axstack 0.54.0 → 0.56.0

package/skills/axstack/references/fleet-verification.md

@@ -0,0 +1,102 @@
+# Bounded live fleet verification (later C3/C6)
+
+Run only under the driver's recorded live/host authority. C3a ships this procedure;
+it does not execute it or enable routing. Offline fixtures and source inspection
+cannot establish live eligibility. Use [Fleet dispatch](fleet-dispatch.md) for
+receipt fields, [T3 runtime](t3-runtime.md) for native lifecycle, and the repository
+verify-axstack recipe for separate offline coverage. Never mix live credentials or
+network into that isolated recipe.
+
+## Prepare one owned attempt
+
+Record run key, origin T3 thread link, operator, allowed origin/targets, role/model/
+options/full-access, repository/project identities, exact candidate/base, explicit
+start/end times and a maximum of one harmless nonwriter per distinct route config.
+No overload stress, installation, global policy edits, raw provider CLI or production
+writes belong to this procedure. Exclude any unverified route from enabled coverage.
+No top-level thread without an explicit new-thread request.
+
+Create a fresh 0700 scratch outside HOME on each participating host; record each
+literal path with hostId/environmentId. Before use validate owner, realpath and
+no symlink. Use a separately owned persistent evidence folder on origin and target,
+outside scratch selected for deletion. Put only a tiny fixture README/candidate in
+an explicitly provisioned test project. Record its root HEAD/status/all refs before
+and after; no shared project or unknown ignored artifacts may be cleaned.
+Use native T3 worktree isolation for candidate reviewers; no shell child checkouts.
+
+Save a coverage row for every directed origin→target and materially distinct
+provider/model/options/runtimeMode/project/isolation/browser/session configuration.
+Record both endpoint T3/Axstack versions, exact installed skill hashes, config
+schema/digest, native-balancer client setting and link expiry. Reuse evidence only
+with a recorded equivalence argument; direction/version/project/session differences
+require their own check. Do not expose credentials in this matrix.
+
+## Actions, expected results and evidence
+
+| Owned fixture / bounded action | Expected observation and retained evidence | Cleanup / failure disposition |
+| --- | --- | --- |
+| Native discovery, once per directed link/config | Save t3_environment_links on origin; forwarded environment/project/catalog reads on target, raw bytes/digests/time/expiry/access. Native project repository identity and selected env/project/model/options match independent expected values. Required session is authenticated on target. Missing effective fields stay UNKNOWN. | No link/settings mutation to make a check pass. Expired/unreachable/access/model gaps exclude the route. |
+| One bounded telemetry batch per origin | C2 sample with explicit configured host↔environment manifest, interval 5000ms, timeout 10000ms. Save raw JSON, collector start/end and source/whole-host/duration/age. Directed telemetry origin×target matrix covers all configured hosts. A failed host is UNKNOWN, never fabricated zero. | Collector exits/reaps only owned processes. No daemon/timer or real overload. |
+| Inventory + pending fixture batch | Save origin task identities, actual remoteChild and current descendants, complete collection provenance and pending clientRequestIds. Replay C1 with exact config/time. Observe 20/35/40 fixture oracle and harmless sequential dispatch spread without claiming reservations. | Reconcile ambiguous submissions in place; unknown inventory remains unknown. Never duplicate a task because a response was lost. |
+| One read-only remote nonwriter | Build destination-bound plan from the actual target catalog, independently compare expected env/project/model/options/mode, then delegate_task with exact target and stable key/clientRequestId. Task writes only its named target evidence report with pinned candidate marker. Save requested arguments, submission and origin task_status. | Follow native next; no polling, SSH agent, permission/model substitution or top-level fallback. Driver owns native task cancellation if this exact owned attempt must stop. |
+| Current terminal receipt | On completion wake, read origin task_status and target thread/current terminal run plus native pending-question list. Require completed/result_available/no children/questions/approval and exact final marker/run. Save latestTerminalRunId, thread latestRunId/ordinals, native terminal result and host-qualified evidence. If a provider continuation occurs, record the newer current run; old original summary is insufficient. | Unknown liveness or incomplete native read holds. No replacement until exact old attempt is reconciled. Failed/cancelled/waiting outcomes never become successes. |
+| Target reviewer worktree (only when authorized/enabled) | Native isolation worktreePath differs from target project root. Verify exact candidate and base objects there, preserve host/path ownership and report digest; origin transport/readback matches exact SHA/base and bytes. Driver root HEAD/status remains unchanged. | Archive/read back evidence on origin, settle/read back owned child on actual target, then retire only its exact T3-created disposable checkout through cleanup ownership guards. |
+| Required browser mode | For configurations requiring a browser, drive the harmless fixture in the requested headed/headless mode using the configured browser MCP; save actual mode/interaction evidence. | Close only the session/page created by this attempt. No mode equivalence inferred from catalog flags. |
+| Helper failure + fallback fixture | An owned missing/malformed telemetry input produces UNKNOWN; no executable remote route falls back to a locally isolated author at the same pins, even when overloaded. Save recommendation→explicit destination→receipt trace. | No new helper state, automatic retry, model change or authority grant. |
+| C6 installation/config parity and one rollback rehearsal | Under separately recorded deployment authority, all five hosts have identical reviewed config digest/schema and intended CLI/skill/global-source revisions. Roll back only one explicitly owned target, read back exact prior bytes/revision, then restore intended revision and verify. | Keep prior bytes private, never copy credentials. A partial host matrix remains incomplete C6. C3a changes none of these hosts. |
+| iosatellite unattended claim | Before claiming closed-lid/unattended eligibility, verify a real closed-lid job, SSH and T3 operation under its actual configured AC/lid policy and retain logs. | Without that proof, label unattended UNKNOWN; attended reachable operation remains a separate eligible configuration. |
+
+Suggested harmless nonwriter brief: name its key, target-only private evidence
+path, pinned candidate/base, read-only fixture question and exact final
+AXSTACK-DONE marker; forbid tracked/untracked project writes, children, forge,
+install/config edits and html_render. No worktree author or coordinator is part
+of the nonwriter check. Save the observed dispatch response rather than a worker's
+claim about how it was launched.
+
+For terminal negative controls use offline saved copies with one changed fact
+(stale run, question, pending child, wrong env/project/settings/path). Do not create
+real denied prompts, disconnected workers or orphaned production tasks just to
+exercise a guard. Live submission ambiguity, cancellation, provider continuation
+and question handling remain separate UNKNOWN rows unless actually observed in
+an authorized owned context. Never infer their success from an offline negative.
+
+## Remote authors stay disabled
+
+C3b's all-refs-unchanged pilot failed on T3 checkpoint refs. Do not rerun, waive
+or enable that coordinator in C3a/C6 nonwriter verification. Direct remote worktree
+authors are ineligible on T3 v0.1.5. Local isolated authors remain the fallback.
+Any future separately authorized C3b investigation must prove every F4 gate in the
+approved baseline: target local isolation and exact base, nested completion,
+same-author repair/new-run origin wake, question/answer/resume, approval boundary,
+cancellation/failure/orphan propagation including owned disconnected cases,
+unchanged root HEAD/status/all refs, exact retrieval and owned retirement. Record
+all nested IDs and both versions. Unknown stop forbids replacement. No production
+enablement without all gates and accepted scope; no silent all-refs exception.
+
+## Cleanup and receipt
+
+For each owned remote reviewer, read exact target thread/run/ownership again.
+Archive evidence on origin, verify its digest and read it back, then settle on
+target and verify settled:true before removing that recorded disposable checkout.
+Retain user-taken-over, changed, active, unknown or ambiguously owned resources.
+Driver alone owns forge publication, PR links/watch and merges. No worker watches.
+
+For each scratch path, validation must succeed first: exact created literal path,
+no symlink, realpath equality, current ownership and 0700 mode. Finish validation
+successfully, then perform deletion in a separate sequential call on that same
+host/path. Never parallel validation/deletion, ignore failures, glob shared paths,
+clean by age or delete unknown ignored artifacts. Confirm scratch absence and
+persistent evidence survival; record retained resources with a named hold.
+
+Return rows as PASS/FAIL/UNKNOWN/N/A with command/native-call evidence and exact
+versions/config/candidate hashes. Summaries are counts only, never aggregate
+permission. List every omitted config/host/gate and its owning phase. C4 owns
+personal routing policy/Haoshoku live changes; C6 owns deployment and the complete
+live matrix. Nothing here declares a deployed routing switch.
+
+Rerun affected rows after routing/helper/receipt releases, either endpoint's T3
+version change, link replacement/expiry/access change, project/provider/model/
+options/runtimeMode/session/browser change, config digest or policy change, and
+before C6 acceptance. A failed bounded attempt retains evidence; reconcile and
+repair within authority before one new explicit attempt. Never create a scheduler,
+state machine or recurring task to make verification run itself.

