axstack 0.20.31 → 0.22.0

package/skills/axstack-align/SKILL.md

@@ -26,7 +26,9 @@ Set the rung from researched facts; never ask the user to choose it. A change
 inside one module's existing interface, ownership, data flow, and failure
 guarantees is Rung 0: no design questions or sketch. Otherwise load the
 [design lens ladder](../axstack/references/design-lens.md) for Rung 1 or 2
-and settle only unresolved areas in its order within the existing budget. Carry a
+and settle only unresolved areas in its order within the existing budget.
+For unresolved Rung 1 or 2 design questions, load
+[Brainstorm](../axstack-brainstorm/SKILL.md) inline. Carry a
 Rung 1 or 2 sketch in the substantial spec's `Design` section or the returned
 small-change intent. A design question alone does not make small work
 substantial; apply routing's existing size reassessment rule.
@@ -37,7 +39,7 @@ substantial; apply routing's existing size reassessment rule.
    tools before asking the user. Separate facts from preferences, name evidence
    gaps, and map which decisions unlock others. When a fact needed for the
    frontier is not derivable from the local repo or docs by ordinary reading,
-   dispatch `axstack-research` branches through Orca by source type:
+   dispatch `axstack-research` branches through T3 `delegate_task` by source type:
    requirements, code, web, and, once configured, X. Give one owner per branch,
    use cross-harness routes where the roles allow, and require a cited note per
    the research skill's source standards. The driver folds verified claims into
@@ -65,9 +67,10 @@ substantial; apply routing's existing size reassessment rule.
 The current chat remains the driver under
 [Standing contracts](../axstack/references/contracts.md). For each new
 user round, the driver independently drafts the prioritized frontier and
-recommendations, except for an arena-grade question (below), where the driver
-writes the brief and rubric but drafts no recommendation until the candidates
-and judge verdicts return, so nothing anchors them. Then consult `axstack-advisor-astra` and
+recommendations, except for brainstorm questions, where the driver frames the
+brief and rubric and assesses after the candidates and required judge rounds
+return. Reuse valid brainstorm receipts to replace the adviser consult for
+that question. For other questions, consult `axstack-advisor-astra` and
 `axstack-advisor-opus` independently, without cross-reading, using the same
 bounded evidence and question. Each adviser challenges assumptions, edges,
 omissions, and alternatives; the driver synthesizes disagreements and accepts
@@ -76,61 +79,21 @@ material disagreement remains, then surface the choices to the user. Never
 fabricate consensus or impersonate a role.
 
 Immediately before the first actual adviser dispatch, load and follow
-[Orca runtime](../axstack/references/orca-runtime.md). Reuse each adviser
+[T3 runtime](../axstack/references/t3-runtime.md). Reuse each adviser
 session and settled receipt; consult only the changed frontier and reuse
 unchanged receipts. Record compact adviser evidence, the driver's assessment,
 and user-resolved choices for `axstack-spec`. If either adviser is unavailable,
 hold Align; safe fact work may continue without substitution.
 
