opencode-thrum-pro 0.1.5 → 0.1.6

package/assets/commands/thrum-compact.md

@@ -0,0 +1,300 @@
+---
+description:
+  Stage a standard 11-section snapshot, verify it landed, then send /compact to
+  this agent's OWN tmux pane so it stays alive (subagents, loops, crons survive)
+  and resumes at low context. Use for in-place context relief when you do NOT
+  want to kill the session.
+---
+
+# Compact — Snapshot Then Compact In Place
+
+Compose a standard 11-section prose continuation, write it directly to your
+restart file, verify it landed, then send `/compact` to your own tmux pane.
+Unlike `/thrum:restart` and `/thrum:sleep`, compact does NOT end your session and
+does NOT kill your tmux pane — the agent stays ALIVE. Any sub-agents, background
+loops, and cron schedules you own keep running across the compaction (confirmed
+empirically). After compaction you Read your snapshot by hand and re-prime lean.
+
+## When to Use
+
+- Your context is high and you want relief WITHOUT losing the live session —
+  you own sub-agents, a background loop, or a cron that must survive.
+- You are mid-task and a fresh session (which loses in-flight sub-agent handles
+  and scheduler state) would be more expensive than a compaction.
+
+For context-exhaustion or stuck-state cases where a FRESH session is the right
+answer — or where the coordinator should move you — use `/thrum:restart`. For
+operator-shutdown parking that kills the session, use `/thrum:sleep`. Compact is
+the only one of the three that keeps the runtime process alive.
+
+## Steps
+
+### 1. Verify tmux session (Tier 1 pre-check; run BEFORE composing anything)
+
+```bash
+# compact SENDS /compact to your own pane, so a non-tmux agent has no pane to
+# target. Fail fast before you spend a snapshot composing.
+SESSION_RAW=$(thrum whoami --field tmux_session)
+if [ -z "$SESSION_RAW" ]; then
+  echo "ERROR: the compact command requires a tmux-managed agent session (tmux_session field is empty)."
+  echo "For a non-tmux agent, run /compact yourself and Read your snapshot by hand afterward."
+  exit 1
+fi
+```
+
+If `tmux_session` is empty: ABORT before composing. Exit code 1.
+
+### 2. Read the shared snapshot-composition partial
+
+**First, persist state + queue.** Update your personal state
+(`thrum state set --kind personal_state ...` — see the `using-thrum-state`
+skill) and your committed work (`thrum queue` — see the `using-the-queue`
+skill) BEFORE composing your snapshot below — these survive compaction
+independently of the prose continuation file and are what a post-compact
+render reads back.
+
+Read the partial at the absolute path (resolve `$REPO` yourself first via
+`thrum agent worktree --authoritative` — NEVER `thrum whoami --field worktree`
+or `git rev-parse --show-toplevel`, both cwd-resolved and the root cause of
+a documented snapshot-save loss class; there is no git fallback):
+
+```text
+${REPO}/claude-plugin/commands/_snapshot-protocol.md
+```
+
+Apply its Step 2 (compose your continuation) per the structure guidance.
+
+**Use the STANDARD 11-section structure.** For comprehensive
+designer/architect-grade snapshots, use `/thrum:compact-extended` instead.
+
+**Note on §1 framing:** For a compact snapshot, §1 frames as "where work stands
+at compaction" — you are continuing in place, not completing and not parking.
+
+**Your snapshot's FIRST line MUST be the compact resume header**, above §1. It
+survives even if post-compact orientation fails, so it is read-first and
+self-contained:
+
+> 🔴 ON RESUME — you were COMPACTED, not restarted. Daemon binding is intact
+> (subagents/loops/crons survived). Resume LEAN: this file is delivered inline in the injected briefing (read it FIRST). Expect a
+> `thrum prime --light` briefing already auto-injected by the SessionStart
+> hook; only run `thrum:prime-agent` if it did NOT appear. Do NOT manually run
+> full `thrum prime`. Then continue from §9.
+
+Then §1…§11 as normal, with §9 (Numbered resume plan) actionable from a
+compacted (not cold) start.
