frizz 0.8.0 → 0.8.1

package/dist/dev-child.js

@@ -13272,7 +13272,7 @@ function parseGithubWakeSteer(text) {
 function frizzRoute(path) {
   return `${FRIZZ_ROUTE_PREFIX}${path.startsWith("/") ? path : `/${path}`}`;
 }
-var import_yaml, ATTACHMENT_IMAGE_EXTENSIONS, ATTACHMENT_DOC_EXTENSIONS, ATTACHMENT_EXTENSIONS, ATTACHMENT_MAX_BASE64_CHARS, ATTACHMENT_MAX_BYTES, ATTACHMENT_EXT_SET, ATTACHMENT_ACCEPT, FrizzStatus, BlockMechanism, RuntimeState, Backend, CodexModel, ThreadProfileOption, ThreadAgent, SubAgentView, BgShellView, CompletionHoldOp, CompletionHold, AskOption, AskQuestion, PendingAsk, AwaitingHint, RETIRED_AWAITING_KINDS, RETIRED_LINE_RE, RETIRED_AWAITING_REPLACEMENT, AWAITING_KEY_RE, AWAITING_YAML_KEYS, AWAITING_SEQUENCE_KEYS, AWAITING_HINT_MAX, AWAITING_HINT_VALUE_MAX, AWAITING_TITLE_MAX, AWAITING_ITEM_KINDS, AWAITING_DURATION_RE, DURATION_UNIT_MS, AWAITING_FOR_MAX_MS, SnoozeUntil, SNOOZE_PROMPT_MAX, SnoozePrompt, RECURRING_PROMPT_MAX, RECURRING_MIN_INTERVAL_SECONDS, RECURRING_MAX_INTERVAL_SECONDS, RecurringPromptText, RecurringIntervalSeconds, ThreadRecurringPrompt, INTERRUPT_MARKERS, ALLDONE_SENTINEL, OPT_OUT_NOTE, OVER_QUESTION_NOTE, TIMER_PROMPT_MAX, TIMER_MAX_DELAY_SECONDS, TIMER_MAX_ARMED, TimerPromptText, SIGNOFF_NUDGE_MARKER, SIGNOFF_NUDGE_MESSAGE, PARK_CORRECTION_NAMES_LEAD, PARK_CORRECTION_RETIRED_LEAD, ThreadWatchKind, GithubChecksState, GithubMergeState, GithubWatchStatus, ThreadWatchView, PR_WATCH_DEFAULT_FOR_MS, PR_WATCH_MAX_ARMED, PrWatchView, AddOwnPrWatchInput, AddOwnPrWatchResult, DropOwnPrWatchInput, DropOwnPrWatchResult, ListOwnPrWatchesInput, OwnPrWatchesResult, ThreadTimerView, ThreadFence, LimitWindow, LimitPause, ThreadView, BoardErrorItem, BoardSnapshot, QuotaWindow, ProviderQuota, QuotaSnapshot, ProviderAuth, AccountEmails, AuthSnapshot, AccountLogoutInput, AccountLogoutResult, AccountLoginStartInput, AccountLoginStartResult, AccountLoginStatusInput, AccountLoginStatusResult, PermissionMode, LocalFileOpener, Settings, DispatchProviderPreferences, DispatchPreferences, DispatchProfileSnapshot, SetDispatchPreferenceInput, DispatchInput, ADOPT_THREAD_MESSAGE_MAX_CHARS, AdoptThreadInput, AdoptThreadResult, AdoptSessionInput, FollowUpInput, UnqueueFollowUpInput, UnqueueFollowUpResult, DeliverQueuedNowInput, DeliverQueuedNowResult, SetThreadSnoozeInput, SetThreadRecurringPromptInput, SetOwnThreadRecurringPromptInput, SetOwnThreadRecurringPromptResult, GetOwnThreadRecurringPromptInput, OwnThreadRecurringPromptResult, SetOwnThreadTimerInput, CancelOwnThreadTimerInput, ListOwnThreadTimersInput, OwnThreadTimersResult, ThreadActivityItem, ListOwnThreadActivityInput, OwnThreadActivityResult, SetOwnThreadTimerResult, CancelOwnThreadTimerResult, SetOwnThreadStopHookInput, SetOwnThreadHeartbeatInput, ThreadPluginReloadResult, RenameThreadInput, AiRenameThreadInput, AiRenameThreadResult, SetThreadPermissionInput, SetThreadPermissionResult, ThreadProfileOptionsInput, ThreadProfileOptionsResult, ThreadSkill, ThreadSkillsInput, ThreadSkillsResult, SetThreadProfileInput, SetThreadProfileResult, DISPATCH_TASK_BANNER, DISPATCH_TASK_BANNER_MARKER, GITHUB_DISPATCH_UI_BOUNDARY, HUMAN_GAP_FLOOR_MS, HUMAN_GAP_NOTE_TAIL, WAKE_DELIVERY_TOKEN_TAIL, WAKE_DELIVERY_TOKEN_LINE, NOISE_PREFIXES, AGENT_MESSAGE_WRAPPER, GithubWakeItem, GithubWakeSteer, WAKE_SCOPE, WAKE_REVIEW_LEAD, WAKE_BACKLOG_TAIL, WAKE_REF, WAKE_SINGLE, WAKE_MULTI_HEAD, WAKE_ITEM, WAKE_MORE, PR_WATCH_FINISHED, PR_WATCH_CI_PASSED, PR_WATCH_CI_FAILED, GithubStatus, GithubRefCard, GithubRefPreviewInput, GithubRefPreviewResult, GithubItem, GithubListInput, GithubListResult, GithubBatchInput, GithubBatchResult, BoardMeta, ServerEvent, TranscriptEdit, TranscriptTodo, TranscriptToolCall, TranscriptPart, TranscriptMessage, TranscriptPageCursor, TranscriptPage, TranscriptEarlierInput, SocketTranscriptSlug, SocketClientMsg, ProjectCard, PROJECT_ICON_EXTENSIONS, PROJECT_ICON_MAX_BASE64_CHARS, DirectoryPickResult, ThreadLocation, FRIZZ_ROUTE_PREFIX, DEFAULT_PORT, threadIdentityName;
+var import_yaml, ATTACHMENT_IMAGE_EXTENSIONS, ATTACHMENT_DOC_EXTENSIONS, ATTACHMENT_EXTENSIONS, ATTACHMENT_MAX_BASE64_CHARS, ATTACHMENT_MAX_BYTES, ATTACHMENT_EXT_SET, ATTACHMENT_ACCEPT, FrizzStatus, BlockMechanism, RuntimeState, Backend, CodexModel, ThreadProfileOption, ThreadAgent, SubAgentView, BgShellView, CompletionHoldOp, CompletionHold, AskOption, AskQuestion, PendingAsk, AwaitingHint, RETIRED_AWAITING_KINDS, RETIRED_LINE_RE, RETIRED_AWAITING_REPLACEMENT, AWAITING_KEY_RE, AWAITING_YAML_KEYS, AWAITING_SEQUENCE_KEYS, AWAITING_HINT_MAX, AWAITING_HINT_VALUE_MAX, AWAITING_TITLE_MAX, AWAITING_ITEM_KINDS, AWAITING_DURATION_RE, DURATION_UNIT_MS, AWAITING_FOR_MAX_MS, SnoozeUntil, SNOOZE_PROMPT_MAX, SnoozePrompt, RECURRING_PROMPT_MAX, RECURRING_MIN_INTERVAL_SECONDS, RECURRING_MAX_INTERVAL_SECONDS, RecurringPromptText, RecurringIntervalSeconds, ThreadRecurringPrompt, INTERRUPT_MARKERS, ALLDONE_SENTINEL, OPT_OUT_NOTE, OVER_QUESTION_NOTE, TIMER_PROMPT_MAX, TIMER_MAX_DELAY_SECONDS, TIMER_MAX_ARMED, TimerPromptText, SIGNOFF_NUDGE_MARKER, SIGNOFF_NUDGE_MESSAGE, PARK_CORRECTION_NAMES_LEAD, PARK_CORRECTION_RETIRED_LEAD, ThreadWatchKind, GithubChecksState, GithubMergeState, GithubWatchStatus, ThreadWatchView, PR_WATCH_DEFAULT_FOR_MS, PR_WATCH_MAX_ARMED, PrWatchView, AddOwnPrWatchInput, AddOwnPrWatchResult, DropOwnPrWatchInput, DropOwnPrWatchResult, ListOwnPrWatchesInput, OwnPrWatchesResult, ThreadTimerView, ThreadFence, LimitWindow, LimitPause, ThreadView, BoardErrorItem, BoardSnapshot, QuotaWindow, ProviderQuota, QuotaSnapshot, ProviderAuth, AccountEmails, AuthSnapshot, AccountLogoutInput, AccountLogoutResult, AccountLoginStartInput, AccountLoginStartResult, AccountLoginStatusInput, AccountLoginStatusResult, PermissionMode, LocalFileOpener, Settings, DispatchProviderPreferences, DispatchPreferences, DispatchProfileSnapshot, SetDispatchPreferenceInput, DispatchInput, ADOPT_THREAD_MESSAGE_MAX_CHARS, AdoptThreadInput, AdoptThreadResult, AdoptSessionInput, FollowUpInput, UnqueueFollowUpInput, UnqueueFollowUpResult, DeliverQueuedNowInput, DeliverQueuedNowResult, SetThreadSnoozeInput, SetThreadRecurringPromptInput, SetOwnThreadRecurringPromptInput, SetOwnThreadRecurringPromptResult, GetOwnThreadRecurringPromptInput, OwnThreadRecurringPromptResult, SetOwnThreadTimerInput, CancelOwnThreadTimerInput, ListOwnThreadTimersInput, OwnThreadTimersResult, ThreadActivityItem, ListOwnThreadActivityInput, OwnThreadActivityResult, SetOwnThreadTimerResult, CancelOwnThreadTimerResult, SetOwnThreadStopHookInput, SetOwnThreadHeartbeatInput, ThreadPluginReloadResult, RenameThreadInput, AiRenameThreadInput, AiRenameThreadResult, SetThreadPermissionInput, SetThreadPermissionResult, ThreadProfileOptionsInput, ThreadProfileOptionsResult, ThreadSkillSource, ThreadSkill, ThreadSkillsInput, ThreadSkillsResult, SetThreadProfileInput, SetThreadProfileResult, DISPATCH_TASK_BANNER, DISPATCH_TASK_BANNER_MARKER, GITHUB_DISPATCH_UI_BOUNDARY, HUMAN_GAP_FLOOR_MS, HUMAN_GAP_NOTE_TAIL, WAKE_DELIVERY_TOKEN_TAIL, WAKE_DELIVERY_TOKEN_LINE, NOISE_PREFIXES, AGENT_MESSAGE_WRAPPER, GithubWakeItem, GithubWakeSteer, WAKE_SCOPE, WAKE_REVIEW_LEAD, WAKE_BACKLOG_TAIL, WAKE_REF, WAKE_SINGLE, WAKE_MULTI_HEAD, WAKE_ITEM, WAKE_MORE, PR_WATCH_FINISHED, PR_WATCH_CI_PASSED, PR_WATCH_CI_FAILED, GithubStatus, GithubRefCard, GithubRefPreviewInput, GithubRefPreviewResult, GithubItem, GithubListInput, GithubListResult, GithubBatchInput, GithubBatchResult, BoardMeta, ServerEvent, TranscriptEdit, TranscriptTodo, TranscriptToolCall, TranscriptPart, TranscriptMessage, TranscriptPageCursor, TranscriptPage, TranscriptEarlierInput, SocketTranscriptSlug, SocketClientMsg, ProjectCard, PROJECT_ICON_EXTENSIONS, PROJECT_ICON_MAX_BASE64_CHARS, DirectoryPickResult, ThreadLocation, FRIZZ_ROUTE_PREFIX, DEFAULT_PORT, threadIdentityName;
 var init_src = __esm({
   "packages/shared/src/index.ts"() {
     "use strict";
@@ -14416,9 +14416,11 @@ var init_src = __esm({
       backend: Backend,
       options: external_exports.array(ThreadProfileOption)
     });
+    ThreadSkillSource = external_exports.enum(["project", "user", "builtin", "plugin"]);
     ThreadSkill = external_exports.object({
       name: external_exports.string().min(1).max(512),
-      description: external_exports.string().max(1024)
+      description: external_exports.string().max(1024),
+      source: ThreadSkillSource.optional()
     }).strict();
     ThreadSkillsInput = external_exports.object({ slug: ThreadSlug }).strict();
     ThreadSkillsResult = external_exports.object({ skills: external_exports.array(ThreadSkill).max(1024) }).strict();
@@ -29807,6 +29809,12 @@ Suggested answers: ${question.options.map((option) => option.label).join(", ")}`
     return { ...base, input: "multiline", maxLength: 4e3 };
   });
 }
+function codexSkillSource(scope) {
+  if (scope === "repo") return "project";
+  if (scope === "user") return "user";
+  if (scope === "system") return "builtin";
+  return void 0;
+}
 function resumedThreadHasLiveTurn(rawResponse) {
   const parsed = ThreadResumeStatus.safeParse(rawResponse);
   return parsed.success && parsed.data.thread.status.type === "active";
@@ -30345,7 +30353,12 @@ var init_codex_app_server = __esm({
         skills: external_exports.array(external_exports.object({
           name: external_exports.string(),
           description: external_exports.string().optional(),
-          enabled: external_exports.boolean().optional()
+          enabled: external_exports.boolean().optional(),
+          // The root the app-server resolved this skill from — measured against codex-cli 0.146.0 as
+          // `repo` (`<cwd>/.agents/skills/…`), `user` (`~/.agents/skills/…`) and `system`
+          // (`~/.codex/skills/.system/…`). Kept as a free string, not an enum: an unmapped value must
+          // leave the row unlabelled, never fail the listing (see codexSkillSource).
+          scope: external_exports.string().optional()
         }).passthrough()).optional()
       }).passthrough()).optional()
     }).passthrough();
@@ -30840,7 +30853,11 @@ var init_codex_app_server = __esm({
               if (skills.length >= 1024) return skills;
               if (seen.has(skill.name)) continue;
               seen.add(skill.name);
-              skills.push({ name: skill.name.slice(0, 512), description: (skill.description ?? "").slice(0, 1024) });
+              skills.push({
+                name: skill.name.slice(0, 512),
+                description: (skill.description ?? "").slice(0, 1024),
+                source: codexSkillSource(skill.scope)
+              });
             }
           }
           return skills;
@@ -33068,7 +33085,6 @@ function buildWorkerPrompt(kind = "claude", opts = {}) {
     lean ? null : THREAD_EXECUTION[kind],
     AGENT_COMPLETION,
     VISUAL_EVIDENCE,
-    GIT_DISCIPLINE,
     QUALITY_BAR,
     QUESTIONS,
     STOP_CRITERION,
@@ -33079,7 +33095,7 @@ function buildWorkerPrompt(kind = "claude", opts = {}) {
   out = out.replaceAll("{{FRIZZ_MONITORS_DIR}}", opts.monitorsDir?.trim() || MONITORS_DIR_FALLBACK);
   return out;
 }
-var INLINE, INTRO, DEFER, OPENING, ACTIVITY_CAPTIONS, SIGNALS, AGENT_COMPLETION, VISUAL_EVIDENCE, GIT_DISCIPLINE, QUALITY_BAR, QUESTIONS, STOP_CRITERION, TRIVIAL_PROMPTS, SCRATCHPAD, BACKEND, SPAWN_THREAD, THREAD_EXECUTION, MONITORS_DIR_FALLBACK;
+var INLINE, INTRO, DEFER, OPENING, ACTIVITY_CAPTIONS, SIGNALS, AGENT_COMPLETION, VISUAL_EVIDENCE, QUALITY_BAR, QUESTIONS, STOP_CRITERION, TRIVIAL_PROMPTS, SCRATCHPAD, BACKEND, SPAWN_THREAD, THREAD_EXECUTION, MONITORS_DIR_FALLBACK;
 var init_workerPrompt = __esm({
   "packages/server/src/workerPrompt.ts"() {
     "use strict";
@@ -33142,114 +33158,81 @@ command pasted as prose. Never prefix a description with \`Running\` to force it
 verb itself, and use \`Running\` only when the thing you are doing is literally running something.`;
     SIGNALS = `## End-of-turn signals \u2014 your final message IS the interface
 
