@openrig/cli 0.5.9 → 0.5.11

package/daemon/context-packs/skills/retiring-and-inheriting-a-seat/SKILL.md

@@ -20,7 +20,7 @@ A **planned** seat transition. A long-lived seat accumulates context; as it near
 window's edge, don't wait for compaction to degrade you into a cold-started agent —
 **retire deliberately** and hand the seat to a fresh successor primed from a packet plus
 the seat's accumulated lineage. The **seat address is stable; its occupants are a lineage.**
-This is the practice that named the "seat" primitive.
+Keep the transition and its authority explicit.
 
 ## Use this when
 
@@ -48,8 +48,9 @@ threshold you can see coming; fall back to compaction only when a transition was
 
 ## The handover sequence
 
-1. **Trigger** — ~85% context, or a deliberate role transition. The oversight-rig context
-   detector can fire this for you; you can also self-initiate when you feel the edge.
+1. **Trigger** — the selected continuity threshold or a deliberate role transition.
+   Use the configured policy and named transition owner; a context estimate alone
+   does not authorize a cutover.
 2. **Author the handover packet, deliberately** — a composed context pack carrying current
    work + next owner, the seat's durable pointers, constraints and authority boundaries, and
    the accumulated **lineage wisdom** ("those before you learned X"). This IS a restore packet
@@ -66,26 +67,29 @@ threshold you can see coming; fall back to compaction only when a transition was
    `orienting-to-an-inherited-seat`** — its world model of what a handover *is*. Carry that
    pointer **in the durable packet artifact itself**; never inject it as a runtime prompt keyed
    to the seat name (that runtime mechanism is the **ghost-prompt** class the orientation skill
-   teaches successors to refuse — and it has misfired on real successors). Artifact-carried
+   teaches successors to refuse). Artifact-carried
    survives the swap for free and needs no enabled gate.
-4. **Preserve the physical seat at cutover** — the live seat address and its canonical tmux
-   session, window, and pane stay stable. Assess the apprentice in a staged session; at the
-   owner-worded cutover, resume the accepted successor history in the original canonical pane
-   and remove the empty staging session. The retiring tenure becomes a cold advisor through its
-   lineage token. Renaming tmux sessions is a repair fallback, because attached clients follow
-   the physical pane rather than the logical seat name.
-5. **Write your lineage-ledger row + a one-line tombstone** (below).
-6. **Optional warm handoff** — a bounded apprenticeship window: the successor asks questions,
-   the predecessor judges fitness, *then* the swap completes. Use it when the seat holds a lot
-   of live judgment; skip it for a clean cut.
+4. **Assess before cutover.** If an apprenticeship or warm handoff is selected,
+   use that staged window for questions and domain work before the owner decides.
+   The incumbent retains authority until the owner-worded cutover; do not retire
+   it merely to free a name while waiting for that decision.
+5. **Preserve the physical seat at cutover** — follow the portable SOP linked from
+   `seat-continuity-and-handover`. Keep the canonical tmux session, window and pane;
+   resume the exact accepted successor history there and reconcile binding,
+   environment, queue identity and attached clients. Preserve the incumbent's
+   exact token as a cold-advisor handle when that is the selected disposition.
+   Renaming tmux sessions is a repair fallback, not the default sequence.
+6. **Write the lineage-ledger row and tombstone** (below). Record the actual
+   outcomes and transfer each standing duty explicitly. Complete the successor's
+   post-cutover self-check before unfreezing authority.
 
 ## Apprentice mode — incumbent
 
 An `apprentice-handover` policy gives you an early preparation boundary, not permission to
 automate the succession decision. Create a fresh, staged, unbound successor; prove the pinned
 model before installing context; then open a **conversation, not a gauntlet**. Give coached
-errands, answer questions, and judge work in the real domain. The experiment's scored probes are
-optional tools whose rigor must match the stakes, not mandatory ceremony.
+errands, answer questions, and judge work in the real domain. Scored probes are optional tools whose rigor must match the stakes, not
+mandatory ceremony.
 
 Stay the authority-bearing incumbent until the named owner words the gate and the mechanic records
 the effect receipt. Before that word, the apprentice may observe, ask, and produce evidence but may
@@ -114,15 +118,15 @@ ledger is the tenure record; work-tree notes remain lived context, not identity
 **Crash-ended tenures** get their row appended **post-hoc** by the crash-cart / restore path,
 flagged **honest-approximate** (the boot-captured session id is what makes this recoverable).
 
-## Do NOT over-inherit — the key lesson from the practice's history
+## Inherit the seat, not the predecessor's identity
 
 **You are inheriting a seat, not becoming your predecessor.** Frame it explicitly to the
 successor: *"agents sat here before you and learned X; you carry the seat's mission, not their
-identity."* The historical failure was agents getting confused about whether they **were** the
-predecessor — carrying a stale self-model, over-claiming prior work as their own. Inherit the
+identity."* Do not claim a predecessor's work as your own or use its stale identity
+as the current binding. Inherit the
 seat's **mission and hard-won lessons**; keep your own **fresh identity and session**.
 
