events** — lines whose kind is `coord` (commit-claim waits and steals, file-claim contacts, skipped queue writes). The log genre promises its failure stream to later intelligence, and you are that reader. Empty set (no entries and no coord events) ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
 3. **Skip entries carrying no field block.** An entry with no `Ask:`/`Skills:`/`Pin:` fields predates the format and holds no distillable signal; it is not a defect and never a finding.
 4. Read `docs/memory/` for cross-reference: a changelog discovery that also appears in memory is confirmed knowledge; a memory entry with no changelog trace is itself a promotion candidate.
 
@@ -23,6 +23,7 @@ Classify every finding into exactly one bucket. Work from the entries — recurr
 3. **Skill evolution** — tally each skill's `Skills:` verdicts across the entries: invoked / survived / overridden, override reasons aggregated. A skill overridden in most of its invocations is a finding. A refinement class recurring ≥3 times with no skill invoked is a candidate new skill.
 4. **Pin** — a `Pin: none — candidate:` entry that recurs, or any entry whose `Ask` carries a user taste quote or explicit approval with no enforced artifact guarding the behavior. Output the exact pin (test, token, guardrail, schema) and where it goes.
 5. **Harness rule** — a discovery true across projects, not of this repo (tooling collisions, platform ceilings, auth toil). Route to the shared rule file it belongs in.
+6. **Coordination** — a `coord` pattern recurring across sessions: one file drawing repeated cross-session contact (candidate ownership split, or a rendezvous artifact wanting a "discover rather than register" refactor), repeated commit-claim contention (sessions batching too much per commit), repeated stale-claim steals or skipped queue writes (a liveness or lock-health defect). A single event is operations, never a finding.
 
 ## Report & record
 

package/data/harnesses/delivery/harness.json

@@ -1,12 +1,12 @@
 {
   "harness": "delivery",
   "name": "delivery",
-  "version": "0.2.12",
+  "version": "0.2.15",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
   "seeds": [],
-  "digest": "599762913a4e"
+  "digest": "c9abef75f3c4"
 }

package/data/harnesses/delivery/rules/changelog.md

@@ -10,8 +10,6 @@ Every unit of work leaves one record — `docs/history/changelog/YYYY-MM-DD-{thr
 | The user asks for a changelog | The entry for the work in hand. No commit required |
 | A commit is made | Every non-exempt commit is covered by an entry — the `commit` skill writes or completes it (no `commit` skill in the runtime ⇒ write the entry from the `documentation` skill's `templates/changelog-entry.md` and stage it with the commit) |
 
-An entry is owed only by work that changes promised behavior or takes a design decision; mechanical and cosmetic commits — a typo, a copy tweak, a config value, a log line — take only their `docs/history/CHANGELOG.md` row, no entry file. The failure fields (`Ask:`, `Skills:`, `Pin:`) are required only when non-none.
-
 Route the lesson by who pays for losing it: product context — what changed and why — belongs in the entry; anything the **next session would re-pay** — a library's API drifted from what the model expects, a validator's quirk, a tooling workaround — goes to `docs/memory/main.md` as well, because a changelog is read by people tracing history and memory is read by every session before it repeats the mistake.
 
 ## Lifecycle

package/data/harnesses/etna/CLAUDE.md

@@ -178,9 +178,17 @@ The single policy for sub-agent dispatch — when to fan out, at what tier, and
 
 ## Authoring Conventions
 
-Most artifacts are markdown — skills, agents, rules, docs. Follow the conventions in `docs/architecture/skills/` and the `kb` / `nomenclature` rules; markdown has no file-path-comment rule. Keep the `.claude/rules/*` reference docs frontmatter-free.
+Most artifacts are markdown — skills, agents, rules, docs. Follow the `kb` / `nomenclature` rules; markdown has no file-path-comment rule. Keep the `.claude/rules/*` reference docs frontmatter-free.
 
-Authoring or updating an **agent** keeps both runtimes in sync: the `.md` is the single source, and its Codex `.codex.toml` twin is derived from it by following [`docs/architecture/harness/authoring-agents.md`](docs/architecture/harness/authoring-agents.md), then checked with `node packages/cli/lib/codex/validate-codex-agents.mjs`.
+**Each artifact class has an authoring guide — read the one you are editing, before you edit it.** The forge is the only repo that authors these, so the guides live here and ship nowhere:
+
+| Editing | Guide |
+| --- | --- |
+| A **rule** (`rules/*.md`) | [`docs/architecture/rules.md`](docs/architecture/rules.md) — the catalog, the conventions, and the whole-file audit |
+| A **skill** (`skills/*/`) | [`docs/architecture/skills/playbook/`](docs/architecture/skills/playbook/Readme.md) — fit and scope through shipping and maintenance |
+| An **agent** (`agents/*.md`) | [`docs/architecture/harness/authoring-agents.md`](docs/architecture/harness/authoring-agents.md) |
+
+Authoring or updating an **agent** keeps both runtimes in sync: the `.md` is the single source, and its Codex `.codex.toml` twin is derived from it by the guide above, then checked with `node packages/cli/lib/codex/validate-codex-agents.mjs`.
 