package/skills/axstack/references/lifecycle.md

@@ -4,6 +4,8 @@ Phases load through [Standing contracts](contracts.md).
 Driver settlement follows [Workspace hygiene](workspace-hygiene.md).
 Delegated or resumable work uses a driver-owned [Run record](run-record.md)
 binding state and receipts to exact revisions.
+For a logical Coordinator coordinating project drivers, follow
+[Coordinating multiple drivers](t3-runtime.md#coordinating-multiple-drivers).
 
 ## Roster (compact)
 
@@ -80,10 +82,14 @@ Store receipt references, not raw output, in the [Run record](run-record.md).
 - Audit receipt: scope, evidenced PASS/FAIL/UNKNOWN counts/denominators and
   proposals. Only an authorized sanitized summary publishes.
 
+Before ending a waiting turn or closing its condition, follow
+[Waiting-turn and closing records](run-record.md#waiting-turn-and-closing-records).
+
 ## Execution tracking
 
 Follow [T3 runtime](t3-runtime.md) for native completion, questions, launch
-recovery and run-watch waits. Delegated notifications wake the driver; a launched
+recovery and run-watch waits. Never status-check running delegate_task children on scheduled wakes.
+Delegated notifications wake the driver; a launched
 writer sends its marker with `t3_thread_send` using `mode: queue` to the recorded driver thread.
 Delegated completion requires persisted `task_status` before `t3_thread_read`, terminal `completed`, `result_available`, `hasPendingChildRuns:false`, and final `AXSTACK-DONE`.
 Delegated author completion requires delegated terminal checks plus candidate checks: non-empty diff, clean tree and named red/green logs.
@@ -120,7 +126,7 @@ ready. An unreachable predecessor holds. Update one `Next:` line on each
 transition with owner, last receipt time, next action and hold; reconcile it for
 status questions. Stale receipts remain evidence only.
 