-## Wake v0 — ask the agent who sat before you (a practice, not a verb)
+## Reach back to a retained predecessor
 
 A retired tenure is a cold advisor you can consult. Look up the seat's ledger → get that
 generation's session token → resume it for **one question**, then let it sleep again:
@@ -130,19 +134,22 @@ generation's session token → resume it for **one question**, then let it sleep
 - Claude: `claude -p --resume <session>`
 - Codex: `codex exec` (resume the rollout)
 
-This is also a `rig` verb: `rig ask <rig> "<q>" --wake <seat[@gen]|token>` (CLI 0.5.1; also
-`--runtime`, `--wake-timeout`, default 180s). It wraps the harness resume above and is **not yet
-well-exercised** — if it fails, fall back to `claude -p --resume <full-uuid>`. **A failing wrapper is
-not a closed channel.** The ledger is how you **find** the right predecessor; wake is how you ask them.
+Use `rig ask <rig> "<q>" --wake <seat[@gen]|token>` for an explicit bounded
+consultation (introduced in CLI 0.5.1). Check `rig ask --help` for `--runtime`
+and `--wake-timeout`. The wrapper uses a runtime resume; its presence is not
+proof that a particular retained history is available. For a Claude history,
+`claude -p --resume <full-uuid>` is the runtime-level fallback when supported.
+Diagnose the specific failure before declaring the channel unavailable.
 
 **What to write in your packet about reaching you** — your successor asking you questions is the
 reason this is a handover and not a compaction:
 
-- **State that the channel does not expire**, and give your **verbatim resume handle**. You stay
-  reachable after retirement; the only real bound is your own context wall, hit while answering. Ask
-  them to treat your answers as testimony if you like — that is a posture claim, not a limit on access.
+- **Give your verbatim resume handle and known availability limits.** Retirement alone
+  does not expire retained history. Resuming still depends on that history, runtime
+  access and remaining context; distinguish these failure modes. The advisor
+  supplies testimony and does not regain the live seat's authority.
 - **Pre-form the questions.** Inventory what only you hold and write the questions out. An affordance
-  without a trigger goes unused, so *"you may consult your predecessor"* reliably produces none.
+  needs a trigger: name the tradeoff, missing rationale or conflict that should prompt a question.
 
 **Wake-tenancy — the identity halves (a woken tenure can mistake itself for the live seat).** The
 hardest thing to apply *checked-not-believed* to is your own identity — a retired tenure resumed for a
@@ -165,57 +172,36 @@ question can answer, and act, as if it still held the seat. Two rules close it:
 3. **Session id captured at retirement, not boot** — a crash then leaves no row, or an
    unfindable tenure. Capture at boot.
 4. **Suffixing the LIVE seat** (`<seat>-v2` as the active address) — lineage leaking into
-   identity, the wrong shape. The live address stays clean; only the retiree is versioned.
+   identity, the wrong shape. The live address stays clean; generation belongs in the ledger.
 5. **Tombstone omitted or vague** — the ledger can no longer answer "who did this / who to
    wake." One honest line, every tenure.
 
