axstack 0.55.0 → 0.56.1

package/docs/concepts.md

@@ -59,7 +59,9 @@ do not belong in it.
 
 Delegation uses the `t3-code` MCP. Use async `delegate_task` for every role, including authors with
 `isolation:"worktree"` in their own SHA-pinned worktrees.
-Top-level drivers use `t3_thread_launch`.
+Every top-level launch, including an author fallback, requires an explicit user request.
+Top-level drivers use `t3_thread_launch` only after an explicit user request.
+Preserve existing accepted authorization within its exact scope.
 Use `t3_thread_launch` as a rare author fallback only when
 worktree isolation is unavailable and record each use in the run record. Configuration read-back,
 run receipts and revision-bound completion are separate from capability

package/docs/installation.md

@@ -215,10 +215,13 @@ also routes every subagent, delegated worker, reviewer, and cross-harness dispat
 through the `t3-code` MCP. It forbids harness-native subagent tools. The current
 T3 thread is the driver. Use async `delegate_task` for every role, including authors with
 `isolation:"worktree"` in their own SHA-pinned worktrees.
-Top-level drivers use `t3_thread_launch`.
+Every top-level launch, including an author fallback, requires an explicit user request.
+Top-level drivers use `t3_thread_launch` only after an explicit user request.
+Preserve existing accepted authorization within its exact scope.
 Use `t3_thread_launch` as a rare author fallback only when
 worktree isolation is unavailable and record each use in the run record. The standing block
-authorizes top-level driver threads, delegated writers and worktrees;
+authorizes delegated writers and worktrees within approved scope;
+it grants no blanket top-level launch permission;
 it grants no push, merge, release, or host mutation.
 The [runtime reference](../skills/axstack/references/t3-runtime.md) owns the dispatch
 and receipt protocol.

package/docs/workflows.md

@@ -201,7 +201,9 @@ All subagent, delegated-worker, reviewer, and cross-harness work uses T3
 orchestration through the `t3-code` MCP. Do not use harness-native subagent
 tools. Use async `delegate_task` for every role, including authors with
 `isolation:"worktree"` in their own SHA-pinned worktrees.
-Top-level drivers use `t3_thread_launch`.
+Every top-level launch, including an author fallback, requires an explicit user request.
+Top-level drivers use `t3_thread_launch` only after an explicit user request.
+Preserve existing accepted authorization within its exact scope.
 Use `t3_thread_launch` as a rare author fallback only when
 worktree isolation is unavailable and record each use in the run record.
 Reviewers and investigators receive driver-made disposable detached checkouts pinned to candidate

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.55.0",
+  "version": "0.56.1",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks T3 Code capabilities.",
   "keywords": [
     "claude-code",

