opencode-thrum-pro 0.1.4 → 0.1.6

package/assets/skills/brainstormer-staying-current/SKILL.md

@@ -0,0 +1,113 @@
+---
+name: brainstormer-staying-current
+description: "Use when a long-lived brainstormer worktree may be behind its configured merge target, before review or handoff, or when asked to merge-forward and leave the worktree clean. Resolves the target and merge owner from Thrum config, preserves local work, and verifies freshness after the merge."
+---
+
+# Brainstormer: Stay Current with the Merge Target
+
+Keep a long-lived brainstorm branch current without landing it into the merge
+target. Every git write in this skill (commit, merge, revert, push) stays with
+you — never delegate a git write to a subagent. Every `fetch` also stays with
+you, the acting agent, per Preserve and Bind freshness below. If you delegate
+the read-only merge-base/status analysis, load `choosing-subagent-models`
+first and fence the subagent to `show`, `log`, `diff`, `grep`, `rev-parse`,
+`merge-base`, `status` — the same read-only git surface CLAUDE.md requires for
+every sub-agent — never `stash`, `reset`, `rebase`, `restore`, `clean`,
+`commit`, `push`, or `checkout`.
+
+## Resolve authority from config
+
+Locate the canonical config from the current worktree:
+
+```bash
+CONFIG=.thrum/config.json
+[ -f .thrum/redirect ] && CONFIG="$(cat .thrum/redirect)/config.json"
+test -f "$CONFIG"
+TARGET=$(jq -er '.orchestration.merge_target | select(type == "string" and length > 0)' "$CONFIG")
+MERGE_KING=$(jq -r --arg target "$TARGET" '.orchestration.merge_kings[$target] // "unset"' "$CONFIG")
+```
+
+Treat an absent config or target as a blocker — merge-forward has nowhere to
+target without them. A merge-forward only brings `origin/$TARGET` into the
+brainstorm branch; it never grants permission to merge the brainstorm branch
+into `$TARGET`, so it needs no landing authority to run and an `unset`
+`MERGE_KING` never blocks it.
+
+`orchestration.merge_kings` may not be populated for every target yet: `unset`
+does NOT mean "nobody owns landing, proceed however" — it means the map
+hasn't caught up (same gap `coordinator-merging-code/SKILL.md` documents for
+branch-keyed lookups). `MERGE_KING` matters only when a conflict needs routing
+or at final report. With it `unset` at either point, fall back to whichever
+coordinator has actually been the merge authority for `$TARGET` in practice
+(check with your team, or the project's operational convention) and
+route/report to them the same as if the map had named them explicitly.
+
+## Preserve before merging
+
+Record the current branch, HEAD, status, and ahead/behind counts. Require an
+attached non-target feature branch. Fetch the target branch explicitly:
+
+```bash
+git fetch origin "refs/heads/$TARGET:refs/remotes/origin/$TARGET"
+git rev-list --left-right --count HEAD..."origin/$TARGET"
+```
+
+If the worktree is dirty, preserve tracked and untracked changes as a WIP
+commit and record its SHA — never `git stash`. `stash` is a single shared
+stack across every worktree on this box, not scoped to this worktree or to
+you; a stash push or pop here can silently destroy or restore another agent's
+uncommitted work, with no reflog entry and no recoverable blob for unstaged
+content. A commit is yours alone and fully recoverable.
+
+```bash
+git add -A
+git commit -m "wip: preserve <branch> before merge-forward <timestamp>"
+git rev-parse HEAD
+git status --short
+```
+
+Do not squash, drop, or revert the WIP commit when the requested outcome is a
+clean worktree — it is real history now, not something to discard.
+
+Stop if the worktree is still dirty after the WIP commit. Never use `stash`,
+reset, rebase, force checkout, clean, or force push to obtain a clean state —
+`stash` is banned here exactly like the others, with no worktree-scoped
+exception.
+
+## Merge-forward
+
+Merge the remote-tracking target into the brainstorm branch:
+
+```bash
+git merge --no-edit "origin/$TARGET"
+```
+
+Resolve a conflict only when the correct result is supported by current source
+and the branch's intended work. Otherwise stop with the conflict intact and
+send the branch, worktree, target, and conflicted paths to the user or
+`$MERGE_KING` for direction — falling back to the operational-convention
+authority per above if `$MERGE_KING` is `unset`.
+
+After a successful merge, run validation relevant to every resolved file and
+always run `git diff --check origin/$TARGET..HEAD`.
+
+## Bind freshness to handoff
+
+Immediately before reporting success, fetch the target branch explicitly again
+and verify the fetched target is an ancestor of HEAD:
+
+```bash
+git fetch origin "refs/heads/$TARGET:refs/remotes/origin/$TARGET"
+git rev-list --left-right --count HEAD..."origin/$TARGET"
+git merge-base --is-ancestor "origin/$TARGET" HEAD
+git status --short
+```
+
+If the target advanced, repeat the merge-forward and verification, up to three
+merge cycles in one run. After three moving-target results, stop and report the
+new target SHA instead of claiming the branch is current.
+
+Report the branch and target SHAs, ahead/behind counts, `$MERGE_KING` (or the
+fallback authority if `unset`), validation, clean status, and the WIP commit
+SHA if one was made. Do not push, squash, or drop the WIP commit unless the
+user separately asks.

