@r1z4x/tezgah 1.7.0 → 1.8.3

package/bin/tezgah-taste

@@ -500,7 +500,8 @@ DIFF_MAX = 1500
 def repo_root(path):
     out = subprocess.run(["git", "-C", path, "rev-parse", "--show-toplevel"],
                          capture_output=True, text=True)
-    return out.stdout.strip() if out.returncode == 0 and out.stdout.strip() else None
+    top = out.stdout.strip() if out.returncode == 0 else ""
+    return tezgah_paths.project_top(top) if top else None
 
 
 def sig_id(*parts):
@@ -712,10 +713,12 @@ def write_line(learning):
 
 
 def store_or_exit(args):
-    """The repository whose taste store a command opens. Refused when its
-    `.tezgah` came with the clone: those files are the project's data, and
-    opening the store would import, rename or create files in them."""
-    repo = repo_root(os.path.abspath(args.repo or os.getcwd()))
+    """The repository whose taste store a command opens: the main checkout's,
+    from a linked worktree too (plan 097). Refused when its `.tezgah` came with
+    the clone: those files are the project's data, and opening the store would
+    import, rename or create files in them."""
+    top = repo_root(os.path.abspath(args.repo or os.getcwd()))
+    repo = top and (tezgah_paths.linked_main(top) or top)
     if not repo:
         raise SystemExit(misuse("not inside a git repository"))
     if tezgah_paths.workspace_from_repo(repo):

package/docs/architecture.md

@@ -168,13 +168,30 @@ The cache dir is resolved once per process and falls back to a temp dir on a
 sandboxed host, so one session's state never splits across two files
 (`hooks/tezgah_paths.py::cache_dir`). Per-repo state — `.tezgah/plans/open/`,
 `.tezgah/lessons.md`, `.tezgah/research/` — lives in the repository, and the
-checkout is the source from which the plugin copy is made. Each checkout of a
-repository keeps its own: a linked `git worktree` gets its own `.tezgah`, locks
-and private git repository, never a share of the main checkout's. It sees the
-others read-only - the session-start line above and `tezgah-research --all` -
-through `worktrees`, which lists `<main>/.git/worktrees/*/gitdir` with no git
-fork and skips an entry whose checkout is gone, as git's own `prunable` does
-(`hooks/tezgah_paths.py::worktrees`).
+checkout is the source from which the plugin copy is made. A repository keeps
+one workspace, in its main checkout. A session or CLI in a linked `git worktree`
+reads and writes the main checkout's `.tezgah`: the session context
+(`hooks/tezgah_context.py::context_for`), `tezgah-task`
+(`bin/tezgah-task::main_root`), the slice journal
+(`hooks/tezgah_task.py::slice_dir`), `tezgah-research`
+(`bin/tezgah-research::repo_root`), `tezgah-decisions`, the taste CLI and taste
+capture (`hooks/tezgah_taste.py::enabled`). A
+worktree's own `.tezgah` went with `git worktree remove`, and so did everything
+a session wrote there. `tezgah-research check` still resolves a line's citations
+against the checkout it runs in, where the branch's code is. The session-start
+line names every checkout through `worktrees`, which lists
+`<main>/.git/worktrees/*/gitdir` with no git fork and skips an entry whose
+checkout is gone, as git's own `prunable` does (`hooks/tezgah_paths.py::worktrees`).
+It also names a worktree whose own `.tezgah` still holds data from before, with
+the `tezgah-research import` that moves its lines (`hooks/tezgah_context.py::sibling_line`).
+Session start in a linked worktree makes its `.tezgah` a link to the main one
+(`hooks/tezgah_paths.py::link_workspace`). A relative `.tezgah/...` write lands
+there, and `/.tezgah` goes to the repository's `info/exclude`.
+A second clone is another repository, with a workspace of its own.
+A path inside `.tezgah` belongs to the repository around it, never to `.tezgah`.
+The workspace keeps its own `.git`, so git's top-level answers `.tezgah` there.
+Every resolver passes that answer through `hooks/tezgah_paths.py::project_top`.
+So tezgah never creates a `.tezgah`, `.cursor`, `.opencode` or graph index inside it.
 
 ## Invariants
 

package/docs/environment.md

@@ -112,7 +112,9 @@ the kill switches are files, not variables, and live in
 
 | Variable | Read by | Default | Effect |
 |---|---|---|---|
-| `TEZGAH_SESSION` | `bin/tezgah-status::main`, `bin/tezgah-docs`, `bin/tezgah-route`, `bin/tezgah-triage`, `hosts/omp/tezgah-hook.ts.in` | unset; the omp hook exports it to its shells | The session id `tezgah-docs`, `tezgah-route` and `tezgah-triage` write their ledger rows under, and the id `tezgah-status` lights its "used" marks from when none is passed. |
+| `TEZGAH_SESSION` | `bin/tezgah-status::main`, `bin/tezgah-docs`, `bin/tezgah-route`, `bin/tezgah-triage`, `bin/tezgah-task`, `bin/tezgah-doctor`, `hooks/tezgah_guard.py`, `hosts/omp/tezgah-hook.ts.in` | unset; the omp hook exports it to its shells, and on Claude `hooks/projects-auto-init.py::export_session` appends it to `CLAUDE_ENV_FILE` | The session id `tezgah-docs`, `tezgah-route` and `tezgah-triage` write their ledger rows under, and the id `tezgah-status` lights its "used" marks from when none is passed. `tezgah-task` limits its review guard, slice board and slice lookups to this session. `tezgah-doctor --clean` keeps this session's state. The hook guard writes its crash row under it when the payload names no session. |
+| `CODEX_THREAD_ID`, `CURSOR_CONVERSATION_ID` | `bin/tezgah-route` | set by Codex and Cursor in their agent shells | The session `tezgah-route` writes its rows under when `TEZGAH_SESSION` is unset. When two of the three name different sessions, an inherited id is present and no row is written. |
+| `CLAUDE_ENV_FILE` | `hooks/projects-auto-init.py::main` | set by Claude Code for SessionStart hooks | The file Claude sources before each Bash call; `export_session` appends `TEZGAH_SESSION` to it. |
 | `TEZGAH_CORE_IN_FILE` | `hooks/projects-auto-init.py::core_is_in_a_file`, `hooks/hooks.json` | unset | `1` (set by the Claude plugin's hook rows) drops the core rules from the injection when the host's static file really carries the tezgah block; a file without it falls back to the hook. |
 | `TEZGAH_NESTED` | `hooks/tezgah_integrity.py::_shape_block`, `bin/consult` | unset | Set by consult on the agent CLIs it runs: that session's Stop rule does not fire. |
 | `TEZGAH_CALL_OUTCOME` | `hooks/projects-posttooluse.py::main`, `hosts/dsh/hooks.json` | unset | `none` (dsh's Task rows) records the call's outcome as unknown instead of as a pass. |