package/skills/axstack/references/fleet-dispatch.md

@@ -0,0 +1,228 @@
+# Fleet nonwriter dispatch and receipts (C3a)
+
+This contract joins C1 recommendation and C2 sampling to native T3 execution.
+It does not deploy a routing switch. Read [T3 runtime](t3-runtime.md) and the
+[selector schema](fleet-route-schema.md). The driver owns all native calls,
+records and forge actions. Helpers validate explicit saved inputs only: no
+network, clock, dispatch, retry, merge, retained state or aggregate permission grant.
+Synthetic evidence can pass binding checks; helpers cannot authenticate it.
+
+## Observe before selecting
+
+1. Record installed Axstack and both T3 versions, directed origin/target link,
+   explicit time, exact reviewed config bytes/digest and installed role snapshot.
+   Map each environmentId to its configured hostId. Hosts, environments, projects,
+   threads and paths are distinct namespaces. Never reuse origin project/thread IDs
+   or filesystem paths on a destination by assumption.
+2. On origin call `t3_environment_links`; preserve raw output and expiry/access.
+   On each eligible destination use forwarded `t3_environment_read`,
+   `t3_project_list` (all pages), `t3_project_read` for the actual project and
+   `orchestrator_capabilities({environmentId})`. Preserve exact catalog bytes and
+   SHA-256. Observe repository identity/workspaceRoot and actual required session
+   access there. Authentication occurs on that session host; copy no credentials.
+   Discovery is not proof that the provider executes. Unknown catalog, project,
+   mode, options, access, link or required session excludes that destination.
+3. Keep the model/effort/provider pins from the run; do not re-resolve to another
+   model when quota/auth/timeout fails. Missing native `t3_thread_configuration`
+   means unavailable effective fields stay unknown. Catalog runtimeModes advertise
+   provider restrictions; they do not prove effective access. Native task/thread facts supply
+   only the fields actually returned. A worker assertion is not native readback.
+4. Normalize current driver assignments and the pending batch as below. Sample
+   telemetry with C2's bounded command, then recompute C1 immediately before each
+   dispatch using the collector time and current exclusions. Preserve the full
+   recommendation JSON bytes and complete replayable input. Unknown inventory
+   is unknown, not a claimed zero; pending lower bounds are labelled separately.
+
+### Saved native inventory
+
+Set optional selector input `nativeInventory` to
+`{complete, observedAt, evidence, tasks, pending}`. With this field, it is the
+inventory source; legacy normalized arrays remain for non-fleet callers.
+`complete:true` requires the driver's complete current assignment collection,
+including unsettled attempts, descendants and pending submissions. API failures,
+pagination gaps, missing ownership or unreconciled launches set complete false.
+The helper cannot independently prove that a caller collected every task.
+
+Each tasks entry is `{origin:{environmentId,threadId}, clientRequestId, task,
+assignmentRoot?}`. `task` is saved native task_status, with its actual taskId.
+For remote tasks use remoteChild.environmentId/threadId even if childThreadId
+is null. For local tasks require a nonempty childThreadId before using origin's
+environment. Native childRunId is an initial observation, not a final-run pin.
+Origin-qualified JSON tuple task identities avoid cross-host ID collisions.
+Do not count an unrelated thread just because its ID matches on another host.
+
+A nested entry can name `assignmentRoot:{environmentId,taskId}` for its observed
+coordinator task. Both must exist on the same destination; unresolved/conflicting
+roots remain unknown. One assignment counts once while any member is active.
+This normalization supports evidence reconciliation; it does not enable authors.
+Pending entries are `{origin:{environmentId,threadId},clientRequestId,environmentId,
+taskId?}`. Update a pending entry with its returned taskId; accepted/nested/terminal
+reflections count once. Ambiguous submissions remain pending until reconciled;
+remove only confirmed not-submitted failures. Client identity includes the driver
+thread, not just its host. Unknown native inventory emits null totals and explicit
+pendingLowerBound/reasons/evidence. Balance ranking uses that pending lower bound
+while reported totals remain null. Legacy C1 fixtures and 20/35/40 spread remain.
+
+## Bind and submit once
+
+For live use supply `input.nativeDestination` before dispatch-plan binding. Each
+read envelope is `{tool,environmentId,args,observedAt,evidence,value}` where args
+excludes the forwarding environmentId, and evidence points to the preserved raw
+native call/result. environment/project/capabilities are read on the selected
+host; links are read on origin. The capabilities envelope uses `valueText` for
+exact raw catalog bytes instead of value. Project repositoryIdentity.canonicalKey
+must match the requested repositoryId. If project-read identity is null/omitted,
+`projectList` may carry an ordered array of `t3_project_list` read envelopes on
+that same environment. Collect from cursor 0 through native nextCursor:null,
+recording actual cursor/limit arguments (native defaults: 0/20, limit at most 100).
+Every page must join without gaps, extra arguments or duplicate project IDs.
+The selected project's ID and workspaceRoot must equal project-read; every
+available canonicalKey must equal repositoryId, including when both reads have
+identity. Missing identity in both, incomplete pagination and any conflict hold.
+
+For observed T3 0.1.5 native Codex/Claude drivers, omitted provider runtimeModes
+means no provider restriction: native resolveRuntimeMode and RuntimePolicy
+preserve the requested mode. Bind this only with catalog runtimeMode equal to
+the request, exactly one selected provider, canRunChildTask:true and an explicit
+empty constraints array. Explicit mode restrictions must include the requested
+mode. Unknown version/driver omission semantics, missing caller authority,
+unavailable providers or restrictions hold. This is preflight support, never
+proof of a child's effective mode; terminal receipts still require actual native
+readback. Preserve the exact catalog bytes/digest; do not synthesize runtimeModes
+or repositoryIdentity in the saved raw reads. Unknown mappings hold rather than guessing.
+The pure `inspectDestination` API returns per-term pass/fail/unknown with evidence;
+`dispatch-plan` holds on a failed/unknown term. This is supplied binding proof only.
+
+Run existing dispatch-plan with the selected destination catalog, complete input,
+recommendation, explicit evaluation time and config pin. Compare its target to the
+independently selected host/environment/project/model/options/runtimeMode. Copy only
+native supported fields, never inputs or fleetBinding. Call `delegate_task` with
+that exact target, full-access, a role-labelled title, stable clientRequestId and
+scope. Reviewers require native isolation:"worktree" and pinned candidate/base;
+no shell-created child checkout. Other nonwriters write only their named private
+evidence directory on that host. Preserve requested arguments and native response.
+
+Record taskId on the origin plus remoteChild.environmentId/threadId. The native
+remoteChild schema need not return runId: normalize it from observed task/thread
+run facts, preserving the native raw response separately. Do not invent it.
+Never top-level launch unless the user explicitly requested a new thread.
+No agent execution through SSH; T3 forwarding is the only remote execution route.
+Unknown submission/liveness blocks replacement. Reconcile the exact attempt and
+clientRequestId against the native remote task before retrying; do not launch a