package/assets/skills/choosing-subagent-models/SKILL.md

@@ -22,6 +22,20 @@ mechanical-task carve-out anymore — lint runs, grep-and-collect, file maps,
 config edits, and all other "simple" work now dispatch at sonnet-low, not Haiku.
 Never select Haiku on own judgment — use sonnet-low instead.
 
+### Read the tiers at the moment of use
+
+**Role templates and launch examples do not name models or effort levels; this
+skill and the live config do.** Read the tier when you are about to spawn or
+launch, never from memory or from a copied example:
+
+```bash
+jq -r '.runtime.role_models' .thrum/config.json
+```
+
+Launching with `--role` and no `--model` resolves the role default
+automatically. A `--model` / `--effort` flag in a launch command takes its value
+from `runtime.role_models` for the target role, per this skill.
+
 ### Agent tiers
 
 Effort tier governs whether an agent does the hard thing or the expedient thing.

package/assets/skills/conversation-only-context/SKILL.md

@@ -62,7 +62,7 @@ Workflow `agent()` opts, agent-definition frontmatter, `thrum tmux launch
 ```python
 Agent(subagent_type="general-purpose",
       name="<prefix>_<slug>",
-      model="sonnet",
+      model="<per choosing-subagent-models>",
       description="<3-5 words>",
       prompt="""<task>
 
@@ -92,14 +92,14 @@ to fire-and-forget monitors, not to a named agent you re-message.
 
 | Subagent role | Name prefix | Model / effort (effort only where exposed) | Result file |
 |---|---|---|---|
-| Investigation, grep, doc summary, mechanical | `<topic>` (e.g. `vmdocs`) | `sonnet` / low | `<scratch>/<name>.md` |
-| Root-cause | `<bead>_rc` | `sonnet` / low | `<scratch>/<bead>-rc.md` |
-| Verifier, reviewer, design-verify | `<bead>_verify` | `sonnet` / medium | `<scratch>/<bead>-verify.md` |
-| Implementer | `impl_<slug>` | `sonnet` / medium | `<scratch>/<slug>-impl.md` |
-| VM driver | `vmdriver_<slug>` | `sonnet` / medium | `<scratch>/<slug>-vm.md` |
-| Prose or deep review | any | `opus` — **only when the operator asks** | as above |
+| Investigation, grep, doc summary, mechanical | `<topic>` (e.g. `vmdocs`) | per `choosing-subagent-models` | `<scratch>/<name>.md` |
+| Root-cause | `<bead>_rc` | per `choosing-subagent-models` | `<scratch>/<bead>-rc.md` |
+| Verifier, reviewer, design-verify | `<bead>_verify` | per `choosing-subagent-models` | `<scratch>/<bead>-verify.md` |
+| Implementer | `impl_<slug>` | per `choosing-subagent-models` | `<scratch>/<slug>-impl.md` |
+| VM driver | `vmdriver_<slug>` | per `choosing-subagent-models` | `<scratch>/<slug>-vm.md` |
+| Prose or deep review | any | per `choosing-subagent-models` — **only when the operator asks** | as above |
 
-Haiku is banned. Opus is never yours to grant onward.
+The model ban list lives in `choosing-subagent-models`. A costly tier is never yours to grant onward.
 
 ### CONSTRAINTS block — paste verbatim into every dispatch
 
@@ -111,8 +111,8 @@ Haiku is banned. Opus is never yours to grant onward.
   tool's own guidance suggests it. It trips a permission modal, and A FROZEN
   PANE EMITS NOTHING, so nobody can tell you are blocked. If you must background
   work, wait for the completion notification.
-- Every sub-agent YOU spawn gets an explicit `model:` — sonnet (low mechanical,
-  medium judgment). HAIKU IS BANNED. Opus is never yours.
+- Every sub-agent YOU spawn gets an explicit `model:` chosen per `choosing-subagent-models`
+  (read `runtime.role_models`). The model ban list lives there. A costly tier is never yours.
 - READ-ONLY git outside your own worktree. NEVER `checkout`/`reset`/`restore`/
   `stash`/`clean` in ANY directory — `stash` is one shared stack across all
   worktrees and the shared tree holds live agents' uncommitted state.
@@ -186,7 +186,7 @@ Restart on a number read from the pane footer, never on a felt sense.
 - The parent reading code or docs "to just check quickly" — message the subagent that already read them and ask for the one field.
 - One subagent handed ten tasks — partition it and dispatch the parts in parallel.
 - A spawn with no `name:` — it cannot be re-messaged. Name every spawn.
-- A spawn with no `model:` — it silently inherits Opus. Pin `model:` on every spawn, and `effort` wherever the mechanism takes it.
+- A spawn with no `model:` — it silently inherits your own model. Pin `model:` on every spawn, and `effort` wherever the mechanism takes it.
 - Holding a design-gating answer behind the rest of the pass while an implementer builds on the old premise — that one goes immediately; the rest ships as one consolidated message.
 - Acting on the resume plan alone and skipping the middle of the prime — the falsified premise sits in the part you skipped.