 For real code (the CLI under `packages/`, hook scripts):
 

package/data/harnesses/etna/agents/retro.md

@@ -1,6 +1,6 @@
 ---
 name: retro
-description: Session-distillation agent for the changelog. Reads the per-unit-of-work entries under `docs/history/changelog/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), and cross-project harness rules. Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on "run retro", "distill the changelog", "refinement retro", "/retro".
+description: Session-distillation agent for the changelog and the session gate logs. Reads the per-unit-of-work entries under `docs/history/changelog/` and the coordination events in `docs/history/sessions/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), cross-project harness rules, and recurring coordination patterns (contested files, commit contention, stale-claim steals). Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on "run retro", "distill the changelog", "refinement retro", "/retro".
 tools: Read, Glob, Grep, Bash, Write, Edit
 model: opus
 ---
@@ -12,7 +12,7 @@ You distill refinement history into documentation and harness feedback. Your inp
 ## Before starting
 
 1. Read `docs/memory/retro.md` if it exists — its opening `Last run:` stamp is your last-distilled marker (run date + last entry seen); below it live prior skill-efficacy tallies and suppressed findings. No file ⇒ first run ⇒ distill everything. **An unparseable or unrecognised marker is not an error** — treat it as "distill from the start of the folder" and re-stamp in the current format.
-2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Empty set ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
+2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Alongside the entries, scan the session gate logs (`docs/history/sessions/*.md`) dated after the marker for **coordination events** — lines whose kind is `coord` (commit-claim waits and steals, file-claim contacts, skipped queue writes). The log genre promises its failure stream to later intelligence, and you are that reader. Empty set (no entries and no coord events) ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
 3. **Skip entries carrying no field block.** An entry with no `Ask:`/`Skills:`/`Pin:` fields predates the format and holds no distillable signal; it is not a defect and never a finding.
 4. Read `docs/memory/` for cross-reference: a changelog discovery that also appears in memory is confirmed knowledge; a memory entry with no changelog trace is itself a promotion candidate.
 
@@ -25,6 +25,7 @@ Classify every finding into exactly one bucket. Work from the entries — recurr
 3. **Skill evolution** — tally each skill's `Skills:` verdicts across the entries: invoked / survived / overridden, override reasons aggregated. A skill overridden in most of its invocations is a finding. A refinement class recurring ≥3 times with no skill invoked is a candidate new skill.
 4. **Pin** — a `Pin: none — candidate:` entry that recurs, or any entry whose `Ask` carries a user taste quote or explicit approval with no enforced artifact guarding the behavior. Output the exact pin (test, token, guardrail, schema) and where it goes.
 5. **Harness rule** — a discovery true across projects, not of this repo (tooling collisions, platform ceilings, auth toil). Route to the shared rule file it belongs in.
+6. **Coordination** — a `coord` pattern recurring across sessions: one file drawing repeated cross-session contact (candidate ownership split, or a rendezvous artifact wanting a "discover rather than register" refactor), repeated commit-claim contention (sessions batching too much per commit), repeated stale-claim steals or skipped queue writes (a liveness or lock-health defect). A single event is operations, never a finding.
 
 ## Report & record
 

package/data/harnesses/etna/codex/agents/retro.toml

@@ -1,6 +1,6 @@
 # dropped Claude tools: Read, Glob, Grep, Bash, Write, Edit
 name = "retro"
-description = "Session-distillation agent for the changelog. Reads the per-unit-of-work entries under `docs/history/changelog/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), and cross-project harness rules. Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on \"run retro\", \"distill the changelog\", \"refinement retro\", \"/retro\"."
+description = "Session-distillation agent for the changelog and the session gate logs. Reads the per-unit-of-work entries under `docs/history/changelog/` and the coordination events in `docs/history/sessions/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), cross-project harness rules, and recurring coordination patterns (contested files, commit contention, stale-claim steals). Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on \"run retro\", \"distill the changelog\", \"refinement retro\", \"/retro\"."
 developer_instructions = '''
 
 # Retro — changelog distillation
@@ -10,7 +10,7 @@ You distill refinement history into documentation and harness feedback. Your inp
 ## Before starting
 