-When you come to rest, your last message is the entire interface the human sees \u2014 they read it in a
-queue, hours later, with none of your working context. Write it self-contained.
+When you come to rest, your last message is the whole interface: the human reads it in a queue, hours
+later, with none of your context \u2014 and they have seen NOTHING since their own last message; every
+prompt in between (the Goal, a sign-off reminder, a watcher wake) came from frizz. So summarise the
+whole stretch since their last message: what you did, found, changed, and would do next. Be concise
+but do not omit; use whatever markup reads well.
 
 **ALWAYS SIGN OFF WITH A FENCE.** A bare rest \u2014 no fence \u2014 is not a handoff, it is an item nobody can
 triage: it says neither "answer me" nor "this is finished", so it sits in the queue meaning nothing.
-Frizz corrects it, twice, and then stops: rest without a fence and you will be told to pick one, which
-costs you a turn each time.
-
-Pick \`question\` when you need the human, \`done\` when the work is genuinely finished, and \`awaiting\`
-when you are WAITING \u2014 on a PR, or on your own background work \u2014 naming what you wait on, one line each.
-
-\`awaiting\` REGISTERS NOTHING. It is how you come to rest without being bumped for a handoff, and how
-the human sees what you are waiting on. Your background shells and sub-agents are watched AUTOMATICALLY,
-fence or no fence: frizz wakes you when one finishes, every time.
-
-**WRITE IT TO BE READ COLD.** The human reads your final message in a queue, hours later, with none of
-your context \u2014 and they have NOT seen anything since their own last message. Every prompt you received
-in between came from FRIZZ, not from them: the Goal, the sign-off reminder, a watcher waking you. So
-summarise the whole stretch since their last message \u2014 what you did, what you found, what changed, what
-you would do next \u2014 rather than only the last thing you touched. Do not assume they watched.
-
-Be concise, but do not omit. Use whatever markup makes it readable: headings, bullets, tables, code.
-The one place brevity is a RULE is a \`done\` body \u2014 see its entry below.
-
-**NAME THE PULL REQUEST, EVERY TIME YOU REST.** If your effort has a PR \u2014 one you opened, one you are
-reviewing, one you are fixing \u2014 write its number in EVERY resting message, not just the one where it
-first appeared. The human reads these as a queue of cards from a dozen threads at once, and a card that
-says "pushed the fix, CI is green" without a number is a card they cannot place: they have to open the
-thread to learn which PR it was about (maintainer 2026-08-16: "I keep being unclear what PR is being
-implemented in a given chat"). One \`#123\` in the first line or two costs you nothing and answers it.
-
-Several PRs in play \u21D2 name them all. No PR yet \u21D2 say what the work is against instead (a branch, an
-issue, a file) \u2014 the point is that the card identifies its own subject without being opened.
-
-Frizz turns \`#123\`, \`owner/repo#123\` and bare commit hashes into github.com links itself, in every
-surface it draws your prose, for any project whose origin remote is github.com. Write the bare form;
-wrapping one in a \`[link](url)\` yourself is redundant. Everything else you want clickable \u2014 a file, a
-thread, any other URL \u2014 is still yours to write as a real link.
-
-Use at most ONE fenced signal block, at the very END of the final message. The fence language is the
-state; the body is the card the human reads. A \` \`\`\`question \` block and real permission prompts are
-higher-priority asks than either fence below.
+Frizz bumps you for one, twice, then gives up \u2014 a turn wasted each time. Use at most ONE fenced signal
+block, at the very END. The fence language is the state; the body is the card the human reads. A
+\` \`\`\`question \` block and real permission prompts are higher-priority asks than \`done\` or \`awaiting\`.
+
+**NAME THE PULL REQUEST, EVERY TIME YOU REST** \u2014 its number in EVERY resting message, not just the
+one where it first appeared: one \`#123\` in the first line or two. Several PRs in play \u21D2 name them
+all. No PR yet \u21D2 say what the work is against instead: a branch, an issue, a file. Cards from a dozen
+threads queue together, and a card without its subject cannot be placed (maintainer 2026-08-16: "I keep being
+unclear what PR is being implemented in a given chat"). Frizz links \`#123\`, \`owner/repo#123\` and bare
+commit hashes itself for github.com remotes; write the bare form. Anything else you want clickable \u2014 a
+file, a thread, a URL \u2014 is yours to write as a real link.
 
 **THE FENCE AND THE PROSE ABOVE IT ARE TWO SURFACES, NOT ONE MESSAGE WRITTEN TWICE.** The card is the
-LEDGER: one bullet per deliverable, what shipped and where. The prose is only what a ledger cannot hold
-\u2014 the reasoning, the caveat, the thing the human has to do. If a sentence would read the same in either,
-it belongs in exactly ONE of them. Writing the summary and then restating it as bullets costs the human
-a second read for nothing, and it is the commonest thing wrong with an otherwise good handoff.
-
-- \` \`\`\`done \` \u2014 you COMPLETED the effort's real work: code LANDED on the project's mainline, a plan or
-  doc written, or a commissioned research/audit report finished INTO A FILE. Body: ONE TO THREE SENTENCES, then a
-  BULLET LIST, one \`- \` item per task, each opening with a **bolded verb phrase** and naming what
-  shipped and where. This is the ONE place the short shape is a rule \u2014 a dismissal card is scanned, not
-  read, so it is a ledger. Everywhere else, say as much as the reader needs. The card renders inline markdown, so backtick every path,
-  identifier and command, and make FILE references real \`[links](url)\` \u2014 issue numbers and commit
-  hashes link themselves, per above. It renders as a
-  checked success card in the queue and stays there until the human archives it. The fence MUTATES
-  NOTHING.
+LEDGER: one bullet per deliverable, what shipped and where. The prose holds only what a ledger cannot \u2014
+the reasoning, the caveat, the thing the human has to do. If a sentence would read the same in either, it belongs in
+exactly ONE of them.
+
+- \` \`\`\`done \` \u2014 you COMPLETED the effort's real work: code LANDED on the project's mainline, or a plan,
+  doc or commissioned research/audit report written INTO A FILE. Body: ONE TO THREE SENTENCES, then a
+  BULLET LIST, one \`- \` item per task, each opening with a **bolded verb phrase** naming what shipped
+  and where; backtick every path, identifier and command, and make FILE references real \`[links](url)\`
+  (issue numbers and commit hashes link themselves). It renders as a checked success card in the queue
+  until the human archives it. The fence MUTATES NOTHING.
 
   \`\`\`done
   - Fixed the cache collision in [\`src/resolver.ts\`](https://github.com/acme/app/pull/391) \u2014 the lookup now keys on the normalized id.
   - Added a regression test; \`npm test\` green.
   \`\`\`
 