+
+### 3. Write the continuation
+
+First run this PREP block (it mints the path and a per-run nonce), then use the
+Write tool per Step 3 of the partial:
+
+```bash
+# The Bash tool does NOT persist shell state across calls, so this block
+# re-resolves identity itself. Fail closed: no cwd/git fallback.
+REPO=$(
+  thrum agent worktree --authoritative 2>/dev/null
+) || { echo "ERROR: cannot authoritatively resolve your worktree via the daemon. Refusing to fall back to cwd/git-toplevel — that would risk silently saving this snapshot to the wrong repo. Check daemon connectivity and retry."; exit 1; }
+[ -n "$REPO" ] || { echo "ERROR: thrum agent worktree --authoritative returned empty"; exit 1; }
+AGENT=$(thrum whoami --field agent_id) || { echo "ERROR: agent not registered"; exit 1; }
+[ -n "$AGENT" ] || { echo "ERROR: empty agent_id"; exit 1; }
+mkdir -p "${REPO}/.thrum/restart"
+SNAPSHOT="${REPO}/.thrum/restart/${AGENT}.md"
+NONCE="zn6fx-$(date +%s)-$$-${RANDOM}${RANDOM}"
+echo "SNAPSHOT_PATH=${SNAPSHOT}"
+echo "SNAPSHOT_NONCE=${NONCE}"
+```
+
+Write to EXACTLY the printed `SNAPSHOT_PATH` (not a path you re-derive), and make
+sure the file contains the marker below (as its final line), with the printed `SNAPSHOT_NONCE` — verify searches the whole file for it:
+
+```text
+<!-- snapshot-nonce: <SNAPSHOT_NONCE> -->
+```
+
+**Record both values** — the verify step pastes them into its verify block, which
+fails closed unless the file at that exact path carries that nonce.
+
+This file lives on disk and is UNAFFECTED by compaction — compaction rewrites
+your conversation context, never your worktree. So the snapshot you write now is
+readable after `/compact` fires. There is no durable-backup step (the worktree is
+not torn down, so `/thrum:sleep`'s teardown-loss risk does not apply here).
+
+### 4. Verify your snapshot, then fire /compact (ONE block)
+
+> ✅ **Use the SINGLE-call self-send form below — it is required, not stylistic.**
+> `thrum tmux send` (OD-5 = B; supersedes `thrum tmux key`,
+> which is being retired) takes exactly ONE client call: the daemon
+> types the text, waits a settle gap, checks for a pending dialog, and only then
+> sends the confirming Enter — all server-side, in that order, within the SAME
+> call. There is no separate `key --type` + `key Enter` pair to race, because
+> there is no second client call: a client-side race is structurally impossible
+> here, not merely avoided by convention.
+> 🔴 **Never issue two separate calls (one for the text, one for Enter)** — that
+> shape is what the retired `tmux key` two-step form did, and it is what
+> produced a truncated `/compac` → invalid command → silent no-op (measured).
+> A single `thrum tmux send "$SESSION" "<command>"` call has no such split to
+> make.
+
+On a non-Claude runtime this block sends that runtime's own compact-equivalent
+command in place of `/compact` — see
+`${REPO}/claude-plugin/commands/_compact-runtime-commands.md` for the cited
+per-runtime table; `scripts/sync-skills.sh` applies the substitution when
+syncing this file to each runtime's plugin tree.
+
+Firing `/compact` before the Step 3 Write lands compacts a pre-write context and
+resumes from a stale/blank file — the exact failure this command prevents. This
+block (paste the two values printed by the Step 3 PREP block into its first two
+lines) re-resolves identity (the Bash tool does NOT persist shell state across
+calls, so earlier steps' variables are gone), verifies the snapshot on disk, and
+only then fires `/compact` — all in ONE call so nothing depends on a prior block.
+
+```bash
+SNAPSHOT="<PASTE SNAPSHOT_PATH FROM STEP 3>"
+NONCE="<PASTE SNAPSHOT_NONCE FROM STEP 3>"
+# Fresh authoritative re-resolution; must agree with the path you actually wrote.
