@nurix/etna 0.19.76 → 0.19.78

package/data/harness-index.json

@@ -1,5 +1,5 @@
 {
-    "fingerprint": "ae6ba8fb523a",
+    "fingerprint": "728af89f1e8e",
     "harnesses": {
         "code": {
             "plugin": "code",

package/data/harnesses/code/agents/bookkeeper.md

@@ -29,6 +29,7 @@ Ground every edit in this ladder, in order. Never invent content; a fact you can
 
 ## Rules
 
+- **One drain at a time — check the claim board first.** Before touching the queue, read `.claude/state/claims.log` (tab-separated: timestamp · start/end · activity · session id). An open `bookkeeping-drain` claim — a `start` with no later `end` — that is under 20 minutes old and belongs to a session whose registry row (`.claude/state/sessions.tsv`) points at a recently-modified transcript means another drain is mid-flight: stop and report that instead of draining. Otherwise append your own `start` line before the pass and an `end` line after it, so a second bookkeeper can see you and a waiting session can see you finish. A stale claim (older, or holder gone) is yours to note and proceed past.
 - **Never edit frozen records** — committed changelog entries, `Status: Complete|Abandoned` plans, outcome-stamped runbooks. A finding that seems to require one gets a `needs-session:` row instead.
 - **Every touched doc goes through the `documentation` skill's rules** — present tense, two-natures, no history narration in truth documents.
 - **Resolution = deletion.** A finished row is removed from the queue, not annotated. Only `waived:` conversions (a reason plus `expires=YYYY-MM-DD`) and `needs-session:` rows survive your pass.

package/data/harnesses/code/agents/retro.md

@@ -1,6 +1,6 @@
 ---
 name: retro
-description: Session-distillation agent for the changelog. Reads the per-unit-of-work entries under `docs/history/changelog/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), and cross-project harness rules. Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on "run retro", "distill the changelog", "refinement retro", "/retro".
+description: Session-distillation agent for the changelog and the session gate logs. Reads the per-unit-of-work entries under `docs/history/changelog/` and the coordination events in `docs/history/sessions/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), cross-project harness rules, and recurring coordination patterns (contested files, commit contention, stale-claim steals). Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on "run retro", "distill the changelog", "refinement retro", "/retro".
 tools: Read, Glob, Grep, Bash, Write, Edit
 model: opus
 ---
@@ -12,7 +12,7 @@ You distill refinement history into documentation and harness feedback. Your inp
 ## Before starting
 
 1. Read `docs/memory/retro.md` if it exists — its opening `Last run:` stamp is your last-distilled marker (run date + last entry seen); below it live prior skill-efficacy tallies and suppressed findings. No file ⇒ first run ⇒ distill everything. **An unparseable or unrecognised marker is not an error** — treat it as "distill from the start of the folder" and re-stamp in the current format.
-2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Empty set ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
+2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Alongside the entries, scan the session gate logs (`docs/history/sessions/*.md`) dated after the marker for **coordination events** — lines whose kind is `coord` (commit-claim waits and steals, file-claim contacts, skipped queue writes). The log genre promises its failure stream to later intelligence, and you are that reader. Empty set (no entries and no coord events) ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
 3. **Skip entries carrying no field block.** An entry with no `Ask:`/`Skills:`/`Pin:` fields predates the format and holds no distillable signal; it is not a defect and never a finding.
 4. Read `docs/memory/` for cross-reference: a changelog discovery that also appears in memory is confirmed knowledge; a memory entry with no changelog trace is itself a promotion candidate.
 
@@ -25,6 +25,7 @@ Classify every finding into exactly one bucket. Work from the entries — recurr
 3. **Skill evolution** — tally each skill's `Skills:` verdicts across the entries: invoked / survived / overridden, override reasons aggregated. A skill overridden in most of its invocations is a finding. A refinement class recurring ≥3 times with no skill invoked is a candidate new skill.
 4. **Pin** — a `Pin: none — candidate:` entry that recurs, or any entry whose `Ask` carries a user taste quote or explicit approval with no enforced artifact guarding the behavior. Output the exact pin (test, token, guardrail, schema) and where it goes.
 5. **Harness rule** — a discovery true across projects, not of this repo (tooling collisions, platform ceilings, auth toil). Route to the shared rule file it belongs in.
+6. **Coordination** — a `coord` pattern recurring across sessions: one file drawing repeated cross-session contact (candidate ownership split, or a rendezvous artifact wanting a "discover rather than register" refactor), repeated commit-claim contention (sessions batching too much per commit), repeated stale-claim steals or skipped queue writes (a liveness or lock-health defect). A single event is operations, never a finding.
 
 ## Report & record
 

package/data/harnesses/code/codex/agents/bookkeeper.toml

@@ -27,6 +27,7 @@ Ground every edit in this ladder, in order. Never invent content; a fact you can
 
 ## Rules
 
+- **One drain at a time — check the claim board first.** Before touching the queue, read `.claude/state/claims.log` (tab-separated: timestamp · start/end · activity · session id). An open `bookkeeping-drain` claim — a `start` with no later `end` — that is under 20 minutes old and belongs to a session whose registry row (`.claude/state/sessions.tsv`) points at a recently-modified transcript means another drain is mid-flight: stop and report that instead of draining. Otherwise append your own `start` line before the pass and an `end` line after it, so a second bookkeeper can see you and a waiting session can see you finish. A stale claim (older, or holder gone) is yours to note and proceed past.
 - **Never edit frozen records** — committed changelog entries, `Status: Complete|Abandoned` plans, outcome-stamped runbooks. A finding that seems to require one gets a `needs-session:` row instead.
 - **Every touched doc goes through the `documentation` skill's rules** — present tense, two-natures, no history narration in truth documents.
 - **Resolution = deletion.** A finished row is removed from the queue, not annotated. Only `waived:` conversions (a reason plus `expires=YYYY-MM-DD`) and `needs-session:` rows survive your pass.

package/data/harnesses/code/codex/agents/retro.toml

@@ -1,6 +1,6 @@
 # dropped Claude tools: Read, Glob, Grep, Bash, Write, Edit
 name = "retro"
-description = "Session-distillation agent for the changelog. Reads the per-unit-of-work entries under `docs/history/changelog/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), and cross-project harness rules. Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on \"run retro\", \"distill the changelog\", \"refinement retro\", \"/retro\"."
+description = "Session-distillation agent for the changelog and the session gate logs. Reads the per-unit-of-work entries under `docs/history/changelog/` and the coordination events in `docs/history/sessions/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), cross-project harness rules, and recurring coordination patterns (contested files, commit contention, stale-claim steals). Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on \"run retro\", \"distill the changelog\", \"refinement retro\", \"/retro\"."
 developer_instructions = '''
 
 # Retro — changelog distillation
@@ -10,7 +10,7 @@ You distill refinement history into documentation and harness feedback. Your inp
 ## Before starting
 
 1. Read `docs/memory/retro.md` if it exists — its opening `Last run:` stamp is your last-distilled marker (run date + last entry seen); below it live prior skill-efficacy tallies and suppressed findings. No file ⇒ first run ⇒ distill everything. **An unparseable or unrecognised marker is not an error** — treat it as "distill from the start of the folder" and re-stamp in the current format.
-2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Empty set ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
+2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Alongside the entries, scan the session gate logs (`docs/history/sessions/*.md`) dated after the marker for **coordination events** — lines whose kind is `coord` (commit-claim waits and steals, file-claim contacts, skipped queue writes). The log genre promises its failure stream to later intelligence, and you are that reader. Empty set (no entries and no coord events) ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
 3. **Skip entries carrying no field block.** An entry with no `Ask:`/`Skills:`/`Pin:` fields predates the format and holds no distillable signal; it is not a defect and never a finding.
 4. Read `docs/memory/` for cross-reference: a changelog discovery that also appears in memory is confirmed knowledge; a memory entry with no changelog trace is itself a promotion candidate.
 
