opencode-thrum-pro 0.1.0

package/assets/commands/thrum-sleep-extended.md

@@ -0,0 +1,186 @@
+---
+description:
+  Park this agent for operator-initiated wake with a comprehensive 16-section
+  snapshot (does NOT signal coordinator) then thrum-tmux-kills own session. Use
+  for designer/architect-grade work where wake may be cold and must recover wire
+  contracts + capability matrix + design rationale.
+---
+
+# Sleep — Extended (16-section snapshot)
+
+Compose a comprehensive 16-section prose continuation, write it directly to your
+restart file, then end session cleanly and kill own tmux session. The agent goes
+to sleep until the operator wakes it later. Same termination semantics as
+`/thrum:sleep`; the only difference is snapshot grade.
+
+## When to use extended vs standard
+
+- **Use `/thrum:sleep` (standard)** for routine park-and-resume where future-you
+  can reconstruct from project state + a compact 11-section snapshot.
+- **Use `/thrum:sleep-extended` (this variant)** for designer/architect-grade
+  work: parking a complex brainstorm with multiple owner-decided forks, parking a
+  fanout implementation (≥3 call sites or ≥2 epics), or any sleep where the next
+  wake may be a fresh restart and must recover wire-contract precision without
+  re-reading the source files.
+
+## Steps
+
+### 1. Resolve identity + verify tmux session (Tier 1 pre-check; run BEFORE anything else)
+
+```bash
+# Resolve identity + your worktree (needed before reading the partial).
+# $REPO must be YOUR worktree — the directory `thrum prime` reads the restart
+# snapshot back from. Resolve it from the daemon's authoritative identity, NOT
+# `git rev-parse` (which keys off the current shell CWD and would write to the
+# wrong .thrum/restart/ if a bash step left your worktree). Fall back to git
+# only if whoami can't answer.
+REPO=$(thrum whoami --field worktree 2>/dev/null)
+[ -n "$REPO" ] || REPO=$(git rev-parse --show-toplevel) || { echo "ERROR: cannot resolve your worktree"; exit 1; }
+AGENT=$(thrum whoami --field agent_id) || { echo "ERROR: agent not registered"; exit 1; }
+[ -n "$AGENT" ] || { echo "ERROR: empty agent_id"; exit 1; }
+mkdir -p "${REPO}/.thrum/restart"
+
+# Tier 1 pre-check: tmux session must exist BEFORE writing snapshot:
+SESSION=$(thrum whoami --field tmux_session)
+if [ -z "$SESSION" ]; then
+  echo "ERROR: the sleep-extended command requires a tmux-managed agent session (tmux_session field is empty)."
+  echo "Use the restart-extended command for non-tmux sessions."
+  exit 1
+fi
+```
+
+If `tmux_session` is empty: ABORT before writing any snapshot. No status change,
+no session end. Exit code 1.
+
+### 2. Read the shared snapshot-composition partial
+
+Read the partial at the absolute path:
+
+```text
+${REPO}/claude-plugin/commands/_snapshot-protocol.md
+```
+
+Apply its Step 2 (compose your continuation) per the structure guidance.
+
+**Use the EXTENDED 16-section structure.** The structure block is `§1.` through
+`§16.` with per-section guidance documented in the partial.
+
+**Note on §3 framing:** For sleep snapshots, §3 frames as "where work stands at
+park time" rather than "what shipped" — the agent is parking, not completing.
+Composition discipline (1–3 sentences, specific, load-bearing-first) is
+identical to restart-extended.
+
+### 3. Write the continuation
+
+Per Step 3 of the partial, use the Write tool to save your composed continuation
+to `${REPO}/.thrum/restart/${AGENT}.md`. On next boot, `thrum prime`
+auto-injects this file — same mechanism as restart wake.
+
+### 4. Back up important files to your durable agents folder (survives worktree teardown)
+
+**Your worktree may be torn down while you sleep — and if it is, YOUR SNAPSHOT
+GOES WITH IT unless you do this step.**
+
+🔴 **READ THIS CAREFULLY.** A worktree's `.thrum/` is a REAL LOCAL DIRECTORY. The
+`redirect` inside it is just a plain text FILE containing a path — a pointer
+thrum's code consults. The filesystem redirects nothing. Your worktree keeps its
+own local `agents/`, `context/`, `identities/`, and `restart/`.