+REPO=$(
+  thrum agent worktree --authoritative 2>/dev/null
+) || { echo "ERROR: cannot authoritatively resolve your worktree via the daemon. Refusing to fall back to cwd/git-toplevel — that would risk silently resuming from the wrong repo's snapshot. Check daemon connectivity and retry."; exit 1; }
+[ -n "$REPO" ] || { echo "ERROR: thrum agent worktree --authoritative returned empty"; exit 1; }
+AGENT=$(thrum whoami --field agent_id) || { echo "ERROR: agent not registered"; exit 1; }
+[ -n "$AGENT" ] || { echo "ERROR: empty agent_id"; exit 1; }
+SESSION_RAW=$(thrum whoami --field tmux_session)
+SESSION=${SESSION_RAW%%:*}
+EXPECTED="${REPO}/.thrum/restart/${AGENT}.md"
+BIND_OK=1
+if [ -z "$SNAPSHOT" ] || [ -z "$NONCE" ] || [[ "$SNAPSHOT$NONCE" == *"<PASTE"* ]]; then
+  echo "VERIFY FAILED: SNAPSHOT/NONCE not filled in — paste SNAPSHOT_PATH and SNAPSHOT_NONCE from Step 3. SNAPSHOT_OK=0"; BIND_OK=0
+elif [ "$SNAPSHOT" != "$EXPECTED" ]; then
+  echo "VERIFY FAILED: identity/worktree DRIFT between write time and verify time. Written path: $SNAPSHOT — re-resolved path: $EXPECTED. SNAPSHOT_OK=0"; BIND_OK=0
+fi
+
+# mtime: choose the stat dialect explicitly. GNU `stat -f` means --file-system
+# (wrong, multiline) — the `stat -f %m . || stat -c %Y` one-liner is fragile on
+# Linux, so branch on which dialect this box speaks.
+if stat -f %m . >/dev/null 2>&1; then
+  MTIME=$(
+    stat -f %m "$SNAPSHOT" 2>/dev/null
+  )
+else
+  MTIME=$(
+    stat -c %Y "$SNAPSHOT" 2>/dev/null
+  )
+fi
+NOW=$(date +%s)
+AGE=$(( NOW - ${MTIME:-0} ))
+
+SNAPSHOT_OK=1
+if [ "$BIND_OK" = 0 ]; then
+  SNAPSHOT_OK=0   # binding failure already reported above
+elif [ ! -s "$SNAPSHOT" ] || [ ! -r "$SNAPSHOT" ]; then
+  echo "VERIFY FAILED: snapshot missing/empty/unreadable at $SNAPSHOT"; SNAPSHOT_OK=0
+elif [ "$AGE" -gt 300 ]; then
+  echo "VERIFY FAILED: snapshot is ${AGE}s old — stale (prior write), not this session's"; SNAPSHOT_OK=0
+elif ! grep -qF -- "$NONCE" "$SNAPSHOT"; then
+  echo "VERIFY FAILED: nonce not found in $SNAPSHOT — file at that path is not this session's write"; SNAPSHOT_OK=0
+else
+  echo "VERIFY OK: snapshot non-empty, readable, written ${AGE}s ago"
+fi
+
+SESSION_OK=1
+if [ -n "$SESSION" ] && tmux has-session -t "$SESSION" 2>/dev/null; then
+  echo "VERIFY OK: tmux session '$SESSION' resolves"
+else
+  echo "VERIFY FAILED: tmux session '$SESSION' (from '$SESSION_RAW') does not resolve"; SESSION_OK=0
+fi
+
+if [ "$SNAPSHOT_OK" = 1 ] && [ "$SESSION_OK" = 1 ]; then
+  # ONE call: `thrum tmux send` queues this text+Enter delivery on the daemon
+  # (internal/daemon/rpc.HandleQueue -> sendQueuedCommand). The daemon waits
+  # for your own pane to go idle (this turn ending is what makes it idle —
+  # emit nothing further after this call), types the command, pauses a settle
+  # gap, checks the pane for a pending dialog, and ONLY THEN sends Enter. If a
+  # dialog is showing at that moment, the daemon withholds Enter itself
+  # (queuedPaneShowsDialogFn / ErrPaneShowsDialog) — a HOLD happens
+  # server-side, automatically, with no separate client-side check needed
+  # here. There is no second client call for Enter, so there is nothing to
+  # race: the old two-step `key --type` + `key Enter` truncation class
+  # (measured: a timed-out type left a separate Enter to submit "/compac")
+  # cannot occur when text+Enter are ONE call.