package/docs/evidence.md

@@ -117,7 +117,7 @@ a write tool is `edit`, a shell call is `verify` when its command matches the ch
 | `turn` | `hooks/tezgah_integrity.py::note_turn`, from the prompt path | `hooks/tezgah_integrity.py::_turn_start`, scoping every turn rule; `hooks/tezgah_integrity.py::_claim_key` |
 | `run`, `edit`, `verify`, `verify_ok`, `verify_fail`, `interrupted` | `hooks/tezgah_integrity.py::note_tool`, the call's own name in `tool`, on opencode the plugin writes these same kinds and the same field (`hosts/opencode/plugins/tezgah.js:1215-1293`) | the Stop rule's `worked` set `hooks/tezgah_integrity.py::WORK_KINDS`; `counters.steps` `hooks/tezgah_integrity.py::_counts`; `last_verify`/`partial_state`; the `--trend` tool histogram |
 | `external`, `unknown` | `hooks/tezgah_integrity.py::note_tool` | the taint notice, via `source`; the `--trend` tool histogram; nothing counts them as work |
-| `todo` | `hooks/tezgah_integrity.py::note_todo`, from `note_tool` for a todo call: omp `todo` (the bridge sends the list from the result's `details`), Claude and dsh `TodoWrite` (their PostToolUse matcher), opencode `todowrite` (the plugin's own `recordTodo`), Cursor `todo_write` and Codex `update_plan`, which arrive with no matcher. `open`, `ready` and `blocked` count the list, and `detail` holds the ready items' heads, one per line | the `ready steps` Stop class (`hooks/tezgah_integrity.py::ready_left`) and the idle-wait warning (`hooks/tezgah_gate.py::ready_advice`) |
+| `todo` | `hooks/tezgah_integrity.py::note_todo`, from `note_tool` for a todo call: omp `todo` (the bridge sends the list from the result's `details`), Claude and dsh `TodoWrite` (their PostToolUse matcher), opencode `todowrite` (the plugin's own `recordTodo`), Cursor `todo_write` and Codex `update_plan`, which arrive with no matcher. `open`, `ready` and `blocked` count the list, `detail` holds the ready items' heads, one per line, `taken` holds the in-progress items' heads, and `partial` marks a Cursor `merge: true` list | the `ready steps` and `open todo` Stop classes (`hooks/tezgah_integrity.py::ready_left`, `hooks/tezgah_integrity.py::open_left`) and the idle-wait warning (`hooks/tezgah_gate.py::ready_advice`) |
 | `wait` | `hooks/tezgah_integrity.py::note_tool`, for omp's `wait` | `hooks/tezgah_gate.py::ready_advice`, which counts it as idle; nothing counts it as work |
 | `ask` | `hooks/tezgah_gate.py::ask_advice`, for an omp `ask` or Claude AskUserQuestion call: `detail` holds the questions, cut; `questions` counts them and `defaults` the ones with a recommended option | nothing refuses on it; the row is the record of what the session asked |
 | `grant` | `hooks/tezgah_context.py::context_for`, from each prompt's `user_grants` (`hooks/tezgah_context.py::user_grants`): `detail` holds the user's clause, `target` the outward class it covers (`push`, `release`, `publish`, `pr` or `all`), or `lift:<class>` when the prompt took it back | `hooks/tezgah_integrity.py::grants_in_force`, read by the `needless ask` Stop class and the ask-tool warning |
@@ -499,6 +499,14 @@ The four shape classes share their switches with the text they enforce: `adhd-of
    (`hooks/tezgah_gate.py::ready_advice`). The warning needs a spawn with nothing after it but
    waits and todo updates, and a ready item no running slice names. It rides back with the wait's
    result.
+   **open todo**, beside it (plan 097): the reply claims done while the same `todo` row still holds
+   an item in progress. The count is `open - blocked - ready`, and `taken` names the heads
+   (`hooks/tezgah_integrity.py::open_left`). The claim is the one `asserted_claims` reads, so a
+   question or a negation is no claim. An in-progress item passes like a ready one: one reply line
+   names it beside a blocker token. A blocked item does not count. A Cursor `merge: true` row
+   holds only the changed items, so the class skips a row marked `partial`. `_residual_block`
+   asks it right after `ready steps`, on the same parsed row (`hooks/tezgah_integrity.py::_turn_todo`),
+   under the same scope and switches. It counts as a false completion, since the reply claims done.
 13. **needless ask** — the reply ends on a question the agent can decide (plan 086, S3). The
    last line asks: it ends on "?" or a pack's question particle
    (`hooks/tezgah_integrity.py::QUESTION_END`). Its paragraph names no recommended default, and

