create-claude-cabinet 0.51.0 → 0.53.0

package/README.md

@@ -18,8 +18,9 @@ and weigh in when their expertise matters:
 - **Briefings** — project context members read before weighing in
 - **Committees** — members grouped by concern so you convene the right
   experts for the right question
-- **The session loop** — `/orient` briefs you at the start, `/debrief`
-  closes the loop for next time
+- **The session loop** — watchtower keeps your project's state current in
+  the background and hands it to you when a session opens; `/close` ends a
+  session (legacy: `/orient` + `/debrief` by hand)
 
 ## Install
 
@@ -56,25 +57,28 @@ it's done, open Claude Code and run `/onboard`.
 
 ## What You Get
 
-### The Session Loop (always installed)
+### The Session Loop (installed by default)
 
-This is the foundation. You run these commands — they don't happen
-automatically.
+Continuity between sessions, so Claude never starts blind. By default this
+is **watchtower** — a background system that keeps your project's state
+current and hands it to Claude when a session opens.
 
-- **`/orient`** — open every session with this. Claude reads project
-  state, checks health, surfaces what needs attention, and briefs you
-  so you never start blind. Think of it as the briefing before the
-  cabinet gets to work.
-- **`/debrief`** — close every session with this. Claude marks work
-  done, records lessons, updates state, and prepares the briefing for
-  next time. Without debrief, the next orient starts with stale
-  information. The loop is what gives Claude memory across sessions.
+- **Sessions start informed** — watchtower's SessionStart hook injects the
+  current state (what you were working on, what's due, what broke). No
+  start-of-session command to run.
+- **`/briefing`** — review what needs attention across the project.
+- **`/close`** (or **`/session-handoff`**) — end a session; the background
+  rings handle inventory, lesson capture, and routing after you walk away.
 
-**The habit matters.** Orient and debrief take 30 seconds each. Skip
-them and sessions start from zero — Claude forgets what happened,
-repeats mistakes, and you spend the first 10 minutes re-explaining
-context. Keep the loop and each session picks up where the last one
-left off.
+Watchtower is installed by default; its background rings start when you run
+**`/watchtower install`**. Until then it ships the skills and a dormant
+SessionStart hook — nothing runs in the background and no API cost is
+incurred.
+
+**Prefer to run it by hand?** Opt out of watchtower and use the legacy
+loop instead — **`/orient`** at the start (reads state and briefs you) and
+**`/debrief`** at the end (marks work done, records lessons). Both still
+ship, but watchtower replaces them.
 
 ### The Cabinet (included in lean)
 
@@ -129,7 +133,7 @@ you already use GitHub Issues, Linear, or something else.
 Claude Code has built-in file memory, but no guardrails around it.
 The memory module adds structure:
 
-- **`/cc-remember`** — write a new memory with automatic indexing. Every memory gets its own file and is made reachable from `MEMORY.md` — by a direct entry or a region pointer — so `/orient` can find it next session.
+- **`/cc-remember`** — write a new memory with automatic indexing. Every memory gets its own file and is made reachable from `MEMORY.md` — by a direct entry or a region pointer — so the session loop can surface it next session.
 - **`/memory`** — browse and search what Claude remembers.
 - **Validation** — `validate-memory.mjs` checks that the index stays within Claude Code's session-start budget and that every memory file is reachable from `MEMORY.md`. A PostToolUse hook flags unreachable writes in real time.
 
@@ -181,14 +185,17 @@ e2e harness.
 
 The rhythm of each session:
 
-1. **Start a session** → `/orient` (get briefed)
+1. **Start a session** → watchtower briefs you automatically; `/briefing`
+   for the full picture (legacy loop: `/orient`)
 2. **Do your work** → talk to Claude, use `/plan` for anything non-trivial
 3. **Build it** → `/execute` to implement approved plans with cabinet oversight
 4. **Check quality** → `/audit` occasionally for a full cabinet review
-5. **Close the session** → `/debrief` (close the loop)
+5. **Close the session** → `/close` (the rings capture the rest after you
+   walk away; legacy loop: `/debrief`)
 
-Steps 1 and 5 are the minimum. Everything in between is yours to use as
-needed. The more you use, the more the cabinet learns about your project.
+Step 5 is the minimum — start is automatic under watchtower. Everything in
+between is yours to use as needed. The more you use, the more the cabinet
+learns about your project.
 
