axstack 0.55.0 → 0.56.0

package/skills/axstack/references/t3-runtime.md

@@ -71,6 +71,125 @@ The first dispatch for each (provider, model, effort) must reach a running or
 completed run before its siblings launch. Rejection stops siblings of that
 configuration; unrelated configurations remain eligible.
 
+## Coordinating multiple drivers
+
+The Coordinator owns the overall outcome and coordinates work across projects.
+A Driver owns delivery within one project: implementation, review, merge and deployment.
+A Worker performs a bounded task for a Driver, including authoring, research or review.
+Parent describes a relationship, not a role name.
+
+A logical Coordinator can coordinate multiple project-bound
+drivers, each using T3 delegation for multiple scoped Workers. Reuse a suitable
+current Coordinator. Suggest a new Coordinator only when useful.
+Every top-level thread launch requires an explicit user request, including a
+new Coordinator, project driver or launch fallback. On resume, preserve existing
+explicit accepted authorization within its scope. This skill never grants
+blanket launch permission. Missing launch authorization holds only the affected
+launch. After a blocked launch, continue independent authorized work, subject
+to its dependencies and scoped holds under [Autopilot](autopilot.md#advance-and-hold).
+
+For cross-project work, use the correct project-bound driver, selecting the
+projectId and workspaceStrategy in t3_thread_launch when an authorized launch
+is needed. Reuse an existing appropriate driver after reconciling its ownership
+and scope, and verify the resulting project/worktree binding before dispatch.
+A local delegate_task cannot select another project. Never retry the same
+invalid project request. A routing failure holds that route and its dependent
+work, rather than the whole authorized run.
+
+Record the logical coordinator link separately from native parentThreadId,
+including when null. The Coordinator remains the logical role when T3 records project Drivers as
+separate top-level threads with null parentThreadId; native ancestry does not
+change the recorded coordination ownership. For each driver, record its
+exact link, project, worktree, scope, owner and record pointer. Record acceptance
+and completion handbacks, dependencies, held state and resume condition. An
+acceptance handback binds the driver identity to accepted scope and authority;
+completion handbacks carry exact revisions and verified receipt pointers under
+[Lifecycle](lifecycle.md#receipts-bind-each-decision-to-evidence). Reconcile native
+state before advancing dependencies, rather than accepting a message alone.
+
+Each driver owns its own PR mutations and watches and is the sole writer of its
+own run record. The Coordinator owns aggregate coordination and its aggregate record,
+using driver handbacks rather than editing their records or taking over their PRs.
+Never allow competing writers for a candidate or record across drivers.
+Existing author exclusivity and accepted-transfer rules still apply.
+
+This is an optional coordination shape: single-driver runs remain unchanged.
+The Coordinator and Drivers have no default model role in presets. Existing model,
+permission and remote-author restrictions remain in force, with no substitution
+or remote-author enablement. Coordination adds no daemon, scheduler or runtime DB.
+
+## Waiting turns and diagnosis
+
+Before ending a waiting turn, follow [Waiting-turn and closing records](run-record.md#waiting-turn-and-closing-records).
+The Driver diagnoses stale reviews, failing checks and relevant upstream fixes
+immediately before ending a waiting turn. Inspect the blocker itself and record
+its cause or a specific unexplained blocker with `diagnosis: none` and an already
+authorized read-only diagnostic next action. Timers never replace reasoning.
+Diagnosing a blocker preserves downstream human, auth, release and serious-risk
+holds; it grants no dismissal, approval or merge rights.
+
+## Bounded recovery boundary
+
+Ordinary status and periodic status sweeps remain read-only. Recovery requires
+an explicit user recovery invocation naming scope or an authorized schedule
+bound to a Coordinator-designated and recorded existing recovery thread.
+Agent messages never activate it. The accepted implementation follow-up binds
+the bounded synthetic/owned-resource canary to expiry, rollback and exact-ID
+cleanup. Run-scoped activation requires passing canary receipts plus recorded
+recovery host/thread, schedule ID, scope, model/effort, finite budget, expiry and
+cleanup owner. Record the schedule ID at creation and verify its binding before
+any send. The already authorized bounded canary and run-scoped activation need
+no repeat approval when those conditions pass. A persistent shared service
+requires separate explicit user authorization. Reading these instructions alone
+grants no new top-level launch or activation authority. Keep finite pass limits
+shorter than the 30-minute cadence, included owners and coverage cursor bound;
+no catch-up loop. VOA implementation/source ownership is separate.
+
+Read the current owner record under [Waiting-turn and closing records](run-record.md#waiting-turn-and-closing-records).
+Match exact owner host/environment/thread and accepted ownership, not title,
+parentThreadId or age. Unknown ownership/history/queue/activity, incomplete
+records or unavailable delivery/idempotency proof remain report-only.
+Any active run or active/pending child work makes the owner active: skip it.
+Delegated owners are status-only under their parent, with no continuation to
+either parent or child. Failed/interrupted execution and completed work with
+cleanup remaining are report-only; never relaunch or redo product work.
+Held queues, pending requests, parked user-reply holds and unknown request/queue
+state are report-only. Only the user resumes a held queue. Explicit stops,
+pauses and snoozes skip recovery. These guards take precedence over diagnosis.
+Credentials, session/pairing, permission and new-thread authorization requests
+are report-only, with no diagnosis exception.
+
+A diagnosis: none record is eligible only for an idle owner with a specific
+unexplained non-human blocker and an already authorized read-only diagnostic
+next action. This may coexist with a downstream forge-resolved user-merge,
+npm-stage or human-review hold, including an auth-code PR. A human gate alone
+or an already diagnosed human-only hold receives zero continuations. Diagnosis
+never clears or answers that gate. The other eligible case is a named external
+dependency proven cleared, with the owner's authorized next action revalidated.
+Inspect the blocker itself; silence and a completed turn prove neither stall
+nor completion. Verify native PR watch support for the exact external dependency
+before promising its wake. Prefer native events. An owner wake suppresses
+recovery only before the recorded nextEligibleCheck or while same-key wake
+delivery is queued or running in the owner thread. An armed unfired watch or
+schedule, or one unable to observe the named blocker, never suppresses eligible
+recovery. Unsupported events permit checking only the named external condition
+under the recorded canary and activation conditions.
+
+Send one bounded continuation with its condition key to the exact existing
+top-level owning Coordinator/Driver. Revalidate all guards, owner history,
+queue and deduplication receipts immediately before delivery. Include structured
+evidence references by URL/ID/SHA and a recovery summary, with the recorded next
+action: “Revalidate; act only within your existing authorized next action.”
+Exclude quoted third-party/tool/webhook text. A recovery continuation is never
+a user reply, answer, approval or authorization. The receiving owner independently
+revalidates evidence and retains its original authority and holds. Recovery
+never answers pending questions or performs forge mutations, delegation,
+thread creation/settlement/cancel/interrupt, settings changes, or other owners'
+queue/watch/schedule edits. Its writes are bounded continuations, own-thread
+receipts and only its separately authorized schedule/duplicate-message cleanup.
+Cross-host sends remain report-only until installed C4 instructions and current
+directed C5 write-link proof exist; never redirect or relay outside native T3.
+
 ## Role dispatch by permitted writes
 