@@ -23,6 +23,7 @@ Classify every finding into exactly one bucket. Work from the entries — recurr
 3. **Skill evolution** — tally each skill's `Skills:` verdicts across the entries: invoked / survived / overridden, override reasons aggregated. A skill overridden in most of its invocations is a finding. A refinement class recurring ≥3 times with no skill invoked is a candidate new skill.
 4. **Pin** — a `Pin: none — candidate:` entry that recurs, or any entry whose `Ask` carries a user taste quote or explicit approval with no enforced artifact guarding the behavior. Output the exact pin (test, token, guardrail, schema) and where it goes.
 5. **Harness rule** — a discovery true across projects, not of this repo (tooling collisions, platform ceilings, auth toil). Route to the shared rule file it belongs in.
+6. **Coordination** — a `coord` pattern recurring across sessions: one file drawing repeated cross-session contact (candidate ownership split, or a rendezvous artifact wanting a "discover rather than register" refactor), repeated commit-claim contention (sessions batching too much per commit), repeated stale-claim steals or skipped queue writes (a liveness or lock-health defect). A single event is operations, never a finding.
 
 ## Report & record
 

package/data/harnesses/code/harness.json

@@ -1,7 +1,7 @@
 {
   "harness": "code",
   "name": "code",
-  "version": "3.10.2",
+  "version": "3.10.4",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
@@ -15,5 +15,5 @@
     "docs/memory/main.md",
     ".mcp.json"
   ],
-  "digest": "7eff5a4d7de8"
+  "digest": "4b1ec8d430ab"
 }

package/data/harnesses/code/hooks/approved-packages.md

@@ -7,6 +7,8 @@ Read by the PreToolUse install gate (`compliance.mjs`) — an off-table install
 | `react` | ^19.2.3 | UI components | — |
 | `vite` | ^8.0.0 | Build tool, dev server | `webpack`, CRA |
 | `tailwindcss` | ^4.1.18 | Styling | `styled-components` |
+| `@nurix/components` | ^0.15.12 | The UI component library — import by subpath | `npx shadcn add`, a `components.json` scaffold |
+| `@tailwindcss/vite` | ^4.1.18 | Tailwind v4 Vite plugin | `postcss`, `tailwind.config.js` |
 | `@vitejs/plugin-react-swc` | ^4.2.2 | JSX compilation | `@vitejs/plugin-react` |
 | `react-router-dom` | ^7.11.0 | Routing | — |
 | `@reduxjs/toolkit` | ^2.11.2 | State management | `zustand`, `jotai` |

package/data/harnesses/code/hooks/awareness.mjs

@@ -32,6 +32,15 @@ import {
 } from "./lib/state.mjs";
 import { frozenStatus } from "./lib/frozen.mjs";
 import { approvedPackages } from "./lib/approved.mjs";
+import {
+  recordSession,
+  liveSiblings,
+  openActivityClaims,
+  recentForeignTouches,
+  releaseActivity,
+  pruneState,
+} from "./lib/claims.mjs";
+import { appendEvent } from "./lib/session-log.mjs";
 
 const today = () => new Date().toISOString().slice(0, 10);
 
@@ -185,15 +194,50 @@ function driftBanner(projectDir) {
   );
 }
 
-function sessionStart(projectDir) {
+function sessionStart(projectDir, payload = {}) {
   // Stamp the session's start so gitless repos still have a "modified since" horizon for the
-  // outcome detector's fallback scan (dirtyPaths). Overwritten per session; best-effort.
+  // outcome detector's fallback scan (dirtyPaths). The legacy shared stamp stays for its reader;
+  // the per-sid twin exists because two concurrent sessions clobber the shared one. Best-effort.
+  const sid = payload.session_id;
+  const stamp = new Date().toISOString() + "\n";
   try {
-    fs.writeFileSync(path.join(stateDir(projectDir), "session-started"), new Date().toISOString() + "\n");
+    fs.writeFileSync(path.join(stateDir(projectDir), "session-started"), stamp);
+    if (sid) {
+      const short = String(sid).replace(/[^a-zA-Z0-9-]/g, "").slice(0, 8);
+      fs.writeFileSync(path.join(stateDir(projectDir), `session-started-${short}`), stamp);
+    }
   } catch (e) {
     /* the stamp is a convenience for the fallback; git repos never need it */
   }
+  // The claim board's registry + eviction: announce this session (liveness reads the transcript's
+  // mtime), and prune state rows past retention — capture with no reader and no expiry is pollution.
+  try {
+    recordSession(projectDir, sid, payload.transcript_path);
+    pruneState(projectDir);
+  } catch (e) {
+    /* presence is a convenience */
+  }
   const lines = [];
+  // Presence, injected instead of excavated: who else is live in this checkout, what they touched
+  // recently, and any open activity claims — the awareness the operator used to carry by hand.
+  try {
+    const siblings = liveSiblings(projectDir, sid);
+    if (siblings.length) {
+      const touches = recentForeignTouches(projectDir, sid);
+      const parts = siblings.map((s) => {
+        const t = touches.find((f) => f.sid === s.sid);
+        const recent = t ? ` — recently: ${t.paths.slice(0, 3).map((p) => p.rel).join(", ")}${t.paths.length > 3 ? " …" : ""}` : "";
+        return `sid=${s.sid8} (active ${s.lastActiveMin}m ago${recent})`;
+      });
+      lines.push(`Concurrency: ${siblings.length} other live session(s) in this checkout · ${parts.join(" · ")} — treat their recent paths as claimed; scope commits with explicit pathspecs.`);
+    }
+    const claims = openActivityClaims(projectDir, sid).filter((c) => !c.mine);
+    if (claims.length) {
+      lines.push(`Open activity claims: ${claims.map((c) => `${c.activity} by sid=${c.sid8} (${c.ageMin}m${c.holderLive ? "" : ", holder gone — will be stolen on next contention"})`).join(" · ")}`);
+    }
+  } catch (e) {
+    /* presence is a convenience */
+  }
   const pm = detectPackageManager(projectDir);
   if (pm) lines.push(`Package manager: ${pm}`);
   const harness = harnessLine(projectDir);
@@ -208,7 +252,7 @@ function sessionStart(projectDir) {
     /* the banner is optional; the index below still injects */
   }
   const block = lines.length
-    ? "# Session context (generated — a convenience, never a gate)\n" + lines.slice(0, 10).join("\n")
+    ? "# Session context (generated — a convenience, never a gate)\n" + lines.slice(0, 12).join("\n")
     : "";
   const index = buildIndex(projectDir);
   const context = [block, index].filter(Boolean).join("\n\n");
@@ -479,6 +523,19 @@ function postToolUse(projectDir, payload) {
   const input = payload.tool_input || {};
   const rows = [];
   if (payload.tool_name === "Bash") {
+    // A completed `git commit` releases the claim compliance took at PreToolUse — the `end` line
+    // is what lets a waiting session verify the actor finished. Root resolution mirrors the
+    // gate's: an explicit `cd` in the command wins, so cross-repo commits release where they claimed.
+    if (/(?:^|&&|;|\|)\s*(?:sudo\s+)?git\s+commit\b/.test(input.command || "")) {
+      const cdMatch = /(?:^|&&|;)\s*cd\s+"?([^"\s;&]+)"?/.exec(input.command || "");
+      const root = cdMatch && path.isAbsolute(cdMatch[1]) && fs.existsSync(cdMatch[1]) ? cdMatch[1] : projectDir;
+      try {
+        releaseActivity(root, "commit", payload.session_id);
+        appendEvent(root, payload.session_id, "coord", "commit-claim", "released");
+      } catch (e) {
+        /* an unreleased claim goes stale in minutes; never fail the detector over it */
+      }
+    }
     detectRenames(projectDir, input.command, meta, rows);
     detectOutcomes(projectDir, meta, rows);
   } else {
@@ -507,7 +564,7 @@ function main() {
   const projectDir = resolveProjectDir(payload);
   const event = payload.hook_event_name || "SessionStart";
   if (event === "PostToolUse") postToolUse(projectDir, payload);
-  else sessionStart(projectDir);
+  else sessionStart(projectDir, payload);
 }
 