 ## How It Works
 
@@ -243,7 +250,7 @@ npx create-claude-cabinet --frontier-model claude-fable-5  # Designate your fron
 
 ### Frontier-model watchdog
 
-`--frontier-model <model>` records, once, which model your heavy thinking is supposed to run on. The designation is per-operator (stored in `~/.claude/cc-registry.json` under `frontierModel`, not per-project), and the installer prints the effective value on every run. From then on, `/orient` — and, on watchtower installs, the SessionStart hook — compares the session's actual model against it and leads the briefing with a loud warning on mismatch. The key can be an exact model ID (`claude-fable-5`, exact match required) or a family alias (`fable`, matches any model ID containing it). This is **visibility only**: nothing is pinned, blocked, or rerouted — it just makes "you're accidentally on the wrong model" impossible to miss. A stale key after a model-family transition nags loudly by design; update it with the same flag.
+`--frontier-model <model>` records, once, which model your heavy thinking is supposed to run on. The designation is per-operator (stored in `~/.claude/cc-registry.json` under `frontierModel`, not per-project), and the installer prints the effective value on every run. From then on, the SessionStart hook (on watchtower installs, the default) — and `/orient` on the legacy loop — compares the session's actual model against it and leads the briefing with a loud warning on mismatch. The key can be an exact model ID (`claude-fable-5`, exact match required) or a family alias (`fable`, matches any model ID containing it). This is **visibility only**: nothing is pinned, blocked, or rerouted — it just makes "you're accidentally on the wrong model" impossible to miss. A stale key after a model-family transition nags loudly by design; update it with the same flag.
 