-End a driver turn with an unsettled launched thread only while the bound run watch is armed; each wake reconciles all unsettled runs.
+End a driver turn with an unsettled launched thread only while the bound run watch is armed; each wake reconciles unsettled launched-fallback Writer runs.
 Use terminal `t3_thread_wait` and the recorded watch as the runtime contract
 requires, re-arming waits on timeout; sleep or poll loops are forbidden. Delete the watch by exact ID and
 verify absence once nothing remains unsettled. After each delegated completion,
@@ -136,6 +142,17 @@ After accepting task or run completion, the driver invokes
 Axstack creates no heartbeat or substitute scheduler.
 Tracking grants no merge, release, model-substitution, or scope authority.
 
+## Host-qualified fleet receipts
+
+Fleet nonwriters use [Fleet dispatch and receipts](fleet-dispatch.md) in addition
+to the local lifecycle. Origin taskId and destination environment/thread/current
+run are separate identities; remote local-child IDs may be null. Keep exact
+recommendation/config/catalog evidence, requested/effective settings and qualified
+artifact/checkout paths. Read task_status on origin and terminal/question facts
+on destination before advancement. Current completed/result_available with no
+children/questions and an exact final marker is required; an old summary cannot
+complete a provider continuation. Driver-only forge/cleanup ownership is unchanged.
+
 ## Deadline (one rule for every owned timer)
 
 The default 24-hour deadline covers standalone task-owned timers. Stop them at

package/skills/axstack/references/role-roster.md

@@ -1,5 +1,11 @@
 # Role roster
 
+Fleet nonwriter placement follows [Fleet dispatch and receipts](fleet-dispatch.md).
+Roles retain exact configured provider/model/options/full-access on the selected
+native destination. Remote reviewers require T3 worktree isolation; no shell child
+checkout. Host names confer no role or permission. Remote authors/coordinator stay
+disabled; local isolated authors remain supported even overloaded.
+
 - Chat drives (no role ID); `axstack-owner` owns one PR and
   `axstack-author` its sole writer.
   For own PRs, automatic merge is the default under the
@@ -31,6 +37,11 @@
   review round and bounded research, spec, ticket, receipt, and release claims.
 - `axstack-ui-verifier`: owns the inline page interaction pass under [UI checks](ui-verification.md)
   for every interactive page, bound to the exact bytes and SHA-256.
+- `axstack-ui-verifier-sonnet`: `claude/sonnet` high in mixed, read-only;
+  independently drives Android and web/PWA run 2 under [UI checks](ui-verification.md#android-device-and-webpwa-dual-run).
+  `axstack-ui-verifier` (Terra high in mixed) drives run 1; the driver reconciles.
+  `axstack-ui-verifier-sonnet` is intentionally absent in both single-provider presets,
+  leaving dual-run verification unverified; record the absence without substitution.
 - `axstack-research-requirements`/
   `axstack-research-code`/`axstack-research-web`/
   `axstack-explore-execution`:

package/skills/axstack/references/routing.md

@@ -2,6 +2,8 @@
 
 Choose a route; load only the phase and references needed next.
 Driver entry sweep follows [Workspace hygiene](workspace-hygiene.md).
+For work spanning project drivers, follow
+[Coordinating multiple drivers](t3-runtime.md#coordinating-multiple-drivers).
 
 ## Role routing
 
@@ -29,6 +31,8 @@ using saved T3 capabilities JSON; missing or malformed capabilities holds.
 Claude exact IDs come from capabilities, replacing transcript read-back.
 Use an explicit model as given; for `model:null` without a class, grok uses the
 provider's first listed model from saved capabilities and records its exact ID.
+A first listed ID without the `grok-` prefix holds that role with no substitution;
+the prefix checks family, not X access or other live capability.
 A Codex or Claude role with neither model nor class is an intentional absence
 and holds.
 Resume must reuse the saved capabilities and role snapshot with no re-resolution; changes require the user’s explicit decision.
@@ -55,6 +59,16 @@ infer from slot, driver, owner, or provider. Author and owner never review.
 `axstack-implement` requires `mixed`; single-provider presets hold at
 step (3) for user routing: no substitution or same-provider review.
 
+## Fleet destinations (C3a)
+
+For fleet nonwriters, follow [Fleet dispatch and receipts](fleet-dispatch.md):
+C2 sampling and current native assignment inventory feed C1; the driver explicitly
+binds the selected environment/project/settings to native T3 delegation and reads
+terminal facts on the actual destination. Origin catalogs, SSH agent commands and
+legacy worker/control-center host labels grant no execution route. Any configured
+host may originate or receive proven nonwriter work; personal policy/deployment
+changes remain C4/C6. Remote authors stay disabled; keep local isolated fallback.
+
 ## Direct routes (no spec ceremony)
 
 - Route requests to create or maintain a verification skill to `axstack-verify`.

package/skills/axstack/references/run-record.md

@@ -4,6 +4,8 @@ One compact Markdown `progress.md` is required for substantive delegated or
 resumable work. One-step direct answers need no record ceremony, but still
 obey their applicable scope identity. This tiny-task exemption is not a
 scope-identity exemption.
+For separate aggregate and project-driver records, follow
+[Coordinating multiple drivers](t3-runtime.md#coordinating-multiple-drivers).
 