-## Arena for hard-to-reverse design choices
-
-Critique of one draft anchors every reader to that draft's shape. Rung 2 designs
-alone enter the arena: they meet the same test as for an ADR (a meaningful,
-hard-to-reverse, non-obvious trade-off: architecture, module boundaries, data
-model, migration strategy). Replace the critique round for that question with
-an arena. Small or routine questions never enter the arena.
-
-1. **Frame.** The driver writes the brief (the artifact, its constraints, the
-   settled decisions it must respect) and three to six gradeable rubric
-   criteria. Candidates receive only the brief; the rubric is for judging.
-2. **Fan out.** Produce one candidate per configured family independently from the same brief,
-   without cross-reading: `axstack-advisor-astra`, `axstack-advisor-opus`,
-   `axstack-arena-candidate-grok`, and `axstack-arena-candidate-antigravity`.
-   Each gives a design, rationale, and rejected alternatives. The driver authors no candidate.
-3. **Cross-judge.** After every candidate completes, give round 1 judge
-   `axstack-arena-judge-opus` the anonymized, relabeled candidates and rubric to
-   score every candidate per criterion and recommend a base with a reason.
-   The driver compares its own pick with the Opus verdict. Only if the driver
-   and the Opus judge disagree on the base, or the user rejects the round-1
-   synthesis,
-   run round 2 with fresh sessions: `axstack-escalation-fable` and `axstack-arena-judge-astra`
-   independently score the same anonymized candidates and rubric. Judges never
-   author, never cross-read each other, and never average verdicts. After round-2
-   verdicts return, the driver re-picks in step 4 and re-presents in step 6.
-4. **Pick.** The driver reads every candidate end to end and scores per
-   criterion, not on holistic feel, then compares with the judge verdicts from
-   each completed round. Agreement confirms the base. On disagreement, re-read
-   the rationales and decide with a stated reason; never average verdicts or
-   fabricate consensus.
-5. **Graft.** Walk the losing candidates once more for the one or two ideas
-   worth porting and fold them into the base by hand so the result stays
-   coherent under one mental model. Convergence on the same shape is a strong
-   agreement signal: adopt the consensus shape, no graft. Wide divergence
-   means the frame was under-specified: reframe and rerun once, never
-   average.
-6. **Present.** The synthesized design is the recommendation in the next
-   `Qn`, with its trade-off, judge verdicts per round, and what was grafted or rejected.
-   The user still decides; spec approval remains the one human checkpoint.
-
-Record the synthesis note (base, grafts and their source candidate, rejections,
-dropouts, judge verdicts per round) as `Decisions` rows in the
-[run record](../axstack/references/run-record.md). Load
-[Orca runtime](../axstack/references/orca-runtime.md) immediately before the
-first candidate or judge dispatch. If any configured candidate or judge seat
-required for that round is unavailable at launch or returns a failed receipt,
-hold that question without substitution, record the gap, and ask: the user decides whether to proceed without it.
-For an uncertain dispatch, reconcile natively; it is never treated as absent.
-Unaffected fact work and questions continue.
+An optional adviser note may be deferred or rejected in a `Decisions` row with
+the draft unchanged; it needs no new adviser pair. Changed draft text, a
+blocking finding, or a high-stakes decision requires fresh receipts on the new
+revision.
+
+## Use the brainstorm synthesis
+
+Present its recommendation and trade-off in the next `Qn` within the same
+question budget. The user still decides; reuse unchanged receipts.
 
 ## Bound the interview
 
@@ -189,7 +152,7 @@ approval; record chosen document names and paths once per run.
    documentation pointers without adding another runtime. Return the compact
    scope and record pointer in the current chat. Native transfer is separate:
    use it only when the user explicitly requests transfer, loading
-   [Orca runtime](../axstack/references/orca-runtime.md) immediately before
+   [T3 runtime](../axstack/references/t3-runtime.md) immediately before
    actual dispatch. Alignment completion never dispatches a recipient.
 
 Alignment completes for both sizes only when the handoff is usable and its next

package/skills/axstack-audit/SKILL.md

@@ -23,7 +23,7 @@ shared load edge explicit: Standing contracts require
 substantive phases, and lifecycle's audit hook loads this skill. This audit is
 the terminal exception: it writes its assigned record and does not audit itself.
 