-## Field-validated refinements (pilot 2026-08-05 — two live runs, both runtimes)
-
-Two live handovers (a Claude seat + a Codex seat) ran this sequence end-to-end and sharpened it:
-
-- **A GATED handover uses STAGED primitives, not an all-in-one verb.** An atomic
-  create/deliver/verify/rebind verb can't pause for a human go/no-go gate. Decompose it: boot the
-  successor **staged (unbound)** → prime it → **retire** the incumbent (this frees the clean seat name)
-  → **HOLD for the gate** → **swap** (bind the successor to the canonical name). The gate sits between
-  retire and swap; a no-go rolls back by renaming the retiree back.
-- **Prime AT BOOT, not walk-after-boot, for a staged successor.** Delivery verbs (`rig walk` / `rig
-  send`) resolve via the **bound** session registry, so they cannot reach an unbound staged successor.
-  Boot it **with the packet as startup/priming context** (the "primed from a handover/startup packet"
-  path). In both runs the successor read the full packet and correctly stated inheritance-not-identity
-  and held.
-- **The lineage ledger is the ONLY reliable wake path — load-bearing, not convenient.** A retired
-  occupant (`<seat>-vN`) is intentionally **absent from the managed registry** — discovery / walk / send
-  cannot find it. The ledger's **boot-captured** session id is how you wake it: `claude -p --resume
-  <id>` (Claude) or `codex exec` resume (Codex) — harness-level, not the rig registry.
-- **Tombstone honest-approximate fallback.** If a long-idle retiree can't be woken to self-write its
-  tombstone, the driver records an honest-approximate one and **flags it as such**.
-- **Telemetry-degraded flag when warranted.** If a fresh successor's activity/producer-link telemetry
-  is degraded, flag its ledger row so no future reader trusts its activity state. (One runtime showed a
-  fresh-launch telemetry gap; the other was clean — capture the reality, don't assume.)
-
-### Production-evidenced (first real-stakes run — a critical-seat generation swap, 2026-08-05)
-
-The first live swap at a critical seat **succeeded** (the successor ruled a live domain question within the
-hour — doctrine intact across the generation) and surfaced two hard refinements:
-
-- **Boot-window queue re-check is REQUIRED — the successor's first action.** A qitem created *during* the
-  swap window can land **after** the handover packet was frozen — and its boot nudge fails
-  `session-not-found` because the seat is mid-cutover. The packet's snapshot is therefore incomplete by
-  construction. So the successor's first action is a **checked-not-believed queue sweep** (`rig queue list`
-  by destination / `--mine`), never trusting the packet's snapshot alone. The swap-window delivery seam is a
-  known product gap until it's closed.
-- **Complete the canonical rename AT cutover — or expect three breakages.** If the staged name
-  (`<seat>-vN-staging`) survives past cutover, it breaks across three identity surfaces with inconsistent
-  enforcement: **transport** (the staged label doesn't resolve; replies to the signature bounce),
-  **queue-claim** (`claim_destination_mismatch` rejects the seat's own claim), and **queue-ledger**
-  (`handoff-and-complete` stamps the phantom staged name durably as `sourceSession`). The product fix is
-  tracked; until it lands, finish the canonical rename at cutover and treat a lingering staged name as a
-  live defect, not cosmetic.
-- **Pre-announce the swap to oversight at swap START.** A live swap fired oversight's liveness detector
-  mid-swap (a false positive, cleared). Oversight clears such flags by consulting handover **receipts** —
-  but receipts only land at swap **end**, so a long swap window can still misfire. So the executing party
-  sends oversight a **one-line pre-announce at swap start** (seat + expected window); oversight honors it
-  as a **suppression window** for its liveness / premature-park flags. See `oversight-team`.
+## Checks around a planned transition
+
+- **Stage and assess before the owner calls cutover.** Use startup context when the
+  successor is unbound; check its actual address before relying on registry-routed
+  delivery. Keep incumbent authority and physical-pane custody until the selected
+  SOP's cutover steps apply. A rejected candidate does not require renaming the
+  incumbent back into a seat it should still hold.
+- **Preserve exact resume handles.** A retained advisor may have no managed node or
+  live pane. The ledger identifies its history independently of the live-seat
+  registry; absence from `rig ps` alone does not prove that history is gone.
+- **Recheck work at the boundary.** Queue items can arrive after the packet was
+  frozen. The successor reads its current owned queue, reconciles transition-window
+  work and staged inputs, and records every remaining obligation.
+- **Verify identity across surfaces.** Canonical binding, provider history,
+  process environment, queue identity and attached clients must agree. Correct a
+  staged identity residue through the supported cutover/reconciliation path;
+  renaming a tmux session alone is not proof that those surfaces agree.
+- **Keep incomplete evidence explicit.** Flag unavailable activity telemetry as
+  unavailable, and mark a tombstone written by someone else as approximate.
+- **Coordinate the maintenance window.** Tell the routing/monitoring owner the
+  target and expected window before an authorized cutover. Only an explicitly
+  configured suppression changes monitoring behavior; close the window with the
+  actual effect receipt, deviations and unresolved gaps.
+
+These are verification prompts, not a claim that a particular runtime transition
+has passed. Use the linked portable SOP for mechanics and record the actual run.
 
 ## See also
 

package/daemon/context-packs/skills/retiring-and-inheriting-a-seat/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "retiring-and-inheriting-a-seat"
-version: "0.5.9"
+version: "0.5.11"
 taxonomy: "skills"
 purpose: "Use when you are a sitting agent near your context threshold (~85%) and a PLANNED seat transition is due — retire deliberately and hand your seat to a fresh successor primed from a packet, rather than let compaction degrade you. Covers the handover packet, the append-only lineage ledger (one row per tenure), physical-seat continuity, the do-not-over-inherit framing, the optional warm-handoff window, and wake-v0 (consulting a retired predecessor). NOT for unplanned compaction/crash recovery (sess"
 files:

package/daemon/context-packs/skills/seat-continuity-and-handover/SKILL.md

@@ -24,17 +24,15 @@ A pair of primitive families that separate *who is sitting in a seat* from
 *what the seat itself is*:
 
 1. **Occupant-creation primitives** — `resume`, `fork`, `rebuild`, `fresh` — produce a candidate new occupant. Answer: "where did the new occupant come from?"
-2. **Seat-binding primitives** — `seat handover`, later `seat transfer` / `seat retire` / `seat swap` — bind a candidate occupant into the topology. Answer: "what happened to the stable seat identity?"
+2. **Seat-binding operations** — handover binds a candidate occupant into the topology. Answer: "what happened to the stable seat identity?" Inspect the current CLI for executable operations; design vocabulary alone does not establish a command.
 