 try {

package/data/harnesses/code/hooks/compliance.mjs

@@ -14,6 +14,7 @@ import { frozenStatus } from "./lib/frozen.mjs";
 import { undischargedRows } from "./lib/ledger.mjs";
 import { appendEvent, unresolvedDenials, sessionLogPath, malformedEventLines } from "./lib/session-log.mjs";
 import { approvedPackages } from "./lib/approved.mjs";
+import { claimActivity, releaseActivity, recentForeignTouches } from "./lib/claims.mjs";
 
 function readSafe(file) {
   try {
@@ -119,6 +120,26 @@ function fileGate(projectDir, rel, toolName, sessionId) {
     return deny(projectDir, sessionId, "protected-file", rel, `BLOCKED — protected file. \`${rel}\` is on the protected list.`);
   }
 
+  // The file half of the claim board: a path another LIVE session touched minutes ago belongs to
+  // someone else right now. Advisory by design — one ask per sibling per session, never a wall —
+  // this is the presence protocol ("git status archaeology") moved into the gate that fires anyway.
+  try {
+    const holder = recentForeignTouches(projectDir, sessionId).find((f) => f.paths.some((p) => p.rel === rel));
+    if (holder) {
+      const recent = holder.paths.find((p) => p.rel === rel);
+      appendEvent(projectDir, sessionId, "coord", "file-claim", rel, `touched ${recent.ageMin}m ago by sid=${holder.sid8}`);
+      const asked = askOnce(
+        projectDir,
+        sessionId,
+        `foreign-claim:${holder.sid8}`,
+        `Another live session (sid=${holder.sid8}, active ${holder.lastActiveMin}m ago) touched \`${rel}\` ${recent.ageMin}m ago and may still be working there. Edit anyway? (Asked once per session for that sibling; scope commits with explicit pathspecs either way.)`
+      );
+      if (asked) return asked;
+    }
+  } catch (e) {
+    /* presence is a convenience — never let it block an edit on failure */
+  }
+
   const inDocs = rel.startsWith("docs/") || rel.startsWith(".claude/") || rel.endsWith(".md");
   if (!inDocs && SOURCE_LIKE.test(rel)) {
     for (const plan of openGatedPlans(projectDir)) {
@@ -256,11 +277,21 @@ function packageGate(projectDir, command, sessionId) {
   if (!m) return null;
   const approved = approvedPackages(projectDir);
   if (approved.size === 0) return null; // no rules file installed — nothing to enforce
-  const args = (m[1] || "")
-    .split(/\s+/)
-    .filter((a) => a && !a.startsWith("-") && PKG_SPEC.test(a));
+  const raw = m[1] || "";
+  // Test packages install at `latest`, outside the table's pin set (.claude/rules/testing.md).
+  // Two dev-only installs are a decision already taken rather than a new one: a companion in an
+  // approved scope (`@testing-library/react` is approved, so `-D @testing-library/user-event` is
+  // not a fresh choice), and `@types/*`, which is the typing of a package already decided. Scoped
+  // and dev only — an unscoped or runtime install is still judged against the table.
+  const isDev = /(?:^|\s)(?:-D|--save-dev|--dev)(?:\s|$)/.test(raw);
+  const approvedScopes = new Set(
+    [...approved].filter((n) => n.startsWith("@")).map((n) => n.split("/")[0])
+  );
+  approvedScopes.add("@types");
+  const args = raw.split(/\s+/).filter((a) => a && !a.startsWith("-") && PKG_SPEC.test(a));
   for (const arg of args) {
     const pkg = arg.startsWith("@") ? arg.split("@").slice(0, 2).join("@") : arg.split("@")[0];
+    if (isDev && pkg.startsWith("@") && approvedScopes.has(pkg.split("/")[0])) continue;
     if (!approved.has(pkg)) {
       return deny(
         projectDir,
@@ -312,7 +343,28 @@ function bashGate(projectDir, command, sessionId) {
   if (!command) return null;
 
   if (statement(String.raw`git\s+commit\b`).test(command)) {
-    return commitGate(projectDir, sessionId);
+    // The claim board serializes the commit sequence: disjoint files do not make disjoint
+    // commits — every session writes the same branch through the same index, so one committer
+    // at a time. A held claim is a plain wait (no denied/resolved pair to resolve — the retry
+    // clears it); a stale claim (holder dead or past TTL) is stolen loudly on the record.
+    const claim = claimActivity(projectDir, "commit", sessionId);
+    if (claim.held) {
+      appendEvent(projectDir, sessionId, "coord", "commit-claim", `waited — held by sid=${claim.held.sid8}`, `${claim.held.ageMin}m old`);
+      return decision(
+        "deny",
+        `WAIT — another session (sid=${claim.held.sid8}, claimed ${claim.held.ageMin}m ago) is mid-commit in this checkout. Re-run the commit in a moment; its completion (or staleness) releases the claim automatically. Do not delete .git/index.lock.`
+      );
+    }
+    if (claim.stole) {
+      appendEvent(projectDir, sessionId, "coord", "commit-claim", `stale claim by sid=${claim.stole.sid8} evicted`);
+    }
+    const gate = commitGate(projectDir, sessionId);
+    if (gate) {
+      // The commit is not happening — release immediately so a walled commit never holds the board.
+      releaseActivity(projectDir, "commit", sessionId);
+      return gate;
+    }
+    return null; // allowed — the awareness PostToolUse releases the claim when the command completes
   }
 