-The dispatching driver reads [Orca runtime](../axstack/references/orca-runtime.md)
+The dispatching driver must read [T3 runtime](../axstack/references/t3-runtime.md)
 immediately before an actual auditor profile or session dispatch. Ordinary
 audit reading and record writing do not load it, and the auditor never
 dispatches.
@@ -34,7 +34,14 @@ This skill governs what that auditor reads, measures, and proposes.
 Dispatch `axstack-auditor` and `axstack-auditor-sol` independently on the same
 bounded brief, without cross-reading. The driver reconciles findings per claim;
 never average verdicts. Record an intentionally absent Sol seat and continue
-with the base auditor alone; a configured but unavailable seat holds its work.
+with the base auditor alone. `axstack-auditor-sol` is optional: if its launch
+fails, fence it, record `absent (<reason>)`, name it once in the next read-back,
+and skip it without relay or substitution. In mixed fan-out retain a Codex and
+a Claude seat or hold the affected audit.
+If the base auditor is unlaunchable (preflight rejection, no Dispatch started),
+record `auditor: UNKNOWN (unlaunchable)` with the attempted route and error as
+the archive receipt; archive the run. A launched auditor Dispatch must settle
+normally. There is no substitution for the base auditor.
 The user-chosen improvement mode is a tested, independently reviewed PR that a
 human merges.
 
@@ -87,7 +94,9 @@ counts with denominators plus the evidence behind the count:
 - Applicable test-first evidence: normal behavior changes have real red-green
   proof; explicitly accepted structure-preserving work has the old revision
   green before edits and the same checks green on the new revision, plus
-  applicable equivalence evidence. Record noncompliance when the applicable
+  applicable equivalence evidence. Authorized F repairs use
+  [F proof](../axstack/references/test-value.md#f-proof).
+  Record noncompliance when the applicable
   evidence path is absent, or `UNKNOWN` with the reason when its records are
   unavailable.
 - Independent exact-revision review status and unresolved findings.

package/skills/axstack-audit/references/record.md

@@ -12,7 +12,7 @@ Steps: <completed / deviated + why + approval per deviation>
 Advisers: <Astra/Opus configured coverage / eligible uses + same-question receipts; Astra/Fable high-stakes AGREE coverage / eligible uses>
 Decisions: <escalation trigger + evidence pointers + outcome changed yes/no, or n/a>
 Debug: <rung reached + loop command + fix attempts + adviser and investigator receipts + isolation evidence | n/a>
-TDD: <applicable evidence path: normal real red-green | accepted structure-preserving old revision green before edits + same checks new revision green; absent proof: noncompliance | unavailable records: UNKNOWN with reason>
+TDD: <applicable evidence path: normal real red-green | accepted structure-preserving old revision green before edits + same checks new revision green | F-repair base-green/removal-inversion-red/rewording-green evidence; absent proof: noncompliance | unavailable records: UNKNOWN with reason>
 Review: <exact-rev independent review status + unresolved findings>
 Rework: <cycles + causes>
 Interventions: <avoidable user interventions, or unsupported by records>

package/skills/axstack-brainstorm/SKILL.md

@@ -0,0 +1,24 @@
+---
+name: axstack-brainstorm
+description: When validating a design approach, use axstack-brainstorm to compare independent candidates and return a synthesis.
+---
+
+# Brainstorm
+
+Standalone usage: `/axstack-brainstorm <problem + candidate approach>`.
+Run inline in the current T3 driver thread. Never delegate a coordinator.
+This procedure is report-only. Do not implement, prototype, or grant execution
+or spec approval. Never interview the user or invoke Align.
+
+Load [Standing contracts](../axstack/references/contracts.md) before acting.
+Set the rung from researched facts under the
+[design lens](../axstack/references/design-lens.md); Rung 2 meets its ADR test.
+Follow the [arena procedure](references/arena.md), preserving settled decisions
+and naming missing evidence. Candidates challenge the supplied approach as
+well as proposing alternatives.
+
+Return `recommend | revise | reject | unresolved` with the
+[sketch](../axstack/references/design-lens.md#sketch), including `Rejected` and
+`Open`, plus base, criterion scores, grafts, dropouts and completed judge rounds.
+Return proposed questions to the caller. The caller owns preferences, next
+steps and any approval; an open blocker stays unresolved.