+
+**THE ACTUAL MECHANISM:** your snapshot at `<worktree>/.thrum/restart/<agent-id>.md`
+is **worktree-local**. It is copied into the main repo **only when you WAKE** —
+`thrum prime` reads it from the worktree and archives it to
+`<main-repo>/.thrum/agents/<agent-id>/sessions/`. **Then and only then.** So a
+teardown that happens BEFORE your wake destroys the snapshot, permanently, and
+nothing warns you. This matters more for an extended snapshot: you are parking
+wire contracts, a capability matrix, and design rationale that are expensive to
+reconstruct and exist nowhere else.
+
+**Leave the snapshot where it is** — `thrum prime` reads it from the worktree on
+wake, so that path is correct and required. **Additionally**, copy anything you
+need to survive teardown to the MAIN REPO PATH, resolved explicitly:
+
+```bash
+# Resolve the main repo's .thrum from the redirect FILE (do not assume a path).
+MAIN_THRUM=$(cat "${REPO}/.thrum/redirect" 2>/dev/null) || MAIN_THRUM="${REPO}/.thrum"
+mkdir -p "${MAIN_THRUM}/agents/${AGENT}"
+cp "${REPO}/.thrum/restart/${AGENT}.md" "${MAIN_THRUM}/agents/${AGENT}/last-sleep-snapshot.md"
+# ...and any other artifact you need on wake.
+ls -la "${MAIN_THRUM}/agents/${AGENT}/last-sleep-snapshot.md"   # VERIFY IT LANDED
+```
+
+Copy there: reports / findings you authored, important uncommitted artifacts, and
+anything your resume plan references.
+
+**VERIFY THE COPY EXISTS AT THE MAIN PATH before ending your session.** Do not
+trust `cp`'s exit code — list the destination file. This step is your ONLY
+recoverability guarantee against teardown-while-asleep; the redirect is not one.
+
+### 5. Mark agent operational status idle
+
+```bash
+thrum agent set-status idle
+```
+
+`idle` is the signal that this agent has parked. NO new "sleeping" state was
+added — `idle` covers both "no active work" and "parked for operator wake."
+
+If `thrum agent set-status` returns an error, continue to Step 6 — the snapshot
+on disk is the load-bearing artifact.
+
+### 6. End session cleanly
+
+```bash
+thrum session end
+```
+
+This emits `agent.session.end` cleanly so the dead-agent sweeper does NOT treat
+the disconnect as a crash.
+
+### 7. Kill own tmux session
+
+```bash
+thrum tmux kill "$SESSION"
+```
+
+Tmux pane terminates → runtime process exits → no further activity until
+operator wakes the agent.
+
+## How wake works
+
+On runtime start, `thrum prime` auto-injects the snapshot — same mechanism as
+restart. Resume from §16 immediate-next-actions.
+
+**Two wake paths, NOT interchangeable — pick by WHO is waking you.**
+
+**A. THE OPERATOR (a human at a terminal):** `thrum tmux start` from the agent's
+own working directory — create + launch + prime + attach in one.
+
+**B. ANOTHER AGENT (e.g. a coordinator):** path A will FAIL for you by design —
+running it from someone else's worktree fires the `cross_worktree` identity guard
+(`pid_mismatch`), which exists to stop one agent assuming another's identity and
+is working correctly when it blocks you. Instead:
+
+```bash
+# 1. PROVE THE STALE PID IS DEAD — DIRECT OBSERVATION, never from the DB.
+ps -p <identity-pid> -o pid=,lstart=,comm=                     # must return NOTHING
+tmux list-panes -a -F '#{pane_pid}' | grep -w <identity-pid>   # must return NOTHING
+# If either shows life: STOP. Not parked. Do not force.