 ## What Gets Installed
 
@@ -252,7 +259,7 @@ source code.
 
 ```
 .claude/
-├── skills/          # orient, debrief, plan, execute, audit, etc.
+├── skills/          # watchtower, plan, execute, audit, orient, debrief, etc.
 │   └── cabinet-*/   # 34 cabinet member definitions
 ├── cabinet/         # committees, lifecycle, composition patterns
 │                    #   (incl. pib-db-access.md, pib-db-triggers.md)
@@ -294,10 +301,10 @@ with Claude everywhere.
 - **Your identity** (`~/.claude/CLAUDE.md`) — set up once, carries to
   every project. Claude always knows who you are and what you do.
 - **Project registry** (`~/.claude/cc-registry.json`) — tracks all
-  your projects. `/onboard` asks how they relate; `/orient` flags
+  your projects. `/onboard` asks how they relate; the session loop flags
   when work in one might affect another.
-- **Debrief maintenance** — if you mention something new about yourself
-  or your project evolves, `/debrief` proposes updating your profile
+- **Profile maintenance** — if you mention something new about yourself
+  or your project evolves, session close proposes updating your profile
   and registry so the next session starts current.
 
 Install in each project folder. They're independent but aware of each

package/lib/cli.js

@@ -1832,8 +1832,8 @@ async function run() {
   console.log('\n  ✅ Cabinet assembled!\n');
   console.log('  Next steps:');
   console.log('  1. Run /onboard in Claude Code — Claude will interview you and prepare the briefings');
-  console.log('  2. Start each session with /orient — get briefed');
-  console.log('  3. End each session with /debrief — close the loop for next time');
+  console.log('  2. Run /watchtower install to start the background rings — sessions then open pre-briefed');
+  console.log('  3. /briefing is your daily surface; end sessions with /close (or /session-handoff)');
   const skippedKeys = Object.keys(skippedModules);
   if (skippedKeys.length > 0) {
     console.log(`\n  Skipped modules: ${skippedKeys.join(', ')}`);

package/lib/modules.js

@@ -15,8 +15,8 @@
 // unchanged.
 const MODULES = {
   'session-loop': {
-    name: 'Session Loop (orient + debrief)',
-    description: 'The briefing cycle. Claude starts each session informed, ends by preparing the next briefing.',
+    name: 'Session Loop (shared verbs + legacy orient/debrief)',
+    description: 'The mandatory session verbs (/menu, /session-handoff) plus the legacy orient/debrief skeletons and their -classic reversibility copies. Watchtower (installed by default) is the live session loop; orient/debrief are the opt-out fallback.',
     mandatory: true,
     templates: [
       'skills/orient',
@@ -209,9 +209,9 @@ const MODULES = {
   },
   watchtower: {
     name: 'Watchtower (continuous background state)',
-    description: 'Replaces orient/debrief with continuous background processing. Three rings (mechanical cron, Claude intelligence, session-aware), ambient state injection via SessionStart hook, and an inbox for extracted knowledge and signals. Sessions start informed with minimal context cost.',
+    description: 'The default session loop. Continuous background processing replaces the legacy orient/debrief skeletons: four rings (mechanical cron, Claude intelligence, session-aware, truth reconciliation), ambient state injection via SessionStart hook, and an inbox for extracted knowledge and signals. Sessions start informed with minimal context cost. Installing the module ships the skills + dormant SessionStart hook; the background rings start only when you run /watchtower install. Opt out to fall back to the legacy orient/debrief loop.',
     mandatory: false,
-    default: false,
+    default: true,
     lean: false,
     templates: [
       'scripts/watchtower-validate.mjs',
@@ -251,6 +251,7 @@ const MODULES = {
       'scripts/watchtower-ring4.mjs',
       'scripts/watchtower-ring4-runner.sh',
       'scripts/watchtower-status.sh',
+      'scripts/memory-consolidation-scan.mjs',
       'skills/briefing',
       'skills/threads',
       'skills/catch-up',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-claude-cabinet",
-  "version": "0.51.0",
+  "version": "0.53.0",
   "description": "Claude Cabinet — opinionated process scaffolding for Claude Code projects",
   "bin": {
     "create-claude-cabinet": "bin/create-claude-cabinet.js"

package/templates/CLAUDE.md

@@ -319,9 +319,22 @@ consumes the registry stays in cli.js).
   ring-filed inbox category to `{reconciler}` or `{exempt}` (exactly
   one), enforced by the structural filing-site test
   `__tests__/detector-registry.test.mjs`: it scans `category:` literals
-  at createItem sites across ring1 + ring2 + ring3-close (read-only
-  source scan) and fails on an unregistered category or a non-literal
-  category value inside a filing owner (act:4d11fd53).
+  at createItem sites across ring1 + ring2 + ring3-close + **ring4 +
+  routines** (read-only source scan) and fails on an unregistered
+  category or a non-literal category value inside a filing owner
+  (act:4d11fd53; act:ea23b3a5 added the last two scripts and their
+  `doc-drift` / `routine` entries, closing the gap act:c2f06955 item 5
+  named — the contract's "maps every ring-filed category" claim was
+  false while ring4 and the routine engine sat outside the scan). Census
+  at 2026-07-26: 27 filing sites, 20 distinct categories, 20 registry
+  entries. **The census binds a `category:` literal to its NEAREST
+  PRECEDING call opener and recognises only `createItem(` and `file(` as
+  filing owners** — an injectable filing dep under any other name reads
+  as a query filter and its category silently drops out of the census.