package/skills/axstack-brainstorm/references/arena.md

@@ -0,0 +1,56 @@
+## Arena
+
+Every brainstorm runs a light arena. At Rung 1, the driver scores, picks and
+grafts without a judge round. Only at Rung 2, run the judge rounds below for
+hard-to-reverse choices; they replace the critique round for that question.
+
+1. **Frame.** The driver writes the brief (the artifact, its constraints, the
+   settled decisions it must respect) and three to six gradeable rubric
+   criteria. Every brief requires a premise check and comparison with the
+   smallest change and doing nothing. The rubric uses agent-contributor red
+   flags as evidence prompts: seeing only opened files, copying the nearest
+   example, taking the shortest path that compiles. Treat them as prompts, not defects. Candidates receive only the brief; the rubric is for judging.
+2. **Fan out.** Produce one candidate per configured family independently from the same brief,
+   without cross-reading: `axstack-advisor-astra`, `axstack-advisor-opus`,
+   `axstack-arena-candidate-grok`, and `axstack-arena-candidate-antigravity`.
+   Each gives a design, rationale, and rejected alternatives. The driver authors no candidate.
+   The driver drafts no recommendation until every candidate returns.
+3. **Cross-judge (Rung 2 only).** After every candidate completes, give round 1 judge
+   `axstack-arena-judge-opus` the anonymized, relabeled candidates and rubric to
+   score every candidate per criterion and recommend a base with a reason.
+   The driver compares its own pick with the Opus verdict. Only if the driver
+   and the Opus judge disagree on the base, or the caller re-invokes with the user's rejection of the round-1
+   synthesis,
+   run round 2 with fresh sessions: `axstack-escalation-fable` and `axstack-arena-judge-astra`
+   independently score the same anonymized candidates and rubric. Judges never
+   author, never cross-read each other, and never average verdicts. After round-2
+   verdicts return, the driver re-picks in step 4 and re-presents in step 6.
+4. **Pick.** The driver reads every candidate end to end and scores per
+   criterion, not on holistic feel, then compares with the judge verdicts from
+   each completed round. Agreement confirms the base. On disagreement, re-read
+   the rationales and decide with a stated reason; never average verdicts or
+   fabricate consensus.
+5. **Graft.** Revisit losing candidates once; graft one or two ideas by hand
+   into the coherent base under one mental model. Convergence on the same shape is a strong
+   agreement signal: adopt the consensus shape, no graft. Wide divergence
+   means the frame was under-specified: reframe and rerun once, never
+   average.
+6. **Present.** Return the synthesized design to the caller with its
+   trade-off, judge verdicts per round, and what was grafted or rejected.
+   The user still decides; spec approval remains the one human checkpoint.
+
+Record the synthesis note (base, graft sources, rejections, dropouts, judge
+verdicts per round) as `Decisions` rows in the
+[caller's run record](../../axstack/references/run-record.md) when one exists,
+otherwise include it in the returned verdict. Load
+[T3 runtime](../../axstack/references/t3-runtime.md) immediately before the
+first candidate or judge dispatch. If an optional Grok or Antigravity candidate
+malfunctions (launch failure, trust/login prompt, or prompt block), fence it,
+record `absent (<reason>)`, name it once in the next
+read-back, and continue with available candidates without relay or substitution.
+A required adviser, candidate, or judge needed for this rung unavailable at
+launch or returning a failed receipt holds that question without substitution;
+record the gap and return a proposed question to the caller about whether to proceed. In mixed fan-out retain at least one Codex and one Claude
+seat, or hold the affected question.
+For an uncertain dispatch, reconcile natively; it is never treated as absent.
+Unaffected fact work and questions continue.

package/skills/axstack-cleanup/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: axstack-cleanup
-description: When completed Orca subagent resources need bounded retirement, use axstack-cleanup after accepted settlement or for an explicitly scoped backlog.
+description: When completed T3 threads and worktrees need bounded retirement, use axstack-cleanup after accepted settlement or for an explicitly scoped backlog.
 ---
 
 # Cleanup
 
-Run cleanup inline in the driver after accepting a worker, Task, or Run
+Run cleanup inline in the driver after accepting a worker task or run
 completion, or for the exact backlog scope the user named. This skill never
 dispatches a cleanup worker and never retires its current driver session.
 
