axstack 0.20.0 → 0.20.2

package/README.md

@@ -114,11 +114,16 @@ answer trust or permission prompts on the worker's behalf, and never create a
 duplicate writer. A `worker_done` advances work only when its Task and Dispatch
 match the active attempt and its revision evidence verifies.
 
-Two reusable native PR-manager chats run on staggered 15-minute schedules in
-dedicated workspaces. Review and watch each admit at most five bounded PR jobs;
+Two logical native PR-manager lanes run on staggered 15-minute schedules. Each
+pass uses a fresh finite session in a new isolated workspace. Review
+and watch each admit at most five bounded PR jobs;
 waiting PRs stay covered without reserving slots. Axstack adds no custom
-scheduler, queue engine, or decision interpreter. Native reuse, busy-tick,
-recovery, and VPS resource behavior require a canary before activation.
+scheduler, queue engine, or decision interpreter. Sessions reconcile before
+admission across the whole lane, save durable continuity and decisions outside
+disposable workspaces, and retire only their verified pass workspace as the
+final action. Manual review/watch never inherits this cleanup lifecycle.
+Native fresh-session, overlapping-pass, recovery, and VPS resource behavior
+require a canary before activation.
 
 Mobile completion/reply behavior remains unverified. Structural checks and
 qualitative scenario evaluation are not live runtime proof.

package/docs/workflows.md

@@ -173,8 +173,8 @@ gate. An applicable `Notification policy` may use `axstack-relay`; otherwise the
 current Orca conversation is the fallback. The relay normally delivers one-way
 through native `hermes send`: it checks CLI lookup and the configured target,
 binds the recipient, deduplicates on the run record, and records the returned
-`message_id`. PR-manager notifications point the user to the reusable manager's
-Orca conversation; Telegram delivery, replies, and silence grant no action
+`message_id`. PR-manager notifications point the user to GitHub or a durable
+user-owned conversation; Telegram delivery, replies, and silence grant no action
 authority. Delivery failure never clears the underlying hold.
 
 Healthy watch observations remain quiet. The optional `axstack-monitor` is a
@@ -182,16 +182,27 @@ read-only observer for standalone watches and never sends.
 
 ## Native watch automations
 
-The accepted contract has exactly two reusable native manager chats: review at
-minutes `0,15,30,45` and watch at `7,22,37,52`. Each has a dedicated manager
-workspace, scans complete discovery pages, and admits at most five executing
+The accepted contract has exactly two logical native manager lanes: review at
+minutes `0,15,30,45` and watch at `7,22,37,52`. Each scheduled pass uses a
+fresh finite session in a new isolated workspace, scans complete
+discovery pages, and admits at most five executing
 PR jobs. Waiting PRs stay covered and consume no slot after owned descendants
 settle. Each job uses one repository-parented worktree; managers never check out
 PR branches in their own workspaces.
 
+Every pass reconciles saved, GitHub, and native Orca state across all same-lane
+workspaces before admission. A
+confirmed same-lane manager makes the new duplicate do no work or shared-record
+write and close only itself. Normal teardown settles descendants, saves durable
+continuity and decisions outside disposable workspaces, then retires its own
+verified isolated pass workspace as the final action. It never bulk-closes a
+shared manager workspace or a PR-job worktree, or cleans preserved candidates,
+evidence, user sessions, unknown liveness, `user_takeover`, or ambiguous
+publication state. Manual review/watch remains outside this scheduled lifecycle.
+
 Requested reviews cover any accessible repository; automatic repairs retain
 their `defi-com/monorepo` and `defi-com/mobile` scope. Orca owns schedules,
-reuse, Tasks, and Dispatches. Axstack adds no custom scheduler, queue engine,
+sessions, Tasks, and Dispatches. Axstack adds no custom scheduler, queue engine,
 cursor files, polling loop, or historical runtime fallback.
 
 ## Automations
@@ -200,8 +211,9 @@ The review and watch managers use short packaged prompts that load the current
 relative contract and invoke `axstack-review` or `axstack-watch`. Bounded jobs
 publish ordinary exact-head review verdicts or reviewed fast-forward repairs;
 the human merges. Exceptional security, permanent-on-chain, or architectural
-decisions remain held in the manager conversation with an authorized
-deduplicated Telegram notification. The current operational contract is
+decisions remain actionable in GitHub or a durable user-owned conversation
+after manager self-close, with an authorized deduplicated Telegram notification.
+The current operational contract is
 `skills/axstack/references/automations.md`.
 