   // `git branch <name>` creates; flag-led forms (--show-current, --list, -d, -vv) query or manage

package/data/harnesses/code/hooks/lib/approved.mjs

@@ -13,6 +13,29 @@ function readSafe(file) {
   }
 }
 
+// A rule names its rejected alternatives in backticks — instruction-style § Negative space requires
+// it — so harvesting every backticked token adds the ban list to the approved set. Two shapes carry
+// a ban: a framework table's "Don't use" column, and the text after a bolded **never** or ❌.
+// A bare "never" does not count: "never against a hand-started dev server (Workers:
+// `@cloudflare/vitest-pool-workers`)" names the prescribed package, not a forbidden one.
+function approvedPart(line, banColumn) {
+  if (line.trimStart().startsWith("|")) {
+    if (banColumn < 0) return line;
+    const cells = line.split("|");
+    return cells.filter((_, i) => i !== banColumn).join("|");
+  }
+  const ban = line.search(/\*\*never\*\*|❌/i);
+  return ban === -1 ? line : line.slice(0, ban);
+}
+
+// The "Don't use" column index, held for the rows of the table that declared it.
+function banColumnOf(line, current) {
+  if (!line.trimStart().startsWith("|")) return -1;
+  const cells = line.split("|");
+  const header = cells.findIndex((c) => /don'?t use|never use/i.test(c));
+  return header === -1 ? current : header;
+}
+
 // Package names approved in .claude/hooks/approved-packages.md (plus testing.md frameworks and
 // general.md). Empty set ⇒ no rules installed ⇒ nothing to enforce.
 export function approvedPackages(projectDir) {
@@ -23,8 +46,13 @@ export function approvedPackages(projectDir) {
     path.join(projectDir, ".claude", "rules", "testing.md"),
   ];
   for (const src of sources) {
-    const text = readSafe(src);
-    for (const m of text.matchAll(/`(@?[a-z0-9][\w./-]*)`/g)) names.add(m[1]);
+    let banColumn = -1;
+    for (const line of readSafe(src).split("\n")) {
+      banColumn = banColumnOf(line, banColumn);
+      for (const m of approvedPart(line, banColumn).matchAll(/`(@?[a-z0-9][\w./-]*)`/g)) {
+        names.add(m[1]);
+      }
+    }
   }
   return names;
 }

package/data/harnesses/code/hooks/lib/claims.mjs

@@ -0,0 +1,203 @@
+// harness/code/hooks/lib/claims.mjs — the claim board: cross-session coordination through
+// machine-local state (.claude/state/), never through conversation. Two surfaces, per the
+// operator's design: an ACTIVITY log (claims.log — serialized activities like `commit`: an agent
+// records sid + start before acting, others read first and wait, completion is an `end` line so a
+// waiter can verify the actor finished) and a FILE log (touched.tsv, which already records
+// ts · path · docs · sid per edit — presence over files is *derived* from its recent rows rather
+// than registered separately, so the file half cannot drift from reality). Liveness is read from
+// the session registry (sessions.tsv): a session is live while its transcript file is recently
+// modified — no PIDs, no daemons. A stale claim (holder dead or past TTL) is stolen loudly, never
+// waited on forever: agents die mid-task as the normal case, so every claim is a lease.
+
+import fs from "node:fs";
+import path from "node:path";
+import { stateDir, withFileLock, atomicWrite } from "./state.mjs";
+
+const LIVE_WINDOW_MIN = 30; // transcript modified within this window ⇒ the session is live
+const CLAIM_TTL_MIN = 20; // an activity claim older than this is stale even if the holder lives
+const RETENTION_DAYS = 14; // registry + touched.tsv rows older than this are pruned
+
+function sid8(sessionId) {
+  return String(sessionId || "unknown").replace(/[^a-zA-Z0-9-]/g, "").slice(0, 8) || "unknown";
+}
+
+function minutesSince(iso) {
+  const t = Date.parse(iso);
+  return Number.isFinite(t) ? (Date.now() - t) / 60000 : Infinity;
+}
+
+function claimsFile(projectDir) {
+  return path.join(stateDir(projectDir), "claims.log");
+}
+
+function sessionsFile(projectDir) {
+  return path.join(stateDir(projectDir), "sessions.tsv");
+}
+
+// Record this session in the registry (idempotent per sid — the latest row wins on read).
+export function recordSession(projectDir, sessionId, transcriptPath) {
+  if (!sessionId) return;
+  const line = `${new Date().toISOString()}\t${sessionId}\t${transcriptPath || "-"}\n`;
+  fs.appendFileSync(sessionsFile(projectDir), line);
+}
+
+// Sessions other than `sessionId` whose transcript was modified inside the live window.
+// The transcript is the liveness signal: it grows on every event, needs no PID, and survives
+// the hook process (which is itself transient).
+export function liveSiblings(projectDir, sessionId) {
+  let text = "";
+  try {
+    text = fs.readFileSync(sessionsFile(projectDir), "utf8");
+  } catch (e) {
+    return [];
+  }
+  const latest = new Map(); // sid → { started, transcript }
+  for (const line of text.split("\n")) {
+    const [ts, sid, transcript] = line.split("\t");
+    if (ts && sid) latest.set(sid, { started: ts, transcript });
+  }
+  const out = [];
+  for (const [sid, rec] of latest) {
+    if (sid === sessionId) continue;
+    let ageMin = Infinity;
+    try {
+      ageMin = (Date.now() - fs.statSync(rec.transcript).mtimeMs) / 60000;
+    } catch (e) {
+      continue; // transcript gone — not live
+    }
+    if (ageMin <= LIVE_WINDOW_MIN) out.push({ sid, sid8: sid8(sid), lastActiveMin: Math.round(ageMin) });
+  }
+  return out;
+}
+
+function parseClaims(projectDir) {
+  let text = "";
+  try {
+    text = fs.readFileSync(claimsFile(projectDir), "utf8");
+  } catch (e) {
+    return new Map();
+  }
+  const open = new Map(); // activity → { sid, since }
+  for (const line of text.split("\n")) {
+    const [ts, event, activity, sid] = line.split("\t");
+    if (!ts || !activity) continue;
+    if (event === "start") open.set(activity, { sid, since: ts });
+    else if (event === "end") open.delete(activity);
+  }
+  return open;
+}
+
+// Open activity claims, annotated with age and holder liveness — for the presence banner.
+export function openActivityClaims(projectDir, sessionId) {
+  const live = new Set(liveSiblings(projectDir, "").map((s) => s.sid));
+  const out = [];
+  for (const [activity, rec] of parseClaims(projectDir)) {
+    out.push({
+      activity,
+      sid: rec.sid,
+      sid8: sid8(rec.sid),
+      ageMin: Math.round(minutesSince(rec.since)),
+      mine: rec.sid === sessionId,
+      holderLive: live.has(rec.sid) || rec.sid === sessionId,
+    });
+  }
+  return out;
+}
+
+// Claim an activity for this session. Returns { ok } on success (with `stole` when a stale
+// claim was evicted), or { held: { sid8, ageMin } } when another live session holds it fresh.
+// The read-check-append runs under the claims lock so two claimants cannot both see "free".
+export function claimActivity(projectDir, activity, sessionId) {
+  const lock = path.join(stateDir(projectDir), "claims.lock");
+  const res = withFileLock(lock, () => {
+    const open = parseClaims(projectDir);
+    const current = open.get(activity);
+    if (current && current.sid !== sessionId) {
+      const ageMin = minutesSince(current.since);
+      const holderLive = liveSiblings(projectDir, sessionId).some((s) => s.sid === current.sid);
+      if (ageMin <= CLAIM_TTL_MIN && holderLive) {
+        return { held: { sid8: sid8(current.sid), ageMin: Math.round(ageMin) } };
+      }
+      // Stale: holder dead or past TTL — evict loudly and take over.
+      fs.appendFileSync(
+        claimsFile(projectDir),
+        `${new Date().toISOString()}\tend\t${activity}\t${current.sid}\tstale-steal by ${sid8(sessionId)}\n`
+      );
+    }
+    if (!current || current.sid !== sessionId) {
+      fs.appendFileSync(claimsFile(projectDir), `${new Date().toISOString()}\tstart\t${activity}\t${sessionId}\t-\n`);
+    }
+    return {
+      ok: true,
+      stole: current && current.sid !== sessionId ? { sid8: sid8(current.sid) } : null,
+    };
+  });
+  // Lock unavailable: fail open — the claim board is a convenience, never a wall on its own.
+  return res.ok ? res.result : { ok: true, unlocked: true };
+}
+
+// Mark this session's claim on an activity complete (the `end` line a waiter reads).
+export function releaseActivity(projectDir, activity, sessionId) {
+  const lock = path.join(stateDir(projectDir), "claims.lock");
+  withFileLock(lock, () => {
+    const current = parseClaims(projectDir).get(activity);
+    if (current && current.sid === sessionId) {
+      fs.appendFileSync(claimsFile(projectDir), `${new Date().toISOString()}\tend\t${activity}\t${sessionId}\t-\n`);
+    }
+    return true;
+  });
+}
+
+// The file half of the board, derived: paths other LIVE sessions touched inside the window,
+// grouped per sibling — the mechanization of "someone else is working there right now".
+export function recentForeignTouches(projectDir, sessionId, windowMin = 45) {
+  let text = "";
+  try {
+    text = fs.readFileSync(path.join(projectDir, ".claude", "state", "touched.tsv"), "utf8");
+  } catch (e) {
+    return [];
+  }
+  const live = new Map(liveSiblings(projectDir, sessionId).map((s) => [s.sid, s]));
+  const bySid = new Map(); // sid → { paths: Map(path → lastMin) }
+  for (const line of text.split("\n")) {
+    const [ts, rel, , sid] = line.split("\t");
+    if (!ts || !rel || !sid || sid === sessionId || !live.has(sid)) continue;
+    const ageMin = minutesSince(ts);
+    if (ageMin > windowMin) continue;
+    if (!bySid.has(sid)) bySid.set(sid, new Map());
+    const paths = bySid.get(sid);
+    paths.set(rel, Math.min(paths.get(rel) ?? Infinity, ageMin));
+  }
+  return [...bySid.entries()].map(([sid, paths]) => ({
+    sid,
+    sid8: sid8(sid),
+    lastActiveMin: live.get(sid).lastActiveMin,
+    paths: [...paths.entries()]
+      .sort((a, b) => a[1] - b[1])
+      .map(([rel, ageMin]) => ({ rel, ageMin: Math.round(ageMin) })),
+  }));
+}
+
+// Evict rows past retention from touched.tsv and sessions.tsv — the capture doctrine's eviction
+// half: both files have named readers (the sid-scoped gates, the presence banner) that only read
+// recent rows, so older rows are pollution. Claims.log stays whole inside retention too.
+export function pruneState(projectDir) {
+  const cutoff = Date.now() - RETENTION_DAYS * 86400000;
+  for (const name of ["touched.tsv", "sessions.tsv", "claims.log"]) {
+    const file = path.join(stateDir(projectDir), name);
+    let text;
+    try {
+      text = fs.readFileSync(file, "utf8");
+    } catch (e) {
+      continue;
+    }
+    const kept = text.split("\n").filter((line) => {
+      const ts = Date.parse(line.split("\t")[0]);
+      return !Number.isFinite(ts) ? false : ts >= cutoff;
+    });
+    const next = kept.join("\n") + (kept.length ? "\n" : "");
+    if (next !== text) {
+      withFileLock(path.join(stateDir(projectDir), "claims.lock"), () => atomicWrite(file, next));
+    }
+  }
+}