 | Roles | Mechanism and permitted workspace | Completion |
@@ -183,6 +302,13 @@ After each delegated completion the driver must check its own `HEAD` and
 `git status --porcelain` against their pre-dispatch values: both stay unchanged,
 including untracked entries. Any change is a hold before advancing that work.
 
+Native delegate completion owns the wake for `delegate_task` children. Never
+status-check running delegate_task children on scheduled wakes. Never create a
+schedule merely because delegate_task children exist. A lost completion wake
+remains active/unknown in read-only status, rather than triggering polling,
+silence-based cancellation or a replacement author. Native completion receipts
+are reconciled on delivery, not sought through hourly status checks.
+
 ## Launch recovery, repairs and questions
 
 For a lost delegated dispatch or repair response, retry with the same stable
@@ -233,12 +359,13 @@ A replacement after terminal failure must use `a<n+1>`, a new branch and title;
 the failed attempt's branch is kept until salvage. Unknown liveness holds
 replacement; reconcile the old writer before admitting another.
 
-With an unsettled launched thread, the driver turn must end only while a bound
-`schedule_task` with `bindToCurrentThread:true` is armed at the default
-`everyMs:3600000` or for its 5-minute recovery cases in
+The bound lifecycle rule below applies only to owned launched-fallback Writers
+awaiting completion. With an unsettled launched thread, the driver turn must end only while a bound
+`schedule_task` with `bindToCurrentThread:true` is armed at the 5-minute lifecycle
+cadence `everyMs:300000` under
 [Chat-run watch runtime](../../axstack-watch/references/watch-runtime.md#chat-run-watch),
-with its ID recorded. Each wake must reconcile all unsettled runs, including a
-writer that died without sending; failed runs hold incomplete work. The watch
+with its ID recorded. Each wake must reconcile unsettled launched-fallback Writer
+runs, including a writer that died without sending; failed runs hold incomplete work. The watch
 inherits the driver model/workspace and adds no runtime of Axstack's own.
 T3 queues a scheduled wake even while the driver is busy, so copies pile up.
 After a provider error, server restart or Stop, T3 holds the queue: held
@@ -324,7 +451,7 @@ An open PR left unwatched by a user Stop never triggers the 5-minute recovery ca
 After T3 auto-settles a multi-PR driver on one PR merge, it re-arms remaining
 open members through the recovery steps before ending the turn.
 If rate-limited, use the 5-minute schedule and next-wake recovery above.
-The schedule still reconciles author and review tasks, readiness, and release.
+The schedule reconciles delivered receipts, readiness and release, plus launched-fallback Writer runs.
 When a PR merges or closes, or its watch is torn down, call `unwatch_pull_request`
 and keep its link.
 