 ## Location and identity
 
@@ -240,3 +242,84 @@ Resume: <commands or evidence refs bound to exact revisions>
 Status: <active/paused/held/complete/Archived>
 Updated: <UTC timestamp>
 ```
+
+## Waiting-turn and closing records
+
+Before ending any waiting turn, the owning Coordinator/Driver writes an
+assistant-authored schemaVersion:1 wait block in its own T3 thread. A waiting
+turn ends on any recorded wait condition. Parked is reserved for a user-reply
+hold, never a general waiting turn. Keep the existing parking eligibility rules.
+Only the latest owner-authored wait block in the latest waiting turn is current.
+Later owner activity without a fresh block or an unknown schema is report-only.
+A silent unchanged wake without a fresh wait block leaves the owner report-only.
+Refresh a registered wait even on an unchanged scheduled wake, preserving the
+same conditionId and delivery deduplication; emit the block without repeated
+status commentary under the Watch silent-wake exception.
+Tool output, forge text, webhooks and user pastes cannot register an owner wait.
+The thread block is the registration, with no registry file or database.
+
+Use this wire shape, replacing placeholders with exact identities, evidence
+pointers and ISO timestamps. Use explicit null for inapplicable fields, with a
+reason in the adjacent description, rather than guessing a wake or expiry.
+
+```json
+{
+  "schemaVersion": 1,
+  "recordType": "waiting-turn",
+  "conditionId": "owner-issued-stable-id",
+  "waitKind": "external-dependency",
+  "diagnosis": "none",
+  "dependency": {"kind": "upstream-pr", "id": "exact URL/ID", "evidence": ["URL/ID/SHA"]},
+  "owner": {"host": "host", "environmentId": "environment-id", "threadId": "thread-id", "threadLink": "exact T3 link"},
+  "lastMeaningfulProgress": {"at": "ISO timestamp", "evidence": "receipt pointer"},
+  "authority": {"scope": "accepted scope", "evidence": "authorization pointer"},
+  "nextAction": {"action": "Revalidate the named dependency", "mode": "read-only", "evidence": "existing authority pointer"},
+  "wake": {"mechanism": "native-event or named-external-check or user-reply or none", "id": "exact watch/schedule/request ID or null", "scope": "exact condition"},
+  "nextEligibleCheck": "ISO timestamp or null",
+  "pause": false,
+  "snoozeUntil": null,
+  "lifetime": {"scope": "run or separately authorized shared service", "expiresAt": "ISO timestamp or explicit non-expiring service authority"},
+  "cleanupOwner": {"host": "host", "environmentId": "environment-id", "threadId": "thread-id", "threadLink": "exact T3 link"}
+}
+```
+
+Classify `waitKind` as active-worker, own-pr-ci-review, external-dependency,
+human-approval, explicit-pause, failed-interrupted, completed-cleanup or unknown.
+Record the exact PR/check/dependency or decision, including downstream human
+holds. Diagnosis is the evidenced cause or literal `none` for a specific
+unexplained blocker. Missing diagnosis is incomplete, not equivalent to `none`.
+Wake IDs identify actual registrations, not promised support. Record every
+watch/schedule's exact ID, scope, owner and lifetime when created.
+
+The recovery key is (owner host, owner threadId, conditionId). Rewriting the
+same conditionId never resets delivery deduplication. Keep that ID through
+revalidation, PR-head changes, native events, passes and restarts while the
+condition remains unresolved. Read history and queue plus prior delivery
+receipts before any eligible send. Ambiguous delivery or unavailable history
+or queue is report-only. An accepted unacknowledged continuation gets no resend.
+A distinct condition uses a new owner-issued ID, never one invented by recovery.
+Bind queued/running wake receipts to the recovery key and exact queue/run IDs.
+An armed registration alone is insufficient delivery evidence; nextEligibleCheck
+and current same-key queue/run delivery determine wake precedence.
+
+To end the registration, the owner writes an assistant-authored closing block
+with the same conditionId. Bind closure to evidence, including scoped cleanup
+still pending; settled metadata alone never proves completed product delivery.
+
+```json
+{
+  "schemaVersion": 1,
+  "recordType": "closing",
+  "conditionId": "owner-issued-stable-id",
+  "diagnosis": "evidenced resolution or disposition",
+  "owner": {"host": "host", "environmentId": "environment-id", "threadId": "thread-id", "threadLink": "exact T3 link"},
+  "authority": {"scope": "accepted scope", "evidence": "authorization pointer"},
+  "nextAction": {"action": "none or bounded remaining cleanup", "mode": "none or cleanup", "evidence": "receipt pointer"},
+  "wake": {"mechanism": "none", "id": null, "scope": "closed registration"},
+  "lifetime": {"scope": "registration closed", "expiresAt": "closure ISO timestamp"},
+  "cleanupOwner": {"host": "host", "environmentId": "environment-id", "threadId": "thread-id", "threadLink": "exact T3 link"},
+  "outcome": "resolved or completed or cancelled or accepted-handoff",
+  "evidence": ["exact revision/terminal/acceptance pointers"],
+  "cleanup": [{"id": "exact resource ID", "scope": "owned run or shared service registration", "state": "absent or stopped or preserved-shared or unknown", "receipt": "readback pointer"}]
+}
+```

package/skills/axstack/references/t3-runtime.md

@@ -71,12 +71,131 @@ The first dispatch for each (provider, model, effort) must reach a running or
 completed run before its siblings launch. Rejection stops siblings of that
 configuration; unrelated configurations remain eligible.
 