package/data/harnesses/code/hooks/lib/state.mjs

@@ -21,6 +21,74 @@ export function queueFile(projectDir) {
   return path.join(projectDir, ...QUEUE_PATH);
 }
 
+// --- The write cell -------------------------------------------------------
+// Every queue mutation is a whole-file read-modify-write, and the queue is shared by every
+// session's hooks in this checkout — measured under two concurrent writers, the bare
+// readFileSync→writeFileSync path silently loses rows and can tear-wipe the file (a concurrent
+// reader catches a truncated file mid-write and writes the fragment back). The cell closes both:
+// mutual exclusion via a create-exclusive lockfile (stale-evicted by age — the holder is a
+// transient hook process, so age is the only honest liveness signal), and torn-read immunity via
+// temp-file + atomic rename. On lock timeout the caller SKIPS its write and records that it did
+// (fail open: a coordination guard must never become an outage; auto: rows are recomputable).
+
+const SLEEP_BUF = new Int32Array(new SharedArrayBuffer(4));
+
+function sleepMs(ms) {
+  Atomics.wait(SLEEP_BUF, 0, 0, ms);
+}
+
+// Run fn while holding the lockfile. Returns { ok: true, result } or { ok: false } on timeout.
+export function withFileLock(lockPath, fn, { retries = 40, delayMs = 25, staleMs = 10000 } = {}) {
+  for (let i = 0; i < retries; i++) {
+    let fd = null;
+    try {
+      fd = fs.openSync(lockPath, "wx");
+    } catch (e) {
+      try {
+        if (Date.now() - fs.statSync(lockPath).mtimeMs > staleMs) fs.unlinkSync(lockPath);
+      } catch (e2) {
+        /* raced another evictor or already gone — retry */
+      }
+      sleepMs(delayMs);
+      continue;
+    }
+    try {
+      return { ok: true, result: fn() };
+    } finally {
+      try {
+        fs.closeSync(fd);
+        fs.unlinkSync(lockPath);
+      } catch (e) {
+        /* already evicted as stale — nothing to release */
+      }
+    }
+  }
+  return { ok: false };
+}
+
+// Write via temp-file + rename so no reader ever sees a truncated file.
+export function atomicWrite(file, text) {
+  const tmp = path.join(path.dirname(file), `.${path.basename(file)}.tmp-${process.pid}`);
+  fs.writeFileSync(tmp, text);
+  fs.renameSync(tmp, file);
+}
+
+function queueLock(projectDir) {
+  return path.join(stateDir(projectDir), "bookkeeping.lock");
+}
+
+// A skipped write is a coordination outcome — record it where the next SessionStart looks.
+function recordSkippedWrite(projectDir, what) {
+  try {
+    fs.appendFileSync(
+      path.join(stateDir(projectDir), "hook-failures.log"),
+      `${new Date().toISOString()} state.mjs lock-timeout: skipped ${what}\n`
+    );
+  } catch (e) {
+    /* nowhere to write — fail open stays absolute */
+  }
+}
+
 const ROW_RE = /^-\s+(auto|note|needs-session|waived):\s+(.*)$/;
 
 // Parse the queue text into rows: { kind, date, body, raw }. Non-row lines are ignored.
@@ -72,48 +140,65 @@ export function formatNeedsSessionRow({ date, description, refs }) {
 