@@ -409,3 +536,43 @@ For own PRs, automatic merge is the default under the
 [watch predicate](../../axstack-watch/SKILL.md#5-state-readiness-precisely).
 The recorded owning watch thread merges; a missing or idle owner requires
 lifecycle reconciliation and explicit transfer first.
+
+## Fleet nonwriter boundary (C3a)
+
+Before dispatch, the driver must capture capability, project, settings and access
+through native forwarded APIs on the selected destination, following
+[Fleet dispatch and receipts](fleet-dispatch.md). Origin catalogs and caller
+assertions alone cannot establish destination readiness. Preserve exact catalog
+bytes/digest, explicit observation/evaluation times, config digest and recommendation.
+
+`t3_thread_configuration` is currently unavailable in the advertised tools.
+Unavailable effective fields remain unknown; the driver must not invent an API,
+readiness or effective settings. Use advertised dispatch/thread facts, keep requested
+and effective values separate, and hold any required unobserved field.
+
+For ambiguous submission, reconcile the exact clientRequestId/attempt and remote task
+before any retry. Unknown liveness prohibits replacement. A confirmed not-submitted
+failure may exclude that route and recompute from current facts; it never permits
+model or permission substitution. No hidden SSH agent or new top-level thread is
+an execution fallback; a new thread requires an explicit user request.
+
+The driver must read task_status on the origin and terminal/thread facts on the
+actual destination for the latest run. Pending children or an unanswered question
+prevent success even after a completed turn. Read the native pending-question list
+with `t3_pending_request` action `list` on that destination; the older
+`t3_pending_request_list` spelling above is not an advertised callable tool.
+A null local childThreadId, idle state, silence or old summary proves no completion.
+
+The remote author coordinator remains DISABLED: C3b's all-refs-unchanged pilot
+failed because of T3 checkpoint refs. Drivers must not enable or rerun the pilot
+under C3a. Direct remote worktree authors remain ineligible on T3 v0.1.5;
+local isolated authors remain the fallback even when overloaded. C4 personal
+policy/Haoshoku changes and C6 deployment/live acceptance remain later phases.
+
+Remote nonwriters use native `delegate_task` with exact selected target.environmentId,
+projectId, providerInstanceId, model, target.options and runtimeMode. Remote reviewers
+use T3 `isolation:"worktree"`; never make their child checkouts in the shell.
+Use no raw agent CLI over SSH. SSH is restricted to telemetry and authorized
+artifact/commit transport. Follow host-qualified archive/readback/retirement in
+[Fleet dispatch and receipts](fleet-dispatch.md#retrieval-and-retirement).
+Only the driver publishes, links, watches or merges PRs.

package/skills/axstack/references/workspace-hygiene.md

@@ -1,5 +1,13 @@
 # Workspace hygiene for driver-owned T3 runs
 
+For remote nonwriters, apply [host-qualified retrieval and retirement](fleet-dispatch.md#retrieval-and-retirement).
+Resolve task status on origin and thread/run/settlement on the actual destination.
+Archive and read back exact evidence on origin before retiring only the owned
+T3-created reviewer checkout. Bind host/environment/path and candidate/base SHA;
+never use an origin filesystem path as a destination path. Unknown liveness,
+ownership or user takeover preserves that resource. Validation precedes deletion
+in separate sequential calls; preserve unknown ignored artifacts.
+
 This is a prompt contract, not a cleanup daemon. Follow [T3 runtime](t3-runtime.md)
 for native identities, terminal run evidence and schema. Dispatched workers never
 sweep or remove another session. A scheduled pass with recorded cleanup authority

package/skills/axstack/scripts/dispatch-plan.js

@@ -1,4 +1,5 @@
 import { readFileSync, writeFileSync } from 'node:fs';
+import { inspectFleetReceipt } from './fleet-receipt.js';
 import { bindFleet } from './fleet-dispatch.js';
 