+second task to test absence. Follow native next instructions, without polling.
+Confirmed pre-submission rejection may exclude a route and trigger a new current
+recommendation at the same model/permission pins; record the exclusion evidence.
+
+## Terminal receipt
+
+Preserve schemaVersion:1, recommendationJSON (exact bytes), configDigest,
+attempt (key, exact title, clientRequestId, origin environmentId/threadId/taskId,
+candidate/base SHAs), requested target/runtimeMode/isolation and native submission.
+The driver's independent fleetAttempt is the expected run-record identity;
+never copy it from an arriving receipt to make a comparison pass.
+
+After native completion wakes origin, read task_status there first. Read actual
+destination thread and terminal run with forwarded t3_thread_read/t3_thread_wait,
+then `t3_pending_request` action list for that same thread. Save envelopes status,
+thread, terminal and questions using the read format above. Preserve raw native
+question output; questions.value.requests is a normalized list extracted from that
+observed response, not an invented API schema. If extraction is uncertain, omit
+it and keep unknown. The native tool currently advertises an opaque result shape.
+
+Normalize remoteChild:{environmentId,threadId,runId} to the current destination run.
+Task latestTerminalRunId, thread latestRunId/recentRuns ordinal, terminal runId
+(and resultRun when present) and final destination message must identify that
+same current completed run. Provider continuation may have a different run from
+submission.childRunId; never use lexical ordering of IDs or the original summary.
+Require completed/result_available/no pending children/no unanswered questions or
+approval. Require exactly one AXSTACK-DONE key/candidate/report marker on both origin's
+latestTerminalSummary and the destination's final current-run agent message.
+A completion marker may be followed by the T3
+`PR <url>, head <sha>, checks and reviews <state>` trailer. Other trailing text
+or additional AXSTACK markers keep the receipt held.
+Old summary, null local child, idle, silence and completed turns with live children
+remain incomplete. Failed/cancelled/interrupted/waiting never succeed.
+
+Evidence is `{hostId,environmentId,path}` with an absolute destination path.
+For isolated review include checkout with those fields, candidate/base and readback:
+`{hostId,environmentId,path,candidate,base,evidence}` from exact-SHA checks there.
+Never infer local file existence from a remote absolute path.
+Requested settings remain separate from effective native status.providerInstanceId,
+model/options and thread.providerInstanceId/model/runtimeMode. Missing effective
+options or mode is unknown and holds required verification, except for the bounded
+T3 0.1.5 initial remote-launch join below.
+
+### T3 0.1.5 initial remote receipt
+
+The remote `readRemoteTask` emitter omits options and returns null childRunId and
+latestTerminalRunId. Preserve those raw omissions/nulls. A current family shell
+is current thread metadata, not an immutable settings record for an older run.
+Never use it to authorize a continuation from an origin summary lacking a run ID.
+
+For the sole initial remote run, optional receipt `nativeFamily` can corroborate
+settings and run identity. The driver acquires `orchestration.getThreadFamily`
+with exact `{threadId}` on the actual destination using an authenticated native
+RPC read with `orchestration:read` scope. This is metadata access, not agent
+execution or an alternate worker launch path. Record host/environment identity,
+authenticated acquisition provenance, exact request/result, and independently
+observed server version. Do not execute an agent through SSH/CLI to obtain it.
+Temporary read sessions require their authorized lifecycle and revocation; never
+put tokens/tickets into evidence. This contract grants no auth/session authority.
+
+The envelope is `{tool:"orchestration.getThreadFamily",transport:"t3-native-rpc",
+environmentId,serverVersion:"0.1.5",args:{threadId},observedAt,evidence,value}`.
+`value` is the unmodified native `{snapshotSequence,threads}` response. Retain
+raw bytes separately, including any diagnostic/revocation trailer; parse only
+the JSON response into a separate file. Never rewrite the raw response as JSON.
+The version must also match selected destination versions; observe the family
+after thread/wait and no later than receipt evaluation. Missing provenance holds.
+
+Require a unique child with the selected project, exact title/current run,
+provider/model/options/mode and delegatedFrom origin environment/thread. Every
+returned family member must explicitly have idle/completed status, null active
+run/request, zero pending guest input and an empty pendingBackgroundTasks array.
+Unknown or live descendants hold even when remote status claims no pending child.
+
+The fallback requires native thread runCount:1, exactly one recentRuns row at
+ordinal:1, null local child IDs/childRunIds on status/submission, null origin
+latestTerminalRunId, and identical origin/destination final text. Existing
+current-run, completed terminal, marker, question and host/path checks still
+apply. Explicit status options or run IDs cannot be overwritten by family facts.
+T3 remote launch forwards the accepted explicit model selection and uses it for
+both thread creation and the initial message; this is the source-backed scope
+of the join. More runs or missing counts/ordinals hold. Later continuations need
+actual result-run/per-run settings provenance; repeated matching markers or
+current family settings are insufficient. Complete native statuses retain their
+existing run-ID path. Saved inputs cannot authenticate their own provenance.
+
+`inspectFleetReceipt(receipt,{attempt,recommendation,recommendationJSON,now})`
+returns terms, never authority. Existing dispatch-plan --verify can additionally
+consume fleetAttempt/fleetReceipt in its saved envelope; save --out to retain
+full receiptTerms. Legacy configuration-only MATCH checks supplied configuration,
+not native completion. Stable receipt-* / destination-* terms identify the exact
+hold and evidence; unknown means incomplete. A passing receipt is no merge grant.
+
+## Retrieval and retirement
+
+The driver retrieves the exact host-qualified report/artifacts and verifies digest
+and byte readback on origin before accepting them. For a reviewer, verify candidate
+HEAD and pinned base commit on the destination, then verify transported commit IDs
+on origin if commits are needed. SSH may transport artifacts/commits or telemetry;
+it never invokes agents or bypasses T3 access. Keep origin and destination paths
+separately qualified in the run record; verify exact SHA/base, not branch names.
+
+Remote reviewer retirement is driver-only through axstack-cleanup: re-read the
+exact destination thread/run/ownership, preserve archive plus digest on origin,
+read it back, settle the owned child there and verify settled:true. Retire only
+its recorded T3-created disposable checkout after candidate/base, terminal state
+and ownership checks. Unknown liveness, changed SHA, user takeover or uncertain
+ownership preserves the resource and holds its cleanup. Validate exact literal
+path/realpath/owner/no symlink before deletion; validation must succeed in a
+separate sequential call before deletion. Preserve unknown ignored artifacts.
+Never delete a shared root, use globs/age sweeps or treat an origin path as remote.
+Authors stay until merge/close; driver alone owns forge links/watch/publication.
+
+Remote author coordinator is DISABLED after the checkpoint-ref pilot failure;
+no C3b pilot or waiver here. Local isolated authors remain eligible even overloaded.
+See [Fleet verification](fleet-verification.md) for later authorized C3/C6 live
+coverage. C4/C6 personal policy, deployment and live routing are unverified here.