+
+# 2. SALVAGE FIRST if the snapshot is not already in the main repo — it is
+#    worktree-local until wake (see Step 4). Forcing is safe; losing is not.
+
+# 3. Create, replacing the stale identity. Quickstart flags are REQUIRED.
+thrum tmux create <name> --cwd <worktree> \
+  --name <agent-id> --role <role> --module <module> \
+  --model <model> --effort <effort> --force
+
+# 4. Launch; the runtime re-binds the identity on start.
+thrum tmux launch <name>
+```
+
+`--force` replaces the STALE IDENTITY FILE (`tmux.create.identity-replaced`); it
+does NOT touch the snapshot — which is why prove-dead and salvage come first.
+Forcing against a LIVE agent would evict a working agent from its own identity.
+
+The snapshot file moves to `.thrum/agents/<your-agent-id>/sessions/` archive on
+wake (same as restart).

package/assets/commands/thrum-sleep.md

@@ -0,0 +1,212 @@
+---
+description:
+  Park this agent for operator-initiated wake. Saves a standard 11-section
+  snapshot (does NOT signal coordinator) then thrum-tmux-kills own session. Use
+  when the operator is shutting down (e.g. computer restart) and the agent
+  should resume from snapshot on next boot.
+---
+
+# Sleep — Park Until Operator Wake
+
+Compose a standard 11-section prose continuation, write it directly to your
+restart file, then end session cleanly and kill own tmux session. The agent goes
+to sleep until the operator wakes it later via
+`thrum tmux create <session-name>`. Unlike `/thrum:restart`, sleep does NOT
+signal the coordinator and does NOT wait for an external mover — it terminates
+its own tmux session.
+
+## When to Use
+
+- The operator is shutting down the machine (e.g. computer restart) and wants
+  this agent's work durably parked.
+- The operator wants to free a tmux session slot but resume this agent's work
+  later.
+- You (the agent) decide independently that further progress requires the
+  operator's attention later, not the coordinator's now.
+
+For routine context-exhaustion / rate-limit restarts where the coordinator
+should bring you back in-place, use `/thrum:restart` instead.
+
+## Steps
+
+### 1. Resolve identity + verify tmux session (Tier 1 pre-check; run BEFORE anything else)
+
+```bash
+# Resolve identity + your worktree (needed before reading the partial).
+# $REPO must be YOUR worktree — the directory `thrum prime` reads the restart
+# snapshot back from. Resolve it from the daemon's authoritative identity, NOT
+# `git rev-parse` (which keys off the current shell CWD and would write to the
+# wrong .thrum/restart/ if a bash step left your worktree). Fall back to git
+# only if whoami can't answer.
+REPO=$(thrum whoami --field worktree 2>/dev/null)
+[ -n "$REPO" ] || REPO=$(git rev-parse --show-toplevel) || { echo "ERROR: cannot resolve your worktree"; exit 1; }
+AGENT=$(thrum whoami --field agent_id) || { echo "ERROR: agent not registered"; exit 1; }
+[ -n "$AGENT" ] || { echo "ERROR: empty agent_id"; exit 1; }
+mkdir -p "${REPO}/.thrum/restart"
+
+# Tier 1 pre-check: tmux session must exist BEFORE writing snapshot:
+SESSION=$(thrum whoami --field tmux_session)
+if [ -z "$SESSION" ]; then
+  echo "ERROR: the sleep command requires a tmux-managed agent session (tmux_session field is empty)."
+  echo "Use the restart command for non-tmux sessions."
+  exit 1
+fi
+```
+
+If `tmux_session` is empty: ABORT before writing any snapshot. No status change,
+no session end. Exit code 1. The skill is the wrong tool for non-tmux agents.
+
+### 2. Read the shared snapshot-composition partial
+
+Read the partial at the absolute path:
+
+```text
+${REPO}/claude-plugin/commands/_snapshot-protocol.md
+```
+
+Apply its Step 2 (compose your continuation) per the structure guidance.
+
+**Use the STANDARD 11-section structure.** For comprehensive
+designer/architect-grade snapshots, use `/thrum:sleep-extended` instead.