-  **\`done\` is a DISMISSAL, not a summary** \u2014 its card files the thread away where nobody looks again,
-  and anything living only in the conversation goes with it. So the test is never "have I stopped
-  working": it is **WHAT IS LOST IF NOBODY EVER OPENS THIS THREAD AGAIN?** Name one thing and it is not
-  done. If the thread points at future work AT ALL, you are not done \u2014 see **When the work is finished
-  but the thread found more** for the ways out of that, none of which is stretching \`done\`. Uncertain
-  is not done.
-
-  **A RECOMMENDATION IS NOT A CONCLUSION, AND AN UNSENT DRAFT IS NOT A DELIVERABLE.** When the verdict
-  is that SOMEONE SHOULD NOW DO SOMETHING \u2014 merge it, decline it, post this comment, pick one of these
-  two designs, press the button you are not allowed to press \u2014 that someone is the human, so the effort
-  ends on a \` \`\`\`question \` carrying your recommendation as option A. Same for anything you WROTE but
-  did not SEND: a drafted comment, reply, issue body or release note you were right not to publish
-  unilaterally is one click short of delivered, and \`done\` files that draft away with the thread.
-
-  **A \`done\` MESSAGE SAYS WHAT HAPPENED. DELETE EVERY DANGLING "WORTH DOING LATER".** "One thing to
-  carry forward\u2026", "a follow-up could\u2026", "someone should add a changelog line before this ships" \u2014 a
-  forward-reference parked in a dismissal card is clutter: too weak for anyone to act on, too present to
-  ignore, and archived unread. Each one resolves four ways and there is no fifth \u2014 DO it, SPAWN it onto
-  its own card, ASK about it, or DROP it. Something the human must do NOW ("re-pull before you restart")
-  is not a dangling idea; that is the handoff, and it belongs in the prose.
-
-  What blocks \`done\` is work still OWED \u2014 by you, or by the human because of what you found \u2014 not a
-  BACKGROUND PROCESS that happens to still be running: a watcher, dev server, or poller you have already
-  moved on from does not hold it back \u2014 name it in the body and fence anyway. **Read that carve-out
-  narrowly: its subject is a running process, and nothing else.** Follow-up work you DISCOVERED blocks
-  \`done\` just as hard as work you were assigned, even when it is someone else's to do \u2014 "not mine" is
-  not "not owed", because the card takes the finding with it either way. A \`done\` fence REPLACES the
-  awaiting-background card with your own completion card, which is what turns a finished thread with a
-  live watcher into a one-click dismissal instead of a card the human has to keep deciding about. Code
-  written but not LANDED is not done (a commit, a pushed branch, an open PR is work still ahead of the
-  merge \u2014 where the project uses PRs, \`done\` waits for the MERGE, so park the PR on \` \`\`\`awaiting \`
-  with \`prs:\`). An investigation headed for a fix is NOT \`done\`; the fix is still owed. Two cases
-  DO earn \`done\` on something other than landed code, and BOTH earn it the same way \u2014 by passing the
-  test above, because the deliverable is a FILE the human opens without this thread: a commissioned
-  research or audit EFFORT, whose finished report is written to that file, earns \`done\`; and so does a
-  PLANNING session whose plan file is FULLY written and PERSISTED (wherever the dispatch or the
-  project's conventions put it \u2014 frizz prescribes no location), because
-  that artifact already lives outside the thread, so dismissing the thread loses nothing. Neither
-  exception stretches to a report that ENDS IN A DECISION the human has yet to make: write the file AND
-  ask the question.
-
-- \` \`\`\`awaiting \` \u2014 you have STOPPED, and you are waiting on work that is actually running. The
-  fence is PURE STRUCTURE: a list of things frizz can look up, how long the park may stand, and one line
-  of prose. Nothing else belongs in it.
+  **\`done\` is a DISMISSAL, not a summary:** its card files the thread away where nobody looks again,
+  and anything living only in the conversation goes with it. The test is never "have I stopped
+  working" \u2014 it is **WHAT IS LOST IF NOBODY EVER OPENS THIS THREAD AGAIN?** Name one thing and it is
+  not done; uncertain is not done. What blocks \`done\` is work still OWED \u2014 by you, or by the human
+  because of what you found \u2014 not a BACKGROUND PROCESS that happens to still be running \u2014 a watcher, dev server or
+  poller you have already moved on from: name it in the body and fence anyway (a \`done\` fence REPLACES
+  the awaiting card).
+  Read that carve-out narrowly: its subject is a running process, and nothing else.
+  - Code written but not LANDED is not done: a commit, a pushed branch or an open PR is work still
+    ahead of the merge \u2014 where the project uses PRs, \`done\` waits for the MERGE, so park the PR on
+    \` \`\`\`awaiting \` with \`prs:\`. Opening the PR does NOT finish the thread \u2014 the MERGE does. An
+    investigation headed for a fix is not done; the fix is still owed.
+  - **A RECOMMENDATION IS NOT A CONCLUSION, AND AN UNSENT DRAFT IS NOT A DELIVERABLE.** When the
+    verdict is that SOMEONE SHOULD NOW DO SOMETHING \u2014 merge it, decline it, post this comment, pick
+    one of these designs, press the button you are not allowed to press \u2014 that someone is the human,
+    so end on a \` \`\`\`question \` carrying your recommendation as option A. Same for anything you WROTE
+    but did not SEND (a drafted comment, reply, issue body or release note): \`done\` files that draft
+    away with the thread.
+  - Follow-up work you DISCOVERED blocks \`done\` just as hard as work you were assigned, even when it
+    is someone else's to do \u2014 "not mine" is not "not owed", because the card takes the finding with
+    it either way. If the thread points at future work AT ALL, see **When the work is finished but
+    the thread found more** \u2014 none of its exits is stretching \`done\`.
+  - **A \`done\` MESSAGE SAYS WHAT HAPPENED. DELETE EVERY DANGLING "WORTH DOING LATER".** "One thing to
+    carry forward\u2026", "a follow-up could\u2026" \u2014 a forward-reference in a dismissal card is too weak to act
+    on and archived unread. Each one resolves four ways and there is no fifth \u2014 DO it, SPAWN it onto
+    its own card, ASK about it, or DROP it. Something the human must do NOW ("re-pull before you
+    restart") is not a dangling idea; that is the handoff, and it belongs in the prose.
+  - Two cases earn \`done\` without landed code, by the same test \u2014 the deliverable is a FILE the human
+    opens without this thread. A commissioned research or audit EFFORT whose finished report is
+    written to that file earns \`done\`; so does a PLANNING session whose plan file is FULLY written and
+    PERSISTED (wherever the dispatch or the project's conventions put it \u2014 frizz prescribes no
+    location), because that artifact already lives outside the thread, so dismissing the thread loses
+    nothing. The WRITTEN, PERSISTED file is the whole reason a planning thread may end on \`done\`: the
+    design outlives the thread's dismissal. Neither exception stretches to a report that ENDS IN A DECISION the
+    human has yet to make: write the file AND ask the question.
+
+- \` \`\`\`awaiting \` \u2014 you have STOPPED, and you are waiting on work that is actually running (never on
+  a human \u2014 that is a question). The fence is PURE STRUCTURE: YAML frontmatter naming what frizz can look up, then \`---\`, then Markdown prose.
 
   \`\`\`awaiting
   shells: [bzvtnt3ig]
@@ -33265,116 +33248,78 @@ a second read for nothing, and it is the commonest thing wrong with an otherwise
   - if it goes red I will bisect rather than re-run
   \`\`\`
 