package/skills/axstack/references/fleet-route-schema.md

@@ -161,6 +161,22 @@ reconciled. An unknown inventory contributes no stale counts; known pending
 records still count. Counts report inventory status/time and pending provenance.
 These are observations, never reservations or predicted resource costs.
 
+### Native inventory and live evidence (C3a)
+
+Optional `nativeInventory` is normalized before counts under
+[Fleet dispatch and receipts](fleet-dispatch.md#saved-native-inventory).
+Unknown native totals are null; balance ranking uses the separately labelled
+pendingLowerBound. Counts also retain inventoryReasons/evidence; flags.countsUnknown follows normalized status.
+Optional `nativeDestination` carries observed native forwarded preflight reads.
+Optional `nativeDestination.projectList` is the complete ordered native project-list
+page envelopes used to join a cold project-read repository identity; preserve
+raw reads and catalogs. Conflicting identities/workspaces or incomplete pages hold.
+T3 0.1.5 native provider mode omissions require the documented caller/provider
+authority evidence, never synthesized catalog fields.
+The same reference defines terminal receipt validation and its supplied-evidence
+limitation. Live drivers require these observed facts, not synthetic caller claims.
+Legacy normalized input remains unchanged. Remote coordinator remains disabled.
+
 ## Bounded collection (C2)
 
 Collect with the installed helper (no bin/axstack.js subcommand):