package/docs/gate.md

@@ -155,7 +155,7 @@ Off: `lang-off`, the rule's own switch (`hooks/tezgah_gate.py::decision`), and `
 Trigger: another session recorded a write of this call's file inside `RACE_WINDOW_MIN = 10` minutes (`hooks/tezgah_gate.py::RACE_WINDOW_MIN`). The call's files are
 its path field, its `apply_patch` headers, or a shell redirect or `tee` target (`hooks/tezgah_gate.py::write_paths`, `hooks/tezgah_gate.py::race_reason`).
 The reader counts an `edit` row and a shell `run` row that carries a `target` (`hooks/tezgah_integrity.py::writers_elsewhere`).
-Scratch is skipped: a temp file or a device (`hooks/tezgah_integrity.py::scratch_target`). A `run` row that writes only scratch carries no `target`. The rule also skips the harness's own channels (`hooks/tezgah_gate.py::URI_CHANNEL`), such as `agent://`, `xd://` and `conflict://`. It skips a shell target with an unknown variable too.
+Scratch is skipped: a temp file or a device (`hooks/tezgah_integrity.py::scratch_target`). A file a git checkout holds is never scratch, even when the checkout lives under the temp dir (`hooks/tezgah_gate.py::_scratch`). A `run` row that writes only scratch carries no `target`. The rule also skips the harness's own channels (`hooks/tezgah_gate.py::URI_CHANNEL`), such as `agent://`, `xd://` and `conflict://`. It skips a shell target with an unknown variable too.
 It skips this session's own subagent once its slice record has closed after the subagent's newest write of the file (`hooks/tezgah_gate.py::ended_child`). The writer ledger's `spawned` row names the child, and the record is read after `pending` closes an ended omp child. A child with no record, an open one, or a write newer than the close stays refused.
 Told: re-read the file and re-apply the change to what is on disk now (`RACE_DENY`
 `hooks/tezgah_gate.py::RACE_DENY`). The text names each writer by its relation to this session (`hooks/tezgah_gate.py::RACE_WHO`, `hooks/tezgah_integrity.py::_relation`).
@@ -170,7 +170,7 @@ Trigger: a write into a file an open sibling slice owns, or into the main checko
 A brief's `Owns:` line holds the globs, split on commas and spaces, or lists them as `- glob` items under it. The slice record stores them as `owns` (`hooks/tezgah_task.py::owned_globs`, `hooks/tezgah_task.py::open_slice`). The owner is the open record whose globs match (`hooks/tezgah_task.py::owner_of`). A reader, an agent named for a read-only role such as a reviewer, holds no lease.
 The main-checkout refusal reads the worktree a `Worktree:`, `Checkout` or `Cwd:` line declares, the slice's own task first (`hooks/tezgah_task.py::_declared_in`). A path the brief only names declares nothing, and a declared main checkout means the slice works there. The journal still keeps the named worktree for reconcile, resume and the board.
 A shell target resolves against the call's own `cwd` and every `cd` or `pushd` before it (`hooks/tezgah_gate.py::_shell_dir`). A redirect to `/dev/*` or a descriptor writes no file.
-A slice may write a path its own `Owns:` names. The `.tezgah` directory and scratch stay free, and a closed owner frees its files.
+A slice may write a path its own `Owns:` names. The `.tezgah` directory and scratch stay free, and a closed owner frees its files. A checkout under the temp dir is not scratch here either (`hooks/tezgah_gate.py::_scratch`).
 On omp, the ledger's `spawned` row maps the writing session to its record (`hooks/tezgah_integrity.py::spawn_of`, `hooks/tezgah_task.py::slice_of`). A Claude background child maps through the `agent_id` its calls carry, which the spawn's result named (`hooks/projects-posttooluse.py`). Its SubagentStop closes the record (`hooks/tezgah_task.py::close_child`). Everything else fails open. A Claude foreground agent, dsh, Cursor and opencode open the record only once the child has ended, and Codex writes no `spawned` row.
 Told: the owner, its globs, how to reach it - omp `write agent://<name>`, Claude `SendMessage`, else the parent - and the `tezgah-task slice done <id>` that frees it (`hooks/tezgah_gate.py::LEASE_DENY`, `hooks/tezgah_gate.py::MAIN_CHECKOUT_DENY`). Standing while the owner's record runs.
 Off: `orchestrate-off`, whose fan-out rule it backs, and `slices-off`, which keeps no record to read (`hooks/tezgah_gate.py::decision`).
@@ -181,12 +181,14 @@ A spawn whose writing slices name one worktree gets a warning, never a refusal,
 Trigger: a write tool, or a shell command that writes a file, while an active task is set — a plan file under `.tezgah/plans/open` whose frontmatter carries a valid
 `phase` (`tezgah_task.active`). The phase refuses a write in a reading phase (`hooks/tezgah_gate.py::TASK_PHASE_DENY`) and a shell command that writes one (`hooks/tezgah_gate.py::TASK_SHELL_DENY`,
 against `hooks/tezgah_gate.py::SHELL_WRITE`); the allowlist refuses a target outside it (`hooks/tezgah_gate.py::TASK_SCOPE_DENY`) — a write tool's path, and a shell command's redirect or `tee` target (`hooks/tezgah_gate.py::write_paths`); and a write whose target IS the record, by a write tool or a shell redirect/`tee`, is refused
-(`hooks/tezgah_gate.py::TASK_RECORD_DENY`), because only `bin/tezgah-task` writes it and that CLI makes the checks a retyped frontmatter would skip. Told:
+(`hooks/tezgah_gate.py::TASK_RECORD_DENY`) - the active task's record and any other open plan that carries a phase (`hooks/tezgah_task.py::phased_record`), matched without case and read against the main checkout, so a session in a worktree meets the same rule - because only `bin/tezgah-task` writes it and that CLI makes the checks a retyped frontmatter would skip. Told:
 the move that lifts it, made by the session itself — `tezgah-task phase implementation` or `tezgah-task allow <glob> ... --why "<reason>"` — since the orchestrator owns the plan lifecycle and the CLI refuses
-the move until the plan's Acceptance, spike and checkpoint are in order, and records the reason for a widened scope (`allowed_why:`). The record's body has its own writers, on any open plan. `tezgah-task tick NNN <n> [--undo]` ticks Acceptance item n (`bin/tezgah-task::cmd_tick`). `tezgah-task note NNN state|next "<text>"` replaces the newest `## State` or the `## Next` body (`bin/tezgah-task::cmd_note`). Neither commits. Standing: only the record changing lifts it.
-Scratch meets no allowlist: a temp file or a device, such as `pytest > /tmp/check.log` (`hooks/tezgah_gate.py::task_reason`). Build output inside the repo stays held.
-Three targets are no project file, so neither the phase nor the allowlist refuses them (`hooks/tezgah_gate.py::unnamed_target`). A URI is one: a tool device (`xd://<tool>`), an agent message (`agent://X`) or a conflict resolution (`conflict://2`). A `file://` URI names a checkout file and stays held. A shell target with an unknown variable is another. `write_paths` first expands a variable from an assignment earlier on the line. So the allowlist holds `B=src; git diff > $B/x.patch` as `src/x.patch`. A variable the same line set to the checkout, such as `R=$(git rev-parse --show-toplevel)`, is read as the checkout (`hooks/tezgah_gate.py::known_tail`). The third is tezgah's own workspace under `.tezgah/`, such as research lines, lessons and briefs (`hooks/tezgah_gate.py::workspace_free`). The slice journal stays held. So does a plan file whose text sets `phase:` and every shell write into `.tezgah/plans/open/`, because such a file could make itself the active task. The record rule still refuses the active record there.
-The gate matches a file in a linked worktree of the same repository relative to that worktree's top (`hooks/tezgah_task.py::relative`). Each writing slice gets its own worktree, so `hooks/a.py` there is in scope when `hooks/a.py` is. Only the allowlist reads a sibling: the record and workspace rules keep the main root. The worktree's admin directory must point back at it, and a worktree of another repository stays outside. Off: `task-off`
+the move until the plan's Acceptance, spike and checkpoint are in order, and records the reason for a widened scope (`allowed_why:`). The record's body has its own writers, on any open plan, run from the main checkout or from any of its worktrees. `tezgah-task tick NNN <n> [--undo]` ticks Acceptance item n (`bin/tezgah-task::cmd_tick`). `tezgah-task note NNN state|next "<text>"` replaces the newest `## State` or the `## Next` body (`bin/tezgah-task::cmd_note`). `tezgah-task spike NNN "<answer>"` writes `spike_recorded:`, the answer `implementation` waits for (`bin/tezgah-task::cmd_spike`). None of them commits. Standing: only the record changing lifts it.
+Scratch meets no allowlist: a temp file or a device, such as `pytest > /tmp/check.log` (`hooks/tezgah_gate.py::task_reason`). Build output inside the repo stays held. So does a file in the repo or its worktrees when the checkout lives under the temp dir, as CI's does.
+The task rule holds repository paths only. A target under no git checkout and no configured root, such as `~/.config/runpod/key`, is no plan's work (`hooks/tezgah_gate.py::_no_repo`). Neither the phase nor the allowlist refuses it, while every other rule, the secret rule among them, still reads that write. The gate reads a relative target in the call's own directory. Any doubt keeps the target held. A line that moves the directory stays held, however it spells the `cd`, `pushd` or `popd`. So does a line that reads `$PWD` back. A line that makes a link stays held: `ln`, `install`, `cp -s`, `cp -l`. So does a target whose parent directory does not exist yet. So does a file with a second hard link. Host agent and instruction files and the shell rc files stay held too, in any letter case (`hooks/tezgah_gate.py::HOME_HELD`). Under `~/.claude` those are `agents/**`, `hooks/**`, `commands/**`, `skills/**` and `CLAUDE.md`. Elsewhere they are `~/.omp/agent/**`, `~/.codex/AGENTS.md`, `~/.codex/prompts/**`, `~/.cursor/**` and `~/.config/opencode/**`. The rc files are `~/.zshrc`, `~/.zshenv`, `~/.zprofile`, `~/.zlogin`, `~/.bashrc`, `~/.bash_profile`, `~/.bash_login` and `~/.profile`. A target in another repository stays refused as outside this one.
+Three targets are no project file, so neither the phase nor the allowlist refuses them (`hooks/tezgah_gate.py::unnamed_target`). A URI is one: a tool device (`xd://<tool>`), an agent message (`agent://X`) or a conflict resolution (`conflict://2`). A `file://` URI names a checkout file and stays held. A shell target with an unknown variable is another. `write_paths` first expands a variable from an assignment earlier on the line. So the allowlist holds `B=src; git diff > $B/x.patch` as `src/x.patch`. A variable the same line set to the checkout, such as `R=$(git rev-parse --show-toplevel)`, is read as the checkout (`hooks/tezgah_gate.py::known_tail`). The third is tezgah's own workspace under `.tezgah/`, such as research lines, lessons and briefs (`hooks/tezgah_gate.py::workspace_free`). The slice journal stays held. So does every shell write into `.tezgah/plans/open/`, because such a file could make itself the active task. A plan file stays held too when its text, once the write lands, carries a `phase:` line (`hooks/tezgah_gate.py::_text_after`). The gate judges the whole text, so two edits cannot each pass on their own. The record rule still refuses the active record there.
+The gate matches a file in a linked worktree of the same repository relative to that worktree's top (`hooks/tezgah_task.py::relative`). Each writing slice gets its own worktree, so `hooks/a.py` there is in scope when `hooks/a.py` is. The phase, allowlist and checkpoint rules read a sibling. The record rule reads the main checkout, and the workspace rule keeps the cwd's own root. The worktree's admin directory must point back at it, and a worktree of another repository stays outside.
+Two plans can run at once, one per worktree. A linked worktree holds plan NNN when its branch is `plan/NNN-...` (`hooks/tezgah_task.py::branch_task`). That covers the plan's declared `branch:` and every slice branch the plan fans out to. Of several, the declared branch's worktree is the one the checkpoint and review read (`hooks/tezgah_task.py::plan_holders`). It then answers to plan NNN's phase, allowlist and checkpoint while plan NNN carries a phase. A session whose cwd is that worktree reads plan NNN as the active task. A write from anywhere else into that worktree meets plan NNN too (`hooks/tezgah_task.py::worktree_task`). A shell line meets the plan of every redirect and `tee` target it names (`hooks/tezgah_gate.py::_owners`). It meets the cwd's task as well when it writes where no target was read. That is a positional writer such as `sed -i`, a `tee` with more than one file, or more write shapes than targets. The checkpoint's sha is read against that worktree's HEAD and tree, and the refusal names `git -C <worktree>`. Every other checkout reads the main checkout's plans. Its task is the first phased plan no worktree holds. When every phased plan is held, it has no scope of its own, and a write outside the plan worktrees meets no plan (`hooks/tezgah_task.py::active`). The record rule still refuses a direct write to each held record. `tezgah-task start` keeps another plan's phase in one case only (`bin/tezgah-task::cmd_start`). Both plans then run in their own worktrees, and their allowlists share no prefix. Otherwise it clears that phase. `allow`, and `phase --any-path`, refuse a scope that shares a prefix with such a held plan (`bin/tezgah-task::held_overlap`). Off: `task-off`
 (`hooks/tezgah_gate.py::decision`). It fails open wherever the question cannot be answered: no active task, no readable record.
 