+## Coordinating multiple drivers
+
+The Coordinator owns the overall outcome and coordinates work across projects.
+A Driver owns delivery within one project: implementation, review, merge and deployment.
+A Worker performs a bounded task for a Driver, including authoring, research or review.
+Parent describes a relationship, not a role name.
+
+A logical Coordinator can coordinate multiple project-bound
+drivers, each using T3 delegation for multiple scoped Workers. Reuse a suitable
+current Coordinator. Suggest a new Coordinator only when useful.
+Every top-level thread launch requires an explicit user request, including a
+new Coordinator, project driver or launch fallback. On resume, preserve existing
+explicit accepted authorization within its scope. This skill never grants
+blanket launch permission. Missing launch authorization holds only the affected
+launch. After a blocked launch, continue independent authorized work, subject
+to its dependencies and scoped holds under [Autopilot](autopilot.md#advance-and-hold).
+
+For cross-project work, use the correct project-bound driver, selecting the
+projectId and workspaceStrategy in t3_thread_launch when an authorized launch
+is needed. Reuse an existing appropriate driver after reconciling its ownership
+and scope, and verify the resulting project/worktree binding before dispatch.
+A local delegate_task cannot select another project. Never retry the same
+invalid project request. A routing failure holds that route and its dependent
+work, rather than the whole authorized run.
+
+Record the logical coordinator link separately from native parentThreadId,
+including when null. The Coordinator remains the logical role when T3 records project Drivers as
+separate top-level threads with null parentThreadId; native ancestry does not
+change the recorded coordination ownership. For each driver, record its
+exact link, project, worktree, scope, owner and record pointer. Record acceptance
+and completion handbacks, dependencies, held state and resume condition. An
+acceptance handback binds the driver identity to accepted scope and authority;
+completion handbacks carry exact revisions and verified receipt pointers under
+[Lifecycle](lifecycle.md#receipts-bind-each-decision-to-evidence). Reconcile native
+state before advancing dependencies, rather than accepting a message alone.
+
+Each driver owns its own PR mutations and watches and is the sole writer of its
+own run record. The Coordinator owns aggregate coordination and its aggregate record,
+using driver handbacks rather than editing their records or taking over their PRs.
+Never allow competing writers for a candidate or record across drivers.
+Existing author exclusivity and accepted-transfer rules still apply.
+
+This is an optional coordination shape: single-driver runs remain unchanged.
+The Coordinator and Drivers have no default model role in presets. Existing model,
+permission and remote-author restrictions remain in force, with no substitution
+or remote-author enablement. Coordination adds no daemon, scheduler or runtime DB.
+
+## Waiting turns and diagnosis
+
+Before ending a waiting turn, follow [Waiting-turn and closing records](run-record.md#waiting-turn-and-closing-records).
+The Driver diagnoses stale reviews, failing checks and relevant upstream fixes
+immediately before ending a waiting turn. Inspect the blocker itself and record
+its cause or a specific unexplained blocker with `diagnosis: none` and an already
+authorized read-only diagnostic next action. Timers never replace reasoning.
+Diagnosing a blocker preserves downstream human, auth, release and serious-risk
+holds; it grants no dismissal, approval or merge rights.
+
+## Bounded recovery boundary
+
+Ordinary status and periodic status sweeps remain read-only. Recovery requires
+an explicit user recovery invocation naming scope or an authorized schedule
+bound to a Coordinator-designated and recorded existing recovery thread.
+Agent messages never activate it. The accepted implementation follow-up binds
+the bounded synthetic/owned-resource canary to expiry, rollback and exact-ID
+cleanup. Run-scoped activation requires passing canary receipts plus recorded
+recovery host/thread, schedule ID, scope, model/effort, finite budget, expiry and
+cleanup owner. Record the schedule ID at creation and verify its binding before
+any send. The already authorized bounded canary and run-scoped activation need
+no repeat approval when those conditions pass. A persistent shared service
+requires separate explicit user authorization. Reading these instructions alone
+grants no new top-level launch or activation authority. Keep finite pass limits
+shorter than the 30-minute cadence, included owners and coverage cursor bound;
+no catch-up loop. VOA implementation/source ownership is separate.
+
+Read the current owner record under [Waiting-turn and closing records](run-record.md#waiting-turn-and-closing-records).
+Match exact owner host/environment/thread and accepted ownership, not title,
+parentThreadId or age. Unknown ownership/history/queue/activity, incomplete
+records or unavailable delivery/idempotency proof remain report-only.
+Any active run or active/pending child work makes the owner active: skip it.
+Delegated owners are status-only under their parent, with no continuation to
+either parent or child. Failed/interrupted execution and completed work with
+cleanup remaining are report-only; never relaunch or redo product work.
+Held queues, pending requests, parked user-reply holds and unknown request/queue