 Core architectural decision: **stable seat identity, fluid occupant
-identity, explicit provenance.** Today's `lead2`/`lead3`/`lead4`/`lead5`
-pattern encodes successor lineage into seat names — that's the wrong
-shape. Stable seat name + separately-recorded provenance trail is the
-right shape.
+identity, explicit provenance.** Do not encode successive occupants into live
+seat names. Keep the stable address and record lineage separately.
 
 ## Use this when
 
-- Replacing a seat's occupant via rebuild, fork, fresh, or future seat-handover
+- Replacing a seat's occupant via rebuild, fork, fresh, or seat-handover
 - Choosing old-occupant disposition: retire / advise / shadow
 - Reasoning about whether a seat's lineage is stable or has drifted
 - Reading or writing the provenance record for a seat
@@ -108,21 +106,28 @@ A seat stays `Stable` even if multiple candidate-occupants were produced and dis
 ## Hard boundaries (do-not list; verbatim)
 
 - **Do NOT collapse `rebuild` and `seat handover` into one primitive.** The design specifically separates them so the system can describe what actually happened.
-- **Do NOT introduce successor-suffix seat names** (`lead2`/`lead3`). Stable seat identity is the architectural goal. *(Reconciliation: this governs the **live** seat address, which stays clean — the seat name is whoever sits now. A **retired** tenure IS versioned (`<seat>-vN`) as the separately-recorded provenance trail / cold wake-target — that is the lineage, not a live successor-suffix. See `retiring-and-inheriting-a-seat` and its lineage ledger.)*
+- **Do NOT introduce successor-suffix seat names** (`lead2`/`lead3`). Stable seat identity is the architectural goal. The live address stays stable. A retired tenure is distinguished by its ledger
+generation and exact history token; preserving it does not require a renamed live pane.
+
 - **Do NOT report `seatBindingOutcome: handed_over`** if the provenance record didn't write durably.
 - **Do NOT auto-rollback a half-completed handover** by re-attaching the old occupant unless detach completed cleanly first.
 
-## Composition: seat handover over fork
+## Composition and current command surface
 
-Once `session_source` fork v1 lands (already shipped at openrig
-`c7b6df1`), the next composition is **seat handover over fork**:
-candidate occupant created via fork, bound into the existing seat via
-handover. Continuity outcome is `forked`; binding outcome is independent.
+A fork can create a candidate occupant; handover binds it into an existing seat.
+The continuity outcome is `forked`; the binding outcome is independent.
 
-## Currently shipped vs deferred
+The packaged `rig handover <seat>` and `rig seat handover <seat>` accept `fresh`,
+`discovered:<id>`, `fork:<id>` and `rebuild` sources. Use `--dry-run` to request
+planning only. Without it, these surfaces can execute; do not infer read-only
+behavior from the shorter seat command's planning-oriented description.
+`rig seat status <seat>` is the read-only observability surface.
 
-- **Option A (rebuild) shipped** at openrig `578bd5c` (2026-04-30): `session_source.mode: rebuild` with `ref.kind: artifact_set`; identity-honesty bedrock at 4 layers (schema dispatch, orchestrator threading, SQLite read-back, negative-grep on resolver output). 26/26 Tier 1 cases green; full daemon regression 2146/2146 PASS.
-- **Option B partially shipped, partially deferred to Mode 3**: the `rig seat handover` CLI exists as a planning/observability surface — `status <seat>` reads the seat-handover observability tables (migration `021`); `handover <seat>` plans a safe two-phase handover sequence with actual execution flowing through existing seat-launch surfaces under operator gating. Full code-direct `SeatHandoverService` daemon module + `seat-binding-outcome` provenance record + nodes-table provenance migration remain deferred to Mode 3. MVP composition `seat handover over fork` is highest-leverage v1.
+Source support is declared by the running daemon and depends on actual identity,
+history and artifact prerequisites. Read the returned source, continuity, binding
+and provenance results independently. A help listing or dry-run is not proof of a
+successful transition. The linked cutover SOP supplies the operator mechanics
+and required effect checks after the named owner authorizes the action.
 
 ## Why load-bearing for RSI
 
@@ -133,13 +138,14 @@ destabilize topology references on each cycle. Provenance must be
 durable AND queryable so RSI loops can decide whether a seat is fresh
 enough to receive new work or needs re-handover.
 
-## Discovery-registration gap (pilot-observed 2026-08-05)
+## Managed binding and retained history
 
-A renamed / retired occupant (`<seat>-vN`, kept alive as a cold advisor) is intentionally **absent from
-the managed node registry** — `rig ps`, discovery, and the delivery verbs (`walk` / `send`) cannot find
-it. This is by design (only bound occupants are registered), and it makes the **lineage ledger +
-boot-captured session id the wake path** (harness-level `--resume` / `codex exec`, not the rig registry).
-Two live handovers confirmed this. See `retiring-and-inheriting-a-seat`.
+A retired advisor's history can remain available without a managed node or live
+pane. Query current binding and the lineage ledger separately: one answers who
+holds the seat, the other identifies the retained history and exact resume token.
+Do not infer that a predecessor is unreachable from registry absence alone, or
+that a preserved token proves a successful resume. Check the actual runtime and
+history when consultation is needed; see `retiring-and-inheriting-a-seat`.
 