 The fourth refusal under the same rule is the checkpoint. Trigger: a write, or a shell command that writes a file (`hooks/tezgah_gate.py::SHELL_WRITE`), while the task is in
@@ -208,6 +210,20 @@ Three triggers, one per shape a credential takes on its way into a file (`hooks/
 - **Shell text.** One simple command (split on `&&`, `||`, `;`, newline — `hooks/tezgah_gate.py::SEGMENT`) carrying both a token (`hooks/tezgah_gate.py::SECRET_TOKEN` — an
   `Authorization: Bearer` header, or a `name=value` assignment for `api_key`/`token`/`secret`/`password`/...) and a sink (`hooks/tezgah_gate.py::SECRET_SINK` — `>`/`>>`,
   `| tee`, a curl `--trace`, or `git add`). Told: record the name, length or a fingerprint instead, and pass the value through the tool's environment (`hooks/tezgah_gate.py::SECRET_DENY`).
+  A token only in the leading `NAME=value` words of a program reaches that program's environment, not the file.
+  So `API_KEY="$(cat key)" python3 tool.py > run.log` passes (`hooks/tezgah_gate.py::_env_prefix_only`).
+  An allowlist is the ceiling of this case (`hooks/tezgah_gate.py::_secret_runner`). Only a script runner named by itself passes: `python`, `node`, `bun`, `deno run`, `bash`, `sh` or `zsh`.
+  It needs a script file ending in `.py`, `.js`, `.mjs`, `.ts` or `.sh`.
+  No option before the file may run inline text, stdin, a preload, interactive mode or a trace.
+  Those are `-c`, `-e`, `-p`, `-`, `-r`, `-i`, `-x`, `-v` and `-o` (`hooks/tezgah_gate.py::SECRET_INLINE`).
+  Every other program holds, because it may print its environment: `env`, `echo`, `xargs env`, `node -pe`, a bare `prog`, a program named by its path.
+  It also holds when the sink is a `git add` or a curl trace (`hooks/tezgah_gate.py::SECRET_OUTPUT`).
+  A line that reads `/proc/*/environ`, defines a function or runs `set -x` holds too.
+  So does a line that sets an interpreter's startup or trace variable (`hooks/tezgah_gate.py::SECRET_STARTUP`: `BASH_ENV`, `NODE_OPTIONS`, `PYTHONSTARTUP`, `LD_PRELOAD`, ...).
+  The rule cannot read the script itself: an allowlisted script that prints its own environment still writes the key.
+  A name an earlier command on the line set to a token stays carried. A printer that reads it into a file still denies, as in `API_KEY=x; echo $API_KEY > f` (`hooks/tezgah_gate.py::_printer_owns_sink`).
+  That check reads the pipeline stage that owns the sink, so `echo "$TOKEN" | docker login --password-stdin > log` passes. A `> /dev/null` is not a file there.
+  The rule reads token shapes, not file names: `echo "$KEY" > f` and `cat key > f` carry no token and pass.
 - **A credential file staged.** A `git add` that names a credential file (`hooks/tezgah_snapshot.py::SECRET_FILE`: `.env`, `.env.local`, a key, `id_rsa`, `credentials.json`).
   The command is read word by word (`hooks/tezgah_gate.py::_secret_add`). `.env.example`, `.env.sample`, `.env.template`, `.env.dist` and `.env.defaults` carry names without values and pass (`hooks/tezgah_gate.py::SECRET_TEMPLATES`).
   The rule does not read `git add -A` or `git add .` (`hooks/tezgah_gate.py::SECRET_ADD_DENY`).
@@ -409,6 +425,7 @@ rule's triggers are the classes `_stop_block` returns, the four `_shape_block` a
 | `no external read` | two turns: "npm 0.22.0 is missing" off a stale client, and "make NPM_TOKEN an automation token" when it already was | `hooks/tezgah_integrity.py::_external_read_row` | `tests/test_integrity.py::test_an_external_claim_with_no_read_is_refused` |
 | `residual work` | the owner's report (2026-10-11): turns end on "Açık kalanlar / Doğrulanmadı / Sıradaki adım" instead of the work; measured 503 of 1876 final replies with such a label at a line start, 467 in turns that called a non-read tool | `hooks/tezgah_integrity.py::_residual_block` | `tests/test_integrity.py::test_a_residual_list_is_refused_once_and_the_reply_after_it_recorded` |
 | `ready steps` | measured 2026-10-11 (research line `orchestrator-flow-audit`): 13.1% of 451 omp user turns were a bare "devam", and 192 of 281 spawns were followed by `wait` with no other call between, at 82 of them with four or more todo items open | `hooks/tezgah_integrity.py::ready_left` | `tests/test_integrity.py::test_a_ready_todo_step_left_is_refused_once` |
+| `open todo` | the owner's report (2026-10-12, plan 097 item 2): `ready_left` counted only `pending` items, so a done claim over an `in_progress` todo item ended the turn | `hooks/tezgah_integrity.py::open_left` | `tests/test_integrity.py::test_a_done_claim_over_an_in_progress_todo_is_refused_once` |
 | `needless ask` | research line `orchestrator-flow-audit` S3: 33 of 48 final replies that ended on a question in the owner's omp transcripts were process questions ("Başlayayım mı?"), and 9 of 47 next prompts were a bare "devam" or "evet" | `hooks/tezgah_integrity.py::needless_ask` | `tests/test_integrity.py::test_a_process_question_at_the_end_is_refused_once` |
 | `stopped slice` | measured 2026-10-11 (research line `subagent-resume-orchestration`): 118 of 1413 omp subagent runs ended stopped, and in the newest 20 the parent absorbed the work inline 16 times instead of resuming it | `hooks/tezgah_integrity.py::_stopped_slice` | `tests/test_integrity.py::test_a_stopped_slice_of_this_session_refuses_the_turn_once` |
 | `placating opener` | designed | output rule 10 read at the Stop event; no incident recorded | `tests/test_integrity.py::test_sycophantic_opener_blocks` |