+state are report-only. Only the user resumes a held queue. Explicit stops,
+pauses and snoozes skip recovery. These guards take precedence over diagnosis.
+Credentials, session/pairing, permission and new-thread authorization requests
+are report-only, with no diagnosis exception.
+
+A diagnosis: none record is eligible only for an idle owner with a specific
+unexplained non-human blocker and an already authorized read-only diagnostic
+next action. This may coexist with a downstream forge-resolved user-merge,
+npm-stage or human-review hold, including an auth-code PR. A human gate alone
+or an already diagnosed human-only hold receives zero continuations. Diagnosis
+never clears or answers that gate. The other eligible case is a named external
+dependency proven cleared, with the owner's authorized next action revalidated.
+Inspect the blocker itself; silence and a completed turn prove neither stall
+nor completion. Verify native PR watch support for the exact external dependency
+before promising its wake. Prefer native events. An owner wake suppresses
+recovery only before the recorded nextEligibleCheck or while same-key wake
+delivery is queued or running in the owner thread. An armed unfired watch or
+schedule, or one unable to observe the named blocker, never suppresses eligible
+recovery. Unsupported events permit checking only the named external condition
+under the recorded canary and activation conditions.
+
+Send one bounded continuation with its condition key to the exact existing
+top-level owning Coordinator/Driver. Revalidate all guards, owner history,
+queue and deduplication receipts immediately before delivery. Include structured
+evidence references by URL/ID/SHA and a recovery summary, with the recorded next
+action: “Revalidate; act only within your existing authorized next action.”
+Exclude quoted third-party/tool/webhook text. A recovery continuation is never
+a user reply, answer, approval or authorization. The receiving owner independently
+revalidates evidence and retains its original authority and holds. Recovery
+never answers pending questions or performs forge mutations, delegation,
+thread creation/settlement/cancel/interrupt, settings changes, or other owners'
+queue/watch/schedule edits. Its writes are bounded continuations, own-thread
+receipts and only its separately authorized schedule/duplicate-message cleanup.
+Cross-host sends remain report-only until installed C4 instructions and current
+directed C5 write-link proof exist; never redirect or relay outside native T3.
+
 ## Role dispatch by permitted writes
 
 | Roles | Mechanism and permitted workspace | Completion |
 |---|---|---|
 | Advisers, research, read-only explorers, explainers, diligence, checker, auditor, arena prose candidates and judges, escalation | Must use async `delegate_task` in the driver worktree, title = role-labelled dispatch key; tracked and untracked files stay untouched; writes only `<run>/evidence/<key>/` | Native notification followed by persisted `task_status` |
-| Reviewers (peer/authored), release checks, debug investigators, execution investigators (`axstack-explore-execution`), UI verifier candidate checks (`axstack-ui-verifier`) | Must use async `delegate_task`, title = role-labelled dispatch key; driver makes a disposable detached checkout of candidate SHA and pinned base with `git worktree add --detach <run>/checkouts/<key> <sha>` (plus pinned debug patch); brief requires `cd` into it; only disposable probes write there, outputs go to `<run>/evidence/<key>/` | Same delegated terminal checks |
+| Reviewers (peer/authored), release checks, debug investigators, execution investigators (`axstack-explore-execution`), UI verifier candidate checks (`axstack-ui-verifier`, `axstack-ui-verifier-sonnet`) | Must use async `delegate_task`, title = role-labelled dispatch key; driver makes a disposable detached checkout of candidate SHA and pinned base with `git worktree add --detach <run>/checkouts/<key> <sha>` (plus pinned debug patch); brief requires `cd` into it; only disposable probes write there, outputs go to `<run>/evidence/<key>/` | Same delegated terminal checks |
 | Author and repairs | Fresh authors must use async `delegate_task` with `isolation:"worktree"`, title = role-labelled dispatch key, stable `clientRequestId` in their own worktree, kept until PR merges or closes; repairs use `t3_thread_send` to the same child | Delegated terminal checks plus verified candidate |
 | Owner | Driver thread in Driver worktree; never writes tracked candidate source or tests; planning artifacts allowed only for repository Markdown; scope, integration, forge mutations and record | No worker launch |
 
@@ -183,6 +302,13 @@ After each delegated completion the driver must check its own `HEAD` and
 `git status --porcelain` against their pre-dispatch values: both stay unchanged,
 including untracked entries. Any change is a hold before advancing that work.
 
+Native delegate completion owns the wake for `delegate_task` children. Never
+status-check running delegate_task children on scheduled wakes. Never create a
+schedule merely because delegate_task children exist. A lost completion wake
+remains active/unknown in read-only status, rather than triggering polling,
+silence-based cancellation or a replacement author. Native completion receipts
+are reconciled on delivery, not sought through hourly status checks.
+
 ## Launch recovery, repairs and questions
 
 For a lost delegated dispatch or repair response, retry with the same stable
@@ -233,12 +359,13 @@ A replacement after terminal failure must use `a<n+1>`, a new branch and title;