 ## Run record and evidence

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.20.0",
+  "version": "0.20.2",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks Orca capabilities.",
   "keywords": [
     "claude-code",

package/skills/axstack/references/automations.md

@@ -5,7 +5,7 @@ automation specs and plans describe retired designs and are not instructions.
 
 ## Topology and schedules
 
-There are exactly two reusable manager chats:
+There are exactly two logical manager lanes:
 
 - **Review manager:** runs at minutes `0,15,30,45` and invokes
   [axstack-review](../../axstack-review/SKILL.md) for eligible peer reviews.
@@ -13,17 +13,67 @@ There are exactly two reusable manager chats:
   [axstack-watch](../../axstack-watch/SKILL.md) for eligible own-PR watch or
   repair events.
 
-Each uses native existing-workspace reuse in its own dedicated manager
-workspace. A manager never checks out a PR branch in that workspace. Missed
-slots do not replay a backlog; the next ordinary tick discovers current state.
-The two short packaged prompts sit beside this file and discover these rules by
-relative link instead of copying them.
+Use a new isolated workspace for every scheduled pass, with one fresh finite
+manager session. Configure native repo-created worktree mode against the
+designated manager repository; never target an existing shared workspace.
+Do not use `--reuse-session`. The scheduler creates the pass workspace before
+launch; the manager must not move itself from a shared launch workspace.
+Keep lane continuity and evidence outside disposable manager workspaces at
+the configured durable absolute paths. A manager never checks out a PR branch
+in its pass workspace. Missed slots do not replay a backlog; the next ordinary pass
+discovers current state. The two short packaged prompts sit beside this file
+and discover these rules by relative link instead of copying them.
 
-This is prompt policy, not proof that Orca serializes a busy tick or reuses a
-session. Before activation a native canary must prove same-session reuse, busy
-tick behavior, recovery after session loss, nested dispatch depth for
-coordinator-launched leaves, and total process and memory effects. A firing
-timestamp proves neither delivery nor useful completion.
+Provision one explicit absolute continuity path per automation ID in the
+scheduled prompt. Follow [Run record](run-record.md) for its contents; the
+repository's absolute Git common directory is a valid durable root, but a pass
+worktree is not. Missing or non-durable continuity configuration holds admission.
+
+This is prompt policy, not proof that Orca starts a fresh session or prevents
+overlapping passes. Before activation a native canary must prove fresh-session
+launch, overlapping-pass behavior, recovery after session loss, nested
+dispatch depth for coordinator-launched leaves, and total process and memory
+effects. A firing timestamp proves neither delivery nor useful completion.
+
+## Session admission
+
+Reconcile saved state, current GitHub state, and native Orca Tasks, Dispatches,
+sessions, and liveness across all workspaces belonging to the same automation
+before discovery or admission; never infer lane ownership from an empty local
+workspace. Bind the lane to the automation ID and pass to its native run ID,
+workspace ID, and terminal identity, not a title or directory-name guess.
+A confirmed live manager for the same lane remains authoritative.
+The new duplicate does no PR work, makes no shared-record write, touches
+nothing owned by the live manager, and closes only itself as its final action
+by the same guarded isolated-workspace retirement below, not a tab-only close.
+Unknown liveness blocks admission and shared-record writes; it does not
+authorize takeover, cleanup, or a duplicate manager. Preserve `user_takeover`
+and other user-owned sessions.
+
+When two new passes overlap, reconcile native run ordering before either admits
+work; the earlier unsettled pass retains the lane. Missing ordering or ownership
+evidence holds admission, never guesses a winner. This is not an atomic lock:
+activation requires an overlap canary proving only one pass admits work. Count
+all unsettled PR jobs and descendants across the lane, not just this workspace.
+Read every page of native runs, workers, and workspace inventory; truncated or
+failed inventory holds admission and cleanup rather than implying absence.
+
+A prior manager does not retain the lane merely because its automation run
+status says failed or dispatched. Require confirmed native process exit for its
+exact terminal incarnation, saved continuity, and settlement of all owned jobs
+and descendants before releasing its lane ownership. Absence or saved retirement
+intent alone is insufficient. Conversely a completed run row does not prove exit.
+If these facts remain unknown, report the hold at the durable decision location;
+do not silently stand down forever or replace a potentially live owner.
+
+Before PR admission, reconcile old pass resources. If three or more unreclaimed
+earlier pass workspaces remain, disable only this automation through the native
+CLI, verify the disabled setting, save/report the cleanup hold, and admit no new
+PR jobs. Also pause on a confirmed cleanup failure or unresolved lane ownership.
+Already-dispatched passes still reconcile and retire only their own safe resources;
+this threshold is a stop condition, not an atomic hard cap on in-flight creations.
+An uncertain disable is a reported failure, not proof scheduling stopped. Resume
+only after ownership/cleanup is verified and explicit activation authority exists.
 