+  #
+  # This dispatch is ASYNC, not instant: it typically fires within a few
+  # seconds of your pane going idle, not in the same instant this call
+  # returns. That is expected — you are not emitting anything further this
+  # turn regardless, so the delay costs nothing.
+  thrum tmux send "$SESSION" "/compact"
+  SEND_RC=$?
+  # Exit 3 = HELD (Enter withheld), 4 = VERDICT UNKNOWN: "/compact" is already
+  # typed in the pane. Do NOT retype it (that yields "/compact/compact"); report
+  # and stop so a human/coordinator can inspect the pane.
+  if [ "$SEND_RC" -eq 3 ] || [ "$SEND_RC" -eq 4 ]; then
+    echo "HOLDING: thrum tmux send exited ${SEND_RC} (3=Enter WITHHELD, 4=verdict unknown) — /compact is typed but not confirmed submitted. NOT retrying."
+    echo "Report this to your coordinator (or the operator if you are top-level) and stop."
+    exit 1
+  elif [ "$SEND_RC" -ne 0 ]; then
+    echo "ERROR: thrum tmux send exited ${SEND_RC} — /compact was not queued. Report and stop."
+    exit 1
+  fi
+  # thrum-xyz: queue the RESUME PROMPT right behind /compact, on the same
+  # daemon queue. Hook output is context only — it does not start a turn — so
+  # without this an idle pane with an empty inbox can sit at 0% context, empty
+  # composer, until a human types. The daemon dispatches it once the pane is
+  # idle again AFTER the compaction (FIFO behind /compact), so it is not a
+  # timer and it fires exactly once.
+  RESUME_PROMPT="Compaction complete - please continue: your Resume Plan is in the auto-injected briefing (# Previous Session Context). If it is missing, read ${SNAPSHOT} or the newest *-restart.md in .thrum/agents/${AGENT}/sessions/ of the main repo, then execute its numbered resume plan."
+  thrum tmux send "$SESSION" "$RESUME_PROMPT"
+  RESUME_RC=$?
+  if [ "$RESUME_RC" -eq 0 ]; then
+    :
+  else
+    echo "WARNING: thrum tmux send exited ${RESUME_RC} — the post-compact resume prompt was NOT queued (exit 3/4 = already typed, do NOT retype). If the pane sits idle after compaction, send it a resume prompt by hand."
+  fi
+else
+  echo "HOLDING: not firing /compact. Report the VERIFY FAILED line(s) above to"
+  echo "your coordinator (or the operator if you are top-level) and stop."
+  exit 1
+fi
+```
+
+**Fail-closed binding rule:** the block only passes for the exact path and nonce
+the Step 3 PREP block printed. It refuses (VERIFY FAILED, no `/compact`) if the
+values are empty or still placeholders, if a fresh re-resolution of your identity
+yields a different path (drift), or if the file at that path lacks the nonce — a
+fresh file merely sitting at the re-derived path is NOT proof you wrote it.
+
+If EITHER check fails, the block HOLDS and does not fire `/compact` — holding is
+safe; compacting against an unverified snapshot loses the context this command
+exists to preserve. After a successful send, the turn ends; emit no further tool
+calls or prose this turn. The send is queued, not synchronous — it fires once
+your pane goes idle, which only happens if you stop acting now.
+
+## How resume works
+
+After `/compact` the SAME process and session survive — the daemon binding is
+intact (that is why your sub-agents, loops, and crons kept running). Full
+`thrum prime` rebuilds identity + binding + full briefing for a NEW session; none
+of that is needed here. Resume LEAN, in this order:
+
+1. **Your Resume Plan arrives inline — do not go looking for the file.** The
+   `SessionStart` hook auto-injects a `thrum prime --light` briefing zero-turn,
+   and its `# Previous Session Context` section carries your full snapshot,
+   including the `ON RESUME` header; execute §9 from it. That prime ARCHIVES the
+   snapshot (moves `${REPO}/.thrum/restart/${AGENT}.md` into the main repo's
+   `.thrum/agents/${AGENT}/sessions/`), so the original path is normally GONE
+   by the time you look — that is by design, not loss. Only if no briefing
+   appeared (daemon unreachable), read the newest `*-restart.md` in that
+   `sessions/` directory (or `${REPO}/.thrum/restart/${AGENT}.md` if it still
+   exists) and run `thrum:prime-agent` manually as the fallback. Never manually
+   run full `thrum prime` when the briefing is present.