package/docs/models.md

@@ -25,8 +25,11 @@ generated in every tezgah root because routing needs no capability (`ROLES`,
 `tezgah-researcher` (`hooks/tezgah_agents.py::SPECIALISTS`). A specialist's
 description names its slot from `AGENT_SLOT`. The tier a host shows and the
 model line it runs therefore cannot disagree, and `tezgah-agents --list` prints
-both. A cheaper worker that meets work above its tier
-answers `ESCALATE: <why>`, and the router restarts the task on `tezgah-frontier`
+both. A cheaper worker that meets work above its tier answers `ESCALATE: <why>`,
+and a report missing an `Output to orchestrator` field
+(`hooks/tezgah_agents.py::WORKER_OUTPUT`) counts the same: the router sends one
+narrower re-brief of the same role naming that
+field or judgement, and only a second miss restarts the task on `tezgah-frontier`
 with the original brief rather than handing the failed trajectory up: continuing a
 cheap trajectory on a frontier model was the most expensive option measured
 (arXiv 2608.24358, Table 1: 1.61 cost units against 0.72 for frontier-only).
@@ -156,16 +159,41 @@ an entry the user owns, and `mode` when omp holds none and the session model run
 otherwise. `via` keeps the word `jev` even when the chat fallback answered,
 because the report groups history by it. `judge` is where the two differ.
 