 const fleetFlags = ['--recommendation', '--fleet-input', '--now', '--config-digest'];
@@ -32,6 +33,9 @@ Fleet --capabilities is the selected destination's raw saved catalog, digest-bou
 by its destination facts. It is never the origin catalog by default.
 Fleet verification requires environmentId/projectId and fleetBinding alongside
 the effective T3 configuration. C3 collects that host-qualified evidence envelope.
+Optional input.nativeDestination validates saved native forwarded reads.
+Optional --verify fleetAttempt/fleetReceipt validates host-qualified terminal facts;
+--out retains per-term receipt evidence. Synthetic bindings cannot authenticate reads.
 Coordinator routes remain unsupported here. A plan grants no launch authority.
 Exit codes: 0 ok, 1 error, 2 hold (including incomplete read-back).
 `;
@@ -95,7 +99,15 @@ function verify(configuration, provider, model, options, fleet) {
     for (const [field, expected] of Object.entries(fleet.destination)) compare(field, expected, configuration?.[field]);
     for (const [field, expected] of Object.entries(fleet.fleetBinding)) compare(field, expected, configuration?.fleetBinding?.[field]);
   }
-  return { mismatches, ...(selection?.provider == null ? {
+  let receiptTerms;
+  if (fleet && configuration?.fleetReceipt !== undefined) {
+    receiptTerms = inspectFleetReceipt(configuration.fleetReceipt, {
+      attempt: configuration.fleetAttempt, recommendation: fleet.recommendation,
+      recommendationJSON: fleet.recommendationJSON, now: fleet.now,
+    });
+    for (const term of receiptTerms) if (term.state !== 'pass') mismatches.push(`${term.code}: ${term.state}; evidence ${JSON.stringify(term.evidence)}`);
+  }
+  return { mismatches, ...(receiptTerms ? { receiptTerms } : {}), ...(selection?.provider == null ? {
     providerEvidence: `provider: unknown; expected ${JSON.stringify(provider)}; observed missing; `
       + 'provider binding checked via instanceId and saved capabilities',
   } : {}) };
@@ -159,9 +171,14 @@ function plan(argv, io) {
   let fleet;
   if (args['--recommendation']) {
     if (!/^\d+$/.test(args['--now'])) throw new Error('evaluation-time');
-    fleet = bindFleet(readJSON(args['--fleet-input']), readJSON(args['--recommendation']),
+    const recommendationJSON = readFileSync(args['--recommendation'], 'utf8');
+    const recommendation = JSON.parse(recommendationJSON);
+    fleet = bindFleet(readJSON(args['--fleet-input']), recommendation,
       args['--config-digest'], Number(args['--now']), readFileSync(args['--capabilities'], 'utf8'),
       resolution, role.id === 'axstack-author');
+    fleet.recommendation = recommendation;
+    fleet.recommendationJSON = recommendationJSON;
+    fleet.now = Number(args['--now']);
   }
   const options = fleet?.options ?? (effortOption ? [effortOption] : []);
   if (args['--verify']) {

package/skills/axstack/scripts/fleet-destination.js

@@ -0,0 +1,39 @@
+// Validate explicit saved native reads. These bindings do not authenticate input.
+import { canonical, text, time } from './fleet-config.js';
+
+export function inspectDestination(observation, recommendation, capabilitiesText, now) {
+  const terms = [];
+  const term = (code, pass, evidence, missing = evidence == null) => terms.push({ code,
+    state: pass ? 'pass' : missing ? 'unknown' : 'fail', evidence: evidence ?? null });
+  const s = recommendation.selected;
+  const o = observation ?? {};
+  for (const [name, tool, environmentId, args] of [
+    ['environment', 't3_environment_read', s.environmentId, {}],
+    ['project', 't3_project_read', s.environmentId, { projectId: s.projectId }],
+    ['capabilities', 'orchestrator_capabilities', s.environmentId, {}],
+    ['links', 't3_environment_links', recommendation.originEnvironmentId, {}],
+  ]) {
+    const read = o[name];
+    term('destination-observation', read?.tool === tool && read?.environmentId === environmentId
+      && canonical(read?.args) === canonical(args) && time(read?.observedAt)
+      && read.observedAt <= now && text(read?.evidence), read);
+  }
+  term('destination-identity', o.environment?.value?.environmentId === s.environmentId,
+    o.environment?.value?.environmentId);
+  term('destination-project', o.project?.value?.id === s.projectId && text(o.project?.value?.workspaceRoot),
+    o.project?.value);
+  term('destination-repository', o.project?.value?.repositoryIdentity?.canonicalKey === s.repositoryId,
+    o.project?.value?.repositoryIdentity);
+  term('destination-catalog', o.capabilities?.valueText === capabilitiesText, o.capabilities?.valueText);
+  const catalog = JSON.parse(capabilitiesText);
+  const provider = catalog.providers?.find((v) => v.providerInstanceId === recommendation.request.providerInstanceId);
+  term('destination-execution', provider?.canRunChildTask === true
+    && provider?.runtimeModes?.includes(recommendation.request.runtimeMode), provider,
+  provider?.canRunChildTask == null || !Array.isArray(provider?.runtimeModes));
+  const local = s.environmentId === recommendation.originEnvironmentId;
+  const link = o.links?.value?.links?.find((v) => v.environmentId === s.environmentId);
+  term('destination-access', o.links?.value?.environmentId === recommendation.originEnvironmentId
+    && (local || (link?.status === 'reachable' && link?.access === recommendation.request.runtimeMode
+      && Date.parse(link?.expiresAt) > now)), local ? o.links?.value : link);
+  return terms;
+}

package/skills/axstack/scripts/fleet-dispatch.js

@@ -1,4 +1,5 @@
 // Bind supplied placement facts to a plan. No reads, dispatch or authority grant.
+import { inspectDestination } from './fleet-destination.js';
 import { canonical, record, text } from './fleet-config.js';
 import { recommend } from './fleet-route.js';
 