 1. Read `docs/memory/retro.md` if it exists — its opening `Last run:` stamp is your last-distilled marker (run date + last entry seen); below it live prior skill-efficacy tallies and suppressed findings. No file ⇒ first run ⇒ distill everything. **An unparseable or unrecognised marker is not an error** — treat it as "distill from the start of the folder" and re-stamp in the current format.
-2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Empty set ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
+2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Alongside the entries, scan the session gate logs (`docs/history/sessions/*.md`) dated after the marker for **coordination events** — lines whose kind is `coord` (commit-claim waits and steals, file-claim contacts, skipped queue writes). The log genre promises its failure stream to later intelligence, and you are that reader. Empty set (no entries and no coord events) ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
 3. **Skip entries carrying no field block.** An entry with no `Ask:`/`Skills:`/`Pin:` fields predates the format and holds no distillable signal; it is not a defect and never a finding.
 4. Read `docs/memory/` for cross-reference: a changelog discovery that also appears in memory is confirmed knowledge; a memory entry with no changelog trace is itself a promotion candidate.
 
@@ -23,6 +23,7 @@ Classify every finding into exactly one bucket. Work from the entries — recurr
 3. **Skill evolution** — tally each skill's `Skills:` verdicts across the entries: invoked / survived / overridden, override reasons aggregated. A skill overridden in most of its invocations is a finding. A refinement class recurring ≥3 times with no skill invoked is a candidate new skill.
 4. **Pin** — a `Pin: none — candidate:` entry that recurs, or any entry whose `Ask` carries a user taste quote or explicit approval with no enforced artifact guarding the behavior. Output the exact pin (test, token, guardrail, schema) and where it goes.
 5. **Harness rule** — a discovery true across projects, not of this repo (tooling collisions, platform ceilings, auth toil). Route to the shared rule file it belongs in.
+6. **Coordination** — a `coord` pattern recurring across sessions: one file drawing repeated cross-session contact (candidate ownership split, or a rendezvous artifact wanting a "discover rather than register" refactor), repeated commit-claim contention (sessions batching too much per commit), repeated stale-claim steals or skipped queue writes (a liveness or lock-health defect). A single event is operations, never a finding.
 
 ## Report & record
 

package/data/harnesses/etna/harness.json

@@ -1,12 +1,12 @@
 {
   "harness": "etna",
   "name": "etna",
-  "version": "1.4.11",
+  "version": "1.5.2",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
   "seeds": [],
-  "digest": "84ce5acb1a74"
+  "digest": "615e0382294b"
 }

package/data/harnesses/etna/rules/changelog.md

@@ -10,8 +10,6 @@ Every unit of work leaves one record — `docs/history/changelog/YYYY-MM-DD-{thr
 | The user asks for a changelog | The entry for the work in hand. No commit required |
 | A commit is made | Every non-exempt commit is covered by an entry — the `commit` skill writes or completes it (no `commit` skill in the runtime ⇒ write the entry from the `documentation` skill's `templates/changelog-entry.md` and stage it with the commit) |
 
-An entry is owed only by work that changes promised behavior or takes a design decision; mechanical and cosmetic commits — a typo, a copy tweak, a config value, a log line — take only their `docs/history/CHANGELOG.md` row, no entry file. The failure fields (`Ask:`, `Skills:`, `Pin:`) are required only when non-none.
-
 Route the lesson by who pays for losing it: product context — what changed and why — belongs in the entry; anything the **next session would re-pay** — a library's API drifted from what the model expects, a validator's quirk, a tooling workaround — goes to `docs/memory/main.md` as well, because a changelog is read by people tracing history and memory is read by every session before it repeats the mistake.
 
 ## Lifecycle

package/data/harnesses/etna/rules/general.md

@@ -4,13 +4,13 @@ Runtime versions, package policy, the API response envelope, and GitHub Actions
 
 ## Runtime Versions
 
-- **Node.js:** the version pinned in `.nvmrc` / `package.json` `engines` — **never** a hardcoded number, **never** the runner's default. Workflows use `node-version-file: .nvmrc`.
+- **Node.js:** the version pinned in `.nvmrc` / `package.json` `engines` — never a hardcoded number anywhere.
 - **Package manager:** detect from the lockfile — **never** hardcode one.
 - **PostgreSQL:** 17 · **Redis:** 7.x (latest)
 
 ## Packages
 
-**Only packages in the approved table** — `.claude/hooks/approved-packages.md`, enforced by the PreToolUse install gate, which names the file on a block. The table changes only by explicit user decision. Test packages install at `latest`; fake data comes from `@ngneat/falso` — **never** `@faker-js/faker` / `chance`.
+**Only packages in the approved table** — `.claude/hooks/approved-packages.md`, enforced by the PreToolUse install gate, which names the file on a block. The table changes only by explicit user decision.
 