 the failed attempt's branch is kept until salvage. Unknown liveness holds
 replacement; reconcile the old writer before admitting another.
 
-With an unsettled launched thread, the driver turn must end only while a bound
-`schedule_task` with `bindToCurrentThread:true` is armed at the default
-`everyMs:3600000` or for its 5-minute recovery cases in
+The bound lifecycle rule below applies only to owned launched-fallback Writers
+awaiting completion. With an unsettled launched thread, the driver turn must end only while a bound
+`schedule_task` with `bindToCurrentThread:true` is armed at the 5-minute lifecycle
+cadence `everyMs:300000` under
 [Chat-run watch runtime](../../axstack-watch/references/watch-runtime.md#chat-run-watch),
-with its ID recorded. Each wake must reconcile all unsettled runs, including a
-writer that died without sending; failed runs hold incomplete work. The watch
+with its ID recorded. Each wake must reconcile unsettled launched-fallback Writer
+runs, including a writer that died without sending; failed runs hold incomplete work. The watch
 inherits the driver model/workspace and adds no runtime of Axstack's own.
 T3 queues a scheduled wake even while the driver is busy, so copies pile up.
 After a provider error, server restart or Stop, T3 holds the queue: held
@@ -324,7 +451,7 @@ An open PR left unwatched by a user Stop never triggers the 5-minute recovery ca
 After T3 auto-settles a multi-PR driver on one PR merge, it re-arms remaining
 open members through the recovery steps before ending the turn.
 If rate-limited, use the 5-minute schedule and next-wake recovery above.
-The schedule still reconciles author and review tasks, readiness, and release.
+The schedule reconciles delivered receipts, readiness and release, plus launched-fallback Writer runs.
 When a PR merges or closes, or its watch is torn down, call `unwatch_pull_request`
 and keep its link.
 
@@ -409,3 +536,43 @@ For own PRs, automatic merge is the default under the
 [watch predicate](../../axstack-watch/SKILL.md#5-state-readiness-precisely).
 The recorded owning watch thread merges; a missing or idle owner requires
 lifecycle reconciliation and explicit transfer first.
+
+## Fleet nonwriter boundary (C3a)
+
+Before dispatch, the driver must capture capability, project, settings and access
+through native forwarded APIs on the selected destination, following
+[Fleet dispatch and receipts](fleet-dispatch.md). Origin catalogs and caller
+assertions alone cannot establish destination readiness. Preserve exact catalog
+bytes/digest, explicit observation/evaluation times, config digest and recommendation.
+
+`t3_thread_configuration` is currently unavailable in the advertised tools.
+Unavailable effective fields remain unknown; the driver must not invent an API,
+readiness or effective settings. Use advertised dispatch/thread facts, keep requested
+and effective values separate, and hold any required unobserved field.
+
+For ambiguous submission, reconcile the exact clientRequestId/attempt and remote task
+before any retry. Unknown liveness prohibits replacement. A confirmed not-submitted
+failure may exclude that route and recompute from current facts; it never permits
+model or permission substitution. No hidden SSH agent or new top-level thread is
+an execution fallback; a new thread requires an explicit user request.
+
+The driver must read task_status on the origin and terminal/thread facts on the
+actual destination for the latest run. Pending children or an unanswered question
+prevent success even after a completed turn. Read the native pending-question list
+with `t3_pending_request` action `list` on that destination; the older
+`t3_pending_request_list` spelling above is not an advertised callable tool.
+A null local childThreadId, idle state, silence or old summary proves no completion.
+
+The remote author coordinator remains DISABLED: C3b's all-refs-unchanged pilot
+failed because of T3 checkpoint refs. Drivers must not enable or rerun the pilot
+under C3a. Direct remote worktree authors remain ineligible on T3 v0.1.5;
+local isolated authors remain the fallback even when overloaded. C4 personal
+policy/Haoshoku changes and C6 deployment/live acceptance remain later phases.
+
+Remote nonwriters use native `delegate_task` with exact selected target.environmentId,
+projectId, providerInstanceId, model, target.options and runtimeMode. Remote reviewers
+use T3 `isolation:"worktree"`; never make their child checkouts in the shell.
+Use no raw agent CLI over SSH. SSH is restricted to telemetry and authorized
+artifact/commit transport. Follow host-qualified archive/readback/retirement in
+[Fleet dispatch and receipts](fleet-dispatch.md#retrieval-and-retirement).
+Only the driver publishes, links, watches or merges PRs.

package/skills/axstack/references/ui-verification.md

@@ -2,8 +2,11 @@
 
 Every Playwright, browser, or rendered-UI check outside the two named browser
 exceptions, including a "confirm it in the browser" step, goes through async
-`delegate_task` to `axstack-ui-verifier` from the run's role snapshot. Give it the exact build, URL, or artifact and the private
-dispatch's evidence folder. The verifier is read-only: it never edits source.
+`delegate_task` to a configured UI verifier role.
+The configured UI verifier roles are `axstack-ui-verifier` and
+`axstack-ui-verifier-sonnet` from the role snapshot; select them under the
+[dual-run trigger](#android-device-and-webpwa-dual-run) below.