 ## Discovery and coverage
 
@@ -74,8 +124,8 @@ a slot settles; repeatedly changing PRs cannot starve older unserved work.
 
 ## Per-PR jobs
 
-The reusable manager owns ongoing discovery and continuity; the bounded PR
-coordinator owns only its admitted event. Do not create a second live owner or
+The logical manager lane owns ongoing discovery and continuity across finite
+sessions; the bounded PR coordinator owns only its admitted event. Do not create a second live owner or
 writer for the same PR. Reuse an existing valid per-PR worktree, owner, and
 unchanged receipts before creating anything. Otherwise create one separate
 Orca worktree per PR job, parented to that repository's primary worktree, and
@@ -85,19 +135,23 @@ handles the current actionable event, returns exact receipts, then settles.
 Settlement returns continuity to the manager rather than retaining an idle PR
 coordinator. Reviewers retain the isolation required by `axstack-review`.
 
-An unchanged exact head and event creates no job. Dedupe from current GitHub
-state, native Orca Task and Dispatch state, and the existing compact run record;
-do not create machine cursor files or a queue engine. Record enough to resume:
-PR, head, base, event identity, mode, owner and worker receipts, candidate,
+An unchanged exact head and unchanged event identity creates no job; an
+unchanged exact head with a new event identity remains actionable. Event
+identity includes the applicable review ID and body digest, check identity and
+result, or other current GitHub event receipt. Dedupe from current GitHub state,
+native Orca Task and Dispatch state, and the existing compact run record; do
+not create machine cursor files or a queue engine. Record enough to resume: PR,
+head, base, event identity, mode, owner and worker receipts, candidate,
 publication receipt, hold, and next action. GitHub remains authoritative for
 open state, revisions, reviews, checks, and merge state.
 
 When the current event is handled, settle and release owned native resources.
-Preserve a dirty worktree, an unpushed candidate, pending external result, or
-user-owned work until its durability and ownership are proven. Here a pending
-external result means an unconfirmed publication or send outcome, not pending
-CI. Waiting state belongs in GitHub and the compact record, never in an idle
-model, per-PR timer, or polling loop.
+Preserve dirty worktrees, unpushed candidates, review evidence, pending
+external results, and user-owned work until durability and ownership are
+proven. Unknown liveness, `user_takeover`, and ambiguous publication likewise
+forbid cleanup. Here a pending external result means an unconfirmed publication
+or send outcome, not pending CI. Waiting state belongs in GitHub and the compact
+record, never in an idle model, per-PR timer, or polling loop.
 
 ## Review and repair authority
 
@@ -137,18 +191,58 @@ boundary.
 ## Exceptional decisions and notifications
 
 A credible security concern, permanent on-chain state change, or architecture
-decision is held in the reusable manager's Orca conversation. Store the PR,
-head, base, action, candidate, decision context, and preserved candidate bytes
-or refs in the compact record. Send one deduplicated Telegram notification only
-when the recorded `Notification policy` authorizes it, using
-[axstack-relay](../../axstack-relay/SKILL.md) and telling the user to act in
-that manager conversation.
+decision is held in GitHub or a durable user-owned conversation that survives
+the finite manager session. Store the PR, head, base, action, candidate,
+decision context, durable decision location, and preserved candidate bytes or
+refs in the compact record. The decision must never depend on a closed manager
+chat. Send one deduplicated Telegram notification only when the recorded
+`Notification policy` authorizes it, using
+[axstack-relay](../../axstack-relay/SKILL.md) and telling the user where the
+durable decision is actionable.
 