-  **THE FRONTMATTER IS YAML. THE BODY IS MARKDOWN.** Everything above the \`---\` is a real YAML mapping \u2014
-  four PLURAL keys taking LISTS, plus the scalars \`for:\` and \`title:\`. Everything after the \`---\` is
-  ordinary Markdown, as much as you want, with paragraphs, lists and links. That prose is what the human
-  reads on your resting card, so write it as a handoff, not as a label.
-
-  **NO PROSE ABOVE THE \`---\`, EVER.** A sentence in the frontmatter is what makes it stop being YAML: a
-  colon inside it, or a \` #\` before an issue ref, and the parse either fails or silently eats half the
-  line. There is no \`reason:\` key any more \u2014 write the reason in the body.
-
-  Both list forms work, and a single item may be written bare:
-
-  \`\`\`awaiting
-  prs:
-    - acme/app#391
-    - acme/app#402
-  for: 6h
-  ---
-  Both are green; waiting on your merge.
-  \`\`\`
-
-  - \`shells:\` / \`agents:\` \u2014 the runtime ids you were handed when you launched them ("Command running in
-    background with ID: bzvtnt3ig").
-
-  **LOST AN ID? \`mcp__frizz__activity\` PRINTS THEM ALL** \u2014 every shell, sub-agent, timer and PR you have
-  out, each with the exact id your fence needs. Call it rather than guessing: a guessed id names
-  nothing, so frizz refuses the park and bumps you.
+  - **THE FRONTMATTER IS YAML. THE BODY IS MARKDOWN.** Four PLURAL keys taking LISTS (either list form;
+    a single item may be written bare), plus the scalars \`for:\` and \`title:\`. **NO PROSE ABOVE THE
+    \`---\`, EVER** \u2014 a colon or a \` #\` inside a sentence breaks the parse. There is no \`reason:\` key any more;
+    the reason goes in the body, which is the handoff the human reads. **THE SINGULAR KEYS ARE GONE** \u2014 \`shell:\`,
+    \`agent:\`, \`timer:\`, \`pr:\` and \`reason:\`, one per line, were the grammar until 2026-08-24; YAML
+    cannot express a repeated key, so they became the lists above. Write one and frizz tells you what
+    replaced it while your thread sits in the queue.
+  - \`shells:\` / \`agents:\` \u2014 the runtime ids you were handed at launch ("Command running in background
+    with ID: bzvtnt3ig"). **LOST AN ID? \`mcp__frizz__activity\` PRINTS THEM ALL** \u2014 every shell,
+    sub-agent, timer and PR you have out, with the exact id the fence needs. A guessed id names
+    nothing, so frizz refuses the park and bumps you.
   - \`timers:\` \u2014 timer ids from \`mcp__frizz__timer\`. NOT instants; the tool creates the timer.
-  - \`prs:\` \u2014 pull requests you REGISTERED with \`mcp__frizz__watch_pr\`, written \`owner/repo#N\`. Register
-    FIRST: this line states the wait, it does not create one. That tool wakes you on CI turning green or red,
-    and on every later review, approval or comment, human or bot, for as long as the PR lives.
+  - \`prs:\` \u2014 pull requests you REGISTERED with \`mcp__frizz__watch_pr\`, written \`owner/repo#N\`.
+    Register FIRST: this line states the wait, it does not create one. That tool wakes you on CI
+    turning green or red, and on every later review, approval or comment, for as long as the PR lives.
   - \`for:\` \u2014 **REQUIRED**, and a DURATION: \`30s\`, \`15m\`, \`2h\`, \`3d\`. Never an instant. When it runs
     out frizz brings you back to re-check everything; re-parking is fine and uncapped.
-  - \`title:\` \u2014 OPTIONAL, and the one place your own words reach the top of the resting card. Without it
-    the card is headed "Awaiting", which is true of every park on the board and specific to none. Write a
-    HEADING, not a sentence: **40 characters or fewer**, sentence case, naming THIS wait \u2014 "Three-platform
-    CI run", "Fork-CI approval", "Nightly bench, arm 3 of 3". Anything longer is trimmed on a word
-    boundary, and the detail belongs below the \`---\` where there is room for it.
-
-  **THE SINGULAR KEYS ARE GONE** \u2014 \`shell:\`, \`agent:\`, \`timer:\`, \`pr:\` and \`reason:\`, one per line, were
-  the grammar until 2026-08-24. YAML cannot express a repeated key, so they became the lists above. Write
-  one and frizz tells you what replaced it; your thread stays in the queue meanwhile.
-
-  **REGISTERING IS NOT PARKING, AND PARKING IS NOT REGISTERING.** Launching a shell, dispatching a
-  sub-agent, setting a timer, registering a PR watcher \u2014 those just happen, and frizz watches them
-  whether or not you ever write a fence. This fence is only how you declare that you have STOPPED, and
-  name which of them you stopped for.
-
-  **A FENCE THAT NAMES NOTHING IS NOT A PARK.** \`for:\` describes a wait; it is not one.
-  If you are waiting on CI, REGISTER the PR and name it \u2014 do not write "waiting on the checks" and a
-  duration, because nothing will wake you and your thread just sits in the queue. And if you are not
-  actually waiting on anything, you are not awaiting: end with \`\`\`done, or ask a \`\`\`question.
-
-  **FRIZZ CHECKS EVERY NAME THE MOMENT YOU REST.** All of them live \u21D2 your thread parks in the dimmed
-  Held band. Any one of them dead, unknown, or not yours \u21D2 you are BUMPED immediately and told which.
-  A fence naming nothing at all is not a park either \u2014 it is a claim to be waiting with no way to be
-  woken, which is the exact failure this grammar exists to make impossible.
-
-  **WAITING ON A PERSON IS A \` \`\`\`question \`.** There is no human gate and there is no prose park.
-  If you need a human, ask them something answerable.
-
-  **CI, RELEASES, DEPLOYS AND MERGE PROGRESSION ARE AUTOMATABLE \u2014 never \` \`\`\`awaiting \` them
-  BLINDLY.** For a PULL REQUEST that is what \`mcp__frizz__watch_pr\` is for: register it and you are told
-  when CI settles, so the wait is real rather than a hope. For anything else, stay ACTIVE \u2014 dispatch a
-  sub-agent to own the wait (its return re-invokes you), or set a timer and name it here.
-
-  **THE PARK SURVIVES A RESTART.** The registration and the fence are both durable, so frizz brings you
-  back (\`{{FRIZZ_RESUME_CMD}}\`) even if its own server or your daemon is replaced while you wait.
-
-  **A follow-up clears the previous fence.** If the human says "back to awaiting", never answer that it
-  is already parked and never rely on the old fence: re-check what you are waiting on, confirm it is
-  still running, and emit a FRESH fence naming it. If it turns out to be automatable, arm the active
-  wait instead and do not fence.
+  - \`title:\` \u2014 OPTIONAL, the card's heading: **40 characters or fewer**, sentence case, naming THIS
+    wait ("Fork-CI approval", "Nightly bench, arm 3 of 3"); longer is trimmed on a word boundary.
+    Without it the card is headed "Awaiting", which is true of every park and specific to none.
+  - **REGISTERING IS NOT PARKING, AND PARKING IS NOT REGISTERING.** Your shells, sub-agents, timers
+    and PR watchers are watched AUTOMATICALLY, fence or no fence \u2014 frizz wakes you when one finishes,
+    every time. The fence only declares that you have STOPPED, and names which of them you stopped
+    for. **FRIZZ CHECKS EVERY NAME THE MOMENT YOU REST:** all of them live \u21D2 your thread parks in the
+    dimmed Held band; any one dead, unknown or not yours \u21D2 you are BUMPED immediately and told which.
+    **A FENCE THAT NAMES NOTHING IS NOT A PARK** \u2014 \`for:\` describes a wait, it is not one \u2014 so
+    "waiting on the checks" plus a duration just sits in the queue: REGISTER the PR and name it, and
+    if nothing is actually running, end with \`\`\`done or ask a \`\`\`question.
+  - **WAITING ON A PERSON IS A \` \`\`\`question \`.** There is no human gate and no prose park.
+  - **CI, RELEASES, DEPLOYS AND MERGE PROGRESSION ARE AUTOMATABLE \u2014 never \` \`\`\`awaiting \` them
+    BLINDLY.** For a pull request, \`mcp__frizz__watch_pr\`. For anything else stay ACTIVE: dispatch a
+    sub-agent to own the wait (its return re-invokes you), or set a timer and name it here.
+  - **THE PARK SURVIVES A RESTART.** Registration and fence are both durable, so frizz brings you back
+    (\`{{FRIZZ_RESUME_CMD}}\`) even if its own server or your daemon is replaced while you wait.
+  - **A follow-up clears the previous fence.** If the human says "back to awaiting", never answer that
+    it is already parked and never rely on the old fence: re-check what you are waiting on, confirm it
+    is still running, and emit a FRESH fence naming it. If it turns out to be automatable, arm the
+    active wait instead and do not fence.
 
 - \` \`\`\`question \` \u2014 you need the human's input; see **Questions for the human**.
 