+  That is not hypothetical: act:ea23b3a5's ring2 memory-budget dep, first
+  written as `createItemFn`, dropped `watchtower-health` out of the
+  filing set and the suite caught it. Name an injected filing seam
+  `file`.
   `GENERATED_STATE_PATTERNS`/`generatedStateIsDisposable` — the JS SSOT
   for machine-written generated state (UNTRACKED `??` lines only:
   `.claude/verification/`, advisories-state.json, checklist-stats.json,
@@ -376,15 +389,43 @@ consumes the registry stays in cli.js).
   to the lib's `resolveProjectFromTranscriptSlug` (feature-detected by
   name on the namespace import) and then to `project_unresolved: true` —
   inbox filing proceeds, but no state-file or thread key is minted from
-  a raw slug. Phase 2c's `completionReviewEmitGuard` adds the
-  create-vs-complete filter (act:9eebbac4): an action whose db `created`
-  date falls inside the session's day window (+1 for past-midnight
-  spill) with confidence below `high` is not a completion candidate (an
-  action born this session whose only evidence is its own creation);
-  mechanical (db row, the same prepared statement as the status
-  re-check) and FAIL-OPEN in every gap — no sessionDate, an unparseable
-  sessionDate (windowEnd is a required conjunct), a missing `created`
-  column, or a thrown lookup all emit. coverage-warning is now a
+  a raw slug. Phase 2c's `completionReviewEmitGuard` was **rebuilt on
+  measurement** (act:ea23b3a5): act:9eebbac4's create-vs-complete
+  day-window filter is DELETED and the model's `confidence: 'high'` is
+  SUPPRESSED instead. Over all 223 items this category had ever filed,
+  each joined against the cited action's OWN project db, `high` scored
+  30% precision (12 acted-on / 28 dismissed-noise) against 60% for
+  medium+low (48 / 32) — the model rates high when a session *talks
+  about* an action (files it, plans it, discusses it), not when it
+  quietly finishes one. The deleted filter exempted `high` from its
+  born-this-session skip, so it suppressed the BEST cohort (same-day
+  creation + medium/low: 74%) and passed the worst (same-day + high:
+  33%); split at its 2026-07-12 ship date the category went **0-for-23**
+  — zero acted-on, 19 dismissed as noise. A **calibration fence** sits on
+  the check: the result holds for the Phase 2c confidence rubric AS
+  WRITTEN, so rewording that rubric requires re-running the measurement.
+  The per-fid dedup corpus gained `expired` + `superseded`, load-bearing
+  because the category's 14-day expiry equals
+  `COMPLETION_REVIEW_DEDUP_DAYS` (without them a fid leaves every corpus
+  exactly when its item expires and refiles forever). A
+  quoted-completion-evidence check (`verifyCompletionQuote` +
+  `decodeTranscriptText`) ships as **INSTRUMENTATION ONLY** — stamped to
+  `evidence.quote_verified`, counted per session, gating nothing: the
+  haystack is `preprocessTranscript`'s JSON-serialized output, so a
+  substring gate rejects ordinary multi-line prose (a newline is the two
+  characters `\` + `n`) and reliably ACCEPTS serialized TodoWrite
+  arguments; `decodeTranscriptText` drops `tool_use` blocks for exactly
+  that reason, and even decoded, containment proves a span EXISTS, never
+  that it means the work is done. Phase 2g (upstream friction) gained a
+  **three-arm actionability gate** (act:ea23b3a5, Phase 2f's
+  verification-gate shape): a named route from the closed vocabulary
+  `cc-feedback | project-tracker | config-change` with a non-empty detail
+  files `upstream-friction`; a durable no-route platform constraint files
+  `knowledge-extraction` (4 of the 5 friction items the operator KEPT
+  exited `captured-to-memory`, so a two-arm gate would have discarded the
+  useful half of the lens); anything else files nothing and is COUNTED.
+  Contract in `watchtower-contracts.md` ("Upstream-Friction
+  Actionability"). coverage-warning is now a
   STANDING-DEBT aggregation (act:e888dd63): ONE pending item per
   (project, debt-class — `COVERAGE_DEBT_CLASS`) whose evidence APPENDS
   per session (session-id union, so a reprocess replay can't inflate
@@ -394,7 +435,17 @@ consumes the registry stays in cli.js).
   at 5, urgent at 15); resolving closes the accumulated view and a
   persisting debt refiles FRESH next session. The `## Last Session`
   block names its authoritative per-session record (`appendRecordPointer`
-  → `<slug>/sessions/<date>-<sessionId>.md`; act:8c076580).
+  → `<slug>/sessions/<date>-<sessionId>.md`; act:8c076580). Phase 2d
+  classifies non-durable facts AT extraction (act:471dd701 N2 +
+  act:a69c21f8): `derivable` (recomputable from a live source → home
+  `derivation`, the recompute instruction visible) and its twin
+  `perishable` (true-at-a-moment, will become false, NOT recomputable —
+  `perishes_when` names what falsifies it → home `session-record`);
+  both ALWAYS FILED to acknowledge/dismiss, never memory, never
+  dropped; derivable wins when both apply; the type/home vocabulary is
+  the exported `KNOWLEDGE_EXTRACTION_TYPES`/`_HOMES` consts
+  (watchtower-queue) with createItem boundary checks + a prompt-parity
+  test (`__tests__/extraction-classification.test.mjs`).
 - `watchtower-queue.mjs` — inbox queue CRUD library (atomic temp+rename,
   no-index convention); also home of the staff-QA recipient gate
   (2026-06-11): every terminal exit on a `qa-handoff` item is structural —
@@ -405,7 +456,19 @@ consumes the registry stays in cli.js).
   exempts the category). `emitPatternPromotion` files one deduplicated
   pattern-promotion inbox item at >=3 sweep instances of a failure class.