+
+**Note on §1 framing:** For sleep snapshots, the Big Picture section frames as
+"where work stands at park time" rather than "what shipped" — the agent is
+parking, not completing. Composition discipline (1–3 sentences, specific,
+load-bearing-first) is identical to restart.
+
+### 3. Write the continuation
+
+Per Step 3 of the partial, use the Write tool to save your composed continuation
+to `${REPO}/.thrum/restart/${AGENT}.md`. On next boot, `thrum prime`
+auto-injects this file — same mechanism as restart wake.
+
+### 4. Back up important files to your durable agents folder (survives worktree teardown)
+
+**Your worktree may be torn down while you sleep — and if it is, YOUR SNAPSHOT
+GOES WITH IT unless you do this step.**
+
+🔴 **READ THIS CAREFULLY.** A worktree's `.thrum/` is a REAL LOCAL DIRECTORY. The
+`redirect` inside it is just a plain text FILE containing a path — a pointer
+thrum's code consults. The filesystem redirects nothing. Your worktree keeps its
+own local `agents/`, `context/`, `identities/`, and `restart/`.
+
+**THE ACTUAL MECHANISM:** your snapshot at `<worktree>/.thrum/restart/<agent-id>.md`
+is **worktree-local**. It is copied into the main repo **only when you WAKE** —
+`thrum prime` reads it from the worktree and archives it to
+`<main-repo>/.thrum/agents/<agent-id>/sessions/`. **Then and only then.** So a
+teardown that happens BEFORE your wake destroys the snapshot, permanently, and
+nothing warns you.
+
+**Leave the snapshot where it is** — `thrum prime` reads it from the worktree on
+wake, so that path is correct and required. **Additionally**, copy anything you
+need to survive teardown to the MAIN REPO PATH, resolved explicitly:
+
+```bash
+# Resolve the main repo's .thrum from the redirect FILE (do not assume a path).
+MAIN_THRUM=$(cat "${REPO}/.thrum/redirect" 2>/dev/null) || MAIN_THRUM="${REPO}/.thrum"
+mkdir -p "${MAIN_THRUM}/agents/${AGENT}"
+cp "${REPO}/.thrum/restart/${AGENT}.md" "${MAIN_THRUM}/agents/${AGENT}/last-sleep-snapshot.md"
+# ...and any other artifact you need on wake.
+ls -la "${MAIN_THRUM}/agents/${AGENT}/last-sleep-snapshot.md"   # VERIFY IT LANDED
+```
+
+Copy there: reports / findings you authored, important uncommitted artifacts, and
+anything your resume plan references.
+
+**VERIFY THE COPY EXISTS AT THE MAIN PATH before ending your session.** Do not
+trust `cp`'s exit code — list the destination file. This step is your ONLY
+recoverability guarantee against teardown-while-asleep; the redirect is not one.
+
+### 5. Mark agent operational status idle
+
+```bash
+thrum agent set-status idle
+```
+
+`idle` is the signal that this agent has parked. NO new "sleeping" state was
+added — `idle` covers both "no active work" and "parked for operator wake."
+
+If `thrum agent set-status` returns an error (e.g. rate-limited), continue to
+Step 6 — the snapshot on disk is the load-bearing artifact, not the status
+field. The operator can set status post-wake.
+
+### 6. End session cleanly
+
+```bash
+thrum session end
+```
+
+This emits an `agent.session.end` event cleanly so the dead-agent sweeper does
+NOT later treat the disconnect as a crash. If `thrum session end` fails,
+continue to Step 7.
+
+### 7. Kill own tmux session
+
+```bash
+thrum tmux kill "$SESSION"
+```
+
+Tmux pane terminates → runtime process exits → no further activity until
+operator wakes the agent via `thrum tmux create <session-name>`.