 - Trusting an older "not started" message over a newer "already running" one — verify, do not recall; that cuts both directions.

package/assets/skills/conversation-only-context/resources/driver-subagent-pattern.md

@@ -21,7 +21,7 @@ findings, and its troubleshooting state across rounds.
 
 Do this:
 
-1. `Agent(name: "vmdriver_<slug>", model: "sonnet", prompt: <round-1 GO>)`.
+1. `Agent(name: "vmdriver_<slug>", model: <per choosing-subagent-models>, prompt: <round-1 GO>)`.
 2. Wait for its report.
 3. `SendMessage(to: "vmdriver_<slug>", message: <round-2 GO>)`.
 

package/assets/skills/conversation-only-context/resources/remote-environment-scenarios.md

@@ -10,7 +10,7 @@ sanctions for reaching it.
 
 You want a multi-hour load or soak run and a verdict, not a log.
 
-1. Spawn `vmdriver_<slug>` with `model: "sonnet"`. The GO names the run, the
+1. Spawn `vmdriver_<slug>` with `model: <per choosing-subagent-models>`. The GO names the run, the
    revision under test, and the exact metrics to report.
 2. The driver opens a persistent session with `<your-ssh-wrapper> <remote-host>`,
    starts the run detached, and writes the exit code to its own file.

package/assets/skills/coordinator-assessing-agent-completion/SKILL.md

@@ -19,6 +19,30 @@ Apply the gate and containment checks below and reach your own
 conclusion. Destructive steps still follow the standing reap preconditions and
 pacing rules; nothing here shortcuts them.
 
+## Standing reap preconditions — ALL must hold
+
+Reaping an agent (removing its worktree) is safe only when every one of these is
+true. It is a gate, not a checklist to rationalize past:
+
+1. **Idle > 48h** — no activity in its transcript for more than two days (rank by
+   message CONTENT, not mtime; your own broadcasts reset mtime).
+2. **No messages exchanged in the last 24h** — nothing sent to it or from it.
+3. **Task complete AND nobody is waiting on it** — it finished and its
+   dispatcher/manager moved on, so a reply it waits for will never come. (A pushed
+   branch held on a still-queued merge is the one nuance — see the
+   held-pending-merge rule.)
+4. **Salvage done first** — its only-copy state is copied to a durable location and
+   verified (see Containment and the reap steps).
+
+**When a needed decision or merge is delayed, ESCALATE — never silently wait.** If an
+agent is parked past the 24h window on something its manager/owner has not acted on,
+raise it explicitly to whoever owns that decision, and re-raise on every subsequent
+run. If the human owner is unresponsive, escalate through your designated escalation
+contact (the human's proxy) rather than leaving the agent parked. A silent park is
+the failure this whole procedure exists to prevent: each run must drive a parked
+agent toward a terminal state — decision made / merge lands (reap-able) or deemed
+orphaned (reap).
+
 ## The instruments, in order of trust
 
 | Question | Instrument |
@@ -81,10 +105,42 @@ sentence IS the terminal statement; a working agent's merely contains one.
 **Name what it is waiting for, then prove that thing is dead or landed.**
 
 *"Held pending the coordinator merge"* is finished only if the merge landed or was
-abandoned. If the merge is still queued, the agent is **correctly** waiting and
-reaping it destroys live context that nobody else holds.
-
-**If you cannot name the blocker, it is not a candidate.**
+abandoned. If the merge is still queued, whether the agent is *correctly* waiting
+depends on its branch and its idle time — see the held-pending-merge rule below.
+
+**If you cannot name the blocker, it is not a candidate.** (This governs the
+*no-transcript* case — absence of evidence — not a named-but-stale merge wait.)
+
+## 🔴 The held-pending-merge case — a PUSHED branch changes the gate
+
+An agent parked "pending the merge" is judged by ONE thing first — **is its branch
+pushed?** — because a merge wait only makes sense if the merge king can reach the
+branch.
+
+- **Branch NOT pushed — broken at ANY idle age.** The merge king cannot access an
+  unpushed branch, so the wait can never resolve, and the agent's commits are also
+  the only copy (unsafe to reap). This is not a legitimate wait — it is a stuck one.
+  → Get the branch PUSHED (nudge the agent / its orchestrator to push it, or escalate
+  that it needs pushing). Never reap an unpushed held-pending-merge agent — pushing
+  first is both what unblocks the merge and what makes any later reap safe.
+- **Branch pushed, idle < 24h.** Legitimately waiting its turn in the merge queue.
+  Leave it (the pushed branch means the merge king can reach it and nothing is lost).