@@ -16,6 +17,11 @@ export function bindFleet(input, saved, configDigest, now, capabilitiesText, res
   const digest = selected.destinationCapabilitiesDigest;
   if (typeof digest !== 'string' || !/^[a-f0-9]{64}$/.test(digest)) hold('capabilities-digest-missing');
   if (new Bun.CryptoHasher('sha256').update(capabilitiesText).digest('hex') !== digest) hold('capabilities-digest-mismatch');
+  if (input.nativeDestination !== undefined) {
+    const mismatch = inspectDestination(input.nativeDestination, current, capabilitiesText, now)
+      .find((term) => term.state !== 'pass');
+    if (mismatch) hold(mismatch.code);
+  }
   const request = current.request;
   const { model, providerInstanceId, effortOption } = resolved;
   if (request.providerInstanceId !== providerInstanceId || request.model !== model

package/skills/axstack/scripts/fleet-facts.js

@@ -1,10 +1,21 @@
+import { nativeAssignments } from './fleet-inventory.js';
 import { canonical, evidence, fail, record, text, time } from './fleet-config.js';
 
 const terminal = new Set(['completed', 'failed', 'cancelled', 'canceled', 'rejected']);
 const states = new Set([...terminal, 'pending', 'queued', 'running', 'waiting', 'blocked']);
 const qualified = (value) => text(value) && /^.+:.+$/.test(value);
 
-export function assignmentCounts(input, hosts) {
+export function assignmentCounts(input, hosts, now) {
+  if (input.nativeInventory !== undefined) {
+    const normalized = nativeAssignments(input.nativeInventory, hosts, now);
+    const counts = assignmentCounts(normalized, hosts);
+    return { ...counts, inventoryReasons: normalized.inventoryReasons,
+      inventoryEvidence: normalized.inventoryEvidence,
+      ...(normalized.inventoryStatus === 'unknown' ? {
+        pendingLowerBound: counts.byEnvironment,
+        byEnvironment: Object.fromEntries(hosts.map((h) => [h.environmentId, null])),
+      } : {}) };
+  }
   const byEnvironment = Object.fromEntries(hosts.map((h) => [h.environmentId, 0]));
   const inventory = new Map();
   const clients = new Map();

package/skills/axstack/scripts/fleet-inventory.js

@@ -0,0 +1,76 @@
+// Normalize saved native observations only. No discovery, reservations or dispatch.
+import { canonical, text, time } from './fleet-config.js';
+
+const active = new Set(['queued', 'running', 'waiting']);
+const terminal = new Set(['completed', 'failed', 'cancelled', 'interrupted']);
+// JSON tuple encoding avoids collisions between IDs containing punctuation.
+const identity = (environmentId, taskId) => JSON.stringify([environmentId, taskId]);
+
+export function nativeAssignments(snapshot, hosts, now) {
+  const reasons = new Set();
+  const unknown = (code) => reasons.add(code);
+  const environments = new Set(hosts.map((h) => h.environmentId));
+  const tasks = new Map();
+  const assignments = new Map();
+  const pending = new Map();
+  if (snapshot?.complete !== true || !time(snapshot?.observedAt) || !time(now) || snapshot.observedAt > now || !text(snapshot?.evidence)
+    || !Array.isArray(snapshot?.tasks) || !Array.isArray(snapshot?.pending)) unknown('inventory-incomplete');
+  for (const item of Array.isArray(snapshot?.tasks) ? snapshot.tasks : []) {
+    if (!text(item?.origin?.environmentId) || !text(item?.origin?.threadId) || !text(item?.task?.taskId)) {
+      unknown('origin-unknown'); continue;
+    }
+    const key = identity(item.origin.environmentId, item.task.taskId);
+    const previous = tasks.get(key);
+    if (previous && canonical(previous) !== canonical(item)) unknown('assignment-conflict');
+    tasks.set(key, item);
+  }
+  for (const [key, item] of tasks) {
+    const task = item.task;
+    const environmentId = task.remoteChild?.environmentId
+      ?? (text(task.childThreadId) ? item.origin.environmentId : null);
+    if (!text(environmentId)) { unknown('destination-unknown'); continue; }
+    if (!environments.has(environmentId)) { unknown('host-unmapped'); continue; }
+    if (task.remoteChild && !text(task.remoteChild.threadId)) { unknown('destination-unknown'); continue; }
+    if (!active.has(task.status) && !terminal.has(task.status)) { unknown('task-state-unknown'); continue; }
+    let rootKey = key;
+    if (item.assignmentRoot) {
+      rootKey = identity(item.assignmentRoot.environmentId, item.assignmentRoot.taskId);
+      const root = tasks.get(rootKey);
+      if (!root || root.assignmentRoot) { unknown('assignment-root-unknown'); continue; }
+      const rootEnvironment = root.task.remoteChild?.environmentId
+        ?? (text(root.task.childThreadId) ? root.origin.environmentId : null);
+      if (rootEnvironment !== environmentId) { unknown('assignment-conflict'); continue; }
+    }
+    const previous = assignments.get(rootKey);
+    const state = active.has(task.status) || task.hasPendingChildRuns === true
+      || task.workState === 'waiting_for_children' ? 'running' : 'completed';
+    // A terminal coordinator with live descendants remains active.
+    assignments.set(rootKey, { assignmentId: `task:${rootKey}`, environmentId,
+      state: previous?.state === 'running' ? 'running' : state });
+  }
+  for (const item of Array.isArray(snapshot?.pending) ? snapshot.pending : []) {
+    if (!text(item?.origin?.environmentId) || !text(item?.origin?.threadId) || !text(item?.clientRequestId)) {
+      unknown('origin-unknown'); continue;
+    }
+    if (!environments.has(item.environmentId)) { unknown('host-unmapped'); continue; }
+    const key = JSON.stringify([item.origin.environmentId, item.origin.threadId, item.clientRequestId]);
+    const value = { clientRequestId: key, environmentId: item.environmentId };
+    if (item.taskId !== undefined) {
+      if (!text(item.taskId)) { unknown('origin-unknown'); continue; }
+      const taskKey = identity(item.origin.environmentId, item.taskId);
+      const known = tasks.get(taskKey);
+      const rootKey = known?.assignmentRoot
+        ? identity(known.assignmentRoot.environmentId, known.assignmentRoot.taskId) : taskKey;
+      value.taskId = `task:${rootKey}`;
+      const reflected = assignments.get(rootKey);
+      if (reflected && reflected.environmentId !== item.environmentId) unknown('assignment-conflict');
+    }
+    const previous = pending.get(key);
+    if (previous && canonical(previous) !== canonical(value)) unknown('assignment-conflict');
+    pending.set(key, value);
+  }
+  return { inventoryStatus: reasons.size ? 'unknown' : 'known',
+    inventoryObservedAt: snapshot?.observedAt ?? null, inventoryReasons: [...reasons],
+    inventoryEvidence: snapshot?.evidence ?? null,
+    assignments: [...assignments.values()], pendingAssignments: [...pending.values()] };
+}