@@ -14,13 +14,15 @@ Before any runtime action, load and follow:
 - [Standing contracts](../axstack/references/contracts.md)
 - [Lifecycle and receipts](../axstack/references/lifecycle.md)
 - [Shared routing](../axstack/references/routing.md)
-- [Orca runtime boundary](../axstack/references/orca-runtime.md)
+- [T3 runtime](../axstack/references/t3-runtime.md)
 - [Workspace hygiene](../axstack/references/workspace-hygiene.md) for settlement, salvage, and driver-start sweep
 - [Private evidence archive](../axstack/references/evidence-archive.md) when
   evidence is the last removable-worktree blocker
 
-Use the runtime-discovered Orca guides for inventory, release, terminal close,
-and worktree removal. Do not embed or improvise a competing command protocol.
+Use project-scoped T3 thread inventory, `git worktree list --porcelain` and run
+records. Preflight requires `worktreeCleanup` off via `t3_project_read` where
+exposed, or a recorded setup limitation. Follow the runtime schema, never invent
+an alternate command protocol.
 
 ## Authority and scope
 
@@ -28,29 +30,26 @@ Inline cleanup may consider only resources owned by the accepted completion it
 is processing. Driver-start orphan sweeps follow the guarded cross-run sweep in
 [Workspace hygiene](../axstack/references/workspace-hygiene.md). Backlog
 cleanup requires an explicit bounded selector such as a
-Run, Task set, workspace set, repository, or named age window; age narrows an
+project, run, task set, checkout set, repository, or named age window; age narrows an
 inventory but never establishes eligibility. A partial inventory holds only the
 resource whose identity or state is incomplete while other independently proven
 resources may proceed.
 
-Never clean a manual chat, the current driver, genuine `user_takeover`, an
-active or unknown worker, an unsettled descendant, or a resource with ambiguous
-ownership.
-Preserve unknown files, unmerged author work, ambiguous publication, and
-evidence that has not been durably preserved. Do not
-force native removal, bulk-clean, override a hook failure, edit a runtime
-database, or add a scheduler, daemon, or state machine.
+Never clean a user-created thread, the current driver, a user-taken-over thread, an active or unknown worker, an unsettled descendant, or a resource with ambiguous ownership.
+Preserve unknown files, unmerged author work, ambiguous publication, and evidence that has not been durably preserved.
+Do not force removal, bulk-clean, edit a runtime database, or add a scheduler,
+daemon or state machine. Report other projects' resources; never touch them.
 
 ## Reconcile each candidate
 
-Take a fresh native inventory and bind every candidate to its exact Run, Task,
-Dispatch, terminal incarnation, workspace, repository, branch, and current
+Take a fresh native inventory and bind every candidate to its exact projectId, attempt key, taskId/childThreadId/childRunId
+or threadId/runId, checkout path, repository, branch, and current
 liveness. Read current Git and forge state rather than trusting age, names, or a
 prior receipt. Reconcile an existing cleanup claim before retrying so repeated
 invocations converge instead of duplicating mutations.
 
 Retire descendants before parents. A candidate is eligible only when all owned
-Dispatches are accepted as settled, no descendant remains unsettled, native
+tasks and runs are accepted as settled, no descendant remains unsettled, native
 liveness is positively known where required, and every preservation guard is
 cleared. Record one decision per resource; uncertainty about one candidate does
 not authorize or block unrelated candidates.
@@ -60,50 +59,47 @@ not authorize or block unrelated candidates.
 Classify exact evidence files individually. Save the compact cleanup decision
 and identities in the private run record or another configured durable private
 location outside disposable worktrees. When the evidence archive applies, use
-its helper with either the existing PR identity or the non-PR Run and Task
+its helper with either the existing PR identity or the non-PR run and task
 identity; never invent a PR number. Read back the durable record and, when an
 archive is used, its manifest, including hashes and exact identities, before
 removing any source copy or workspace.
 