 Telegram delivery, a Telegram reply, or silence never authorizes an action.
-After a decision in the manager conversation, revalidate the exact candidate,
-head, base, event, authority, and remote state before acting. A changed input
-makes the old decision stale and holds that action. There are no token files,
-Telegram decision interpreter, or separate model gate.
+After a decision, revalidate the exact candidate, head, base, event, authority,
+and remote state before acting. A changed input makes the old decision stale
+and holds that action. There are no token files, Telegram decision interpreter,
+or separate model gate.
+
+## Finite-session teardown
+
+After admission closes, settle every owned PR job and all descendants before the
+manager session ends; active or unknown descendants keep their PR slot occupied
+and must be reconciled rather than trusted from saved status. Then save durable
+continuity, evidence locations, pending receipts, and user decisions before
+self-close. Waiting PRs still occupy zero slots once their owned trees settle.
+
+Cleanup of PR-job setup shells stays scoped to positively identified owned unused
+setup shells: use the native exact-terminal close operation for each only.
+Preserve dirty worktrees, unpushed candidates, review evidence, user-owned
+terminals, unknown liveness, `user_takeover`, and ambiguous publication state.
+
+For the manager pass only, verify native run/workspace identity, exclusive
+automation ownership, no unsettled descendants, and a fresh terminal inventory
+containing only this manager and its proven unused setup shells. No other pass
+may target this workspace. If an unexpected terminal or user takeover is present,
+do not bulk-close; preserve the workspace and report the hold at its durable
+decision location. Never bulk-close a shared manager workspace or a PR-job worktree.
+
+After saving continuity, use the version-matched native workspace retirement:
+`terminal close --worktree id:<exact-native-workspace-id> --all --json`.
+Copy the complete ID from the run/workspace receipt; never use a name, branch,
+path-only selector, or `active` for this destructive operation.
+Self-close is the final action; perform no record write or cleanup afterward.
+A failed or uncertain close is not proof of retirement. The next admitted pass
+reconciles prior retirement from native state before trusting saved intent.
+Retire only positively identified completed pass resources; do not kill another
+live or unknown manager. Remove an old pass worktree only with native cleanup
+after terminal retirement is confirmed and its Git state is clean, with no
+unpushed commits, retained evidence, children, or user-owned work. Never use
+recursive shell deletion. Failed cleanup remains recorded, not silently forgotten.
+
+The activation canary must additionally prove distinct workspace IDs per pass,
+cross-workspace lane admission, self-retirement and absence after client reconnect,
+and bounded retained worktrees over repeated passes. A shell-only close test does
+not prove agent resume-record retirement. Do not activate on source checks alone.
 
 ## Recovery and limits
 
@@ -162,6 +256,6 @@ unambiguous work may proceed.
 Use only native schedules and Orca orchestration. Add no daemon, shell precheck,
 watchdog script, custom scheduler, cursor or pending sidecar, runtime database,
 workflow state machine, decision interpreter, or programmatic escalation gate.
-The live VPS activation, native reuse and busy-tick behavior, recovery path,
+The live VPS activation, native fresh-session and overlapping-pass behavior, recovery path,
 nested dispatch depth for coordinator-launched leaves, and resource ceiling
 remain unverified until the canary succeeds.

package/skills/axstack/references/lifecycle.md

@@ -110,8 +110,8 @@ differs from merged; human merges.
 
 ## Watch health
 
-The native review and watch managers reuse separate dedicated workspaces on
-staggered 15-minute schedules. Each admits at most five executing PR jobs;
+Native review and watch lanes use fresh finite sessions in isolated per-pass
+workspaces on staggered 15-minute schedules. Each admits at most five executing PR jobs;
 waiting PRs remain covered without reserving slots. Bounded PR jobs own their
 events, use per-PR worktrees, and settle after descendants settle. Build no
 custom scheduler, state engine, or legacy fallback. Details live in

package/skills/axstack/references/review-manager-prompt.md

@@ -1,9 +1,12 @@
 # Review manager prompt
 
-You are the reusable review manager in your dedicated Orca workspace. Enter
+You are a fresh finite review-manager session in its isolated per-pass Orca workspace. Enter
 through the installed `axstack-review` skill; that skill loads its packaged
 `../axstack/references/automations.md` contract by relative reference. Discover
 every eligible peer-review event and invoke the skill through Orca for each
 admitted bounded PR job. Keep complete coverage separate from the five-job
 execution cap, preserve exact ownership and receipts, settle completed trees,
-and stay quiet when nothing changed. Never check out a PR branch here.
+and stay quiet when nothing changed. Reconcile before admission, save durable
+continuity outside this workspace, then retire only this pass workspace as the
+final action under the contract's ownership guards. Reconcile the whole lane,
+not just this workspace. Never check out a PR branch here.