package/skills/axstack/references/fleet-verification.md

@@ -0,0 +1,102 @@
+# Bounded live fleet verification (later C3/C6)
+
+Run only under the driver's recorded live/host authority. C3a ships this procedure;
+it does not execute it or enable routing. Offline fixtures and source inspection
+cannot establish live eligibility. Use [Fleet dispatch](fleet-dispatch.md) for
+receipt fields, [T3 runtime](t3-runtime.md) for native lifecycle, and the repository
+verify-axstack recipe for separate offline coverage. Never mix live credentials or
+network into that isolated recipe.
+
+## Prepare one owned attempt
+
+Record run key, origin T3 thread link, operator, allowed origin/targets, role/model/
+options/full-access, repository/project identities, exact candidate/base, explicit
+start/end times and a maximum of one harmless nonwriter per distinct route config.
+No overload stress, installation, global policy edits, raw provider CLI or production
+writes belong to this procedure. Exclude any unverified route from enabled coverage.
+No top-level thread without an explicit new-thread request.
+
+Create a fresh 0700 scratch outside HOME on each participating host; record each
+literal path with hostId/environmentId. Before use validate owner, realpath and
+no symlink. Use a separately owned persistent evidence folder on origin and target,
+outside scratch selected for deletion. Put only a tiny fixture README/candidate in
+an explicitly provisioned test project. Record its root HEAD/status/all refs before
+and after; no shared project or unknown ignored artifacts may be cleaned.
+Use native T3 worktree isolation for candidate reviewers; no shell child checkouts.
+
+Save a coverage row for every directed origin→target and materially distinct
+provider/model/options/runtimeMode/project/isolation/browser/session configuration.
+Record both endpoint T3/Axstack versions, exact installed skill hashes, config
+schema/digest, native-balancer client setting and link expiry. Reuse evidence only
+with a recorded equivalence argument; direction/version/project/session differences
+require their own check. Do not expose credentials in this matrix.
+
+## Actions, expected results and evidence
+
+| Owned fixture / bounded action | Expected observation and retained evidence | Cleanup / failure disposition |
+| --- | --- | --- |
+| Native discovery, once per directed link/config | Save t3_environment_links on origin; forwarded environment/project/catalog reads on target, raw bytes/digests/time/expiry/access. Native project repository identity and selected env/project/model/options match independent expected values. Required session is authenticated on target. Missing effective fields stay UNKNOWN. | No link/settings mutation to make a check pass. Expired/unreachable/access/model gaps exclude the route. |
+| One bounded telemetry batch per origin | C2 sample with explicit configured host↔environment manifest, interval 5000ms, timeout 10000ms. Save raw JSON, collector start/end and source/whole-host/duration/age. Directed telemetry origin×target matrix covers all configured hosts. A failed host is UNKNOWN, never fabricated zero. | Collector exits/reaps only owned processes. No daemon/timer or real overload. |
+| Inventory + pending fixture batch | Save origin task identities, actual remoteChild and current descendants, complete collection provenance and pending clientRequestIds. Replay C1 with exact config/time. Observe 20/35/40 fixture oracle and harmless sequential dispatch spread without claiming reservations. | Reconcile ambiguous submissions in place; unknown inventory remains unknown. Never duplicate a task because a response was lost. |
+| One read-only remote nonwriter | Build destination-bound plan from the actual target catalog, independently compare expected env/project/model/options/mode, then delegate_task with exact target and stable key/clientRequestId. Task writes only its named target evidence report with pinned candidate marker. Save requested arguments, submission and origin task_status. | Follow native next; no polling, SSH agent, permission/model substitution or top-level fallback. Driver owns native task cancellation if this exact owned attempt must stop. |
+| Current terminal receipt | On completion wake, read origin task_status and target thread/current terminal run plus native pending-question list. Require completed/result_available/no children/questions/approval and exact final marker/run. Save latestTerminalRunId, thread latestRunId/ordinals, native terminal result and host-qualified evidence. If a provider continuation occurs, record the newer current run; old original summary is insufficient. | Unknown liveness or incomplete native read holds. No replacement until exact old attempt is reconciled. Failed/cancelled/waiting outcomes never become successes. |
+| Target reviewer worktree (only when authorized/enabled) | Native isolation worktreePath differs from target project root. Verify exact candidate and base objects there, preserve host/path ownership and report digest; origin transport/readback matches exact SHA/base and bytes. Driver root HEAD/status remains unchanged. | Archive/read back evidence on origin, settle/read back owned child on actual target, then retire only its exact T3-created disposable checkout through cleanup ownership guards. |
+| Required browser mode | For configurations requiring a browser, drive the harmless fixture in the requested headed/headless mode using the configured browser MCP; save actual mode/interaction evidence. | Close only the session/page created by this attempt. No mode equivalence inferred from catalog flags. |
+| Helper failure + fallback fixture | An owned missing/malformed telemetry input produces UNKNOWN; no executable remote route falls back to a locally isolated author at the same pins, even when overloaded. Save recommendation→explicit destination→receipt trace. | No new helper state, automatic retry, model change or authority grant. |
+| C6 installation/config parity and one rollback rehearsal | Under separately recorded deployment authority, all five hosts have identical reviewed config digest/schema and intended CLI/skill/global-source revisions. Roll back only one explicitly owned target, read back exact prior bytes/revision, then restore intended revision and verify. | Keep prior bytes private, never copy credentials. A partial host matrix remains incomplete C6. C3a changes none of these hosts. |
+| iosatellite unattended claim | Before claiming closed-lid/unattended eligibility, verify a real closed-lid job, SSH and T3 operation under its actual configured AC/lid policy and retain logs. | Without that proof, label unattended UNKNOWN; attended reachable operation remains a separate eligible configuration. |
+
+Suggested harmless nonwriter brief: name its key, target-only private evidence
+path, pinned candidate/base, read-only fixture question and exact final
+AXSTACK-DONE marker; forbid tracked/untracked project writes, children, forge,
+install/config edits and html_render. No worktree author or coordinator is part
+of the nonwriter check. Save the observed dispatch response rather than a worker's
+claim about how it was launched.
+
+For terminal negative controls use offline saved copies with one changed fact
+(stale run, question, pending child, wrong env/project/settings/path). Do not create
+real denied prompts, disconnected workers or orphaned production tasks just to
+exercise a guard. Live submission ambiguity, cancellation, provider continuation
+and question handling remain separate UNKNOWN rows unless actually observed in
+an authorized owned context. Never infer their success from an offline negative.
+
+## Remote authors stay disabled
+
+C3b's all-refs-unchanged pilot failed on T3 checkpoint refs. Do not rerun, waive
+or enable that coordinator in C3a/C6 nonwriter verification. Direct remote worktree
+authors are ineligible on T3 v0.1.5. Local isolated authors remain the fallback.
+Any future separately authorized C3b investigation must prove every F4 gate in the
+approved baseline: target local isolation and exact base, nested completion,
+same-author repair/new-run origin wake, question/answer/resume, approval boundary,
+cancellation/failure/orphan propagation including owned disconnected cases,
+unchanged root HEAD/status/all refs, exact retrieval and owned retirement. Record
+all nested IDs and both versions. Unknown stop forbids replacement. No production
+enablement without all gates and accepted scope; no silent all-refs exception.
+
+## Cleanup and receipt
+
+For each owned remote reviewer, read exact target thread/run/ownership again.
+Archive evidence on origin, verify its digest and read it back, then settle on
+target and verify settled:true before removing that recorded disposable checkout.
+Retain user-taken-over, changed, active, unknown or ambiguously owned resources.
+Driver alone owns forge publication, PR links/watch and merges. No worker watches.
+
+For each scratch path, validation must succeed first: exact created literal path,
+no symlink, realpath equality, current ownership and 0700 mode. Finish validation
+successfully, then perform deletion in a separate sequential call on that same
+host/path. Never parallel validation/deletion, ignore failures, glob shared paths,
+clean by age or delete unknown ignored artifacts. Confirm scratch absence and
+persistent evidence survival; record retained resources with a named hold.
+
+Return rows as PASS/FAIL/UNKNOWN/N/A with command/native-call evidence and exact
+versions/config/candidate hashes. Summaries are counts only, never aggregate
+permission. List every omitted config/host/gate and its owning phase. C4 owns
+personal routing policy/Haoshoku live changes; C6 owns deployment and the complete
+live matrix. Nothing here declares a deployed routing switch.
+
+Rerun affected rows after routing/helper/receipt releases, either endpoint's T3
+version change, link replacement/expiry/access change, project/provider/model/
+options/runtimeMode/session/browser change, config digest or policy change, and
+before C6 acceptance. A failed bounded attempt retains evidence; reconcile and
+repair within authority before one new explicit attempt. Never create a scheduler,
+state machine or recurring task to make verification run itself.