-Archive success proves only preservation of the listed bytes. It does not prove
-settlement, exit, ownership, a clean worktree, publication, or removal safety.
+Archive success proves only preservation of the listed bytes; it does not prove settlement, liveness, ownership, a clean worktree, publication, or removal safety.
 
 For a completed non-author worktree with useful local content, follow the
 [Workspace hygiene](../axstack/references/workspace-hygiene.md) salvage path
 before removal; a verified bundle changes preservation classification, not
 native ownership or liveness. Keep an author worktree until its PR merges or closes.
 
-For a settled reviewer Dispatch, the reviewer worktree can be retired while its
-PR remains open, before merge, after its report and supporting evidence are
-archived privately and read back. Generated reviewer scratch is disposable
-after a compact durable receipt is written outside the review worktree and read
-back. Bind that receipt to the exact repository, Run,
-Task, Dispatch, reviewer workspace and terminal, exact head SHA and base SHA,
-review verdict, coverage and limitations, test and CI result pointers, and the
-user authorization and scope for cleanup. A raw reviewer report may be discarded
-after its verdict and limitations are compacted into that read-back receipt;
-use the private evidence archive for the report and supporting evidence. Verify
-each Dispatch archive and manifest readback independently. Preserve the separate
-author candidate with useful unmerged work; reviewer cleanup never removes it.
-
-Use only a named run-owned scratch prefix recorded with the Dispatch. Multiple
-Dispatches in the same reviewer worktree are recovery for missed earlier
+For a settled reviewer task, its checkout can be retired while the PR remains open, before merge, after its report and supporting evidence are archived privately and read back.
+Generated reviewer scratch is disposable after a compact durable receipt is
+written outside the review checkout and read back. Bind it to projectId,
+repository, attempt key, taskId/childThreadId/childRunId, checkout path, exact head
+SHA and base SHA, review verdict, coverage and limitations, test and CI result
+pointers, user authorization and cleanup scope. A raw reviewer report may be
+discarded after its verdict and limitations are compacted into that read-back
+receipt; use the private evidence archive for the report and supporting evidence.
+Evidence already outside the checkout needs no copy; read it back. Verify each
+task archive and manifest readback independently. Preserve the separate author
+candidate with useful unmerged work; reviewer cleanup never removes it.
+
+Use only a named run-owned scratch prefix recorded with the attempt. Multiple
+tasks in the same reviewer worktree are recovery for missed earlier
 cleanup; after independent archives and readback, use per-prefix removal. Two or
 more review passes in the same reviewer worktree may leave distinct prefixes;
-each named run-owned scratch prefix must belong to an accepted settled Dispatch
-in the Run. Require `git status --porcelain=v1 -z --untracked-files=all`
+each named run-owned scratch prefix must belong to an accepted settled task
+in the run. Require `git status --porcelain=v1 -z --untracked-files=all`
 to show all dirt as untracked files inside a run-owned scratch prefix. Prove
 every remaining untracked file individually belongs to one of those named
 run-owned scratch prefixes; any tracked, staged, unmerged or unpushed work,
 dirty source, or dirt outside them enters the salvage check above or holds.
-Check ignored files across the whole worktree too; unknown or ignored non-cache content holds. Validate that
+Check ignored files across the whole worktree too; classified ignored non-cache content enters the verified salvage path, while unknown content holds. Validate that
 the detached checkout still matches the reviewed head and check local commits
 against recorded remote refs; unknown divergence holds. Validate that
 the exact reviewed scratch prefix names the recorded directory inside the exact
 reviewer worktree, never a repository-root target or symlink. Inspect every
 descendant for symlinks, hard links, special files, unknown content, user-owned
-files, or ignored files; any mismatch holds. Active or `user_takeover` terminals
-also hold.
+files, or ignored files; any mismatch holds. Active or user-taken-over threads also hold.
 