package/skills/axstack/references/watch-manager-prompt.md

@@ -1,10 +1,12 @@
 # Watch manager prompt
 
-You are the reusable watch manager in your dedicated Orca workspace. Enter
+You are a fresh finite watch-manager session in its isolated per-pass Orca workspace. Enter
 through the installed `axstack-watch` skill; that skill loads its packaged
 `../axstack/references/automations.md` contract by relative reference. Discover
 every eligible own-PR event and invoke the skill through Orca for each admitted
 bounded PR job. Keep complete coverage separate from the five-job execution
 cap, preserve exact ownership, candidates, holds, and receipts, settle
-completed trees, and stay quiet when nothing changed. Never check out a PR
-branch here.
+completed trees, and stay quiet when nothing changed. Reconcile before
+admission, save durable continuity outside this workspace, then retire only this
+pass workspace as the final action under the contract's ownership guards.
+Reconcile the whole lane, not just this workspace. Never check out a PR branch here.

package/skills/axstack-review/SKILL.md

@@ -5,11 +5,13 @@ description: When a candidate PR needs final review, use axstack-review for conf
 
 # Review
 
+Manual invocation does not enter the scheduled manager lifecycle; never close the user’s chat or workspace.
+
 Produce one evidence-bound verdict for an exact candidate revision using the
 review count and model routing required by its mode. Report within the
 requested authority; the human merges unless separately authorized otherwise.
 
-When the current session is the reusable review manager, load
+When the current session is a fresh review-manager session, load
 [Native PR managers](../axstack/references/automations.md) and follow only its
 discovery, admission, recovery, and settlement branch. Do not review a PR,
 materialize `axstack-owner`, or check out a PR branch in the manager workspace.
@@ -276,7 +278,7 @@ private transport values or configuration.
 
 Under a manager PR job, credible serious risk found by a reviewer raises the
 standing internal prompt and dependent-action hold immediately in the compact
-run record and reusable manager's Orca conversation. The authorized
+run record and a durable GitHub or user-owned conversation. The authorized
 `axstack-relay` notification points the user there; delivery or silence never
 authorizes action.
 
@@ -329,7 +331,7 @@ to the intended commit.
 For a peer PR selected under
 [Native PR managers](../axstack/references/automations.md), apply the same
 complete-review and exact-commit requirements. A serious-risk escalation holds
-submission in the reusable manager conversation. Otherwise `APPROVE` requires
+submission at its durable decision location. Otherwise `APPROVE` requires
 no validated blocker and `REQUEST_CHANGES` requires at least one evidenced
 validated blocker. `INCOMPLETE`, unavailable inputs, unresolved disagreement,
 or unknown GitHub state submits nothing.

package/skills/axstack-watch/SKILL.md

@@ -5,6 +5,8 @@ description: When babysitting an existing PR, use axstack-watch to monitor or ma
 
 # Watch
 
+Manual invocation does not enter the scheduled manager lifecycle; never close the user’s chat or workspace.
+
 Leave each adopted PR with one accountable owner, current readiness evidence,
 and user-facing updates that name its current milestone and next wake or
 condition.
@@ -14,7 +16,7 @@ Its required edge loads [Shared lifecycle](../axstack/references/lifecycle.md),
 including the end-of-run audit hook. Reach other references only at the steps
 that name them.
 