package/skills/axstack/references/lifecycle.md

@@ -4,6 +4,8 @@ Phases load through [Standing contracts](contracts.md).
 Driver settlement follows [Workspace hygiene](workspace-hygiene.md).
 Delegated or resumable work uses a driver-owned [Run record](run-record.md)
 binding state and receipts to exact revisions.
+For a logical Coordinator coordinating project drivers, follow
+[Coordinating multiple drivers](t3-runtime.md#coordinating-multiple-drivers).
 
 ## Roster (compact)
 
@@ -80,10 +82,14 @@ Store receipt references, not raw output, in the [Run record](run-record.md).
 - Audit receipt: scope, evidenced PASS/FAIL/UNKNOWN counts/denominators and
   proposals. Only an authorized sanitized summary publishes.
 
+Before ending a waiting turn or closing its condition, follow
+[Waiting-turn and closing records](run-record.md#waiting-turn-and-closing-records).
+
 ## Execution tracking
 
 Follow [T3 runtime](t3-runtime.md) for native completion, questions, launch
-recovery and run-watch waits. Delegated notifications wake the driver; a launched
+recovery and run-watch waits. Never status-check running delegate_task children on scheduled wakes.
+Delegated notifications wake the driver; a launched
 writer sends its marker with `t3_thread_send` using `mode: queue` to the recorded driver thread.
 Delegated completion requires persisted `task_status` before `t3_thread_read`, terminal `completed`, `result_available`, `hasPendingChildRuns:false`, and final `AXSTACK-DONE`.
 Delegated author completion requires delegated terminal checks plus candidate checks: non-empty diff, clean tree and named red/green logs.
@@ -120,7 +126,7 @@ ready. An unreachable predecessor holds. Update one `Next:` line on each
 transition with owner, last receipt time, next action and hold; reconcile it for
 status questions. Stale receipts remain evidence only.
 