+
+**If Step 7 fails with "anonymous caller cannot invoke":** `thrum session end`
+(Step 6) severs the daemon binding, so `thrum tmux kill` may be rejected if the
+daemon hasn't yet processed the CallerWorktree self-kill path. Use the raw tmux
+fallback — the lifecycle safeguards (snapshot, status idle, session end) were
+already discharged by Steps 1-6, so nothing is lost:
+
+```bash
+tmux kill-session -t "$SESSION"
+```
+
+## How wake works
+
+On runtime start, `thrum prime` auto-injects the snapshot at
+`.thrum/restart/<your-agent-id>.md` — same mechanism used by restart. Resume
+from §9 (Numbered resume plan).
+
+**Two wake paths, and they are NOT interchangeable — pick by WHO is waking you.**
+
+**A. THE OPERATOR (a human, at a terminal):** `thrum tmux start` from the agent's
+own working directory. That is create + launch + prime + attach in one, and it is
+the simplest path.
+
+**B. ANOTHER AGENT (e.g. a coordinator waking a parked agent):** the operator path
+will FAIL for you, by design. Running `thrum tmux start` from someone else's
+worktree fires the `cross_worktree` identity guard (`pid_mismatch`) — that guard
+exists to stop one agent assuming another's identity, and it is working correctly
+when it blocks you. Use this instead, in order:
+
+```bash
+# 1. PROVE THE STALE PID IS DEAD — by DIRECT OBSERVATION, never from the DB.
+ps -p <identity-pid> -o pid=,lstart=,comm=          # must return NOTHING
+tmux list-panes -a -F '#{pane_pid}' | grep -w <identity-pid>   # must return NOTHING
+# If either shows life, STOP. The agent is not parked; do not force anything.
+
+# 2. SALVAGE FIRST if the snapshot is not already in the main repo — it is
+#    worktree-local until wake (see Step 4 above). Forcing is safe; losing is not.
+
+# 3. Create, replacing the stale identity. The quickstart flags are REQUIRED —
+#    without --name/--role/--module this fails with "quickstart flags required".
+thrum tmux create <name> --cwd <worktree> \
+  --name <agent-id> --role <role> --module <module> \
+  --model <model> --effort <effort> --force
+
+# 4. Launch the runtime; it re-binds the identity on start.
+thrum tmux launch <name>
+```
+
+`--force` replaces the STALE IDENTITY FILE (you will see
+`tmux.create.identity-replaced`). It does **not** touch the snapshot — that is why
+step 1 (prove dead) and step 2 (salvage) come first. Forcing against a LIVE agent
+would evict a working agent from its own identity.
+
+The snapshot file moves to `.thrum/agents/<your-agent-id>/sessions/` archive on
+wake (same as restart). Worst-case fallback: previous Claude session may be
+resumable via Claude Code's native session-continuation mechanism.
+
+## Programmatic use (operator shutdown scripts)
+
+The underlying mechanic — write snapshot + set status idle + session end + tmux
+kill — can be invoked from an operator's shutdown script directly via the bash
+commands above (without going through the skill).

package/assets/commands/thrum-team.md

@@ -0,0 +1,12 @@
+---
+description: Show active team members
+---
+
+List all active agents with their roles, modules, and current intents.
+
+```bash
+thrum team                   # Human-readable
+thrum team --json            # Machine-readable
+```
+
+Use `thrum ping @name` to check if a specific agent is online.

package/assets/commands/thrum-update-project.md

@@ -0,0 +1,259 @@
+---
+description: Update project state with session summary and mechanical state
+---
+
+Update `.thrum/context/project_state.md` with fresh project state so a new
+session can pick up exactly where this one left off.
+
+**Do this IN YOUR OWN CONTEXT. Do NOT delegate it to a subagent.**
+
+This is a named exception to the general dispatch discipline in your role
+preamble ("delegate essentially all investigation to sub-agents to preserve
+your context"). That rule is correct and stays — it protects your context from
+repetitive investigation a subagent can do just as well. update-project is
+different in kind: it is not investigation, it is the **serialisation of
+context that exists only in your own head**. A subagent works from a brief you
+hand it and can only render what the brief contains. What gets lost is exactly
+what makes the artifact worth having — the rulings and their reasoning, the
+corrections and *why*, which claims were VERIFIED versus merely assumed, and
+which of this session's confident statements turned out WRONG. If you could
+summarize those faithfully into a brief, you would already have written the
+state yourself. Two more reasons this delegation is pure downside here
+specifically: (1) you are already live with the session loaded — a subagent
+re-processes context you already hold, at extra cost, from a summary instead
+of the full session; (2) update-project runs only at session end, immediately
+before a restart — there is no "later work" this session to protect, so the
+usual token-saving justification for delegating does not apply.