-A routed worker runs in its own session, so its checks land in its own ledger. On omp
-and opencode the child's ledger opens with a `spawned` row that names its parent
-session. `tezgah-route --report` matches a route to a child by agent type first. On
-opencode the child's own title carries the type. On omp the parent's task call
-records which type each named child runs. Order is the fallback, and only when one
-child sits between each route and the next with no two spawns in one second. The
-report then reads each child's first check: `pass`, `fail`, `ran` (no outcome seen)
-or `none`. A route it cannot prove counts as `unjoined`. That covers a tie, an
-unrouted spawn, a nested subagent, and every host with no parent signal: Claude
-Code, Codex, Cursor and dsh. The parent's own next check never counts for the worker.
+On omp and opencode a routed worker runs in its own session and its own ledger. That
+ledger opens with a `spawned` row that names the parent session. On opencode the
+child's own title carries its type. On omp the parent's task call records which type
+each named child runs. On Claude Code and Codex the worker runs under its parent's
+session id, and its rows carry its own `agent` id. There the SubagentStart hook writes
+a `subagent_start` row into the parent's ledger with that id and the child's type.
+Both hosts' payloads carry `agent_id` and `agent_type`. Claude's SessionStart hook
+exports `TEZGAH_SESSION` through `CLAUDE_ENV_FILE`. A Codex shell carries
+`CODEX_THREAD_ID`, the root thread's id. So the `route` row lands in the same ledger.
+A Cursor subagent runs under its own conversation id. Each Cursor agent shell carries
+its conversation's id as `CURSOR_CONVERSATION_ID`, so the route row lands in the
+parent's ledger. Cursor's
+subagentStart hook opens the child's ledger under `subagent_id` with a `spawned` row
+that names `parent_conversation_id`. Cursor's docs do not say that the child's own
+calls carry `subagent_id`, so that link counts only once a row of the child lands.
+A host started from another host's agent shell inherits that host's id. When two of
+these ids differ, no variable tells which host runs the call, so `tezgah-route`
+writes no row.
+
+`tezgah-route --report` joins by type when any child has a type. A route owns the
+first fan-out of its type after it and before the next route of that type. A fan-out
+is the children of one task call, each started within 2 seconds of the one before
+(`FAN_OUT_GAP`). One failed first check in it fails the route, else a pass passes it
+(`OUTCOME_ORDER`). Later spawns of that type in the window had no route, so the
+report leaves them out. A route gets nothing when the route of its type before it
+had no worker yet: both routes' workers may sit in one fan-out. It also gets nothing
+when an untyped child started inside its span. It gets nothing when its fan-out
+started more than 30 minutes after it (`ROUTE_GAP`). With no typed child, order is the
+fallback. It joins only when one child sits between each route and the next, with
+no two spawns in one second. The report then reads each child's first check: `pass`,
+`fail`, `ran` (no outcome seen) or `none`. A route it cannot prove counts as
+`unjoined`: a tie, an unrouted spawn, or a host with no child row. Two cases write
+none. `cursor-agent` 2026.10.01 fires no subagentStart, and its child's calls name no
+parent. The dsh bridge runs Claude's hook, and no dsh SubagentStart payload on
+record shows `agent_id`. The parent's own next check never counts for the worker.
 One line per `via` and tier gives the first-attempt pass rate. The `jev-below-static`
 line counts Jev routes under the static tier and how many of them failed. That is the
 measurement that decides whether Jev routing becomes the default or the static table

package/docs/operations.md

@@ -616,6 +616,36 @@ it costs nothing there. On held-out Turkish phrasings of the docs index,
 meaning alone found the page in the top three for 0.91 with `embed-mrl` and 0.78
 with `embed-m2v`. The fusion found it for 0.75 and 0.74, BM25 for 0.68.
 
+## Plan records: the lock, `landed`, the close commit
+
+Every `tezgah-task` writer of a plan record holds an exclusive lock on the
+`<main checkout>/.tezgah/plans` directory across its read, change and write
+(`hooks/tezgah_task.py::plans_lock`). The lock leaves no file behind for the
+private repository to commit. `tick` finds its item's line under the lock
+(`hooks/tezgah_task.py::set_box`). A writer writes a temp file beside the record
+and renames it over the record, so a reader never sees a torn file
+(`hooks/tezgah_task.py::_write`). Windows has no `fcntl`, so writers run unlocked
+there, and the rename alone keeps reads whole. `close NNN done` records
+`landed:`, the main checkout's HEAD, once the reviewed commit has landed there
+(`bin/tezgah-task::landed_head`). Before the merge it prints a warning and
+records nothing. A squash merge and a branch deletion can orphan
+`reviewed_sha:`, but not that commit. When `.tezgah` is a git repository of its
+own, `close` commits the move as `plan: close NNN <slug>`. The commit holds the
+record's old and new paths and nothing else the owner staged
+(`bin/tezgah-task::commit_close`). Every worktree commits into that one
+repository, so another git can hold its `index.lock`. Each private-repository
+git call waits about 1.5 s for the lock (`hooks/tezgah_paths.py::ws_git`). A
+lock still held after that fails the close: exit 1, with the command that
+commits the moved record.
+
+`close` then removes each linked worktree whose branch landed and that holds
+nothing else (`bin/tezgah-task::prune_worktrees`). It deletes that branch with
+`git branch -D` (`bin/tezgah-task::drop_branch`). `git branch -d` refuses a
+squash- or rebase-merged branch, and `_landed` has already shown that its work
+is in a landing base (`bin/tezgah-task::_landed`). A branch that has not landed
+stays with its worktree, and the `worktree kept:` line names it as not merged.
+A delete git still refuses prints `branch kept:` with git's reason.
+
 ## Slice journal: `tezgah-task slice`
 