-End a driver turn with an unsettled launched thread only while the bound run watch is armed; each wake reconciles all unsettled runs.
+End a driver turn with an unsettled launched thread only while the bound run watch is armed; each wake reconciles unsettled launched-fallback Writer runs.
 Use terminal `t3_thread_wait` and the recorded watch as the runtime contract
 requires, re-arming waits on timeout; sleep or poll loops are forbidden. Delete the watch by exact ID and
 verify absence once nothing remains unsettled. After each delegated completion,
@@ -136,6 +142,17 @@ After accepting task or run completion, the driver invokes
 Axstack creates no heartbeat or substitute scheduler.
 Tracking grants no merge, release, model-substitution, or scope authority.
 
+## Host-qualified fleet receipts
+
+Fleet nonwriters use [Fleet dispatch and receipts](fleet-dispatch.md) in addition
+to the local lifecycle. Origin taskId and destination environment/thread/current
+run are separate identities; remote local-child IDs may be null. Keep exact
+recommendation/config/catalog evidence, requested/effective settings and qualified
+artifact/checkout paths. Read task_status on origin and terminal/question facts
+on destination before advancement. Current completed/result_available with no
+children/questions and an exact final marker is required; an old summary cannot
+complete a provider continuation. Driver-only forge/cleanup ownership is unchanged.
+
 ## Deadline (one rule for every owned timer)
 
 The default 24-hour deadline covers standalone task-owned timers. Stop them at

package/skills/axstack/references/role-roster.md

@@ -1,5 +1,11 @@
 # Role roster
 
+Fleet nonwriter placement follows [Fleet dispatch and receipts](fleet-dispatch.md).
+Roles retain exact configured provider/model/options/full-access on the selected
+native destination. Remote reviewers require T3 worktree isolation; no shell child
+checkout. Host names confer no role or permission. Remote authors/coordinator stay
+disabled; local isolated authors remain supported even overloaded.
+
 - Chat drives (no role ID); `axstack-owner` owns one PR and
   `axstack-author` its sole writer.
   For own PRs, automatic merge is the default under the

package/skills/axstack/references/routing.md

@@ -2,6 +2,8 @@
 
 Choose a route; load only the phase and references needed next.
 Driver entry sweep follows [Workspace hygiene](workspace-hygiene.md).
+For work spanning project drivers, follow
+[Coordinating multiple drivers](t3-runtime.md#coordinating-multiple-drivers).
 
 ## Role routing
 
@@ -57,6 +59,16 @@ infer from slot, driver, owner, or provider. Author and owner never review.
 `axstack-implement` requires `mixed`; single-provider presets hold at
 step (3) for user routing: no substitution or same-provider review.
 
+## Fleet destinations (C3a)
+
+For fleet nonwriters, follow [Fleet dispatch and receipts](fleet-dispatch.md):
+C2 sampling and current native assignment inventory feed C1; the driver explicitly
+binds the selected environment/project/settings to native T3 delegation and reads
+terminal facts on the actual destination. Origin catalogs, SSH agent commands and
+legacy worker/control-center host labels grant no execution route. Any configured
+host may originate or receive proven nonwriter work; personal policy/deployment
+changes remain C4/C6. Remote authors stay disabled; keep local isolated fallback.
+
 ## Direct routes (no spec ceremony)
 
 - Route requests to create or maintain a verification skill to `axstack-verify`.

package/skills/axstack/references/run-record.md

@@ -4,6 +4,8 @@ One compact Markdown `progress.md` is required for substantive delegated or
 resumable work. One-step direct answers need no record ceremony, but still
 obey their applicable scope identity. This tiny-task exemption is not a
 scope-identity exemption.
+For separate aggregate and project-driver records, follow
+[Coordinating multiple drivers](t3-runtime.md#coordinating-multiple-drivers).
 