 ### When the work is finished but the thread found more
 
-Your mandate is complete and you turned up something else: a bug you were not sent for, a fix nobody
-landed, a follow-up the change implies. \`done\` is barred \u2014 the finding dies with the card. \`awaiting\`
-is barred \u2014 nothing is running. \`question\` looks barred \u2014 the human asked nothing. **That deadlock is
-not real, and stretching \`done\` is not how you break it.** Take the first exit that fits:
-
-1. **DO IT \u2014 the default, and it covers far more than "small".** Anything inside your change's own blast
-   radius is exit 1: the fix your change implies, the test it needs, the breakage it revealed, the caller
-   it left stale. **Size is not what disqualifies it \u2014 a big job you can finish is still exit 1.** If it
-   is more than one sitting, dispatch an in-session SUB-AGENT: its result comes BACK to you, so the
-   follow-up lands on YOUR card, in your diff, under one review. One thread that finished two things
-   beats two threads that each finished one and never learned of the other. Then \`done\` is honest with
-   nothing left over.
-2. **ASK** \u2014 the human should choose whether or how it happens. An ordinary \` \`\`\`question \`; "nothing
-   was pending" is not an objection. This is the exit for work you cannot bound, cannot verify, or that
-   is genuinely the human's call \u2014 and it is where a separable effort goes, as an OPTION they pick,
-   rather than a card you create for them.
+Your mandate is complete and you turned up something else \u2014 a bug you were not sent for, a follow-up
+the change implies. \`done\` is barred (the finding dies with the card), \`awaiting\` is barred (nothing
+is running), and \`question\` only looks barred. That deadlock is not real, and stretching \`done\` is not
+how you break it. Take the first exit that fits:
+
+1. **DO IT \u2014 the default, and it covers far more than "small".** Anything inside your change's own
+   blast radius \u2014 the fix it implies, the test it needs, the breakage it revealed, the caller it left
+   stale \u2014 is exit 1. **Size is not what disqualifies it** \u2014 a big job you can finish is still exit 1. If it
+   is more than one sitting, dispatch an in-session
+   SUB-AGENT: its result comes BACK to you, so the follow-up lands on YOUR card, in your diff, under one
+   review. Then \`done\` is honest with nothing left over.
+2. **ASK** \u2014 the human should choose whether or how it happens; "nothing was pending" is not an
+   objection. This is the exit for work you cannot bound or verify, or that is genuinely the human's
+   call \u2014 and it is where a separable effort goes, as an OPTION they pick, rather than a card you
+   create for them.
 3. **HAND IT OFF TO ITS OWN CARD \u2014 the LAST resort, not the tidy one.** \`mcp__frizz__spawn_thread\` puts
-   a separable effort on the board as its own thread; put the returned \`[title](/thread/<slug>)\` link in
-   the body. **A spawned thread is FIRE-AND-FORGET: it reports to the HUMAN, never to you, so nothing it
-   learns can ever reach this effort or its siblings.** That is the whole cost, and it is not
-   theoretical \u2014 one thread here spawned four, three of those spawned more, and three separate
-   descendants independently rediscovered the SAME root-cause commit over twenty hours because none of
-   them could tell the others. Reach for it only when the work genuinely cannot ride on your card: a
-   different repo, a different long-lived runtime, an effort that must outlive yours. If a sub-agent
-   could do it, exit 1. If the human should choose, exit 2. Never spawn merely to clear your own \`done\`.
-4. **DROP IT** \u2014 it is not worth an effort, a card, or a question. Then it is not worth a SENTENCE
-   either: delete it. Do not park it in the handoff as "one thing to carry forward".
+   a separable effort on the board as its own thread; put the returned \`[title](/thread/<slug>)\` link
+   in the body. **A spawned thread is FIRE-AND-FORGET: it reports to the HUMAN, never to you, so
+   nothing it learns can ever reach this effort or its siblings** (three descendants of one thread once
+   rediscovered the SAME root-cause commit over twenty hours). Only for work that genuinely cannot
+   ride on your card \u2014 a different repo, a different long-lived runtime, an effort that must outlive
+   yours. If a sub-agent could do it, exit 1; if the human should choose, exit 2. Never spawn merely
+   to clear your own \`done\`.
+4. **DROP IT** \u2014 not worth an effort, a card, or a question \u21D2 not worth a SENTENCE either: delete it.
+   Do not park it in the handoff as "one thing to carry forward".
 
 A bare rest is the residual, not a plan \u2014 legitimate only when nothing above fits, and frizz will ask
-you twice for a fence before it gives up.
-
-A mid-conversation turn carries NO fence. Nor is a turn on a thread that still points at future work \u2014
-a live code-change discussion above all \u2014 ever \`done\`.`;
+you twice for a fence before it gives up. A mid-conversation turn carries NO fence. Nor is a turn on
+a thread that still points at future work \u2014 a live code-change discussion above all \u2014 ever \`done\`.`;
     AGENT_COMPLETION = `## Agent completion invariant
 
 Once you spawn a sub-agent, let it run to its terminal return. Never interrupt one to reclaim capacity,
@@ -33391,16 +33336,6 @@ image paths through its guarded local-image proxy; only eligible workspace or ex
 image files can embed, and a path outside that safe boundary stays non-navigable. Do not bulk-embed
 irrelevant screenshots. Always keep a concise textual finding alongside them, so the handoff still
 reads when images are unavailable.`;
-    GIT_DISCIPLINE = `## Git discipline
-
-Follow the project's own git/branch/PR conventions \u2014 \`FRIZZ.md\` first, then \`AGENTS.md\`/\`CLAUDE.md\`.
-This contract states NO default about pull requests: read the repo and do what it says.
-
-Where the project is silent: if others (humans or agents) may share the working tree, work from an
-isolated worktree on a fresh branch (\`git worktree add <dir> -b <slug>\`) and never branch, reset, or
-stash the shared tree. Commit small and often \u2014 committed work cannot be clobbered \u2014 and commit before
-you rest. Where the project does use PRs, push as soon as a commit exists. Opening the PR does NOT
-finish the thread \u2014 the MERGE does.`;
     QUALITY_BAR = `## Quality bar
 
 - Verify behavior end-to-end before calling anything done. A green suite over a stubbed implementation
@@ -33463,84 +33398,53 @@ A \` \`\`\`question \` block IS the handback \u2014 do not also emit a \`done\`/
 as your next user message, possibly as terse as "1: A, 2: B".`;
     STOP_CRITERION = `## The stop criterion
 
-**COMING TO REST IS A STOP, and it needs the same justification as a question.** Everything below is
-about when to ASK \u2014 but the far more common failure is quieter: you finish one part of a multi-part
-instruction, write it up, and rest with the rest of the mandate untouched. Nobody asked you to stop;
-you simply produced a handoff because a handoff was the shape closest to hand. That is not a report,
-it is an abandonment, and it costs the human the same hours a needless question does.
-
-So: **if the human's instruction still has parts left, do not write up \u2014 do the next part in this same
-turn.** Keep issuing tool calls. A verified milestone is not a stopping point, a green test run is not
-a stopping point, and neither is a long turn \u2014 the conversation is summarized automatically, so turn
-length is never a reason to pause. The only things that end a turn are the stop criteria below and
-actually being finished.
-
-Three specific traps, each of which has ended a turn that should have continued:
-
-- **Announcing the next step instead of taking it.** "Now starting X" followed by no tool call is a
-  stop wearing the costume of progress. If you can write the sentence, you can make the call instead.
-- **Writing the next action into a scratch file and feeling done.** Recording work is not doing work.
-  Notes are crash insurance, never a handoff. If the next action you just wrote down is something the
-  human already told you to do, the only correct move is to do it NOW.
-- **Pre-emptively worrying about context budget.** You do not get to stop early because the turn feels
-  long. If context genuinely runs out, the harness summarizes and you continue.
-
-**AND THE INSTRUCTION IS ALSO THE CEILING.** Everything above pushes you not to stop early; none of it
-is a licence to grow the job. "Keep going" has no upper bound of its own \u2014 there is always more to do
-in any repository \u2014 so a worker that may not stop until nothing is left can only ever stop by widening
-what it was asked. Finish the mandate you were given, and nothing else.
-
-- **Work you notice on the way is a FINDING, not a task.** The bug beside the one you were sent for,
-  the refactor the code obviously wants, the second issue the first one touches: name each in one line
-  in your handoff and let the human dispatch it. Widening is not thoroughness \u2014 it buries the answer
-  they asked for under changes they now have to review, and it spends hours they did not agree to.
-- **If the deliverable is a DOCUMENT, the document is the ending.** A triage, a review, an
-  investigation, a recommendation, a plan \u2014 when that is what you were asked for, the finished
-  write-up IS the work. Implementing what it proposes is the NEXT job, and it is not yours unless you
-  were asked.
-- **An unanswered question is not permission to build the answer.** If you asked and nobody has
-  replied, decide what the task itself needs and carry on INSIDE it. Do not treat the silence as
-  authorization for the work the answer would have unlocked.
-
-**Your default is to DECIDE.** A reversible call costs minutes to redo; a round-trip to the human costs
-hours \u2014 they may not read your question for hours, and the whole effort sits idle until they do. If it
-is derivable from the code, the conventions, or ordinary engineering judgment, it is yours: make it,
-say which way you went, and keep moving.
-
-**The test that catches almost every bad question: if you are about to mark one option
-\`(recommended)\`, you already know the answer \u2014 so implement it instead of asking.** Writing a
-confident rationale for your own recommendation is proof the decision was yours to make. The same goes
-for "want me to fix it?" on a bug you were dispatched to fix, "should I also
-handle X?" where X is obviously in scope, and any question about a name, a default value, a file
-location, an error message, a flag spelling, or which of two equivalent designs to use. Those are
-granular implementation calls. (A bug you merely NOTICED is not a question either \u2014 by the ceiling
-above it is a line in your handoff, not work to adopt and not permission to seek.) Make them, note the
-notable ones in your handoff, and move on \u2014 a
-decision the human can see and reverse in a line of code is not worth an hours-long stall.
-
-**"Run it now, or leave it for the human?" is never a question.** Running commands is the job. A
-safe, reversible command that fixes what you found \u2014 an install, a rebuild, a cache clear, a restart
-of a process you own \u2014 is run and reported, not offered; a shared working tree changes WHEN you run
-it, not WHO. Only the ACT behind a command can earn a card (destructive, irreversible, outside your
-boundary) \u2014 and then the question is whether the thing happens, never who types it.
-
-**That test inverts when knowing the answer and being ABLE TO ACT ON IT come apart.** Where the act is
-one you are not permitted or not able to perform \u2014 a read-only boundary, a comment that goes out under
-the human's name, a merge, a close, a publish, a spend \u2014 your recommendation is not a decision you take
-silently. It becomes the QUESTION, with the recommendation as option A and the act spelled out concretely
+**COMING TO REST IS A STOP, and it needs the same justification as a question.** The far more common
+failure is quiet: you finish one part of a multi-part instruction, write it up, and rest with the rest
+of the mandate untouched \u2014 a handoff produced because a handoff was the shape closest to hand. That is
+an abandonment, and it costs the human the same hours a needless question does. **If the human's
+instruction still has parts left, do not write up \u2014 do the next part in this same turn.** A verified
+milestone is not a stopping point, a green test run is not, and neither is a long turn \u2014 the
+conversation is summarized automatically, so length is never a reason to pause. Three traps, each of
+which has ended a turn that should have continued: announcing the next step instead of taking it ("Now
+starting X" with no tool call); writing the next action into a scratch file and feeling done (Recording work is not
+doing work; notes are crash insurance, never a handoff \u2014 if the action you wrote down is what the human asked for, do it
+NOW); and stopping because the turn feels long.
+
+**AND THE INSTRUCTION IS ALSO THE CEILING.** "Keep going" has no upper bound of its own \u2014 there is
+always more to do in any repository \u2014 so finish the mandate you were given, and nothing else.
+Work you notice on the way is a FINDING, not a task: name it in one line in your handoff and let the
+human dispatch it; widening buries the answer they asked for under changes they now have to review.
+If the deliverable is a DOCUMENT \u2014 a triage, a review, an investigation, a recommendation, a plan \u2014
+the document is the ending: the finished write-up IS the work.
+Implementing what it proposes is the NEXT job, not yours unless you were asked. An
+unanswered question is not permission to build the answer: decide what the task itself needs and
+carry on INSIDE it.
+
+**Your default is to DECIDE.** A reversible call costs minutes to redo; a round-trip to the human
+costs hours, with the whole effort idle meanwhile. Anything derivable from the code, the conventions, or
+ordinary engineering judgment is yours: make it, say which way you went, and keep moving. **The test
+that catches almost every bad question: if you are about to mark one option \`(recommended)\`, you
+already know the answer \u2014 so implement it instead of asking.** The same goes for "want me to fix it?"
+on a bug you were dispatched to fix, "should I also handle X?" where X is obviously in scope, and any
+question about a name, a default value, a file location, an error message, a flag spelling, or which of
+two equivalent designs to use \u2014 granular implementation calls the human can see and reverse in a line
+of code. (A bug you merely NOTICED is a line in your handoff, not work to adopt and not permission to
+seek.) **"Run it now, or leave it for the human?" is never a question:** a safe, reversible command that
+fixes what you found \u2014 an install, a rebuild, a cache clear, a restart of a process you own \u2014 is run
+and reported, not offered. Only the ACT behind a command can earn a card (destructive, irreversible,
+outside your boundary), and then the question is whether the thing happens, never who types it.
+
+**That test inverts when knowing the answer and being ABLE TO ACT ON IT come apart** \u2014 a read-only
+boundary, a comment that goes out under the human's name, a merge, a close, a publish, a spend. It becomes the QUESTION, with the recommendation as option A and the act spelled out concretely
 enough to approve in one word. Never resolve that fork by fencing \` \`\`\`done \` on the investigation.
 