 ## See also
 
@@ -148,4 +154,4 @@ Two live handovers confirmed this. See `retiring-and-inheriting-a-seat`.
 - `references/apprentice-evidence-toolkit.md` — optional evidence apparatus selected only when the stakes earn it
 - `session-source-fork` skill — `fork` occupant-creation primitive (sibling)
 - `agent-starters` skill — composes occupant-creation + binding into named reusable starting points
-- `cross-host-rig-commands` skill — multi-host handover (deferred)
+- `cross-host-rig-commands` skill — remote addressing and transport; verify lifecycle support on the target

package/daemon/context-packs/skills/seat-continuity-and-handover/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "seat-continuity-and-handover"
-version: "0.5.9"
+version: "0.5.11"
 taxonomy: "skills"
 purpose: "Use when replacing a seat's occupant (rebuild/handover/swap), reasoning about stable-seat-identity vs fluid-occupant-identity, choosing an old-occupant disposition (retire/advise/shadow), or recording provenance for an occupant change. Two independent outcomes (continuityOutcome + seatBindingOutcome) and the 5 failure modes that prevent silent dishonesty."
 files:

package/daemon/context-packs/skills/session-compaction-and-restore/SKILL.md

@@ -139,20 +139,18 @@ transcript > touched-files > `restore-summary.json`.**
 
 ## Memory surfaces consumed at restore time
 
-This primitive consumes multiple externalized memory surfaces. Per the
-externalized-memory-surfaces convention's 13-row first inventory pass,
-the primary rows for restore are:
-
-| Row | Surface |
-|---|---|
-| 1 | Transcripts |
-| 2 | Durable chat |
-| 3 | Startup replay context |
-| 5 | Checkpoints |
-| 12 | Restore/reentry packets and Agent Starters |
-
-The umbrella's authority-rank + permission-posture columns govern which
-surfaces a restore path can write vs only read.
+A restore may consume transcripts, durable messages, startup context,
+checkpoints and a restore packet. Inventory the surfaces actually present for
+this seat, with their source, freshness and purpose. Do not infer that a named
+surface exists or grants write authority.
+
+The active project/rig policy and task authorization determine what may be
+written. Treat provider-owned conversation records as evidence to read through
+supported tooling. For placement and durable context, load
+`skills/openrig-operating-model/SKILL.md` with `rig context get`; for the
+selected startup path, use `skills/core/agent-startup-and-context-ingestion/SKILL.md`.
+A packet or marker proves retained/delivered evidence, not successful provider
+restoration; measure the resumed seat against the proof standard above.
 
 ## See also
 
@@ -160,4 +158,4 @@ surfaces a restore path can write vs only read.
 - `mental-model-ha` skill — HA-pair compaction recovery (different scenario; sister primitive)
 - `session-source-fork` skill — `fork` mode for native-runtime-continuity-based restoration
 - `seat-continuity-and-handover` skill — occupant-creation primitives (resume/fork/rebuild/fresh) that this primitive instantiates
-- `externalized-memory-surfaces` skill — umbrella convention listing all surfaces this primitive consumes
+- `openrig-operating-model` skill — placement and authority of durable context

package/daemon/context-packs/skills/session-compaction-and-restore/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "session-compaction-and-restore"
-version: "0.5.9"
+version: "0.5.11"
 taxonomy: "skills"
 purpose: "Use when reasoning about what survives compaction/context-loss/restart/seat-refresh, designing a high-fidelity restore packet, or distinguishing native runtime resume vs fork vs artifact-backed mental-model rebuild. Covers the 4 failure modes that prevent honest restore (compacted seat drops hot potato; restore packet preserves details but loses product intent; runtime resume mistaken for handover or fork; rebuilt seat starts with stale instructions)."
 files:

package/daemon/context-packs/skills/software-for-agents/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "software-for-agents"
-version: "0.5.9"
+version: "0.5.11"
 taxonomy: "skills"
 purpose: "Use when older OpenRig instructions name software-for-agents or describe agent-in-the-middle or studio software under the former skill name."
 files:

package/daemon/context-packs/world-example/manifest.yaml

@@ -1,5 +1,5 @@
 name: world-example
-version: "0.5.9"
+version: "0.5.11"
 taxonomy: world
 purpose: "A fill-in template showing the anatomy of an OpenRig world pack."
 files:

package/daemon/context-packs/world-public/build-your-world.md

@@ -39,18 +39,23 @@ The address is the source: retrieve it with `rig context get <address>` before m
 