package/skills/axstack/scripts/fleet-receipt.js

@@ -0,0 +1,130 @@
+// Saved evidence validator. A pass binds supplied facts; it cannot authenticate them.
+import { canonical, record, text, time } from './fleet-config.js';
+
+function options(value) {
+  if (!Array.isArray(value)) return record(value) ? value : null;
+  if (value.some((v) => !text(v?.id) || !['string', 'boolean'].includes(typeof v.value))
+    || new Set(value.map((v) => v.id)).size !== value.length) return null;
+  return Object.fromEntries(value.map((v) => [v.id, v.value]));
+}
+const same = (a, b) => a !== undefined && b !== undefined && canonical(a) === canonical(b);
+const absolute = (path) => text(path) && path.startsWith('/') && !path.split('/').some((p) => p === '..' || p === '.');
+
+export function inspectFleetReceipt(receipt, expected) {
+  const terms = [];
+  const term = (code, pass, observed, missing = observed === undefined || observed === null) => {
+    terms.push({ code, state: pass ? 'pass' : missing ? 'unknown' : 'fail', evidence: observed ?? null });
+  };
+  const r = receipt ?? {};
+  term('receipt-version', r.schemaVersion === 1, r.schemaVersion);
+  const a = expected.attempt;
+  const s = expected.recommendation.selected;
+  const request = expected.recommendation.request;
+  term('receipt-origin', text(a?.origin?.threadId) && a?.origin?.environmentId === expected.recommendation.originEnvironmentId
+    && same(r.attempt?.origin, a?.origin), r.attempt?.origin,
+  !text(a?.origin?.threadId) || r.attempt?.origin == null);
+  term('receipt-attempt', text(a?.key) && text(a?.clientRequestId) && text(a?.origin?.taskId)
+    && same(r.attempt, a), r.attempt);
+  term('receipt-recommendation', r.recommendationJSON === expected.recommendationJSON, r.recommendationJSON);
+  term('receipt-config', r.configDigest === expected.recommendation.configDigest, r.configDigest);
+  const status = r.status?.value;
+  const submitted = r.submission;
+  const thread = r.thread?.value?.thread;
+  const remote = s.environmentId !== expected.recommendation.originEnvironmentId;
+  const child = (v) => remote ? v?.remoteChild?.threadId : v?.childThreadId;
+  const env = (v) => remote ? v?.remoteChild?.environmentId : a?.origin?.environmentId;
+  term('receipt-destination', env(status) === s.environmentId && env(submitted) === s.environmentId
+    && text(child(status)) && child(status) === child(submitted)
+    && r.thread?.environmentId === s.environmentId && thread?.threadId === child(status),
+  { submitted: submitted?.remoteChild ?? submitted?.childThreadId,
+    status: status?.remoteChild ?? status?.childThreadId, thread: r.thread?.environmentId });
+  term('receipt-title', text(a?.title) && thread?.title === a.title, thread?.title);
+  term('receipt-project', thread?.projectId === s.projectId, thread?.projectId);
+  for (const [name, tool, environmentId, args] of [
+    ['status', 'task_status', a?.origin?.environmentId, { taskId: a?.origin?.taskId }],
+    ['thread', 't3_thread_read', s.environmentId, { threadId: child(status) }],
+    ['terminal', 't3_thread_wait', s.environmentId, { threadId: child(status), runId: thread?.latestRunId }],
+  ]) {
+    const read = r[name];
+    term('receipt-observation', read?.tool === tool && read?.environmentId === environmentId
+      && same(read?.args, args) && time(read?.observedAt) && read.observedAt <= expected.now
+      && text(read?.evidence), read);
+  }
+  term('receipt-origin', status?.taskId === a?.origin?.taskId && submitted?.taskId === a?.origin?.taskId,
+    status?.taskId);
+  const target = r.requested?.target;
+  term('receipt-requested', target?.environmentId === s.environmentId && target?.projectId === s.projectId
+    && target?.providerInstanceId === request.providerInstanceId && target?.model === request.model
+    && same(options(target?.options), request.options) && r.requested?.runtimeMode === request.runtimeMode,
+  r.requested);
+  term('receipt-effective', status?.providerInstanceId === request.providerInstanceId
+    && status?.model === request.model && thread?.providerInstanceId === request.providerInstanceId
+    && thread?.model === request.model && same(options(status?.options), request.options)
+    && thread?.runtimeMode === request.runtimeMode, { provider: status?.providerInstanceId,
+    model: status?.model, options: status?.options ?? null, runtimeMode: thread?.runtimeMode },
+  status?.options == null || thread?.runtimeMode == null);
+  const terminal = r.terminal?.value;
+  term('receipt-terminal', status?.status === 'completed' && status?.latestTerminalStatus === 'completed'