 For each prefix, list the exact scoped path and all descendants with their
 types, confirm each belongs to generated reviewer scratch, and record that
@@ -121,64 +117,50 @@ absent, while remaining classified prefixes and outside content still match.
 Only unexpected changes hold. Then run
 `git clean -fd -- <same exact prefix>` with the identical concrete path, record
 that path and outcome, and repeat for the next proven prefix. Recheck clean Git status
-after the last deletion. Require final clean Git status before native
-exact-workspace removal without force. Use no unresolved variable as a destructive target.
-Never use `-x`, a
-glob, a repository-root target, extra force, or broad clean.
+after the last deletion. Require final clean Git status before exact `git worktree remove <path>` without force. Use no unresolved variable as a destructive target.
+Never use `-x`, a glob, a repository-root target, extra force, or broad clean.
 This scratch decision does not waive any other preservation or native removal
 guard.
 
 ## Apply distinct native operations
 
-Treat these operations as separate decisions and receipts:
-
-1. **Worker release.** After the matching completion is accepted, use the
-   runtime guide's settled-Dispatch release operation. Release is not
-   cancellation, terminal-close proof, worktree removal, or chat archival.
-   Once required output is captured, a dirty or useful unmerged worktree does
-   not block release of its accepted settled worker; retain the worktree under
-   its own classification and receipt.
-2. **Unused shell close.** Close only a positively identified unused setup
-   shell with the guide's exact-terminal operation. Re-list and require exit for
-   that same terminal incarnation. Never close a worker, manual, unexpected, or
-   current-driver terminal through this path.
-3. **Worktree removal.** Re-read Git status, branch/upstream divergence,
-   unpushed commits, forge merge/publication state, children, terminals, and
-   archived evidence immediately before the native exact-workspace removal.
-   When archived evidence is the last dirt for one Dispatch, use the evidence
-   archive helper's manifest-bound retirement operation and require an empty
-   pending set. If multiple Dispatch scratch prefixes remain in one checkout,
-   the helper may reject the other Dispatch's files as unclassified; after
-   independently verified per-Dispatch archives and full union classification,
-   use the exact per-prefix dry-run and clean above. Never unlink through prose
-   or a shell loop. Verify the effective Archive Script
-   provenance before native removal: an unknown or required-but-untrusted hook
-   holds. Record its native outcome as `unconfigured`, `passed`, `failed`, or
-   `unknown`; only `unconfigured` or trusted `passed` may advance. Account for
-   branch-deletion side effects explicitly, then re-list both native workspaces
-   and Git refs. Read back each remaining local review ref against its recorded
-   name and tip. Any branch with unknown origin, unique commits, an active
-   worktree, or a remote counterpart must be preserved. Only when provenance
-   proves a ref was created for the removed reviewer checkout and its tip is
-   already reachable from the preserved author candidate or confirmed remote PR
-   head, permit
-   exact-ref expected-old ref deletion and read back its absence. Never delete
-   the author branch or use generic force. A failed or unknown hook outcome or
-   uncertain response preserves the resource; never force or substitute shell
-   deletion.
-4. **Chat archival.** Attempt it only if the version-matched runtime guide
-   advertises a distinct supported operation and the scoped chat is eligible.
-   Otherwise record chat archival as unsupported. Process exit, worker release,
-   terminal close, and worktree removal do not prove UI history disappeared.
-
-Do not self-close or self-remove. Return control to the driver after recording
-receipts and holds; the owner decides when its own Run may archive.
+Follow [Workspace hygiene](../axstack/references/workspace-hygiene.md)'s exact
+cleanup order: settled descendants, evidence readback, salvage dirty or ignored
+non-cache content, thread archive, exact worktree removal without force, then
+local-only branch retirement. Treat each as a separate decision and receipt:
+
+1. **Thread archival.** Require accepted matching completion and terminal run
+   evidence for the exact task or run, with no pending descendants. Use
+   `t3_thread_organize` archive for that exact eligible thread. Retain an author
+   thread and worktree until PR merge or closure. Metadata archive does not prove
+   process exit, worktree removal or evidence preservation.
+2. **Worktree removal.** Immediately re-read Git status, ignored files,
+   branch/upstream divergence, unpushed commits, forge merge/publication state,
+   descendants, native ownership/liveness and preserved evidence. When archived
+   evidence is the last dirt for one task, use the evidence archive helper's
+   manifest-bound retirement operation and require an empty pending set. For
+   multiple task scratch prefixes, independently verify archives and full union
+   classification, then use the exact per-prefix dry-run and clean above. Never
+   unlink through prose or a shell loop. Run exact `git worktree remove <path>`
+   without force; re-list native threads and `git worktree list --porcelain` to
+   verify archival and worktree absence separately. No native Archive Script is
+   part of this Git path; unknown removal hooks or safety prompts hold.
+3. **Branch retirement.** Read back each remaining local ref's recorded name and
+   tip. Unknown origin, unique commits, active worktrees or a remote counterpart
+   preserve it. Only provenance proving a run-owned local-only ref for the removed
+   checkout and a tip reachable from a preserved candidate, verified salvage ref
+   or confirmed remote PR head permits exact `git branch -d <branch>`; no force.
+   Read back absence; refusal or uncertainty holds the ref.
+   Never delete the author branch or use generic force.
+
+Do not self-archive or self-remove. Return control to the driver after recording
+receipts and holds; the owner decides when its own run may archive.
 