+- **Branch pushed, idle ≥ 24h.** The wait is no longer legitimate — a pushed branch
+  is not the only copy of anything, so any agent could carry the merge. Resolve it to
+  one of two clear states:
+  - **Merge HAPPENED** (branch is an ancestor of trunk, or was abandoned/superseded)
+    → the agent is **ORPHANED**, waiting for a response that will never come → **reap**
+    (salvage-first, and still subject to the standing reap preconditions).
+  - **Merge still PENDING** (branch not on trunk, not abandoned) → the merge king
+    forgot it or the queue is stuck → **ESCALATE** to the merge king (name the branch
+    tip + how long it has waited), and **re-escalate on every subsequent skill run**
+    until it resolves. Never leave it silently parked.
+
+**The escalation is the load-bearing half.** Because each skill run re-checks and
+re-escalates a still-pending merge, the condition is self-correcting: it drives toward
+one of two terminal states — the merge completes (agent then reap-able) or the agent
+is deemed orphaned (reap) — instead of a pushed-branch agent parked forever on a merge
+nobody is tracking. A silent park is exactly the failure this rule prevents.
 
 ## Containment, before anything is stood down
 
@@ -126,8 +182,8 @@ an empty/never-read premise as a match"*). `--force` does NOT bypass it; the gua
 correct. So the reap that actually frees load is worktree removal — but salvage BEFORE you remove,
 then remove PLAIN (no `--force`):
 
-1. Enumerate untracked+ignored `.thrum` content — BOTH flags, one flag alone misses a class
-   (thrum-j14q3): `git status --untracked-files=all --ignored -- .thrum`
+1. Enumerate untracked+ignored `.thrum` content — BOTH flags, one flag alone misses a class:
+   `git status --untracked-files=all --ignored -- .thrum`
 2. Salvage BOTH kinds to their canonical redirect paths, and `cmp`-verify each copy is
    byte-identical to its source:
    - `?? .thrum/agents/<agent>/sessions/*-restart.md` — the restart snapshot.
@@ -218,6 +274,42 @@ RSS-MB.
   you decide**. It is read-only and dry-run — it prints a kill-list, it never
   kills anything.
 
+## 🔴 Footguns — never do these (each measured, each cost real time or state)
+
+- **Never glob/`cp` `.thrum/context/*.md` when salvaging** — the glob matches the
+  shared `project_state.md` and overwrites the canonical copy with a stale worktree
+  copy. Salvage the agent-specific `<agent>.md` by exact name only.
+- **A worktree's `.thrum/` holds a redirect file to the main repo AND a physical
+  stale local copy of shared files** (e.g. `project_state.md`) — the physical
+  worktree copy is NOT canonical; never treat it as the source of truth or copy it
+  upward.
+- **Never use shell-specific builtins in a reap loop without checking the shell** —
+  `mapfile`/`readarray` are bash-only and silently fail in zsh (`command not
+  found`), so the salvage you thought ran did not. Use portable `while read` and
+  verify each salvaged file actually landed.
+- **`rm -rf` raises a confirmation modal that blocks the PARENT pane invisibly** —
+  use `rm -r` for scratch cleanup (identical deletion, no modal). Never `rm -rf`.
+- **`git worktree remove` (plain) silently deletes gitignored-only content (rc=0)**
+  and refuses (rc=128) only on untracked/modified files — salvage is the ONLY
+  protection for gitignored only-copy state.
+- **`git worktree remove` refuses while a just-salvaged untracked snapshot still
+  sits in the worktree** — remove that salvaged copy from the worktree first, then
+  plain-remove.
+- **Never `checkout`/`reset`/`restore`/`stash`/`clean` in a shared tree, even to
+  undo** — to restore a file to its committed version, write it with a plain
+  redirect from `git show <ref>:<path>`, not a checkout.
+- **Test the reap on ONE agent first and verify the EFFECT** (gone from the worktree
+  list AND disk), not just the exit code.
+- **Rank candidates by last-message CONTENT, not elapsed time** — your own
+  broadcasts reset every recipient's idle clock.
+- **`--force` on agent-delete does NOT bypass the CAS guard** on a stale agent — the
+  reap that frees load is worktree removal, not the delete.
+- **Reap order is `thrum tmux kill <session>` FIRST, THEN `git worktree remove`** —
+  removing the worktree alone leaves the agent's tmux session alive with a
+  now-deleted cwd, which the fleet flags as recurring "cwd drift" and whose runtime
+  process keeps consuming RAM/CPU. Kill the session, verify it's gone, then remove
+  the worktree.
+
 ## Why this fails dangerously if you skip the gate
 
 The failure direction is **false-GONE**: concluding a live agent is finished. It