 | Dimension | Exact address | What it contains | Read it when the task asks you to… |
 |---|---|---|---|
-| product | `project-world/identity/product-identity-and-instincts.md#current-position` | The current product position and the instincts the team protects. | choose what OpenRig should optimize or trade one product quality against another. |
-| topology | `project-world/craft/topology-design-judgment.md#judgment-rules` | Judgment rules for cutting seats, pods, edges, and responsibility boundaries. | add, split, merge, or assign a seat, pod, edge, or responsibility boundary. |
+| product | `world-public/boundaries.md#this-pack-does-not-cover` | The boundary of public guidance; the project must supply its actual purpose and product judgment. | choose a product outcome or tradeoff and locate the project authority that can decide it. |
+| topology | `skills/core/openrig-architect/SKILL.md` | Portable topology authoring, role selection, validation and context guidance. | add, split, merge, or assign a seat, pod, edge, or responsibility boundary. |
 | context | `world-public/build-your-world.md#separate-kinds-tag-regions` | The World/Lore/Skills/Mission separation and region-tagging rule. | decide where knowledge belongs or whether it should be preloaded. |
 | skill | `onboarding-width/public-reference-material.md#the-one-you-read-rather-than-consult` | The operating-model entry point and how it differs from lookup references. | choose an operating model or repeatable procedure instead of improvising one. |
 | queue/custody | `onboarding-width/public-what-you-can-do.md#making-work-outlive-you` | Durable queue ownership, state, blocking, and transactional handoff. | assign, claim, block, hand off, or close work that must survive a turn or occupant. |
 | source/worktree | `onboarding-width/public-reference-material.md#the-command-surface-docs-as-built-in-the-source-repo` | The maintained as-built source map and its trust metadata. | locate the source owner, choose authoritative documentation, or separate branch state from running behavior. |
-| proof/review | `project-world/craft/seam-first-negative-proof.md#the-discipline` | The seam-first negative-proof discipline and causal RED rule. | decide what evidence proves a cross-component change or design its negative control. |
-| lifecycle/release | `project-world/project-authority/release-ownership.md` | The release manager's public-release ownership and operator boundary. | adopt a runtime, fold a candidate, or decide who may perform public release mechanics. |
+| proof/review | `skills/process/verification-before-completion/SKILL.md` | Evidence before claims, content checks and untested dimensions; apply the project-selected proof standard. | decide what evidence supports a change or design its negative control. |
+| lifecycle/release | `skills/core/rig-lifecycle/SKILL.md` | Lifecycle mechanics and limits; release ownership must come from the actual project authority. | plan a lifecycle operation and resolve who may execute or publish it. |
 | continuity/recovery | `onboarding-width/public-what-you-can-do.md#when-something-is-broken` | Recovery, handover, compaction, snapshot, and restore capabilities. | restore, hand over, compact, or recover a seat, rig, daemon, or host without losing continuity. |
-| host-boundary | `project-world/project-authority/lifecycle-authority.md` | The asymmetric VM versus parent-host lifecycle authority. | move an operation between the recoverable VM and parent host or infer authority across that boundary. |
-
-The map reveals where a question lives. It does not replace the source, preload its answer, or make an unavailable local authority public.
+| host-boundary | `skills/core/cross-host-rig-commands/SKILL.md` | Host addressing, transport and verification limits; local authority remains separately declared. | move an operation between hosts or determine which target and authority apply. |
+
+The addresses above are public entry points, not this project's decisions. When a
+row calls for local product, release or host authority, resolve the configured
+project context and record its exact address before acting. If no such authority
+is authored or available, report the missing decision; do not treat the public
+mechanics guide as permission. The map reveals where to start without inventing
+a builtin project policy.
 
 Inspect the public pack and compose it for a fresh session:
 

package/daemon/context-packs/world-public/manifest.yaml

@@ -1,5 +1,5 @@
 name: world-public
-version: "0.5.9"
+version: "0.5.11"
 taxonomy: world
 purpose: "A portable operating-world primer that derives volatile facts and teaches agents to author their own world."
 files:

package/daemon/dist/adapters/tmux.d.ts

@@ -1,6 +1,6 @@
 export type ExecFn = (cmd: string) => Promise<string>;
 /**
- * Injectable file/buffer operations for the large-payload `sendText` path.
+ * Injectable file/buffer operations for `sendText`.
  * Split out so tests can observe temp-file writes and unique-name generation
  * without touching the real filesystem; production wires node fs + os.tmpdir.
  */
@@ -101,24 +101,22 @@ export declare class TmuxAdapter {
      */
     hasSession(name: string): Promise<boolean>;
     createSession(name: string, cwd?: string, env?: Record<string, string>): Promise<TmuxResult>;
-    sendText(target: string, text: string): Promise<TmuxResult>;
     /**
-     * Large-payload delivery path (the point of this transport change): a
-     * >100KB startup pack must NOT be embedded in a tmux/shell argv. The text is
-     * written to a unique temp file via Node fs (never shell-embedded), loaded
-     * into a unique tmux buffer, and pasted with `-d -r`:
+     * Paste text at every size. Unbracketed input can be consumed as individual
+     * keystrokes by agent TUIs, losing text even below the old 8 KiB cutoff.
+     * A file keeps payload bytes out of shell/tmux argv and its size limits.
+     *   `-p`  bracket the paste when the receiving application enables that mode.
      *   `-r`  preserve raw LF. tmux's default paste-buffer replaces every LF with
      *         CR, and CR (= `C-m` = Enter) is SUBMIT in the Claude/Codex TUIs - a
      *         default paste of a multi-line pack would submit on every newline.
      *   `-d`  drop the buffer after a successful paste.
-     * The single trailing submit stays the caller's separate `sendKeys(["C-m"])`,
-     * exactly as the inline `send-keys -l` path relies on (behavior-preserving).
+     * The single trailing submit stays the caller's separate `sendKeys(["C-m"])`.
      * Cleanup unlinks the temp file in `finally`; if the buffer was loaded but the
      * paste failed (e.g. missing target), an explicit `delete-buffer` runs so no
      * buffer leaks. Unique temp + buffer names per call keep parallel `rig up`
      * seats from colliding.
      */
-    private sendTextViaBuffer;
+    sendText(target: string, text: string): Promise<TmuxResult>;
     sendKeys(target: string, keys: string[]): Promise<TmuxResult>;
     setWindowOption(target: string, option: string, value: string): Promise<TmuxResult>;
     resizeWindow(target: string, cols: number, rows: number): Promise<TmuxResult>;

package/daemon/dist/adapters/tmux.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tmux.d.ts","sourceRoot":"","sources":["../../src/adapters/tmux.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEtD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,+EAA+E;IAC/E,OAAO,IAAI,MAAM,CAAC;IAClB,uFAAuF;IACvF,UAAU,IAAI,MAAM,CAAC;CACtB;AAwBD,MAAM,MAAM,UAAU,GAClB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,GACpB;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE,GACnB;IAAE,KAAK,EAAE,uBAAuB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAqJtD,qBAAa,WAAW;IACV,OAAO,CAAC,IAAI;IAAU,OAAO,CAAC,OAAO;gBAA7B,IAAI,EAAE,MAAM,EAAU,OAAO,GAAE,WAAkC;IAE/E,YAAY,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAUtC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAUvD,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAUpD;;;;;;;;;OASG;IACG,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAkBvD;;;;;OAKG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK1C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;IAc5F,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAejE;;;;;;;;;;;;;;;OAeG;YACW,iBAAiB;IA0BzB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAU7D,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAUnF,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAgB7E,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAUpD;;;;;;;;;;;;;;;;;yGAiBqG;IAC/F,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GACpD,OAAO,CAAC,UAAU,CAAC;IAetB;;;uCAGmC;IAC7B,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;IAU3E;+GAC2G;IACrG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASlD;;qEAEiE;IAC3D,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAarF,oFAAoF;IAC9E,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAWxD;;8FAE0F;IACpF,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAU/C,iFAAiF;IAC3E,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAU5D;;;;+BAI2B;IACrB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAYlF,4DAA4D;IACtD,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAajF,mCAAmC;IAC7B,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAU5D,wEAAwE;IAClE,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IASpF;;;;;OAKG;IACG,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAS/D;;;;;OAKG;IACG,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAkB/E;;;;;;;OAOG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAU5F;;;;;;OAMG;IACG,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAUzE;;;;OAIG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAU9D,gFAAgF;IAC1E,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAShF;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAelE;;;;;;;OAOG;IACG,WAAW,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAU1C;;;;;OAKG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CASxE"}
+{"version":3,"file":"tmux.d.ts","sourceRoot":"","sources":["../../src/adapters/tmux.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEtD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,+EAA+E;IAC/E,OAAO,IAAI,MAAM,CAAC;IAClB,uFAAuF;IACvF,UAAU,IAAI,MAAM,CAAC;CACtB;AAWD,MAAM,MAAM,UAAU,GAClB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,GACpB;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE,GACnB;IAAE,KAAK,EAAE,uBAAuB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAqJtD,qBAAa,WAAW;IACV,OAAO,CAAC,IAAI;IAAU,OAAO,CAAC,OAAO;gBAA7B,IAAI,EAAE,MAAM,EAAU,OAAO,GAAE,WAAkC;IAE/E,YAAY,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAUtC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAUvD,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAUpD;;;;;;;;;OASG;IACG,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAkBvD;;;;;OAKG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK1C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;IAclG;;;;;;;;;;;;;;OAcG;IACG,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA0B3D,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAU7D,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAUnF,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAgB7E,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAUpD;;;;;;;;;;;;;;;;;yGAiBqG;IAC/F,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GACpD,OAAO,CAAC,UAAU,CAAC;IAetB;;;uCAGmC;IAC7B,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;IAU3E;+GAC2G;IACrG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASlD;;qEAEiE;IAC3D,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAarF,oFAAoF;IAC9E,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAWxD;;8FAE0F;IACpF,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAU/C,iFAAiF;IAC3E,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAU5D;;;;+BAI2B;IACrB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAYlF,4DAA4D;IACtD,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAajF,mCAAmC;IAC7B,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAU5D,wEAAwE;IAClE,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IASpF;;;;;OAKG;IACG,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAS/D;;;;;OAKG;IACG,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAkB/E;;;;;;;OAOG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAU5F;;;;;;OAMG;IACG,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAUzE;;;;OAIG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAU9D,gFAAgF;IAC1E,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAShF;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAelE;;;;;;;OAOG;IACG,WAAW,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAU1C;;;;;OAKG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CASxE"}