+
+### Step 1: Compose Your Session Summary
+
+From YOUR context (what you already know), write a brief summary covering:
+
+- **Session number**: Increment from the current project_state.md's session
+  number (check `Phase` line or latest session heading)
+- **What you worked on**: Key tasks, epics, beads progressed or closed
+- **What changed**: Files modified, features shipped, bugs fixed
+- **Key decisions**: Architecture choices, approach changes, investigations done
+- **Current state**: What's in progress, what's blocked, what's next
+
+This is the most valuable input — only you have the session narrative. Keep it
+concise but complete (10-30 lines). You gather the mechanical state yourself in
+the next step.
+
+### Step 2: Gather Mechanical State Yourself
+
+Run this ONE compound command directly in your own turn — do not dispatch it
+to a subagent:
+
+```bash
+cd REPO_ROOT && \
+echo "=== GIT LOG ===" && git --no-pager log --oneline -15 && \
+echo "=== GIT STATUS ===" && git branch --show-current && git status --short && \
+echo "=== BEADS STATS ===" && bd stats 2>&1 && \
+echo "=== OPEN EPICS ===" && (bd list --status=open --type=epic 2>/dev/null || echo "(none)") && \
+echo "=== READY ISSUES ===" && (bd ready -n 5 2>/dev/null || echo "(none)")
+```
+
+(Replace `REPO_ROOT` with the absolute path to the project root.)
+
+### Step 3: Read the Current File
+
+Read `REPO_ROOT/.thrum/context/project_state.md` in full, yourself, using the
+Read tool.
+
+### Step 3.5: Staleness Check First (Parallel Fan-Out)
+
+Before you edit anything, verify what's actually still true. Stale rows in
+this file are how a coordinator ends up citing a merged bead as open or a torn-down
+worktree as active — the fan-out below catches that before you write, not after.
+
+This is narrower than the no-delegation rule above and does not conflict with
+it: these sub-agents verify facts, they do not compose the session narrative
+and they do not edit the file. You still write every Edit call yourself in
+Step 4.
+
+Dispatch one **read-only**, background sub-agent per section, each scoped to
+exactly one section and returning only a verified-stale delete-list plus an
+unsure-list (unsure ⇒ keep, never delete on a guess):
+
+1. `## Current State Summary` — for each cited SHA, `git merge-base
+   --is-ancestor <sha> origin/<merge_target>`; for each cited bead, `bd show
+   <id>`.
+2. `## Open Epics / Active Work` — `bd show` each bead ID; rows whose bead is
+   CLOSED are stale.
+
+Consolidate the delete-lists yourself, then fold the confirmed-stale
+rows into the section edits in Step 4. Fan-out keeps this fast without
+sacrificing thoroughness — a single-threaded pass over independent
+sections is the slow path, not the safe one.
+
+**Deploy state, fleet topology, worktree layout, agent pool, and standing
+rulings are NOT maintained here anymore** — they live in `thrum state`
+(`--kind deploy_state|topology|worktree|agent_pool|ruling`), a cheap `thrum
+state set` upsert done at the moment a fact changes, not part of this
+end-of-session ritual. Staleness for those kinds is read-time (`as_of` +
+per-kind threshold), not something this command curates.
+
+### Step 4: Edit the File In-Place, Yourself
+
+Use the **Edit tool** directly to make targeted updates. Do NOT rewrite the
+entire file with the Write tool. Make one Edit call per section that needs
+updating.
+
+#### Sections to Update (use Edit tool for each)
+
+1. **Header line** — Update `Last Updated` date and `Phase` status summary. Also
+   derive and insert the Authored-against stamp, placing it immediately after
+   the `Last Updated` line (see `claude-plugin/commands/_stamp-protocol.md`
+   for the exact two-line format).