 A delegated slice can die with its parent. A crash, an omp `/clear`, a quota or
@@ -683,7 +713,7 @@ sessions' records. `tezgah-task slice reconcile` lists them all.
 |---|---|
 | `tezgah-task slice open --id ID [--kind agent\|job] [--host H] [--agent A] [--brief TEXT\|--brief-file F] [--parent P] [--cwd PATH]` | records a slice by hand, for a host whose spawn the hooks do not see |
 | `tezgah-task slice done ID` / `slice stop ID [--class C]` | closes a record as done, or as stopped with a failure class. An exact record id answers from any session. A spawned name answers too, and under `TEZGAH_SESSION` only for that session's records and unowned ones (`hooks/tezgah_task.py::find_slice`) |
-| `tezgah-task slice reconcile [--prune]` | lists every pending record with a resume brief. `--prune` also removes landed worktrees and marks those records done. It deletes a landed local branch only when no worktree holds it, it tracks no upstream and its reflog shows a commit of its own; it never deletes main, master or the current branch |
+| `tezgah-task slice reconcile [--prune]` | lists every pending record with a resume brief. `--prune` also removes landed worktrees and marks those records done. It deletes a landed local branch, a squash-merged one too (`git branch -D`), only when no worktree holds it, it tracks no upstream and its reflog shows a commit of its own; it never deletes main, master or the current branch |
 | `tezgah-task slice resume ID` | prints the native path first: omp `write agent://<id>` while the parent lives, Claude `SendMessage` when the id is an agent name. Otherwise it prints a re-dispatch brief: the original brief plus the last commit, the uncommitted files and "do not redo committed steps". A quota or rate-limit stop is sent to another provider. It sets the status to `resumed` |
 | `tezgah-task slice stats [--window DAYS] [--json]` | counts records per status, failure class and host. A `class+host` signature with 3 or more events is an RSI lever candidate, and so is one with 5% of a window that holds 20 or more slices. The line names the lever |
 | `tezgah-task slice board [--parent P]` | lists the open slices one parent spawned - the session's own, or for a subagent its parent's - newest first: the `Owns:` globs, worktree, branch and last commit of each, bounded to 12 lines (`hooks/tezgah_task.py::board`) |

package/docs/research.md

@@ -451,8 +451,9 @@ writes, for a line whose every experiment's order still checks. The ack goes to
 
 ### Moving a line between checkouts
 
-Each checkout keeps its own `.tezgah` repository, and that repository has no
-remote. One directory on one disk holds the only copy of a line's order proof.
+A repository keeps one `.tezgah`, in its main checkout, and every worktree writes
+there. `import` moves a line out of a worktree `.tezgah` written before plan 097,
+or out of another clone.
 A **copy** of a line, committed in another checkout, lands protocol and results
 in one commit. The copy destroys the proof: `check` refuses it as "one commit
 added both". `tezgah-research import <checkout> [<slug>]` moves the line with

package/docs/testing.md

@@ -74,17 +74,16 @@ No matrix cancels its other legs when one fails (`fail-fast: false`).
 - `test` (`ci.yml:100`) on Python 3.10 and 3.14, the floor and the ceiling.
   It byte-compiles, lints with ruff from `requirements-dev.txt` (pip cached),
   audits the docs citations and clarity and runs `TEZGAH_E2E_STRICT=1 python3
-  tests/e2e_plan_flow.py`. On `main` it also runs the serial suite with `-v`.
-  A pull request skips that step, and so does a release, which passes the
-  `release` input and runs one 3.10 leg.
-- `test-sharded` (`ci.yml:145`) on Python 3.10 and 3.14 with node 22 (the
+  tests/e2e_plan_flow.py`. A release passes the `release` input and runs one
+  3.10 leg.
+- `test-sharded` (`ci.yml:142`) on Python 3.10 and 3.14 with node 22 (the
   first line that loads the omp `.ts` hook without a flag). On `main` and a
   release it runs `python3 tests/impacted.py --all`. On a pull request it runs
   `--ref <base>`: the modules the change maps to, and the whole suite when the
-  map does not know a path. It is a shadow that started 2026-10-05. After four
-  weeks it replaces the serial `test` step only if it missed no failure that
-  step caught.
-- `apps-e2e` (`ci.yml:178`) on Python 3.12 and node 20: one step,
+  map does not know a path. It replaced the serial `unittest discover` step on
+  2026-10-13: both caught the same failures, and the serial step took about 30
+  minutes.
+- `apps-e2e` (`ci.yml:175`) on Python 3.12 and node 20: one step,
   `TEZGAH_E2E_STRICT=1 python3 tests/e2e_analyze_wiring.py`. It completes the
   app-MCP handshake only - no browser, no device - so it stays deterministic;
   strict mode makes a server that cannot start a failure rather than a skip, so
@@ -99,9 +98,10 @@ No matrix cancels its other legs when one fails (`fail-fast: false`).
   opencode live probe and `--uninstall` from the installed tree. Any residue
   under the prefix fails it.
 
-`.github/workflows/neuter.yml` runs two jobs weekly (and on demand). The first,
-`neuter`, asks the question the suite cannot ask of itself - would a test fail
-if a guard went?
+`.github/workflows/neuter.yml` runs two jobs weekly, on demand, and on a push to
+`main` that changes a guard, the matrix or a test module it runs. The matrix is
+CI's, not the local loop's. The first job, `neuter`, asks the question the suite
+cannot ask of itself - would a test fail if a guard went?
 `tests/neuter_matrix.py` clones HEAD once per anti-shortcut guard, reverts that
 guard, and runs the gate's test modules; a mutant that still passes is a guard no
 test notices, and an unmutated control that fails voids the run. The script
@@ -114,6 +114,13 @@ rows cover the guards around those classes: the pass predicate, the empty-run
 read and the "doğrulanmadı" clear. The lost call, the bookkeeping and idle-turn
 fallbacks and the refusal row have rows too. The shortcut half is still
 hand-written (`MUTANTS`), so a new guard there needs a row.
+Each mutant first runs alone the test that killed it last time, read from
+`tests/neuter_killers.json`. When that test passes or is gone, the mutant runs
+every module in its own HOME and TMPDIR. The module that reads the mutated file
+goes first. The first failing test becomes its new entry. The
+control runs every module, then every cached killer alone, so a killer that
+fails without a mutant voids the run. A session that adds a deny rule checks its
+one mutant with `python3 tests/neuter_matrix.py --only <name>`.
 