package/daemon/dist/adapters/tmux.js

@@ -10,18 +10,6 @@ function defaultTmuxFileOps() {
         bufferName: () => `openrig_${process.pid}_${randomUUID().replace(/-/g, "")}`,
     };
 }
-/**
- * Payloads at or below this byte size go through the inline `send-keys -l`
- * path. Larger payloads are written to a temp file and delivered via a tmux
- * paste-buffer. TWO ceilings bound the inline path, and the binding one is
- * tmux's own: tmux rejects long command lines with "command too long" at a
- * measured ceiling of ~9.4KB — far below the OS per-arg limit (Linux
- * MAX_ARG_STRLEN ~128KB) the prior 100KB threshold was sized against. A
- * 19.8KB world-install piece failed live on exactly that gap (Test-A
- * preflight repair, 2026-08-24). 8KB keeps normal command/control text
- * inline and routes everything above through the proven buffer path.
- */
-const LARGE_PAYLOAD_THRESHOLD_BYTES = 8 * 1024;
 const TMUX_FIELD_SEPARATOR = "|";
 const SESSION_FORMAT = [
     "#{session_name}",
@@ -260,38 +248,22 @@ export class TmuxAdapter {
             return classifyWriteError(err);
         }
     }
-    async sendText(target, text) {
-        if (Buffer.byteLength(text, "utf8") > LARGE_PAYLOAD_THRESHOLD_BYTES) {
-            return this.sendTextViaBuffer(target, text);
-        }
-        // `--` (end-of-options) is required so text beginning with `-` (e.g. `---`
-        // YAML frontmatter) is taken literally, not parsed as flags. OPR.0.3.3.17.
-        const cmd = `tmux send-keys -t ${shellQuote(target)} -l -- ${shellQuote(text)}`;
-        try {
-            await this.exec(cmd);
-            return { ok: true };
-        }
-        catch (err) {
-            return classifyWriteError(err);
-        }
-    }
     /**
-     * Large-payload delivery path (the point of this transport change): a
-     * >100KB startup pack must NOT be embedded in a tmux/shell argv. The text is
-     * written to a unique temp file via Node fs (never shell-embedded), loaded
-     * into a unique tmux buffer, and pasted with `-d -r`:
+     * Paste text at every size. Unbracketed input can be consumed as individual
+     * keystrokes by agent TUIs, losing text even below the old 8 KiB cutoff.
+     * A file keeps payload bytes out of shell/tmux argv and its size limits.
+     *   `-p`  bracket the paste when the receiving application enables that mode.
      *   `-r`  preserve raw LF. tmux's default paste-buffer replaces every LF with
      *         CR, and CR (= `C-m` = Enter) is SUBMIT in the Claude/Codex TUIs - a
      *         default paste of a multi-line pack would submit on every newline.
      *   `-d`  drop the buffer after a successful paste.
-     * The single trailing submit stays the caller's separate `sendKeys(["C-m"])`,
-     * exactly as the inline `send-keys -l` path relies on (behavior-preserving).
+     * The single trailing submit stays the caller's separate `sendKeys(["C-m"])`.
      * Cleanup unlinks the temp file in `finally`; if the buffer was loaded but the
      * paste failed (e.g. missing target), an explicit `delete-buffer` runs so no
      * buffer leaks. Unique temp + buffer names per call keep parallel `rig up`
      * seats from colliding.
      */
-    async sendTextViaBuffer(target, text) {
+    async sendText(target, text) {
         const path = this.fileOps.tmpName();
         const buffer = this.fileOps.bufferName();
         let bufferLoaded = false;
@@ -299,7 +271,7 @@ export class TmuxAdapter {
             await this.fileOps.writeFile(path, text);
             await this.exec(`tmux load-buffer -b ${shellQuote(buffer)} ${shellQuote(path)}`);
             bufferLoaded = true;
-            await this.exec(`tmux paste-buffer -t ${shellQuote(target)} -b ${shellQuote(buffer)} -d -r`);
+            await this.exec(`tmux paste-buffer -t ${shellQuote(target)} -b ${shellQuote(buffer)} -d -r -p`);
             return { ok: true };
         }
         catch (err) {