   `listItems()` exposes filtered item listing (project/category/status/since)
-  for the Ring 3 dedup corpora. Terminal exits on any dispatched-category
+  for the Ring 3 dedup corpora. **Category expiry is single-sourced here**
+  (act:ea23b3a5): `expiryDaysFor` / `categoryNeverExpires` /
+  `CATEGORY_EXPIRE_DAYS` / `DEFAULT_EXPIRE_DAYS`, with
+  `categoryNeverExpires` sitting beside `expireItem`'s throw because the
+  qa-handoff carve-out is STRUCTURAL (returning anything but null for it
+  crashes the caller's loop). There are TWO expiry engines — Ring 2's
+  `escalateQueueItems` cron and `runExpiry`, which `/inbox` and
+  `/briefing` call — and each previously hardcoded 30 days with its own
+  inlined carve-out, so a per-category policy set in one was silently
+  violated by whichever reached the item first. Both now delegate.
+  completion-review is the first override at 14 days; note that a
+  shortened expiry can open a refile loop when it meets its filing site's
+  dedup window (see the "Category Expiry" contract). Terminal exits on any dispatched-category
   item (`qa-handoff`, `routine` — the DISPATCHED_CATEGORIES set; resolve /
   typed dismiss / supersede / expire) also clear the matching mux
   dispatch-queue descriptor — queued AND in-flight, across all desk dirs —
@@ -491,6 +554,23 @@ consumes the registry stays in cli.js).
   descriptor through `mux qa dispatch` — the SAME hardened desk-dispatch path
   as qa-handoffs, never a fork. Pending-item dedup blocks refiring; stale
   pending firings (default 24h) are superseded + redispatched.
+  `sweepExpiredMoments` (act:ea23b3a5) adds **end-of-day moment expiry for
+  `time-of-day` triggers**: Ring 1's tick supersedes a pending item once
+  the calendar day it was FILED on has ended, instead of waiting 24h for
+  the next firing. End-of-day rather than a fixed window is a measured
+  choice — the portfolio's one time-of-day routine had 10 real pickups in
+  six weeks, 8 within four hours and 2 after (4.4h, 8.6h), so a 4h window
+  would have destroyed two genuine pickups to clear one stale item.
+  Scoped to Ring 1's PORTFOLIO tick (Ring 3's single-project
+  session-close call would otherwise sweep every other project's items,
+  once per replayed session during a reprocess drain), classified from
+  `item.evidence.trigger` rather than config (so a de-registered routine
+  still classifies instead of rotting), and an unparseable `filed_at`
+  ABSTAINS loudly rather than sweeping (the `stale_after_hours` path
+  treats the same input as stale — two mechanisms disagreeing silently is
+  worse than one abstaining out loud). For time-of-day the moment sweep
+  now pre-empts the `stale_after_hours` supersede; interval /
+  path-nonempty / session-close have no moment and are untouched.
   `buildPickupPrompt` (the dispatch pickup-prompt wording, including the
   resolve-on-run that clears the badge) is exported and reused by the
   build-context missed-routine re-delivery (act:4b4fa7d9), so the wording is
@@ -745,7 +825,9 @@ modules total.
 
 ## session-loop (mandatory)
 
-orient + debrief skeleton skills.
+The LEGACY orient + debrief skeleton skills plus shared session verbs.
+Watchtower (default-installed) is now the live session loop; orient/debrief
+are the opt-out fallback, kept shipping via this mandatory module.
 `/orient` leads with the frontier-model watchdog (core phase #0): compares
 the session model against the per-operator `frontierModel` key in
 `~/.claude/cc-registry.json` (set via the `--frontier-model` installer flag;
@@ -776,9 +858,17 @@ dedup-vs-pending discipline as Ring 3 Phase 2m; see "Session Advisor Pass" in
 UNTRACKED marker with neither — and the rendered line cites the filed id;
 debrief's 16b also verifies persistence.
 Ships `/session-handoff`, the **default session-close verb**: a thin wrapper
-over `/debrief` that runs three phases — (1) debrief, whose
-`qa-handoff-sweep.md` instruction phase performs a `/qa-handoff` for every
-worktree→main merge this session still needs one for; (2) propose a
+over `/close` plus the handoff extras the rings can't own after walk-away
+(act:9ce4dfde — repointed off full `/debrief`, whose ring-redundant capture
+was the defect). It runs three phases — (1) `/close` (commit + push, and on
+a worktree its conditional gated-merge offer), then debrief's
+`qa-handoff-sweep.md` phase (a `/qa-handoff` for every worktree→main merge
+this session still needs one for) and `methodology-capture.md` (the one
+capture phase with no ring twin — Ring 3 only DETECTS an already-written
+`.claude/methodology/` record, it can't author one or ask the four-choice
+question, so it stays on the default path); the heavy debrief capture
+(lessons/knowledge/upstream-friction/session-advisors) is NOT run — the
+rings own it after close; (2) propose a
 next-session seed prompt (non-QA work thread only — QA drains belong to
 window 1's standing station), operator approves/rejects, and ONLY on approve
 launch the next session in a **fresh worktree** (via the `mux handoff
@@ -792,7 +882,9 @@ window is already up): it surfaces this project's watchtower threads/cursors
 in plain English (read-only, temporal-labeled, cap 3) and offers at most one
 well-explained inbox decision (drained via `applyBatch`, gated/dispatched
 categories excluded) — strictly skippable, two frozen sections, growth routes
-to `/briefing`. Plain `/debrief` stays the "nothing queued" close. The sweep
+to `/briefing`. Plain `/close` is the "nothing queued" close; plain
+`/debrief` is the opt-in heavy synchronous capture (kept, off the default
+path — act:9ce4dfde). The sweep
 self-skips without watchtower; the launch degrades to a saved seed path