+Give each verifier the exact build, URL, or artifact and the private dispatch's evidence folder. The verifier is read-only: it never edits source.
 The PR writer remains the sole writer.
 
 Before using a PR preview URL, the UI verifier must read [PR previews](preview.md).
@@ -17,12 +20,12 @@ The second named browser exception permits dispatched roles to use
 `html_preview` as a non-publishing self-check.
 Dispatched-role self-checks never replace the driver's two previews or the `axstack-ui-verifier` pass.
 Dispatched roles never call `html_render`.
-All other browser checks outside the two named exceptions remain delegated to `axstack-ui-verifier`.
+All other browser checks outside the two named exceptions remain delegated to configured UI verifier roles under the dual-run trigger below.
 
 Read the [T3 runtime boundary](t3-runtime.md) before dispatch; for candidate
 checks use its driver-made disposable detached checkout at the pinned candidate SHA.
 Use the configured verifier browser and honor the user browser-tool policy.
-Candidate browser and visual checks must run in the delegated `axstack-ui-verifier` in its own detached checkout; outputs go to its private evidence folder, never the driver worktree.
+Candidate browser and visual checks must run in a delegated UI verifier role in its own detached checkout; outputs go to its private evidence folder, never the driver worktree.
 
 For every interactive page, require a real-browser `axstack-ui-verifier` interaction pass.
 Give the evidence path and SHA-256 of the exact bytes in the verifier brief.
@@ -47,6 +50,66 @@ Report a broken or stale recipe as a `low` finding naming `axstack-verify mainta
 Never let a broken or stale recipe waive existing acceptance obligations.
 Keep browser recipes tool-neutral for the verifier.
 
+## Android device and web/PWA dual run
+
+Apply the dual run to Android device verification or explicitly requested
+PWA/app feature verification, such as a `verify-<app>` device recipe or a user request.
+Ordinary review and watch browser checks use one `axstack-ui-verifier` pass by default.
+For these Android and web/PWA runs, assign run 1 to
+`axstack-ui-verifier` (Terra high).
+Dispatch independent run 2 to `axstack-ui-verifier-sonnet` with the same brief
+and the same pinned build.
+Never show run 2 the run 1 results.
+Start run 2 only after run 1 completes shutdown; use a fresh delegated session
+and a separate private evidence folder.
+The two-provider check requires the mixed preset; an intentional single-provider
+absence leaves dual-run verification unverified, without substitution.
+This dual run does not add a second pass to the inline-page exception above.
+
+Before run 1, record APK SHA-256 (or build SHA) and PWA deploy SHA in the brief.
+Include feature files, prerequisites, target URL and per-feature acceptance checks.
+Select the host through fleet routing using account-local configuration and
+[capability examples](fleet-route-schema.md#device-and-browser-examples).
+When `desktop:user` status is missing or unknown, treat the host as a user desktop.
+On a `desktop:user` host, including that safe default, use only a headless browser and a windowless emulator.
+Never focus windows or switch workspaces on a user desktop.
+Allow only one emulator per host at a time.
+Run a thermal precheck before starting on hosts that declare one; honor their
+account-local start/stop thresholds and hold or route elsewhere if unsafe.
+For iOS without a capable host, report unverified.
+
+Each run follows the same lifecycle:
+
+1. Call `device_list` and confirm `agentDeviceInstalled: true` before `device_open`.
+   Pass the selected device's `hostId` and `id` to `device_open`.
+2. Use `device_open` and its returned `agent-device` command to install, launch
+   and drive the pinned APK; open the app before snapshots or input.
+   Use the returned command's help for supported operations; report unavailable
+   install/build capabilities as unverified rather than inventing commands.
+3. Save a snapshot and `device_screenshot` for each feature end state in private
+   evidence; capture actions, resulting states and side effects.
+4. For web/PWA, use Playwright MCP at 390×844 and 1440×900, driving the same features.
+   Capture console errors as route template and code only.
+5. Return pass, fail or blocked per feature, pinned build identities and evidence
+   paths; keep secrets, recovery phrases, tokens and addresses out of reports.
+   Follow the app's production-testing policy; unattended production money paths
+   stop at read-only actions.
+6. After each run, including failed attempts, use `device_close` with
+   `shutdown: true` and `browser_close` for owned sessions; preserve evidence.
+
+The driver reconciles each feature:
+
+- When both runs pass, the driver records pass.
+- When both runs fail a feature, the driver records fail and routes it to `axstack-debug`.
+- If runs disagree, the driver holds and requests one Sonnet rerun of that feature.
+  Use a fresh delegated session and a separate private evidence folder for the
+  Sonnet rerun, with the same brief and same pinned build.
+  Never show the Sonnet rerun run 1 or run 2 results.
+  If the rerun still disagrees with run 1, report flaky/unverified with all observations.
+  If the rerun agrees with run 1, the agreed result stands while the driver records
+  the initial disagreement in evidence; an agreed failure routes to `axstack-debug`.
+- Blocked or missing coverage remains unverified, never a pass.
+
 ## Proof standards
 
 Apply these standards wherever referenced, including the verifier's candidate checks