 // Append rows to the queue, creating the file with its genre header when absent.
 // Dedupes on the row text before the `| sid=` tail, so a re-fired detector never stacks duplicates.
+// Runs inside the write cell; a healed header covers the one wipe residue a torn write can leave
+// (file present, header gone — recreation used to trigger only on file-absent).
 export function appendRows(projectDir, rowLines) {
   if (!rowLines || rowLines.length === 0) return 0;
   const file = queueFile(projectDir);
-  let text = "";
-  try {
-    text = fs.readFileSync(file, "utf8");
-  } catch (e) {
-    fs.mkdirSync(path.dirname(file), { recursive: true });
-    text = QUEUE_HEADER + "\n";
+  const res = withFileLock(queueLock(projectDir), () => {
+    let text = "";
+    try {
+      text = fs.readFileSync(file, "utf8");
+    } catch (e) {
+      fs.mkdirSync(path.dirname(file), { recursive: true });
+      text = QUEUE_HEADER + "\n";
+    }
+    if (!text.startsWith("# Bookkeeping")) text = QUEUE_HEADER + "\n" + text;
+    const key = (line) => line.split("| sid=")[0].trim();
+    const existing = new Set(parseQueue(text).map((r) => key(r.raw)));
+    const fresh = rowLines.filter((line) => !existing.has(key(line)));
+    if (fresh.length === 0) return 0;
+    if (!text.endsWith("\n")) text += "\n";
+    atomicWrite(file, text + fresh.join("\n") + "\n");
+    return fresh.length;
+  });
+  if (!res.ok) {
+    recordSkippedWrite(projectDir, `append of ${rowLines.length} queue row(s)`);
+    return 0;
   }
-  const key = (line) => line.split("| sid=")[0].trim();
-  const existing = new Set(parseQueue(text).map((r) => key(r.raw)));
-  const fresh = rowLines.filter((line) => !existing.has(key(line)));
-  if (fresh.length === 0) return 0;
-  if (!text.endsWith("\n")) text += "\n";
-  fs.writeFileSync(file, text + fresh.join("\n") + "\n");
-  return fresh.length;
+  return res.result;
 }
 
 // Delete queue rows matching the predicate (used by the detector to auto-resolve
 // rows whose finding the session has since addressed). Returns the count removed.
 export function resolveRows(projectDir, predicate) {
   const file = queueFile(projectDir);
-  let text;
-  try {
-    text = fs.readFileSync(file, "utf8");
-  } catch (e) {
-    return 0;
-  }
-  let removed = 0;
-  const kept = text.split(/\r?\n/).filter((line) => {
-    const m = ROW_RE.exec(line.trim());
-    if (!m) return true;
-    const row = { kind: m[1], body: m[2].trim(), raw: line };
-    if (predicate(row)) {
-      removed += 1;
-      return false;
+  const res = withFileLock(queueLock(projectDir), () => {
+    let text;
+    try {
+      text = fs.readFileSync(file, "utf8");
+    } catch (e) {
+      return 0;
     }
-    return true;
+    let removed = 0;
+    const kept = text.split(/\r?\n/).filter((line) => {
+      const m = ROW_RE.exec(line.trim());
+      if (!m) return true;
+      const row = { kind: m[1], body: m[2].trim(), raw: line };
+      if (predicate(row)) {
+        removed += 1;
+        return false;
+      }
+      return true;
+    });
+    if (removed > 0) atomicWrite(file, kept.join("\n"));
+    return removed;
   });
-  if (removed > 0) fs.writeFileSync(file, kept.join("\n"));
-  return removed;
+  if (!res.ok) {
+    recordSkippedWrite(projectDir, "resolve pass");
+    return 0;
+  }
+  return res.result;
 }
 
 // Unexpired waived rows for a finding kind (the dead-glob allowlist CI honors).

package/data/harnesses/delivery/agents/retro.md

@@ -1,6 +1,6 @@
 ---
 name: retro
-description: Session-distillation agent for the changelog. Reads the per-unit-of-work entries under `docs/history/changelog/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), and cross-project harness rules. Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on "run retro", "distill the changelog", "refinement retro", "/retro".
+description: Session-distillation agent for the changelog and the session gate logs. Reads the per-unit-of-work entries under `docs/history/changelog/` and the coordination events in `docs/history/sessions/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), cross-project harness rules, and recurring coordination patterns (contested files, commit contention, stale-claim steals). Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on "run retro", "distill the changelog", "refinement retro", "/retro".
 tools: Read, Glob, Grep, Bash, Write, Edit
 model: opus
 ---
@@ -12,7 +12,7 @@ You distill refinement history into documentation and harness feedback. Your inp
 ## Before starting
 
 1. Read `docs/memory/retro.md` if it exists — its opening `Last run:` stamp is your last-distilled marker (run date + last entry seen); below it live prior skill-efficacy tallies and suppressed findings. No file ⇒ first run ⇒ distill everything. **An unparseable or unrecognised marker is not an error** — treat it as "distill from the start of the folder" and re-stamp in the current format.
-2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Empty set ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
+2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Alongside the entries, scan the session gate logs (`docs/history/sessions/*.md`) dated after the marker for **coordination events** — lines whose kind is `coord` (commit-claim waits and steals, file-claim contacts, skipped queue writes). The log genre promises its failure stream to later intelligence, and you are that reader. Empty set (no entries and no coord events) ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
 3. **Skip entries carrying no field block.** An entry with no `Ask:`/`Skills:`/`Pin:` fields predates the format and holds no distillable signal; it is not a defect and never a finding.
 4. Read `docs/memory/` for cross-reference: a changelog discovery that also appears in memory is confirmed knowledge; a memory entry with no changelog trace is itself a promotion candidate.
 
@@ -25,6 +25,7 @@ Classify every finding into exactly one bucket. Work from the entries — recurr
 3. **Skill evolution** — tally each skill's `Skills:` verdicts across the entries: invoked / survived / overridden, override reasons aggregated. A skill overridden in most of its invocations is a finding. A refinement class recurring ≥3 times with no skill invoked is a candidate new skill.
 4. **Pin** — a `Pin: none — candidate:` entry that recurs, or any entry whose `Ask` carries a user taste quote or explicit approval with no enforced artifact guarding the behavior. Output the exact pin (test, token, guardrail, schema) and where it goes.
 5. **Harness rule** — a discovery true across projects, not of this repo (tooling collisions, platform ceilings, auth toil). Route to the shared rule file it belongs in.
+6. **Coordination** — a `coord` pattern recurring across sessions: one file drawing repeated cross-session contact (candidate ownership split, or a rendezvous artifact wanting a "discover rather than register" refactor), repeated commit-claim contention (sessions batching too much per commit), repeated stale-claim steals or skipped queue writes (a liveness or lock-health defect). A single event is operations, never a finding.
 