+
+2. **Current State Summary — LIVE STATE ONLY, SUPERSEDED EACH SESSION.**
+   Update version, branch, beads counts, and hold *only* what is currently
+   in flight, owed, blocked, or pending the owner's decision. It carries
+   **no session narrative** — no "what we did", no "why", no derivation.
+   - **This is a SUPERSESSION, not an append.** Rewrite it to reflect
+     current reality; do not add this session's items on top of last
+     session's.
+   - **Resolved items are DELETED, not annotated.** Do not leave a
+     "~~fixed in S42~~" line — remove the line entirely. The line's absence
+     *is* the record that it's resolved; the memory record (rule 4 below) is
+     where the resolution's story lives.
+   - Bounding only the session-index entries (rule 4/5 below) is a point fix:
+     if narrative is merely blocked from `## Recent Sessions`, it reappears
+     here under a different heading with no cap at all — the identical
+     growth, one section over. This rule closes that sibling surface.
+
+3. **Architecture Health table** (STRICT 10-row rolling window):
+   - The table has a **Session / Date** column — format: `S<N> · YYYY-MM-DD`
+     (e.g. `S32 · 2026-04-14`)
+   - Add new rows for work done this session at the TOP of the table
+   - Then TRIM: keep only the 10 most recent rows PLUS any row currently in a
+     broken/regressed state (statuses like BROKEN, REGRESSED, BLOCKED, or a
+     note explicitly describing ongoing breakage). Drop all other historical
+     COMPLETE/FIXED/MOVED/UPDATED rows — they live in git history + Recent
+     Sessions below
+   - This is a rolling window, not an append log. If the table is at 10 and
+     you add 2 new rows, remove 2 of the oldest non-broken rows
+   - Do NOT add rows for routine work already covered in Recent Sessions —
+     only genuinely new capabilities, architectural shifts, or broken state
+
+4. **Recent Sessions** — EVERY session, including the one you are closing
+   right now, is exactly ONE LINE. No session ever gets a prose block.
+   - For the session being closed, emit a `session_summary` memory record:
+     ```
+     thrum memory create \
+       --kind session_summary \
+       --scope project \
+       --title "Session N — <title>" \
+       --oneline "<one-line summary>" \
+       --short "<short narrative (2-4 sentences)>" \
+       --full "<full session body>"
+     ```
+     Capture the returned memory ID (e.g. `thrum-mem-01HQXZ...`).
+   - Append a **single index line** to the `## Recent Sessions` block in
+     project_state.md — no body prose, ever:
+     ```
+     - Session N (YYYY-MM-DD) — <what changed, ≤30 words> — [mem:<id>]
+     ```
+   - **The cap is on WORDS, not on newlines.** A 200-word run-on sentence
+     crammed onto one physical line VIOLATES this rule just as much as a
+     multi-line prose block does. Count words; keep the line ≤30 of them.
+   - The full body lives in the memory record and is retrieved on demand via
+     `thrum memory show <id>` or surfaced by the progressive-disclosure prime.
+   - **What goes where** — the mechanical tell for sorting content: if a
+     sentence contains "because", "I verified", "the mechanism was", "caught
+     by", or "control fired", that sentence is DERIVATION, not state, and it
+     belongs in the memory record, never in project_state.md.
+     | Content | Destination |
+     | --- | --- |
+     | What changed | The one-line session index entry |
+     | How you concluded it / verified it / why an earlier claim was wrong / what it taught | `thrum memory`, never project_state.md |
+     | What's currently in flight, owed, blocked, or pending the owner | `## Current State Summary` (rule 2 above) |
+
+   **NOTE:** the old `update-agent-state` / `update-state` skills (State.md
+   surface, MI1) were retired — superseded by `thrum state` (personal_state
+   kind). This command (`update-project`) is unaffected; it always governed
+   `project_state.md`, a separate surface.