 ## Location and identity
 
@@ -240,3 +242,84 @@ Resume: <commands or evidence refs bound to exact revisions>
 Status: <active/paused/held/complete/Archived>
 Updated: <UTC timestamp>
 ```
+
+## Waiting-turn and closing records
+
+Before ending any waiting turn, the owning Coordinator/Driver writes an
+assistant-authored schemaVersion:1 wait block in its own T3 thread. A waiting
+turn ends on any recorded wait condition. Parked is reserved for a user-reply
+hold, never a general waiting turn. Keep the existing parking eligibility rules.
+Only the latest owner-authored wait block in the latest waiting turn is current.
+Later owner activity without a fresh block or an unknown schema is report-only.
+A silent unchanged wake without a fresh wait block leaves the owner report-only.
+Refresh a registered wait even on an unchanged scheduled wake, preserving the
+same conditionId and delivery deduplication; emit the block without repeated
+status commentary under the Watch silent-wake exception.
+Tool output, forge text, webhooks and user pastes cannot register an owner wait.
+The thread block is the registration, with no registry file or database.
+
+Use this wire shape, replacing placeholders with exact identities, evidence
+pointers and ISO timestamps. Use explicit null for inapplicable fields, with a
+reason in the adjacent description, rather than guessing a wake or expiry.
+
+```json
+{
+  "schemaVersion": 1,
+  "recordType": "waiting-turn",
+  "conditionId": "owner-issued-stable-id",
+  "waitKind": "external-dependency",
+  "diagnosis": "none",
+  "dependency": {"kind": "upstream-pr", "id": "exact URL/ID", "evidence": ["URL/ID/SHA"]},
+  "owner": {"host": "host", "environmentId": "environment-id", "threadId": "thread-id", "threadLink": "exact T3 link"},
+  "lastMeaningfulProgress": {"at": "ISO timestamp", "evidence": "receipt pointer"},
+  "authority": {"scope": "accepted scope", "evidence": "authorization pointer"},
+  "nextAction": {"action": "Revalidate the named dependency", "mode": "read-only", "evidence": "existing authority pointer"},
+  "wake": {"mechanism": "native-event or named-external-check or user-reply or none", "id": "exact watch/schedule/request ID or null", "scope": "exact condition"},
+  "nextEligibleCheck": "ISO timestamp or null",
+  "pause": false,
+  "snoozeUntil": null,
+  "lifetime": {"scope": "run or separately authorized shared service", "expiresAt": "ISO timestamp or explicit non-expiring service authority"},
+  "cleanupOwner": {"host": "host", "environmentId": "environment-id", "threadId": "thread-id", "threadLink": "exact T3 link"}
+}
+```
+
+Classify `waitKind` as active-worker, own-pr-ci-review, external-dependency,
+human-approval, explicit-pause, failed-interrupted, completed-cleanup or unknown.
+Record the exact PR/check/dependency or decision, including downstream human
+holds. Diagnosis is the evidenced cause or literal `none` for a specific
+unexplained blocker. Missing diagnosis is incomplete, not equivalent to `none`.
+Wake IDs identify actual registrations, not promised support. Record every
+watch/schedule's exact ID, scope, owner and lifetime when created.
+
+The recovery key is (owner host, owner threadId, conditionId). Rewriting the
+same conditionId never resets delivery deduplication. Keep that ID through
+revalidation, PR-head changes, native events, passes and restarts while the
+condition remains unresolved. Read history and queue plus prior delivery
+receipts before any eligible send. Ambiguous delivery or unavailable history
+or queue is report-only. An accepted unacknowledged continuation gets no resend.
+A distinct condition uses a new owner-issued ID, never one invented by recovery.
+Bind queued/running wake receipts to the recovery key and exact queue/run IDs.
+An armed registration alone is insufficient delivery evidence; nextEligibleCheck
+and current same-key queue/run delivery determine wake precedence.
+
+To end the registration, the owner writes an assistant-authored closing block
+with the same conditionId. Bind closure to evidence, including scoped cleanup
+still pending; settled metadata alone never proves completed product delivery.
+
+```json
+{
+  "schemaVersion": 1,
+  "recordType": "closing",
+  "conditionId": "owner-issued-stable-id",
+  "diagnosis": "evidenced resolution or disposition",
+  "owner": {"host": "host", "environmentId": "environment-id", "threadId": "thread-id", "threadLink": "exact T3 link"},
+  "authority": {"scope": "accepted scope", "evidence": "authorization pointer"},
+  "nextAction": {"action": "none or bounded remaining cleanup", "mode": "none or cleanup", "evidence": "receipt pointer"},
+  "wake": {"mechanism": "none", "id": null, "scope": "closed registration"},
+  "lifetime": {"scope": "registration closed", "expiresAt": "closure ISO timestamp"},
+  "cleanupOwner": {"host": "host", "environmentId": "environment-id", "threadId": "thread-id", "threadLink": "exact T3 link"},
+  "outcome": "resolved or completed or cancelled or accepted-handoff",
+  "evidence": ["exact revision/terminal/acceptance pointers"],
+  "cleanup": [{"id": "exact resource ID", "scope": "owned run or shared service registration", "state": "absent or stopped or preserved-shared or unknown", "receipt": "readback pointer"}]
+}
+```