 ## Report & record
 

package/data/harnesses/delivery/codex/agents/retro.toml

@@ -1,6 +1,6 @@
 # dropped Claude tools: Read, Glob, Grep, Bash, Write, Edit
 name = "retro"
-description = "Session-distillation agent for the changelog. Reads the per-unit-of-work entries under `docs/history/changelog/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), and cross-project harness rules. Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on \"run retro\", \"distill the changelog\", \"refinement retro\", \"/retro\"."
+description = "Session-distillation agent for the changelog and the session gate logs. Reads the per-unit-of-work entries under `docs/history/changelog/` and the coordination events in `docs/history/sessions/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), cross-project harness rules, and recurring coordination patterns (contested files, commit contention, stale-claim steals). Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on \"run retro\", \"distill the changelog\", \"refinement retro\", \"/retro\"."
 developer_instructions = '''
 
 # Retro — changelog distillation
@@ -10,7 +10,7 @@ You distill refinement history into documentation and harness feedback. Your inp
 ## Before starting
 
 1. Read `docs/memory/retro.md` if it exists — its opening `Last run:` stamp is your last-distilled marker (run date + last entry seen); below it live prior skill-efficacy tallies and suppressed findings. No file ⇒ first run ⇒ distill everything. **An unparseable or unrecognised marker is not an error** — treat it as "distill from the start of the folder" and re-stamp in the current format.
-2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Empty set ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
+2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Alongside the entries, scan the session gate logs (`docs/history/sessions/*.md`) dated after the marker for **coordination events** — lines whose kind is `coord` (commit-claim waits and steals, file-claim contacts, skipped queue writes). The log genre promises its failure stream to later intelligence, and you are that reader. Empty set (no entries and no coord events) ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
 3. **Skip entries carrying no field block.** An entry with no `Ask:`/`Skills:`/`Pin:` fields predates the format and holds no distillable signal; it is not a defect and never a finding.
 4. Read `docs/memory/` for cross-reference: a changelog discovery that also appears in memory is confirmed knowledge; a memory entry with no changelog trace is itself a promotion candidate.
 
@@ -23,6 +23,7 @@ Classify every finding into exactly one bucket. Work from the entries — recurr
 3. **Skill evolution** — tally each skill's `Skills:` verdicts across the entries: invoked / survived / overridden, override reasons aggregated. A skill overridden in most of its invocations is a finding. A refinement class recurring ≥3 times with no skill invoked is a candidate new skill.
 4. **Pin** — a `Pin: none — candidate:` entry that recurs, or any entry whose `Ask` carries a user taste quote or explicit approval with no enforced artifact guarding the behavior. Output the exact pin (test, token, guardrail, schema) and where it goes.
 5. **Harness rule** — a discovery true across projects, not of this repo (tooling collisions, platform ceilings, auth toil). Route to the shared rule file it belongs in.
+6. **Coordination** — a `coord` pattern recurring across sessions: one file drawing repeated cross-session contact (candidate ownership split, or a rendezvous artifact wanting a "discover rather than register" refactor), repeated commit-claim contention (sessions batching too much per commit), repeated stale-claim steals or skipped queue writes (a liveness or lock-health defect). A single event is operations, never a finding.
 
 ## Report & record
 

package/data/harnesses/delivery/harness.json

@@ -1,12 +1,12 @@
 {
   "harness": "delivery",
   "name": "delivery",
-  "version": "0.2.14",
+  "version": "0.2.15",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
   "seeds": [],
-  "digest": "3ef9954da94f"
+  "digest": "c9abef75f3c4"
 }

package/data/harnesses/etna/agents/retro.md

@@ -1,6 +1,6 @@
 ---
 name: retro
-description: Session-distillation agent for the changelog. Reads the per-unit-of-work entries under `docs/history/changelog/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), and cross-project harness rules. Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on "run retro", "distill the changelog", "refinement retro", "/retro".
+description: Session-distillation agent for the changelog and the session gate logs. Reads the per-unit-of-work entries under `docs/history/changelog/` and the coordination events in `docs/history/sessions/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), cross-project harness rules, and recurring coordination patterns (contested files, commit contention, stale-claim steals). Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on "run retro", "distill the changelog", "refinement retro", "/retro".
 tools: Read, Glob, Grep, Bash, Write, Edit
 model: opus
 ---
@@ -12,7 +12,7 @@ You distill refinement history into documentation and harness feedback. Your inp
 ## Before starting
 
 1. Read `docs/memory/retro.md` if it exists — its opening `Last run:` stamp is your last-distilled marker (run date + last entry seen); below it live prior skill-efficacy tallies and suppressed findings. No file ⇒ first run ⇒ distill everything. **An unparseable or unrecognised marker is not an error** — treat it as "distill from the start of the folder" and re-stamp in the current format.
-2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Empty set ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
+2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Alongside the entries, scan the session gate logs (`docs/history/sessions/*.md`) dated after the marker for **coordination events** — lines whose kind is `coord` (commit-claim waits and steals, file-claim contacts, skipped queue writes). The log genre promises its failure stream to later intelligence, and you are that reader. Empty set (no entries and no coord events) ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
 3. **Skip entries carrying no field block.** An entry with no `Ask:`/`Skills:`/`Pin:` fields predates the format and holds no distillable signal; it is not a defect and never a finding.
 4. Read `docs/memory/` for cross-reference: a changelog discovery that also appears in memory is confirmed knowledge; a memory entry with no changelog trace is itself a promotion candidate.
 
@@ -25,6 +25,7 @@ Classify every finding into exactly one bucket. Work from the entries — recurr
 3. **Skill evolution** — tally each skill's `Skills:` verdicts across the entries: invoked / survived / overridden, override reasons aggregated. A skill overridden in most of its invocations is a finding. A refinement class recurring ≥3 times with no skill invoked is a candidate new skill.
 4. **Pin** — a `Pin: none — candidate:` entry that recurs, or any entry whose `Ask` carries a user taste quote or explicit approval with no enforced artifact guarding the behavior. Output the exact pin (test, token, guardrail, schema) and where it goes.
 5. **Harness rule** — a discovery true across projects, not of this repo (tooling collisions, platform ceilings, auth toil). Route to the shared rule file it belongs in.
+6. **Coordination** — a `coord` pattern recurring across sessions: one file drawing repeated cross-session contact (candidate ownership split, or a rendezvous artifact wanting a "discover rather than register" refactor), repeated commit-claim contention (sessions batching too much per commit), repeated stale-claim steals or skipped queue writes (a liveness or lock-health defect). A single event is operations, never a finding.
 
 ## Report & record
 

package/data/harnesses/etna/codex/agents/retro.toml

@@ -1,6 +1,6 @@
 # dropped Claude tools: Read, Glob, Grep, Bash, Write, Edit
 name = "retro"
-description = "Session-distillation agent for the changelog. Reads the per-unit-of-work entries under `docs/history/changelog/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), and cross-project harness rules. Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on \"run retro\", \"distill the changelog\", \"refinement retro\", \"/retro\"."
+description = "Session-distillation agent for the changelog and the session gate logs. Reads the per-unit-of-work entries under `docs/history/changelog/` and the coordination events in `docs/history/sessions/` accumulated since its last run and distills the refinement delta — what user-driven iteration added that the one-shot build lacked — into a typed punch list of doc-content gaps, doc-structure moves (missing doc / mothership split / merge), skill-evolution findings backed by survived-vs-overridden counts, unpinned discoveries needing an enforced artifact (test, token, guardrail, schema), cross-project harness rules, and recurring coordination patterns (contested files, commit contention, stale-claim steals). Proposes only — actionable items land in the backlog, never applied directly. Run on demand: before a brainstorm or LLD session, before starting a new project, or after a refinement arc. Triggers on \"run retro\", \"distill the changelog\", \"refinement retro\", \"/retro\"."
 developer_instructions = '''
 
 # Retro — changelog distillation
@@ -10,7 +10,7 @@ You distill refinement history into documentation and harness feedback. Your inp
 ## Before starting
 