+
+5. **Session History Update Rule** (CRITICAL — keeps this cheap):
+   - **At most TEN index entries in `## Recent Sessions`.** Older entries are
+     **DELETED**, not archived in-file or moved to another section — the
+     memory record IS the archive, so deleting the 11th line loses nothing.
+   - **Adding this session's line and deleting the overflow line happen in
+     the SAME edit / SAME commit.** Do not split "append now, trim later"
+     into two steps; there is no later step. Emit the memory record, append
+     the new index line, and delete the 11th-oldest line (if present)
+     together.
+   - Do NOT re-write or re-consolidate the other index lines you keep — they
+     are frozen once written. The section stays compact indefinitely because
+     it is bounded at 10, not because entries shrink over time.
+
+6. **Open Epics / Active Work** — Replace with current epic list from beads.
+
+7. **What's Queued / Next Steps** — Update priorities based on current state.
+
+#### Edit Rules
+
+- Use the Edit tool's old_string / new_string to target specific sections
+- Each Edit should replace a clearly bounded section (between headings)
+- Do NOT touch sections that haven't changed
+- Do NOT re-write frozen `## Recent Sessions` index lines you are keeping
+- Preserve all markdown formatting and heading hierarchy
+- Use ABSOLUTE paths for all file operations
+
+### Step 5: Verify Before Finishing
+
+Run these checks yourself before reporting done — this is a required step,
+not advice you may skip:
+
+- `wc -l` the file BEFORE your edits and AFTER — report both counts.
+- Count the entries under `## Recent Sessions` — must be **≤10**.
+- Word-count the newly added session index line — must be **≤30 words**.
+- Confirm no `## Sxxx` (or any other) prose block exists for any session —
+  every entry in `## Recent Sessions` is a single index line.
+- If the file GREW, state the reason. Growth is not automatically wrong
+  (a legitimately new structural section can grow it), but an update that
+  grows the file with no stated reason is a defect, not a style choice.
+
+### Step 6: Report What You Changed
+
+State directly (no subagent summary to relay):
+- Which sections were edited
+- Architecture Health: N rows dropped, N rows added, final count
+- Recent Sessions: entry count before/after (must be ≤10), and the
+  word count of the new entry (must be ≤30)
+- Line count before/after (Step 5)
+- Any issues encountered
+
+## CRITICAL Rules
+
+- Use the EDIT tool, not the Write tool — targeted changes only
+- Architecture Health table is a **strict 10-row rolling window** + broken
+  rows. Never let it grow beyond that
+- **`## Recent Sessions` — every session is ONE LINE, no exceptions, including
+  the session you are closing right now.** At most **10** entries; older ones
+  are **deleted**, not archived in-file — the memory record is the archive.
+  Deletion of the overflow entry happens in the **same edit** as the addition
+  of the new one; it is one step, never two. The line cap is **≤30 words**,
+  measured on words, not physical newlines — a long run-on sentence on one
+  line still violates this.
+- **`## Current State Summary` is superseded each session, never appended
+  to.** It holds only what is in flight/owed/blocked/pending the owner.
+  Resolved items are deleted outright, not annotated as resolved. Session
+  narrative and derivation NEVER belong here — that is what `thrum memory`
+  is for.
+- Do NOT touch stable sections (Key Architecture Files, etc.) unless they
+  changed
+- Target total file size: ~150-300 lines for a SMALL project. A mature project
+  will legitimately be larger and that is not bloat to be trimmed. The bounded
+  part is SESSION HISTORY — those bodies now live in `session_summary` memories
+  with a one-line index entry for the ~10 most recent, and older sessions are
+  recoverable via `thrum memory search`. The rest (schema-compat contract,
+  merge protocol, architecture decisions) is DURABLE STRUCTURAL DATA that a
+  restarting agent needs in order to act safely; shrinking it costs more than
+  it saves. Do not trim structural sections to hit a line count. (Deploy
+  state, fleet topology, worktree layout, agent pool, and standing rulings
+  are no longer in this file at all — see the note above Step 4's section
+  list.)
+- **Do not delegate any part of this to a subagent.** See the reasoning at the
+  top of this file — it is a deliberate, named exception, not an oversight.