package/assets/skills/coordinator-context-monitoring/SKILL.md

@@ -26,40 +26,51 @@ What's forbidden is a script that bypasses this skill and fires
 `thrum tmux restart --force` unconditionally (that violates
 `feedback_restart_discipline` — burn the runway, don't restart on schedule).
 
-## Coordinator self-restart — ALWAYS `/thrum:restart-extended`
+## Coordinator self-restart — ALWAYS the EXTENDED form, compact-extended FIRST
 
 This skill's tier ladder (Steps 3–5) governs how the coordinator restarts
 **other** agents. When the **coordinator restarts ITSELF**, a different rule
-applies and it is absolute:
+applies and it is absolute — but D5 (owner-ruled)
+REVERSES which command that is:
 
-> **The coordinator ALWAYS self-restarts via `/thrum:restart-extended`, NEVER
-> `/thrum:restart`.**
+> **The coordinator ALWAYS uses the EXTENDED snapshot grade for itself — never
+> the standard/compact form. Which command carries that grade is
+> runtime-directed: `/thrum:compact-extended` on any runtime with a verified
+> compact-equivalent skill (D6, the default), `/thrum:restart-extended` ONLY
+> as the fallback on a runtime without one (today: muse, copilot).**
+
+This is a REVERSAL of the prior absolute rule ("ALWAYS restart-extended, NEVER
+compact") — that rule is retired, not merely relaxed. Do not restore it.
 
 Rationale: the coordinator is the nerve center. Its handoff must carry the full
 16-section snapshot (wire contracts, capability matrix, cycle history, open
 L-questions, anticipated Q&A, design rationale) so the next session resumes
-steady-state coordination without re-deriving fleet state. The standard
-`/thrum:restart` compact format drops that load-bearing context and strands the
-next session. This holds regardless of which tier the coordinator's own context
-sits in — there is no ctx-band at which the coordinator downgrades to the
-compact restart.
+steady-state coordination without re-deriving fleet state — that requirement
+is UNCHANGED and is what "EXTENDED" governs; only the compact-vs-restart choice
+changed. Compacting (rather than restarting) additionally keeps the SAME
+process/session alive — sub-agents, background loops, and cron schedules the
+coordinator owns survive the compaction, where a restart would drop them.
+There is no ctx-band at which the coordinator downgrades to the standard/
+compact-grade snapshot — the tier ladder below governs OTHER agents, not this.
 
-Practical trigger points for coordinator self-restart:
+Practical trigger points for coordinator self-restart/compact:
 
 - A warn-tier context nudge fires on the coordinator's own pane (e.g. 70%+).
 - The coordinator hits a clean checkpoint and elects a fresh session.
 - Rate-limit / stuck-state recovery on the coordinator itself.
 
-In every one of these, run `/thrum:restart-extended`. (Captured as role-rule
-`coord-always-restart-extended` /
-`Coordinator ALWAYS uses /thrum:restart-extended`; this skill is the
-always-loaded home so the rule survives even when memory isn't consulted.)
+In every one of these: run `/thrum:compact-extended` if the coordinator's
+runtime has a compact equivalent (the default); `/thrum:restart-extended` only
+if it does not. (The role-rule `coord-always-restart-extended` — `Coordinator
+ALWAYS uses /thrum:restart-extended` — is RETIRED as of D5; see
+`thrum memory` for its retirement record. This skill is the always-loaded home
+so the CURRENT rule survives even when memory isn't consulted.)
 
 Note the distinction from Steps 3–5 below: those steps drive `/thrum:restart`
 (Step 4) and `/thrum:restart-extended` (Step 5) into
 **implementer/brainstormer** panes per their ctx tier — that tiering is correct
 for worker agents. The carve-out here is ONLY about the coordinator's own
-restart, which is unconditionally the extended form.
+restart/compact, which is unconditionally the extended grade, compact-first.
 
 ## How the scheduled sweep works (v0.10.6+ — thrum monitor)
 
@@ -274,10 +285,7 @@ brick.
 
 ## Subagent model selection
 
-> **Model tiers:** pass an explicit `model:` on every dispatch — `sonnet`
-> (low effort) mechanical, `sonnet` (medium effort) judgment, Opus only on
-> operator-ask or a skill step that names it. See the
-> `choosing-subagent-models` skill for the full policy.
+> **Model tiers:** pass an explicit `model:` on every dispatch; choose model and effort per the `choosing-subagent-models` skill (read `runtime.role_models` at the moment of use). Never let a sub-agent inherit your own model.
 
 ## Step 1 — Run the sweep
 
@@ -464,6 +472,8 @@ by typing the restart command directly into their input field:
 thrum tmux send <tmux_session_name> '/thrum:restart'
 ```
 