 ## Receipt
 
 Report the scope and inventory denominator, then for each candidate record its
 exact identity, classification (`removed`, `retained`, `held`, or `unsupported`),
 the fresh evidence used, native receipt and readback, and any resume condition.
-Keep settlement, worker release, terminal exit, worktree/branch effects,
+Keep settlement, terminal run evidence, thread archival, worktree/branch effects,
 evidence preservation, and chat archival as separate fields. An idempotent retry
 reconciles these receipts and performs only still-pending eligible operations.

package/skills/axstack-debug/SKILL.md

@@ -129,7 +129,7 @@ two independent receipts or clear the hold. Reconcile contradictory receipts
 by evidence or one discriminating rerun, never by vote.
 
 Immediately before an actual adviser or investigator dispatch, load and follow
-[Orca runtime](../axstack/references/orca-runtime.md).
+[T3 runtime](../axstack/references/t3-runtime.md).
 
 ## Isolation
 

package/skills/axstack-explain/SKILL.md

@@ -16,7 +16,7 @@ exposes both skills, route the request here only.
 Before acting, load [Standing contracts](../axstack/references/contracts.md),
 then follow its required lifecycle and audit pointers. Explanation work has no
 scope baseline. Ordinary work in the current chat needs no launch preflight;
-load the [Orca runtime boundary](../axstack/references/orca-runtime.md) only
+load the [T3 runtime boundary](../axstack/references/t3-runtime.md) only
 immediately before an actual profile dispatch.
 
 ## 1. Bound the question and evidence

package/skills/axstack-explain/references/visual-qa.md

@@ -3,6 +3,8 @@
 Use this checklist for every HTML explanation and other visual artifacts where
 rendering matters.
 
+Browser and visual checks must run in the delegated `axstack-ui-verifier` in its own detached checkout; outputs go to its private evidence folder, never the driver worktree.
+
 1. Identify the final artifact bytes and theme. The explicit user theme wins;
    otherwise use the dark default.
 2. Delegate the rendered pass through [UI verification](../../axstack/references/ui-verification.md).