 without mux; the epilogue self-skips without watchtower.
 Also ships `/orient-classic` and `/debrief-classic` (act:6fa60c7d):
@@ -855,11 +947,16 @@ provider-agnostic email/MCP/file/API transport). 3 primary skills
 for old skill names. `requires: ['work-tracking']` (the pib-db adapter is the
 engine's data source). Evolved from the former handoff module.
 
-## watchtower (opt-in, off by default)
+## watchtower (default-installed, opt-out)
 
-Continuous background state management replacing orient/debrief with four
+THE default session loop. Continuous background state management replacing
+the legacy orient/debrief with four
 processing rings (mechanical cron, Claude intelligence, session-aware,
-periodic truth reconciliation). All four rings implemented: Ring 1
+periodic truth reconciliation). Installing the module ships the skills + a
+dormant SessionStart hook; the metered background rings start only on
+`/watchtower install`, so a fresh default install incurs no API cost until
+the operator activates them. Opt out to fall back to the legacy
+orient/debrief loop. All four rings implemented: Ring 1
 (mechanical heartbeat, 5-min cron; also delivers the global CC feedback
 outbox every tick via `flushFeedbackOutbox()`, ticks declared-routine
 triggers via `runRoutinePass()`, surfaces a READ-ONLY
@@ -894,7 +991,17 @@ summary attention aggregates portfolio-wide pib errors into ONE line (almost
 always a single system-level fault; Ring 2's `openPibDb` logs instead of
 silently nulling); the memory-integrity check delegates to
 `checkMemoryReachability` (watchtower-lib) — reachability, never
-filename-substring (act:49cb1c27). Ring 1's worktree-unmerged +
+filename-substring (act:49cb1c27). Standing Issues also renders the
+**cabinet-roster ambient lines** (act:ea23b3a5, `readRosterMetrics` +
+`renderRosterEntries`): dormant-skill and stale-briefing counts stopped
+being `advisor-finding` queue items and became a Ring 2 measurement that
+Ring 1 renders — the same relationship as the recall canary (the
+measurement is Ring 2's, the render is Ring 1's, because Ring 1 owns the
+per-project state file). Rendered ON CHANGE only and carrying skill
+NAMES, because ambient state has no dismiss verb and a number that never
+moves is furniture by the third read; the count itself had to be fixed
+first, since `ROSTER_DORMANT_LIST_CAP` saturated it and every project
+ever measured reported exactly "12 dead". Ring 1's worktree-unmerged +
 branch-diverged detectors flag on CONTENT, not ahead-count (act:a152cf6c): a
 squash-merge leaves a branch a non-ancestor of main with phantom "ahead"
 commits but an IDENTICAL tree, so the old ancestry/`aheadCount` gates flagged
@@ -942,11 +1049,60 @@ knowledge-extraction drafts with freshness (cited `act:` fids positively
 CLOSED in the item's own project pib-db — parameter-bound lookups via
 `openPibDb`, now `timeout: 5000` for lock parity with Ring 3) and fold
 proposals (the watchtower-queue recipe), demoting them out of batch
-sign-off, never dismissing; unreadable dbs and out-of-config drafts are
-counted LOUDLY (`skipped_projects`/`unscanned_items`) and every run
-writes the positive-confirmation sidecar
+sign-off, never dismissing; act:09184ad7 added a SECOND fold corpus —
+pending pattern-promotion items, grouped per `evidence.target_member`
+(cross-member similarity is never a duplicate), so near-duplicate
+pattern variants arrive pre-annotated for the next consolidation pass
+(`pattern_items_scanned`/`pattern_fold_annotated`/
+`unscanned_pattern_items` counters); act:ea23b3a5 added a THIRD corpus —
+pending `raised-unhandled` loose ends, grouped per project
+(`loose_end_items_scanned`/`loose_end_fold_annotated`). That third corpus
+is where the spec's "aggregate recurring loose ends into ONE item"
+landed after measurement refused the merge: `proposeFolds` scores with
+`overlapCoefficient` (act:421a8ab2 retired `unigramJaccard`), whose
+`min()` denominator lets two three-token titles sharing ONE word clear
+`FOLD_SIMILARITY_THRESHOLD = 0.22` — four false folds in fifteen pairs
+against the six live titles — and the five timelog specimens were
+resolved `deferred` (real work the operator postponed, across two
+projects and three date ranges), so merging would have buried which gaps
+remain. The threshold was calibrated for ADVISORY retrieval, not a
+destructive merge: **a lexical matcher may propose, never silently
+suppress.** Unreadable dbs and out-of-config
+items are counted LOUDLY (`skipped_projects`/`unscanned_items`) and
+every run writes the positive-confirmation sidecar
 `state/draft-annotations-health.json`, so "no annotations" is
-distinguishable from "never ran"), Ring 3 (session close, transcript
+distinguishable from "never ran". The slow tier also owns the
+**memory-budget standing debt + its retraction** (act:ea23b3a5):
+`surfacePersistentViolations` files ONE accumulating `watchtower-health`
+item per project instead of a fresh one every 7 days — keyed by CALENDAR
+DAY (a per-run key would count ~48 cron ticks a day and make the replay
+guard dead code), appended via `annotateItemEvidence` so `filed_at` is
+never bumped, carrying `session_count` because that is the spelling
+`itemSessionWeight` already reads — and `retractClearedMemoryBudgetItems`
+retracts on the SAME pass over the `passProjects` `runMemoryHygiene`
+already computes. Deliberately not in Ring 1: a second memory-health
+producer is forbidden by name in `watchtower-contracts.md`, and at a
+30-minute throttle against ring2's 30-minute cadence it would buy zero
+freshness. Both selectors match the LEGACY `{violations, streak}` title