+If it exits 3 (Enter WITHHELD, text already typed) or 4 (verdict unknown), do NOT retype it: `thrum tmux capture` the pane and submit with `thrum tmux send <tmux_session_name> --keys Enter` only if no dialog is showing.
+
 (Find the tmux session name in sweep output — it's typically the worktree
 basename, e.g. `myepic-impl`, NOT the agent_id.)
 

package/assets/skills/coordinator-deploying-a-node/SKILL.md

@@ -0,0 +1,124 @@
+---
+name: coordinator-deploying-a-node
+description: "Use when deploying a build to a single node, migrating or not — deploying a build, schema-migrating deploy, pro-bundle install plus service restart on a node, roll out a build to a node, ship to a node, single-node canary. Loads the deploy runbook — verifying the artifact actually CONTAINS the fix, install-before-restart ordering, verify-by-effect, and preventing store corruption on migration."
+---
+
+# Coordinator: Deploying a Build to a Single Node — migrating or not
+
+> This runbook covers EVERY deploy to a single node, migrating or not. Most sections apply to every deploy; only migration-weight and store-corruption specifics are bump-only.
+
+## 0. Pull-current first (ff-only)
+
+The absolute first action before anything else: fetch the control-plane repository and fast-forward to the orchestrator's pin.
+
+- Read the project's deployment adapter inside `.thrum/config.json` (`fleet.deployment`; reference at the deployment-adapter reference) to obtain `preflight.pull_command` and `preflight.pin_command`.
+- Run `preflight.pull_command` (must be ff-only; if not fast-forwardable, STOP and surface — never blind-merge in the shared tree).
+- Verify the delivered artifact actually CONTAINS the fix at the pinned SHA (adapter `artifact.commit_file` sidecar).
+
+This ensures the node's coordinator reasons from a checkout that is actually current before evaluating backup, install, or migration.
+
+> Example — Thrum project: pull via `git fetch origin && git merge --ff-only origin/<branch>` before any backup or install.
+
+## 1. Who executes — resolve the node's local coordinator (via adapter identity)
+
+The node's own coordinator drives the deploy locally on its own host. Never drive a node's build/install/restart from another host.
+
+- Resolve WHO via `topology.identity_resolution` (adapter `fleet.deployment.thrum.topology.identity_resolution` or `fleet.deployment.products.<id>.topology`) — a `daemon_id` join plus hostname and absence of `.thrum/redirect`, never by agent name or worktree name.
+- When connected-repo daemons share a host, respect the adapter-defined restart order within that host.
+
+If the target node has no working coordinator, state why explicitly before using any fallback.
+
+## 2. Back up before touching anything (via adapter backup command + sizing formula)
+
+- Run the project's backup command (`fleet.deployment.thrum.backup.command` or `fleet.deployment.products.<id>.backup.command`) and verify per `backup.verify`.
+- Size BEFORE you run it on a bloated node: apply the adapter's `backup.sizing_formula` (`free_at_completion = free_now - zip(stale current/) + size(stale current/) - size(live lane)`) — the stale `current/` is removed before the fresh export, so peak is not double-count. Retention runs last and does not bound the peak.
+- On failure, roll back via `backup.restore_command`; never delete the store.
+
+> Example — Thrum project: backup via `thrum backup`, sized per the formula above, verified with `sqlite3 ?mode=ro&immutable=1` read.
+
+## 3. Storage access — through the engine or control-plane CLI, never file-bypass
+
+Access the state store only through the engine or the control-plane CLI in read-only mode. Never bypass the storage engine's file ownership.
+
+- Via: `storage_access.via` (e.g., CLI or `?mode=ro`).
+- Forbidden: `storage_access.forbidden` (e.g., hand-copy of live `-wal`/`-shm`, concurrent `.backup` on live store).
+- A bare read-write open can fire a checkpoint that truncates the write log out from under live readers → sustained corruption. Always use `?mode=ro` where applicable.
+
+If the project has no WAL/SHM, this section is N/A — skip and note.
+
+## 4. Never wrap service start/restart in a blind timeout
+