 1. Read `docs/memory/retro.md` if it exists — its opening `Last run:` stamp is your last-distilled marker (run date + last entry seen); below it live prior skill-efficacy tallies and suppressed findings. No file ⇒ first run ⇒ distill everything. **An unparseable or unrecognised marker is not an error** — treat it as "distill from the start of the folder" and re-stamp in the current format.
-2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Empty set ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
+2. Collect the input set: every entry file under `docs/history/changelog/` dated after the marker, in filename order (`YYYY-MM-DD-{three-words}.md` sorts chronologically). Alongside the entries, scan the session gate logs (`docs/history/sessions/*.md`) dated after the marker for **coordination events** — lines whose kind is `coord` (commit-claim waits and steals, file-claim contacts, skipped queue writes). The log genre promises its failure stream to later intelligence, and you are that reader. Empty set (no entries and no coord events) ⇒ report "nothing to distill since {date}" in one line, refresh the `Last run:` stamp, and stop — never manufacture findings.
 3. **Skip entries carrying no field block.** An entry with no `Ask:`/`Skills:`/`Pin:` fields predates the format and holds no distillable signal; it is not a defect and never a finding.
 4. Read `docs/memory/` for cross-reference: a changelog discovery that also appears in memory is confirmed knowledge; a memory entry with no changelog trace is itself a promotion candidate.
 
@@ -23,6 +23,7 @@ Classify every finding into exactly one bucket. Work from the entries — recurr
 3. **Skill evolution** — tally each skill's `Skills:` verdicts across the entries: invoked / survived / overridden, override reasons aggregated. A skill overridden in most of its invocations is a finding. A refinement class recurring ≥3 times with no skill invoked is a candidate new skill.
 4. **Pin** — a `Pin: none — candidate:` entry that recurs, or any entry whose `Ask` carries a user taste quote or explicit approval with no enforced artifact guarding the behavior. Output the exact pin (test, token, guardrail, schema) and where it goes.
 5. **Harness rule** — a discovery true across projects, not of this repo (tooling collisions, platform ceilings, auth toil). Route to the shared rule file it belongs in.
+6. **Coordination** — a `coord` pattern recurring across sessions: one file drawing repeated cross-session contact (candidate ownership split, or a rendezvous artifact wanting a "discover rather than register" refactor), repeated commit-claim contention (sessions batching too much per commit), repeated stale-claim steals or skipped queue writes (a liveness or lock-health defect). A single event is operations, never a finding.
 
 ## Report & record
 

package/data/harnesses/etna/harness.json

@@ -1,12 +1,12 @@
 {
   "harness": "etna",
   "name": "etna",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
   "seeds": [],
-  "digest": "7fbf00581722"
+  "digest": "615e0382294b"
 }

package/data/harnesses/etna/rules/kb.md

@@ -1,6 +1,6 @@
 # Knowledge-Base Folders
 
-Conventions for any folder that is majority markdown — `docs/`, `research/`, an Obsidian vault, any knowledge base. Folder shape and linking only.
+Conventions for any folder that is majority markdown — `docs/`, `research/`, an Obsidian vault, any knowledge base. Folder shape and linking only. **Instruction files are not a knowledge base and this rule does not reach them** — `rules/`, `agents/`, and skill bodies carry their own linking discipline and no `Readme.md`.
 
 - **Every topic folder carries a `Readme.md`**, created with the topic's first document — **never** `index.md` or an unscoped filename. `Readme.md` is what GitHub and Obsidian surface first, so every folder introduces itself.
 - **Every mention is a link** — wikilinks (`[[other-doc]]`) inside Obsidian-native vaults, relative markdown links (`[label](../other-doc.md)`) everywhere else. Unlinked mentions decay a knowledge graph into a pile of files.

package/data/harnesses/hr/harness.json

@@ -1,12 +1,12 @@
 {
   "harness": "hr",
   "name": "hr",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
   "seeds": [],
-  "digest": "598500b95045"
+  "digest": "a8da585229ba"
 }

package/data/harnesses/hr/rules/code-eval-batcher.md

@@ -1,6 +1,6 @@
 # Code-Eval Batcher
 
-Evaluating and ranking **multiple code projects** — candidate take-homes, submissions, a folder of repos — against the production-readiness + product-quality rubric. The main agent drives this directly: it can dispatch sub-agents in parallel and a sub-agent cannot, so this is a rule to perform, not an agent to delegate to. A single project does **not** need this rule — invoke the `evaluator` skill directly. Scoring how a person *steered a session* is `interview-eval`, not this rule.
+Evaluating and ranking **multiple code projects** — candidate take-homes, submissions, a folder of repos — against the production-readiness + product-quality rubric. The main agent performs this directly rather than delegating it: the rollup needs every scorecard in one context, so the session that ranks must be the one that fans out. A single project does **not** need this rule — invoke the `evaluator` skill directly. Scoring how a person *steered a session* is `interview-eval`, not this rule.
 
 ## Division of labor
 
@@ -12,7 +12,7 @@ Per-project scoring — the rubric, gates, absolute banding, the 8 sub-criteria,
 | --- | --- |
 | 0 | **Preflight once:** `bash .claude/skills/evaluator/preflight.sh`. Halt on non-zero and report the missing tools — never score with degraded signals. |
 | 1 | **Enumerate** the projects → local paths, one slug each (its dir name). Choose an `out_dir` (default `./code-eval-out`). |
-| 2 | **Dispatch in parallel — rolling window of 4.** Per project: `Agent(subagent_type="general-purpose", run_in_background=True, …)` instructing it to invoke the `evaluator` skill on that one path, write the workspace to `<out_dir>/<slug>/`, validate it (`python3 .claude/skills/evaluator/validate_scorecard.py <out_dir>/<slug>/scorecard.yaml`), and return the workspace path + the scorecard's `normalized`. Fire a replacement the moment a slot frees. |
+| 2 | **Dispatch in parallel — batches of 4.** Per project: an `Agent` call with `subagent_type="general-purpose"` instructing it to invoke the `evaluator` skill on that one path, write the workspace to `<out_dir>/<slug>/`, validate it (`python3 .claude/skills/evaluator/validate_scorecard.py <out_dir>/<slug>/scorecard.yaml`), and return the workspace path + the scorecard's `normalized`. **Issue all four calls in one block** — that is what makes them concurrent; start the next batch when the block returns. |
 | 3 | **Collect** every `<out_dir>/*/scorecard.yaml`. Re-dispatch a validation failure once; on the second failure mark the project `VALIDATION_FAILED` and continue. |
 | 4 | **Weight + normalize** every project (math below) using the weights block. |
 | 5 | **Rollup** → `<out_dir>/results/{scorecard.csv, ranking.md, summary.md}` (contents below), sorted by rank score desc. Leave everything uncommitted. |

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nurix/etna",
-    "version": "0.19.76",
+    "version": "0.19.78",
     "description": "Bootstrap a project with a Nurix harness — copies the harness's CLAUDE.md, skills, agents, rules, and hooks directly into the project from a bundled payload (no marketplace fetch, no network).",
     "type": "module",
     "bin": {
@@ -42,5 +42,5 @@
         "agent",
         "plugin"
     ],
-    "etnaFingerprint": "ae6ba8fb523a"
+    "etnaFingerprint": "728af89f1e8e"
 }