 ## API Response Envelope
 
@@ -37,4 +37,4 @@ Pin the major, and check it against the action's releases — a major behind sti
 | `actions/checkout` | v7 | Repo checkout |
 | `actions/setup-node` | v7 | Node toolchain + npm cache |
 
-Set `node-version` via `node-version-file: .nvmrc`, **never** a hardcoded number and **never** the runner's default.
+Set `node-version` via `node-version-file: .nvmrc`, **never** the runner's default.

package/data/harnesses/etna/rules/kb.md

@@ -1,6 +1,6 @@
 # Knowledge-Base Folders
 
-Conventions for any folder that is majority markdown — `docs/`, `research/`, an Obsidian vault, any knowledge base. Folder shape and linking only.
+Conventions for any folder that is majority markdown — `docs/`, `research/`, an Obsidian vault, any knowledge base. Folder shape and linking only. **Instruction files are not a knowledge base and this rule does not reach them** — `rules/`, `agents/`, and skill bodies carry their own linking discipline and no `Readme.md`.
 
 - **Every topic folder carries a `Readme.md`**, created with the topic's first document — **never** `index.md` or an unscoped filename. `Readme.md` is what GitHub and Obsidian surface first, so every folder introduces itself.
 - **Every mention is a link** — wikilinks (`[[other-doc]]`) inside Obsidian-native vaults, relative markdown links (`[label](../other-doc.md)`) everywhere else. Unlinked mentions decay a knowledge graph into a pile of files.

package/data/harnesses/hr/harness.json

@@ -1,12 +1,12 @@
 {
   "harness": "hr",
   "name": "hr",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
   "seeds": [],
-  "digest": "598500b95045"
+  "digest": "a8da585229ba"
 }

package/data/harnesses/hr/rules/code-eval-batcher.md

@@ -1,6 +1,6 @@
 # Code-Eval Batcher
 
-Evaluating and ranking **multiple code projects** — candidate take-homes, submissions, a folder of repos — against the production-readiness + product-quality rubric. The main agent drives this directly: it can dispatch sub-agents in parallel and a sub-agent cannot, so this is a rule to perform, not an agent to delegate to. A single project does **not** need this rule — invoke the `evaluator` skill directly. Scoring how a person *steered a session* is `interview-eval`, not this rule.
+Evaluating and ranking **multiple code projects** — candidate take-homes, submissions, a folder of repos — against the production-readiness + product-quality rubric. The main agent performs this directly rather than delegating it: the rollup needs every scorecard in one context, so the session that ranks must be the one that fans out. A single project does **not** need this rule — invoke the `evaluator` skill directly. Scoring how a person *steered a session* is `interview-eval`, not this rule.
 
 ## Division of labor
 
@@ -12,7 +12,7 @@ Per-project scoring — the rubric, gates, absolute banding, the 8 sub-criteria,
 | --- | --- |
 | 0 | **Preflight once:** `bash .claude/skills/evaluator/preflight.sh`. Halt on non-zero and report the missing tools — never score with degraded signals. |
 | 1 | **Enumerate** the projects → local paths, one slug each (its dir name). Choose an `out_dir` (default `./code-eval-out`). |
-| 2 | **Dispatch in parallel — rolling window of 4.** Per project: `Agent(subagent_type="general-purpose", run_in_background=True, …)` instructing it to invoke the `evaluator` skill on that one path, write the workspace to `<out_dir>/<slug>/`, validate it (`python3 .claude/skills/evaluator/validate_scorecard.py <out_dir>/<slug>/scorecard.yaml`), and return the workspace path + the scorecard's `normalized`. Fire a replacement the moment a slot frees. |
+| 2 | **Dispatch in parallel — batches of 4.** Per project: an `Agent` call with `subagent_type="general-purpose"` instructing it to invoke the `evaluator` skill on that one path, write the workspace to `<out_dir>/<slug>/`, validate it (`python3 .claude/skills/evaluator/validate_scorecard.py <out_dir>/<slug>/scorecard.yaml`), and return the workspace path + the scorecard's `normalized`. **Issue all four calls in one block** — that is what makes them concurrent; start the next batch when the block returns. |
 | 3 | **Collect** every `<out_dir>/*/scorecard.yaml`. Re-dispatch a validation failure once; on the second failure mark the project `VALIDATION_FAILED` and continue. |
 | 4 | **Weight + normalize** every project (math below) using the weights block. |
 | 5 | **Rollup** → `<out_dir>/results/{scorecard.csv, ranking.md, summary.md}` (contents below), sorted by rank score desc. Leave everything uncommitted. |

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nurix/etna",
-    "version": "0.19.75",
+    "version": "0.19.77",
     "description": "Bootstrap a project with a Nurix harness — copies the harness's CLAUDE.md, skills, agents, rules, and hooks directly into the project from a bundled payload (no marketplace fetch, no network).",
     "type": "module",
     "bin": {
@@ -42,5 +42,5 @@
         "agent",
         "plugin"
     ],
-    "etnaFingerprint": "a4e2f407bbc6"
+    "etnaFingerprint": "f747b8cde1b8"
 }