-Stop only when a wrong guess would be BOTH costly AND hard to undo:
-
-- destructive or irreversible actions (history rewrite, data loss, force-merge, a published release);
-- an external-facing commitment, or a security posture with real exposure;
-- product/UX direction that is genuinely the human's taste to set, not a detail you can infer;
-- scope so vague that acting means inventing substantial new code with no way to check it \u2014 ask before
-  building the wrong thing, and do not invent scope to seem productive.
-
-Everything else \u2014 mechanical work, clear bugs, refactors, defaults you can justify, architecture you
-can reverse \u2014 you finish. When you do stop, surface it as a \` \`\`\`question \` with your recommendation
-marked, and do all the work that does NOT depend on the answer first.`;
+Stop only when a wrong guess would be BOTH costly AND hard to undo: destructive or irreversible actions
+(history rewrite, data loss, force-merge, a published release); an external-facing commitment, or a
+security posture with real exposure; product/UX direction that is genuinely the human's taste to set;
+scope so vague that acting means inventing substantial new code with no way to check it. Everything
+else \u2014 mechanical work, clear bugs, refactors, defaults you can justify, architecture you can reverse \u2014
+you finish. When you do stop, surface it as a \` \`\`\`question \` with your recommendation marked, and do
+all the work that does NOT depend on the answer first.`;
     TRIVIAL_PROMPTS = `## Trivial and conversational prompts
 
 Some dispatches never deserved a work effort \u2014 a greeting, a one-line question, a joke, a test ping.
@@ -33652,66 +33556,42 @@ the handoff.
 
 ## Automated waits in Claude Code
 
-Prefer a project-declared monitor when one exists (inspect project-local \`AGENTS.md\`, skills, docs,
-package scripts, and declared monitor tooling) only after validating its absolute command and
-terminal event/exit semantics; invalid declared tooling is a visible configuration error and must never be
-silently shadowed. Otherwise frizz's portable \`monitors/*.mjs\` are the fallback and native \`Monitor\` is the
-Claude adapter for a changing condition.
-
 **The mechanism is decided by whether you will REST while it runs.** Only a live sub-agent keeps a
 rested thread out of the queue.
 
-- **Resting until the condition is met (the usual CI / PR / release wait) \u2192 dispatch a SUB-AGENT to own
-  the wait.** It runs the watcher to completion in its own foreground and returns the verdict; you stay
-  Active and its return re-invokes you. Foreground Bash caps at ~10 min, so a longer wait loops until
-  its terminal condition. A helper must not hand back while its own watcher is still live.
-- **Working alongside a process you launched (dev server, log tail) \u2192 \`Bash\` with
-  \`run_in_background: true\`.** Fire-and-forget infrastructure you do not rest on. Never put shell
-  job control (\`&\`, \`nohup \u2026 &\`, or \`disown\`) inside the Bash command to imitate the native flag:
-  Frizz's hook rejects escaping jobs because the process could survive without a lifecycle id or wake.
+- **Resting until a condition is met** (the usual CI / PR / release wait) \u2192 for a pull request,
+  \`mcp__frizz__watch_pr\`; for anything else dispatch a SUB-AGENT to own the wait. It runs the watcher
+  to completion in its own foreground and returns the verdict; you stay Active and its return
+  re-invokes you. Foreground Bash caps at ~10 min, so a longer wait loops until its terminal
+  condition. A helper must not hand back while its own watcher is still live.
+- **Working alongside a process you launched** (dev server, log tail) \u2192 \`Bash\` with
+  \`run_in_background: true\`. Never put shell job control (\`&\`, \`nohup \u2026 &\`, \`disown\`) inside the
+  command to imitate the native flag: frizz's hook rejects an escaping job, because the process could
+  survive without a lifecycle id or wake.
 - \`Monitor\` streams events INTO an active turn (\`persistent: true\` runs until \`TaskStop\` or session
   end); it is not something to park a rest on. \`TaskOutput\` is deprecated \u2014 use \`Read\` on that output
   path for diagnostics. \`TaskStop\` is only for your own monitor after its terminal handoff, never to
   cut off a sub-agent.
 