 The second, `fuzz-shell`, runs the bash-oracle fuzzer (`tests/fuzz_shell.py`)
 under the ubuntu runner's bash 5.x. Locally, macOS ships bash 3.2. A first step

package/hooks/projects-auto-init.py

@@ -14,7 +14,7 @@ sys.path.insert(0, os.path.dirname(os.path.realpath(__file__)))
 from tezgah_guard import attest_session, import_failed, safe  # noqa: E402
 try:
     from tezgah_context import context_for, record  # noqa: E402
-    from tezgah_paths import HOST_DIRS  # noqa: E402
+    from tezgah_paths import HOST_DIRS, root_for  # noqa: E402
 except Exception as exc:
     import_failed(exc)
 
@@ -62,6 +62,20 @@ def core_is_in_a_file():
         return False
 
 
+def export_session(env_file, session_id):
+    """Append `export TEZGAH_SESSION=<id>` to Claude's CLAUDE_ENV_FILE, appended
+    because other hooks write the same file."""
+    import shlex
+    with open(env_file, "a", encoding="utf-8") as fh:
+        fh.write("export TEZGAH_SESSION=%s\n" % shlex.quote(session_id))
+
+
+def note_child(session_id, agent_id, agent_type):
+    """The child's lineage row in its parent's ledger (`tezgah-route --report`)."""
+    from tezgah_integrity import note
+    note(session_id, "subagent_start", agent_type, agent=agent_id)
+
+
 def main():
     try:
         payload = json.load(sys.stdin)
@@ -74,6 +88,14 @@ def main():
         # tezgah wires, and dsh (which runs it too) has no transcript to derive
         # the kind from, so the store is the only channel its line has.
         safe(payload.get("session_id"), record, payload.get("session_id"), "orch")
+        # The child's lineage row: a Claude subagent runs under its parent's
+        # session id, its calls carrying `agent_id`, so this row in the parent's
+        # ledger is what types it for `tezgah-route --report` (hooks reference,
+        # SubagentStart input: agent_id, agent_type).
+        aid, kind = payload.get("agent_id"), payload.get("agent_type")
+        if isinstance(aid, str) and aid and isinstance(kind, str) and root_for(cwd):
+            safe(payload.get("session_id"), note_child, payload.get("session_id"),
+                 aid, kind)
     if event == "SessionStart":
         # Claude and dsh run this one script; Claude's manifest declares
         # TEZGAH_CORE_IN_FILE on SessionStart and dsh's does not, so the flag
@@ -82,6 +104,12 @@ def main():
         sid = payload.get("session_id")
         host = "claude" if os.environ.get("TEZGAH_CORE_IN_FILE") == "1" else "dsh"
         safe(sid, attest_session, host, sid, cwd)
+        # The session id the route, judge and status CLIs write under: Claude
+        # sources this file before every Bash call (CLAUDE_ENV_FILE, SessionStart
+        # only), as omp exports TEZGAH_SESSION to its shells
+        env_file = os.environ.get("CLAUDE_ENV_FILE")
+        if env_file and isinstance(sid, str) and sid:
+            safe(sid, export_session, env_file, sid)
     text = safe(payload.get("session_id"), context_for,
                 EVENTS.get(event, "session_start"), cwd, payload,
                 # the brief is a subagent's own text, never the file's; every

package/hooks/tezgah_agents.py

@@ -252,17 +252,29 @@ def _worker_body(tier):
             scope = ("If the work needs a judgement above this tier - a design choice,\n"
                      "a stored-data or ordering invariant, security-sensitive code, or\n"
                      "a failure whose cause you cannot find - stop editing and answer\n"
-                     "`ESCALATE: <why>`; the router restarts it on tezgah-frontier.")
+                     "`ESCALATE: <why>`.")
         return ("You are tezgah-%s, a worker on the %s model tier. Do exactly the\n"
                 "brief: stay inside the files it names, run the checks it names, and\n"
                 "report what changed and what each check printed, verbatim. Report\n"
                 "progress, but never redefine the work. Never widen or narrow the brief's\n"
                 "scope, budget or question. If the brief cannot be met as written, say\n"
                 "so and stop rather than answering a different question.\n%s\n"
-                "Never spawn subagents." % (tier, tier, scope))
+                "Never spawn subagents.\n%s" % (tier, tier, scope, WORKER_OUTPUT))
     return body
 
 
+# The report a consumer reads: the orchestrator re-briefs a report missing one
+# of these fields (_orch_body), so only a role with a reader gets them. One
+# text on every host, since a worker body ignores its host.
+WORKER_OUTPUT = ("End the report, after any other shape asked for, with `Output to\n"
+                 "orchestrator`, every field, `none` when empty:\n"
+                 "- changed: the files you changed\n"
+                 "- commit: the sha\n"
+                 "- checks: each command, its exit code and the last lines of its\n"
+                 "  output file, verbatim\n"
+                 "- escalate: the `ESCALATE:` reason (always `none` on tezgah-frontier)")
+
+
 # The specialists beside the tier workers: name -> (what it does, the skills it
 # loads first, its tools, the role text). The tier is not here: it is
 # tezgah_models.AGENT_SLOT, the row every host's model line is rendered from, so
@@ -282,9 +294,11 @@ SPECIALISTS = {
         "import the changed modules. Keep each check last on its line with its\n"
         "output in a file, then read the file in a separate call: never pipe a\n"
         "check into tail or grep, never `|| true`, never `--no-verify`, never a\n"
-        "new skip. Set the shell timeout above 300 s for a long run. Report each\n"
-        "check as passed or failed with its counts and the exact failure text.\n"
-        "Never edit source or test files; a fix belongs to the caller."),
+        "new skip. Set the shell timeout above 300 s for a long run. Never edit\n"
+        "source or test files; a fix belongs to the caller.\n"
+        "End the report, after any other shape asked for, with `Output to\n"
+        "orchestrator`, per check: its command, the pass/fail/skip counts and\n"
+        "the first failure verbatim (`none` when it passed)."),
     "tezgah-docs": (
         "Writes and repairs docs pages and their `path:line` / `path::symbol` "
         "citations after a code change, under the repo's own docs checks.",
@@ -449,8 +463,11 @@ def _orch_body(names):
         "codegraph tools; a second opinion (`consult`) stays with the main\n"
         "thread. Other work goes to the tier worker\n"
         "`tezgah-route \"<brief>\"` names (tezgah-cheap, tezgah-standard,\n"
-        "tezgah-frontier); an ESCALATE answer is restarted on tezgah-frontier with\n"
-        "the same brief. Never delegate a task a specialist is not\n"
+        "tezgah-frontier). A report missing an `Output to orchestrator` field,\n"
+        "or an ESCALATE, gets one narrower re-brief of the same role naming the\n"
+        "missing field or the escalated judgement; only a second miss is\n"
+        "restarted on tezgah-frontier with the original brief, never continued.\n"
+        "Never delegate a task a specialist is not\n"
         "listed for, and never let a subagent spawn its own subagents. Verify each\n"
         "returned claim against the code before acting." % (listed, say()["blocker_tokens"]))