-When the current session is the reusable watch manager, load
+When the current session is a fresh watch-manager session, load
 [Native PR managers](../axstack/references/automations.md) and follow only its
 discovery, admission, recovery, and settlement branch. Do not adopt or repair a
 PR, materialize `axstack-owner`, or check out a PR branch in the manager
@@ -71,9 +73,9 @@ Read-only checks and updates to the already-owned local record need no runtime
 load. When the watch needs a new owner or automated observation, first read
 [Watch runtime](references/watch-runtime.md) and then
 [Orca runtime](../axstack/references/orca-runtime.md). Reconcile before creating
-anything. The native watch manager reuses one dedicated workspace on its
-staggered 15-minute schedule, covers every eligible own PR, and starts only
-bounded actionable-event jobs. Waiting PRs reserve no execution slots and
+anything. Each native watch-manager pass starts a fresh finite session in an
+isolated per-pass workspace on its staggered 15-minute schedule, covers
+every eligible own PR, and starts only bounded actionable-event jobs. Waiting PRs reserve no execution slots and
 there is no watch deadline for manager automation. `axstack-monitor` stays an
 optional read-only observer that never sends. One read-only PR observation
 needs neither. The bounded PR coordinator is the live owner for its event;
@@ -127,8 +129,8 @@ the current revision, and a recorded hold or next owner where work remains.
 When a new actionable event is eligible under a recorded `Notification policy`,
 the owner may use the optional [axstack-relay](../axstack-relay/SKILL.md).
 The monitor never sends. The manager deduplicates authorized notifications;
-absent policy or failed relay uses its current Orca conversation and leaves
-every existing hold open.
+absent policy or failed relay uses the recorded durable GitHub or user-owned
+conversation and leaves every existing hold open.
 
 ## 5. State readiness precisely
 
@@ -140,9 +142,9 @@ observed state distinct from merged, and the human merges by default.
 ## 6. End and preserve continuity
 
 A bounded manager PR job ends as soon as its current event and every owned
-descendant settle. It returns exact receipts and remaining state to the
-reusable manager, releases proven resources, and never waits for merge or stops
-the manager's recurring schedule.
+descendant settle. It returns exact receipts and remaining state to the logical
+manager lane's durable continuity, releases proven resources, and never waits
+for merge or stops the manager's recurring schedule.
 
 End a standalone watch early when all required PRs merge, at cancellation, or
 at its shared default 24 h deadline. There is no watch deadline for manager

package/skills/axstack-watch/references/repair-publication.md

@@ -36,9 +36,9 @@ exact new revision and base, all six angles, applicable acceptance, the reply
 body identities, and every affected boundary, with no unresolved material
 finding or urgent hold. Under a manager PR job, a serious-risk escalation
 preserves the local candidate and exact context, records the hold in the
-compact record and reusable manager conversation, and sends only an authorized
-deduplicated notification. Publication remains held until the user decides in
-that conversation and all exact inputs are revalidated.
+compact record and a durable GitHub or user-owned conversation, and sends only
+an authorized deduplicated notification. Publication remains held until the
+user decides at that durable location and all exact inputs are revalidated.
 
 ## 3. Revalidate immediately before publication
 

package/skills/axstack-watch/references/watch-runtime.md

@@ -13,10 +13,12 @@ stop task-owned registrations at completion, cancellation, or expiry.
 
 ## Native watch manager
 
-The separate native watch manager follows the
-[native PR-manager contract](../../axstack/references/automations.md). It reuses
-one dedicated workspace at minutes `7,22,37,52`, scans every eligible own PR,
-and admits at most five bounded actionable-event jobs. Waiting PRs stay covered
+The separate native watch manager lane follows the
+[native PR-manager contract](../../axstack/references/automations.md). Each pass
+uses a new isolated workspace and fresh finite session at minutes `7,22,37,52`.
+Continuity survives outside disposable workspaces; admission reconciles the
+whole lane across workspaces. It scans every eligible own PR and
+admits at most five bounded actionable-event jobs. Waiting PRs stay covered
 without reserving slots. Each job uses its own repository-parented worktree and
 settles with all descendants; no model, per-PR timer, or polling loop waits for
 CI, review, a user decision, or merge.
@@ -27,8 +29,8 @@ settings or source configuration are not runtime evidence. Preserve quiet
 unchanged behavior, exact-head event dedupe, ownership, complete discovery,
 and current authority.
 
-Before activation, canary same-session reuse, a busy scheduled tick, session
-loss and recovery, nested dispatch depth for coordinator-launched leaves, and
+Before activation, canary fresh-session launch, an overlapping scheduled pass,
+session loss and recovery, nested dispatch depth for coordinator-launched leaves, and
 total process and memory behavior. Until observed, those remain unverified; do
 not replace them with a precheck, watchdog, custom scheduler, state engine, or
 legacy fallback.