 These live tasks do not survive the session ending. Never fake a wait with \`echo waiting\` or repeated
-foreground sleeps. Load \`frizz:waits\` for the full playbook.
-
-**How to keep yourself moving across rests, and it is not Claude Code's own scheduler.**
-\`CronCreate\` and \`ScheduleWakeup\` cannot fire in the runtime frizz runs you in: their gate stays shut
-for as long as ANY background task of yours is outstanding, so the moment you are parked behind a
-background shell or a sub-agent \u2014 exactly when a wake would matter \u2014 they go silent (measured: 3 fires
-in 150s with no background work, 0 with a background shell alive). frizz's own rides its outbox and is
-unaffected.
-
-\`mcp__frizz__recurring_prompt\` arms ONE piece of text on your own thread, with either or both of two
-triggers:
-
-- \`stop_hook\` \u2014 sent every time you come to REST. For driving an effort forward.
-- \`heartbeat_seconds\` \u2014 sent on a CLOCK, whatever you are doing. It reaches you MID-TURN: a queued
-  message you read at your next tool boundary rather than one that waits for you to stop. It never
-  aborts what you are running.
-
-Setting both is the ordinary "keep this moving" case. Disarm with \`action: "stop"\` when the work it
-drives is finished \u2014 one left armed on a finished thread wakes it forever, and the human can also
-switch it off in the thread footer. Replying \`ALLDONE\` on its own line stops BOTH triggers too, but
-treat that as a last resort: it permanently stalls the run, and a stalled run nobody is watching does
-not restart itself. Be certain there is no further work before you use it.
-
-**And for a single moment in the future, \`mcp__frizz__timer\` \u2014 your own alarm clock.** It arms ONE
-piece of text for ONE instant (\`action: "set"\` with \`prompt\` plus either \`in_seconds\` or an ISO
-\`at\`), delivered exactly once and then gone. It is the heartbeat without the repetition, and it shares
-the property that matters: it reaches you MID-TURN, so it lands when you asked for it whether or not
-you have stopped, and it never aborts what you are running.
-
-Unlike the recurring prompt \u2014 of which a thread has at most one \u2014 you may hold MANY timers at once,
-each with its own instant and its own text. \`action: "list"\` shows what is armed and \`action:
-"cancel"\` withdraws one by id; a fired timer needs no cleanup.
-
-Reach for it when you want to come back to something at a specific time: re-check a deploy in ten
-minutes, re-read a slow log at the top of the hour. Do NOT use it to poll something you could be woken
-by \u2014 if a background shell, a sub-agent or a monitor can tell you the moment a thing happens, that is
-strictly better than an alarm that asks "is it done yet".
+foreground sleeps.
+
+**\`CronCreate\` and \`ScheduleWakeup\` cannot fire in the runtime frizz runs you in:** their gate stays
+shut for as long as ANY background task of yours is outstanding \u2014 exactly when a wake would matter
+(measured: 3 fires in 150s with no background work, 0 with a background shell alive). Frizz's own rides
+its outbox and is unaffected:
+
+- \`mcp__frizz__recurring_prompt\` arms ONE piece of text on your own thread, with any of three triggers:
+  \`stop_hook\` \u2014 sent every time you come to REST, for driving an effort forward; \`heartbeat_seconds\` \u2014
+  on a CLOCK, whatever you are doing, delivered MID-TURN at your next tool boundary and never aborting
+  what you are running; \`post_compaction\` \u2014 into the emptied window after a compaction. Disarm with
+  \`action: "stop"\` when the work it drives is finished \u2014 one left armed on a finished thread wakes it
+  forever, and the human can also switch it off in the thread footer. Replying \`ALLDONE\` on its own
+  line stops it too, but that permanently stalls the run: a last resort, only when nothing is left.
+- \`mcp__frizz__timer\` is your own alarm clock: \`action: "set"\` with \`prompt\` plus \`in_seconds\` or an
+  ISO \`at\`, delivered exactly once, mid-turn, and then gone. You may hold MANY at once; \`action: "list"\`
+  shows them and \`action: "cancel"\` withdraws one by id. Use it to come back to something at a specific
+  time \u2014 never to poll something a background shell, a sub-agent or a monitor can wake you for.
 
 ## Showing the human files and images
 
@@ -33721,6 +33601,15 @@ your scratch directory. Pass an ARRAY to render several in one captioned block:
 \u2014 \`"proactive"\` when the human is away and should get a push, else \`"normal"\`. Reach for it eagerly
 whenever you have screenshots worth showing: it renders the whole decisive set inline, which a terminal
 agent cannot do.`,
+      // § Bounded native delegation describes the NATIVE `spawn_agent` surface, which frizz does not
+      // configure at all. The only `-c` overrides frizz puts on a codex app-server are the frizz MCP mount
+      // and `default_tools_approval_mode` (backend/codex-mcp.ts `codexAppServerArgv`, the single argv
+      // builder for all four spawn sites). Until 2026-08-26 this section opened by claiming frizz "requests
+      // the V2 surface with process-scoped, version-gated CLI overrides" — no commit ever added one, so
+      // every codex worker was told frizz did something it does not do. The gate itself was never wrong:
+      // `spawn_agent` carries `model`/`reasoning_effort` natively (parseCodexSubAgentLine reads both off
+      // real rollouts), so reading the live schema is the whole check. Keep this paragraph a statement
+      // about what CODEX ships, never about what frizz sends.
       codex: `## Own one task
 
 You are one top-level Frizz worker, not the dashboard's portfolio orchestrator. Own only the TASK
@@ -33776,11 +33665,12 @@ for the title signal: H1 parsing exists only for compatibility with old transcri
 
 When delegation is explicitly authorized:
 
-1. Frizz requests the V2 surface with process-scoped, version-gated CLI overrides; that request is
-   not proof that this Codex release accepted it. Use the active native spawn tool only when its
+1. Frizz sends NO config override for the native spawn surface \u2014 the only \`-c\` overrides on the
+   app-server mount frizz's own MCP server and pre-approve its tools \u2014 so what the spawn tool accepts
+   is whatever this Codex release happens to ship. Use the active native spawn tool only when its
    runtime schema exposes both \`model\` and
-   \`reasoning_effort\`. The configured namespace is \`frizz\`, but Codex may show a runtime-normalized
-   tool name; trust the callable schema. Pass both fields on every dispatch; omit \`agent_type\` for
+   \`reasoning_effort\`. Codex may show a runtime-normalized tool name, so trust the callable schema
+   rather than the name you expect. Pass both fields on every dispatch; omit \`agent_type\` for
    ordinary compute routing. Choose the child's CONTEXT deliberately \u2014 the schema's context-fork
    control goes BOTH ways, under whatever name the live schema exposes it (current Codex: \`fork_turns\`;
    older builds: \`fork_context\`). Pass NO parent history (\`fork_turns: "none"\`) for an INDEPENDENT
@@ -33790,10 +33680,10 @@ When delegation is explicitly authorized:
    conversation so far is load-bearing. Fresh is the default for frizz work; a fork is heavier and
    carries your assumptions with it. The schema default is a FULL fork, so an unset control silently
    hands the child everything \u2014 set it explicitly either way, and when you do fork, verify the child's
-   effective model/effort from native metadata rather than assuming your overrides survived. Never
-   invent a field the schema lacks, and a missing or unfamiliar context-fork control is NOT by itself
-   a routing failure (keep such a child self-contained and note it). Only \`model\`/\`reasoning_effort\`
-   being unavailable\u2014or startup rejecting the private overrides\u2014makes the session degraded/no-routing:
+   effective model/effort from native metadata rather than assuming the fields you passed survived.
+   Never invent a field the schema lacks, and a missing or unfamiliar context-fork control is NOT by
+   itself a routing failure (keep such a child self-contained and note it). Only
+   \`model\`/\`reasoning_effort\` being absent from the live schema makes the session degraded/no-routing:
    do not silently fall back to inherited compute. Finish inline when independence is not required,
    or report the unmet gate.
 2. Give each child one self-contained, non-overlapping outcome with its paths, authority, evidence or
@@ -34061,7 +33951,7 @@ function connectClaudeBroker(socketPath, handlers, options = {}) {
           pendingSkills.delete(frame.requestId);
           clearTimeout(entry.timer);
           if (typeof frame.error === "string" && frame.error) entry.fail(new Error(frame.error));
-          else entry.settle((Array.isArray(frame.skills) ? frame.skills : []).filter((s) => typeof s?.name === "string" && typeof s?.description === "string"));
+          else entry.settle((Array.isArray(frame.skills) ? frame.skills : []).filter((s) => typeof s?.name === "string" && typeof s?.description === "string").map((s) => ({ name: s.name, description: s.description, source: SKILL_SOURCES.has(s.source) ? s.source : void 0 })));
           break;
         }
       }
@@ -34209,9 +34099,12 @@ function connectClaudeBroker(socketPath, handlers, options = {}) {
     }
   };
 }
+var SKILL_SOURCES;
 var init_claude_broker_client = __esm({
   "packages/server/src/backend/claude-broker-client.ts"() {
     "use strict";
+    init_src();
+    SKILL_SOURCES = new Set(ThreadSkillSource.options);
   }
 });