+Run the project's service restart command (`fleet.deployment.thrum.service.restart_command` or product equivalent) without a blind timeout wrapper. A timeout that kills a migrating restart mid-migration manufactures a half-migrated store.
+
+- Adapter flag `service.never_timeout` is true.
+- Signal-window rules are adapter data: `migration.signal_rules` (`SIGQUIT` fatal-always, `SIGUSR1` fatal-before-socket). Respect them — do not send fatal signals in the forbidden window.
+
+> Example — Thrum project: restart via `thrum daemon restart`, never wrapped in `timeout`; mac path via `scripts/mac-daemon-restart-via-cron.sh`.
+
+## 5. Install from the delivered artifact (never rebuild on the node)
+
+Install from the identical bundle the orchestrator built, delivered to `artifact.distribution.drop_path`.
+
+- Verify BEFORE unpack that the delivered bundle's version/checksum/commit sidecar equals the orchestrator's pin (adapter `artifact.checksum`, `artifact.version_file`, `artifact.commit_file`).
+- Run `install.command` (from adapter). The node does not compile, sign, or rebuild — it installs.
+- Collect BEFORE readings (current version, state counters, checkpoint counts, health probes) before the install.
+
+> Example — Thrum project: install from the adapter's `artifact.distribution.drop_path` via the adapter's `install.command`.
+
+## 6. Measure from the running process, never the checkout
+
+Read version/state from the running service, not from the filesystem checkout.
+
+- Verify via `install.verify_by_effect` probes: version equals pin, NEW PID, service status reports pin, sidecar equals pin.
+- Do not trust installer exit 0 alone.
+
+## 7. Migrate via service restart — verify by effect
+
+Migration is performed by restarting the service after install; the service's own boot migration does the schema/data move.
+
+- Calibrate weight via `migration.weight_calibration` (heavy bulk-export vs light add-column) — do not assume a fixed duration.
+- Known signatures that require a cold-restart recovery: `migration.sigbus_signatures` (e.g., WAL-index recover signatures) and `migration.on_sigbus`.
+- Observe that the restarted service reports the new version/state and that health probes have converged (adapter `health.probes`, `health.convergence_wait`).
+
+## 8. Verify post-migration (liveness, health probes, checkpoint counts, agent liveness)
+
+Run adapter `health.probes` and compare BEFORE/AFTER:
+
+- Service alive and reporting pin.
+- State counters converged per `health.convergence_wait` (mechanism-derived, e.g., `3m`).
+- Crash log empty, expected agents live.
+
+For tandem daemons that share a host or depend on each other, verify the coordinated set per adapter.
+
+## 8a. Re-render configuration/templates if the build changes them
+
+If the build carries template or role changes, re-render between install and restart:
+
+- Commands: `templates.refresh_command` and `templates.deploy_command`.
+- Order: `templates.order` (`refresh→deploy` between `install.sh` and daemon restart).
+- Verify by effect (render output, then service restart).
+
+> Example — Thrum project: `thrum roles refresh` then `thrum roles deploy` between install and restart.
+
+## 8b. Plugin/skill refresh if the deploy carries skill changes
+
+If the bundle carries skill/plugin changes, refresh the plugin cache:
+
+- Refresh driver: `plugin.refresh` (version bump required — cache keyed by version).
+- Manifests: `plugin.manifests` (all skill-carrying manifests bumped in the same commit as the new skills).
+
+Do not hand-edit generated marketplace manifests.
+
+## 8c. Reconcile registry/phase after restart
+
+Re-verify the daemon registry and agent phases after restart (adapter `health.probes` includes phase reconciliation). Confirm the pinned version is durable across a clean cold-boot probe where applicable.
+
+## Red flags — STOP
+
+- Pull not ff-only.
+- Backup skipped or undersized.
+- Storage accessed via forbidden path (`storage_access.forbidden`).
+- Restart wrapped in a blind timeout or killed with `SIGQUIT`/`SIGUSR1` in a fatal window (`migration.signal_rules`).
+- Install rebuilt locally instead of from the delivered artifact.
+- Post-migration health not verified by observed effect.
+- Template re-render skipped when the build changed templates (`templates.order` violated).