+shape as well as the new `debt_class`, because every item on disk when
+this shipped carried the former. The cabinet-roster review now files only
+`uncovered-tech` (a proposed cabinet seat is a decision); `dormant-skill`
+and `stale-briefing` became ambient metrics in `state/roster-review.json`
+(`parseDormantSkills` reports TRUE counts — the cap bounds the NAME list
+only) and `retireRosterFindingItems` supersedes any of the two retired
+kinds still pending, since the filing site was the only code that ever
+touched them. The slow tier's `scanAuditPatterns`
+(the pattern-promotion filing site) now runs the act:09184ad7
+emission-quality SHAPE GATE — `patternHasRequiredShape` requires the
+`**Evidence:**` + `**Gap:**` blocks Phase 2e's prompt mandates, rejecting
+document echoes (wave ledgers, dependency graphs, recipes, transcript
+fragments — 17/144 items in the 2026-07-26 consolidation) BEFORE the
+routing Claude call; rejections are counted loudly
+(`rejected_malformed_total`/`last_scan_rejected` in
+`state/pattern-detection.json`) and their hashes marked processed, never
+retried. Calibrated against the consolidation corpus: 120/120 legitimate
+bodies pass, 17/17 fragments fail; hermetic suite in
+`__tests__/ring2-pattern-gate.test.mjs`), Ring 3 (session close, transcript
 processing; fires session-close routines as Phase 2j2; runs the standing
 session advisors as Phase 2m — see
 below; runs three session-close extraction lenses (act:4ff2cfb3) — Phase 2n
@@ -954,7 +1110,12 @@ raised-but-unhandled (loose ends the session raised but neither did nor filed
 → inbox category `raised-unhandled`), Phase 2o skill-candidate (a manual
 procedure repeated by hand → `skill-candidate` inbox item), Phase 2p
 checklist-catch (a surfaced change-impact check that caught a real bug →
-`checklist-stats.json`); its Phase 2h feedback "flush" was deleted 2026-06-12
+`checklist-stats.json`); its Phase 2e quality-pattern prompt is the exported
+`QUALITY_PATTERN_SYSTEM_PROMPT` carrying the act:09184ad7 generation-side
+exclusions — no-gap positives, transcript-artifact observations, document
+echoes are never patterns — the prompt half of ring2's mechanical shape
+gate, guarded by `__tests__/ring2-pattern-gate.test.mjs`; its Phase 2h
+feedback "flush" was deleted 2026-06-12
 — it marked without delivering), Ring 4 (periodic truth reconciliation,
 act:36dae795 — stage-1 BUILT, weekly cadence; cron/launchd registration is a
 deferred `/watchtower install` follow-up). Ring 4 mechanically compares
@@ -1015,9 +1176,13 @@ mid-session awareness refresh — diffs current watchtower state against a
 per-session baseline captured at session start and shows only what CHANGED
 since; new inbox items, advanced/new threads, new/cleared git attention,
 freshly-due deferrals; thin orchestrator over `watchtower-snapshot.mjs`;
-act:a8057f87), `/close` (fast session-end verb — commit + push only; the
-background rings handle inventory/capture/routing after you walk away;
-targets 15–30s, never `--no-verify`; act:8bf86966), and `/qa-handoff`
+act:a8057f87), `/close` (fast session-end verb — commit + push, plus on an
+ORPHANED worktree only (unmerged content AND no qa-handoff filed) a
+conditional offer to land the branch via the existing `/execute` Step 8 /
+qa-handoff merge-now recipe, so the rings don't file `worktree-unmerged`
+(act:9ce4dfde) — `/qa-handoff` stays the primary merge path; the background
+rings handle inventory/capture/routing after you walk away; targets 15–30s,
+never `--no-verify`; act:8bf86966), and `/qa-handoff`
 (package a worktree branch into a surfaced `qa-handoff` inbox item — what
 merged, what the worktree could NOT runtime-verify, what hangs on the next
 step — then push it to the desk's main window via `mux qa dispatch`; usually

package/templates/EXTENSIONS.md

@@ -15,6 +15,13 @@ You and Claude will make different choices for your project. These
 examples show what choices Flow made and why — not what you should do,
 but what's possible.
 
+> **Note — orient/debrief are legacy.** Watchtower is CC's default session
+> loop now; the orient/debrief skeletons used as examples below are the
+> opt-out fallback, and Flow itself has since moved to watchtower. These
+> tables are preserved as a worked example of the **phase-file extension
+> mechanism**, which applies to any skeleton skill — not as a
+> recommendation to build new work on orient/debrief.
+
 
 ## Flow's Phase File Overrides by Skill
 

package/templates/README.md

@@ -47,8 +47,8 @@ templates, see [EXTENSIONS.md](EXTENSIONS.md).
 | `skills/memory/` | Browse, search, validate, and manage built-in memory at `~/.claude/projects/<slug>/memory/`. Writing happens via /cc-remember. |
 | `skills/menu/` | Dynamically discover and display all available skills. Reads from `_index.json`. |
 | `skills/onboard/` | Conversational onboarding. Interviews you, generates briefings, wires the session loop. Re-runnable. 8 phase files. |
-| `skills/orient/` | Session start. Load context, sync data, scan work, run health checks, spawn cabinet consultations, show skills menu. 7 phase files. |
-| `skills/orient-quick/` | Quick orient variant — core phases only, skip presentation. |
+| `skills/orient/` | Session start (legacy loop — watchtower is the default). Load context, sync data, scan work, run health checks, spawn cabinet consultations, show skills menu. 7 phase files. |
+| `skills/orient-quick/` | Quick orient variant (legacy) — core phases only, skip presentation. |
 | `skills/plan/` | Structured planning with cabinet critique. Research, overlap check, draft, critique, completeness, present, file. 9 phase files. |