+    && status?.workState === 'result_available' && status?.hasPendingChildRuns === false
+    && ['completed', 'idle'].includes(thread?.status) && thread?.activeRunId === null
+    && terminal?.status === 'completed' && terminal?.timedOut === false, { status, terminal },
+  status?.status == null || status?.workState == null || status?.hasPendingChildRuns == null
+    || status?.latestTerminalStatus == null || terminal?.status == null || terminal?.timedOut == null
+    || thread?.activeRunId === undefined);
+  term('receipt-question', status?.hasPendingQuestion === false && status?.pendingApproval === null
+    && thread?.pendingRequestCount === 0, { hasPendingQuestion: status?.hasPendingQuestion,
+    pendingApproval: status?.pendingApproval, pendingRequestCount: thread?.pendingRequestCount },
+  status?.hasPendingQuestion == null || status?.pendingApproval === undefined || thread?.pendingRequestCount == null);
+  const questions = r.questions;
+  term('receipt-question', questions?.tool === 't3_pending_request'
+    && questions?.environmentId === s.environmentId
+    && same(questions?.args, { action: 'list', threadId: child(status) })
+    && time(questions?.observedAt) && questions.observedAt <= expected.now
+    && text(questions?.evidence) && Array.isArray(questions?.value?.requests)
+    && questions.value.requests.length === 0, questions,
+  questions == null || questions.value?.requests === undefined);
+  const current = thread?.latestRunId;
+  const runs = r.thread?.value?.recentRuns;
+  const latest = Array.isArray(runs) ? runs.find((v) => v.runId === current) : null;
+  term('receipt-run', text(current) && status?.latestTerminalRunId === current
+    && terminal?.threadId === child(status) && terminal?.runId === current
+    && (!terminal?.resultRun || (terminal.resultRun.runId === current && terminal.resultRun.status === 'completed'))
+    && (!remote || (r.remoteChild?.environmentId === s.environmentId
+      && r.remoteChild?.threadId === child(status) && r.remoteChild?.runId === current))
+    && latest?.status === 'completed' && Number.isSafeInteger(latest?.ordinal)
+    && runs.every((v) => Number.isSafeInteger(v.ordinal) && v.ordinal <= latest.ordinal),
+  { current, originTerminal: status?.latestTerminalRunId, terminal, runs },
+  !current || !status?.latestTerminalRunId || !terminal?.runId || !Array.isArray(runs)
+    || (remote && !r.remoteChild?.runId));
+  const marker = `AXSTACK-DONE key=${a?.key} head=${a?.candidate} report=${r.evidence?.path}`;
+  const finalMarker = (value) => {
+    if (typeof value !== 'string') return null;
+    const lines = value.trim().split('\n');
+    const markers = lines.filter((line) => line.startsWith('AXSTACK-'));
+    if (markers.length !== 1) return null;
+    const trailer = lines.slice(lines.indexOf(markers[0]) + 1);
+    return trailer.length === 0 || (trailer.length === 1
+      && /^PR https?:\/\/\S+, head [a-f0-9]{7,40}, checks and reviews .+$/.test(trailer[0]))
+      ? markers[0] : null;
+  };
+  const items = r.thread?.value?.items;
+  const final = Array.isArray(items) ? items.filter((v) => v.runId === current && v.createdBy === 'agent').at(-1) : null;
+  term('receipt-marker', /^[a-f0-9]{40}$/.test(a?.candidate ?? '')
+    && finalMarker(status?.latestTerminalSummary) === marker && finalMarker(final?.text) === marker,
+  { origin: status?.latestTerminalSummary, destination: final?.text });
+  term('receipt-host-path', r.evidence?.hostId === s.hostId && r.evidence?.environmentId === s.environmentId
+    && absolute(r.evidence?.path) && finalMarker(status?.latestTerminalSummary)?.endsWith(` report=${r.evidence.path}`), r.evidence);
+  if (a?.title?.startsWith('Reviewer: ')) {
+    term('receipt-isolation', r.requested?.isolation === 'worktree', r.requested?.isolation);
+  }
+  if (a?.title?.startsWith('Reviewer: ') || r.checkout != null || thread?.worktreePath != null || r.requested?.isolation === 'worktree') {
+    const c = r.checkout;
+    term('receipt-checkout', c?.hostId === s.hostId && c?.environmentId === s.environmentId
+      && absolute(c?.path) && c.path === thread?.worktreePath
+      && /^[a-f0-9]{40}$/.test(a?.base ?? '') && c?.base === a.base && c?.candidate === a.candidate
+      && c?.readback?.hostId === s.hostId && c?.readback?.environmentId === s.environmentId
+      && c?.readback?.path === c.path && c?.readback?.base === a.base && c?.readback?.candidate === a.candidate
+      && text(c?.readback?.evidence), c);
+  }
+  return terms;
+}