package/assets/skills/coordinator-dispatching-work/SKILL.md

@@ -65,10 +65,7 @@ optimization.
 
 ## Subagent model selection
 
-> **Model tiers:** pass an explicit `model:` on every dispatch — `sonnet`
-> (low effort) mechanical, `sonnet` (medium effort) judgment, Opus only on
-> operator-ask or a skill step that names it. See the
-> `choosing-subagent-models` skill for the full policy.
+> **Model tiers:** pass an explicit `model:` on every dispatch; choose model and effort per the `choosing-subagent-models` skill (read `runtime.role_models` at the moment of use). Never let a sub-agent inherit your own model.
 
 ## Check the target's queue before you dispatch (R3)
 
@@ -162,13 +159,30 @@ re-dispatch overhead.
 3. Acceptance criteria as bullets
 4. The worktree path the work happens in
 5. An explicit reminder to pass `model:` on any sub-agents the implementer
-   spawns (sonnet-low for mechanical, sonnet-medium for judgment)
+   spawns (model and effort per `choosing-subagent-models`)
 6. Spec/plan paths to read before starting
 7. **Adjacent candidate beads** from the adjacency pass above, labeled as
    CANDIDATES with their validity explicitly unverified — plus the instruction to
    check them against the merged-forward tip and either fold them in or return
    them as completed
 
+## Anti-pattern-removal epics must ship a ratchet lens
+
+**Why:** during a prior owner-bypass remediation, judgment
+review alone let 11 new instances of the exact anti-pattern being removed
+land through the merge gate mid-sprint, because no mechanical check enforced
+a monotonic budget across diffs.
+
+**How to apply:** When dispatching an epic whose purpose is removing an
+existing anti-pattern (not just fixing one instance of it), the acceptance
+criteria MUST include a mechanical ratchet lens (see
+`coordinator-hotpath-merge-gate` § "Invariant-ratchet lenses") wired into
+`.thrum/hotpath-gate.json` as `always_run` before the epic is considered
+closeable — not as a follow-up. A judgment-only acceptance ("reviewer
+confirms the count went down") is insufficient; the count must be enforced
+by a standing mechanical budget the gate itself checks on every subsequent
+merge.
+
 ## Execution invariants — carry these in every implementation dispatch
 
 **Why:** A plan is a snapshot; trunk moves and reality drifts from it. Sprints
@@ -208,17 +222,16 @@ with a different name — do not rename in place.
 
 ## Propagate model-selection discipline downward
 
-**Why:** Sub-agents inherit the parent model by default. A coordinator on Opus
-that spawns an unspecified sub-agent gets Opus-cost work for tasks that need
-sonnet-low. The same trap repeats inside an implementer's worktree: if the
+**Why:** Sub-agents inherit the parent model by default. A coordinator whose own tier is
+costly that spawns an unspecified sub-agent gets costly work for tasks that need
+a cheap tier. The same trap repeats inside an implementer's worktree: if the
 implementer doesn't propagate the discipline, their own sub-agents silently
 inherit too. Cost compounds across a session.
 
 **How to apply:** Every dispatch prompt should include the model-selection rule
 explicitly: "When you spawn your own sub-agents, pass explicit `model:` —
-`sonnet` (low effort) for mechanical work (lint, tests, find/replace), `sonnet`
-(medium effort) for judgment work (review, complex implementation), `opus`
-only when justified. Default to sonnet over opus." Audit the dispatch prompt before sending.
+choose model and effort per the `choosing-subagent-models` skill (read
+`runtime.role_models` at the moment of use); never inherit your own model." Audit the dispatch prompt before sending.
 
 ## The impl-prompt review stamp satisfies pre-dispatch review