 | `skills/cc-publish/` | Publish workflow (CC source repo only, not shipped to consumers). |
 | `skills/pulse/` | Self-description accuracy check. Count freshness, dead references, staleness. 3 phase files. |
@@ -173,7 +173,7 @@ into your project's `.claude/` directory. The minimum viable adoption:
 
 You now have git safety and skill discovery. Add more modules as needed:
 
-- **Session loop:** `skills/orient/`, `skills/debrief/`
+- **Session loop (default):** `skills/watchtower/` + the SessionStart hook. Legacy fallback: `skills/orient/`, `skills/debrief/`
 - **Planning:** `skills/plan/`, `skills/execute/`
 - **Audit:** `skills/audit/`, `skills/pulse/`, `skills/triage-audit/`, plus `cabinet/` infrastructure and `scripts/`
 - **Cabinet members:** Copy individual `skills/cabinet-*/` directories for the experts you want

package/templates/briefing/_briefing-template.md

@@ -54,7 +54,7 @@ Template: `_briefing-cabinet-template.md`.
 
 ### `_briefing-work-tracking.md` — Work Tracking
 How the project tracks planned work — storage, query interface,
-mutation interface. Referenced by /plan, /execute, /orient, /debrief.
+mutation interface. Referenced by /plan, /execute, and the session loop.
 Template: `_briefing-work-tracking-template.md`.
 
 ### `_briefing-api.md` — API Configuration

package/templates/briefing/_briefing-work-tracking-template.md

@@ -1,7 +1,7 @@
 # Work Tracking — [Your Project Name]
 
 How this project tracks planned work. Skills that manage work items
-(/plan, /execute, /orient, /debrief) reference this file.
+(/plan, /execute, and the session loop) reference this file.
 
 ## Work Item Storage
 *Where work items live.*
@@ -27,8 +27,8 @@ already tracking. It sits quietly until you unblock it yourself.
 
 **Trigger-gated deferral** is for work waiting on an identifiable
 external condition — a dependency landing, a stack decision
-finalizing, a referenced file appearing. Every session, orient
-re-evaluates each trigger against the current session's context
+finalizing, a referenced file appearing. Every session, the session
+loop re-evaluates each trigger against the current session's context
 and surfaces items whose conditions have fired. Use
 `pib_defer_with_trigger` (or `defer-with-trigger` CLI). See
 `cabinet/pib-db-triggers.md` for the full convention.

package/templates/cabinet/_cabinet-member-template.md

@@ -26,11 +26,13 @@ briefing:
   # Add other briefing files relevant to this member's domain
   # Common: .claude/cabinet/_briefing-architecture.md, _briefing-jurisdictions.md, _briefing-api.md
 standing-mandate: audit
-  # Add plan, execute, orient, debrief if this member should activate
-  # in those contexts. Most members are audit-only. Two session-boundary
-  # contexts exist for standing advisors (watchtower installs):
-  # session-close (Ring 3's automatic transcript-fed advisor pass) and
-  # briefing (/briefing's live advisor panel).
+  # Add plan or execute if this member should activate in those contexts.
+  # Most members are audit-only. Two session-boundary contexts exist for
+  # standing advisors (watchtower is the default loop): session-close
+  # (Ring 3's automatic transcript-fed advisor pass) and briefing
+  # (/briefing's live advisor panel). The legacy orient/debrief contexts
+  # still work on projects that opted out of watchtower, but new advisors
+  # should use session-close/briefing.
 tools:
   # List every external tool/command this member uses.
   # Format: "tool-name (scope -- what it does)"
@@ -40,8 +42,9 @@ tools:
   #   - grep patterns (all projects -- dead code detection)
   # Use "tools: []" for pure-reasoning members with no tool stage.
 directives:
-  # Only if standing-mandate includes plan, execute, orient, debrief,
-  # session-close, or briefing. Each directive is a one-sentence focused
+  # Only if standing-mandate includes plan, execute, session-close,
+  # briefing, or (legacy loop) orient, debrief. Each directive is a
+  # one-sentence focused
   # task for that context. A mandate without a matching directive is a
   # data error — consumers skip the member and say so.
   # plan: >

package/templates/cabinet/memory-lifecycle-contract.md

@@ -115,6 +115,22 @@ into a corner):
   pinned/load-bearing entry files to the inbox; it never auto-applies,
   because the *gist* becomes the retrieved truth and a wrong gist erases
   a load-bearing detail.
+
+  **Evidence this verb has real work (act:421a8ab2, N5 of
+  grp:retro-remeaning):** two blind reads of the maginnis durable-memory
+  corpus (2026-07-19) found ~47-60% of sampled files involved in a hard
+  duplicate — overwhelmingly outage-recovery extractions and the
+  2026-07-14 read-pass, both bulk-written without a MEMORY.md index line
+  (region-pointer-covered instead), which made the dedup structurally
+  blind to them. `templates/scripts/memory-consolidation-scan.mjs` is the
+  dry-run PROPOSAL half of this verb, built ahead of the full Stage 2 gate:
+  it reuses the (now overlap-coefficient, dual-scored — see
+  `proposeFolds` in `watchtower-queue.mjs`) fold detector over an actual
+  memory directory's files instead of the pending inbox queue, and reports
+  candidate pairs with a `consolidated_from` pointer. It never merges or
+  writes — the human decides. Running the full MERGE half (rewriting
+  files, folding gists) is still gated on the spill-rate data per this
+  contract; the scan only proposes what the merge would act on.
 - **supersede** — mark an entry false/obsolete so retrieval stops
   surfacing it as live truth (kept on disk for audit, with a reverse
   breadcrumb in its successor). Deferred until the frontmatter-parsing