package/skills/axstack/scripts/fleet-route.js

@@ -6,7 +6,7 @@ export { parseFleetConfig } from './fleet-config.js';
 export function recommend(input, now) {
   validateInput(input, now);
   const config = parseFleetConfig(input.configText, input.configDigest);
-  const counts = assignmentCounts(input, config.hosts);
+  const counts = assignmentCounts(input, config.hosts, now);
   const preference = Object.hasOwn(config.taskOrders, input.request.task)
     ? config.taskOrders[input.request.task] : config.defaultOrder;
   const eligible = [];
@@ -46,12 +46,13 @@ export function recommend(input, now) {
   const measured = (h) => h.telemetry.status === 'measured';
   const rank = (h) => preference.indexOf(h.hostId);
   const byLoad = (a, b) => a.telemetry.loadBp - b.telemetry.loadBp || rank(a) - rank(b);
+  const rankingCounts = counts.pendingLowerBound ?? counts.byEnvironment;
   const under = pool.filter((h) => measured(h) && h.telemetry.loadBp <= config.balanceLimitBp);
   let stage; let reason; let selected = null;
   if (!eligible.length) { stage = 'no-route'; reason = 'no-executable-route'; }
   else if (under.length) {
     stage = 'balance'; reason = 'pool-under-limit';
-    selected = under.sort((a, b) => a.assignmentCount - b.assignmentCount || byLoad(a, b))[0];
+    selected = under.sort((a, b) => rankingCounts[a.environmentId] - rankingCounts[b.environmentId] || byLoad(a, b))[0];
   } else if (pool.length && pool.every((h) => !measured(h))) {
     stage = 'pool-unknown'; reason = 'pool-all-unknown'; selected = pool[0];
   } else {
@@ -65,7 +66,7 @@ export function recommend(input, now) {
     }
   }
   const flags = {
-    countsUnknown: input.inventoryStatus === 'unknown', poolEmpty: pool.length === 0,
+    countsUnknown: counts.inventoryStatus === 'unknown', poolEmpty: pool.length === 0,
     poolPartlyUnknown: pool.some(measured) && pool.some((h) => !measured(h)),
     telemetryUnknown: eligible.some((h) => !measured(h)),
     overloaded: selected ? measured(selected) && selected.telemetry.loadBp > selected.fallbackLimitBp : false,

package/skills/axstack-cleanup/SKILL.md

@@ -43,6 +43,27 @@ Preserve unknown files, unmerged author work, ambiguous publication, and evidenc
 Do not force removal, bulk-clean, edit a runtime database, or add a scheduler,
 daemon or state machine. Report other projects' resources; never touch them.
 
+## Wait registrations and owned wakes
+
+Follow [Bounded recovery boundary](../axstack/references/t3-runtime.md#bounded-recovery-boundary)
+and [Waiting-turn and closing records](../axstack/references/run-record.md#waiting-turn-and-closing-records)
+when ending an owner condition. On completion/cancellation/handoff, reconcile
+ownership and delete only run-owned schedule IDs with absence readback.
+Stop owned watches and clear only identified owned duplicate scheduled messages,
+recording exact IDs, scope, owner, lifetime and receipts. Preserve user messages
+and shared persistent schedules. Run completion unregisters only its own
+registration and preserves the shared service and other registrations.
+Without separately authorized shared-service lifetime, recovery ends at run
+close, empty scope or expiry, whichever comes first. Empty scope means no open
+wait registrations, rather than no eligible action in this pass. After expiry,
+perform cleanup-only with zero sends even if deletion failed.
+Unknown deletion or queue state is a scoped cleanup finding, never a reason to
+redo product work. Keep that resource ID and its cleanup owner until reconciled.
+Verify Stop/restart/provider-failure queue behavior before promising a timer
+wake; a timer cannot override a held queue. Use advertised interval/fixed-time/
+webhook operations, never an invented dedicated one-shot trigger. Recovery owns
+only its own resources; each Driver cleans its own watches, queues and schedules.
+
 ## Reconcile each candidate
 
 Take a fresh native inventory and bind every candidate to its exact projectId, attempt key, taskId/childThreadId/childRunId