+2. **A resume prompt starts your first turn.** Step 4 queued a "Compaction
+   complete - please continue" prompt on the daemon right behind `/compact`; it
+   is delivered once the pane is idle after compaction, so a turn starts even
+   with an empty inbox.
+3. **Continue** from §9. Reconnect to your still-live sub-agents, loops, and
+   crons rather than re-dispatching.
+
+Runtime-specific compaction-recovery hooks (if this runtime has any) are
+documented in that runtime's own plugin tree (its hooks manifest and
+the scripts it points to), not here.
+
+**Follow the Resume Plan in your injected `# Previous Session Context` (snapshot
+saved at `${REPO}/.thrum/restart/${AGENT}.md`, archived by the prime) post-compact.**

package/assets/commands/thrum-inbox.md

@@ -9,7 +9,7 @@ thrum inbox                  # All recent messages (auto-marks as read)
 thrum inbox --unread         # Unread only (does not mark as read)
 thrum inbox --json           # Machine-readable
 thrum sent --unread          # Check sent items with unread recipients
-thrum message read --all     # Mark all messages as read
+thrum message read --all --force  # Mark ALL unread as read (run `read --all` alone first — dry run)
 ```
 
 **Search — do not page through it.** The default page is 10, newest-first, so

package/assets/commands/thrum-restart-extended.md

@@ -34,12 +34,16 @@ artifact alone.
 
 ```bash
 # $REPO must be YOUR worktree — the directory `thrum prime` reads the restart
-# snapshot back from. Resolve it from the daemon's authoritative identity, NOT
-# `git rev-parse` (which keys off the current shell CWD and would write to the
-# wrong .thrum/restart/ if a bash step left your worktree). Fall back to git
-# only if whoami can't answer.
-REPO=$(thrum whoami --field worktree 2>/dev/null)
-[ -n "$REPO" ] || REPO=$(git rev-parse --show-toplevel) || { echo "ERROR: cannot resolve your worktree"; exit 1; }
+# snapshot back from. Resolve it ONLY via the daemon's authoritative,
+# peercred-resolved identity (`thrum agent worktree --authoritative`) — NEVER
+# via `thrum whoami --field worktree` or `git rev-parse --show-toplevel`
+# (both cwd-resolved). A cwd-derived pattern could silently
+# resolve to a DIFFERENT agent's worktree, or the main repo. There is NO git
+# fallback — if the daemon can't answer, refuse and stop rather than guess.
+REPO=$(
+  thrum agent worktree --authoritative 2>/dev/null
+) || { echo "ERROR: cannot authoritatively resolve your worktree via the daemon. Refusing to fall back to cwd/git-toplevel — that would risk silently saving this snapshot to the wrong repo. Check daemon connectivity and retry."; exit 1; }
+[ -n "$REPO" ] || { echo "ERROR: thrum agent worktree --authoritative returned empty"; exit 1; }
 AGENT=$(thrum whoami --field agent_id) || { echo "ERROR: agent not registered"; exit 1; }
 [ -n "$AGENT" ] || { echo "ERROR: empty agent_id"; exit 1; }
 mkdir -p "${REPO}/.thrum/restart"
@@ -64,8 +68,36 @@ structure and the EXTENDED 16-section structure with per-section guidance.
 
 ### 3. Write the continuation
 
-Per Step 3 of the partial, use the Write tool to save your composed continuation
-to `${REPO}/.thrum/restart/${AGENT}.md`. `thrum prime` auto-injects this file on
+First run this PREP block (it mints the path and a per-run nonce):
+
+```bash
+# The Bash tool does NOT persist shell state across calls, so this block
+# re-resolves identity itself. Fail closed: no cwd/git fallback.
+REPO=$(
+  thrum agent worktree --authoritative 2>/dev/null
+) || { echo "ERROR: cannot authoritatively resolve your worktree via the daemon. Refusing to fall back to cwd/git-toplevel — that would risk silently saving this snapshot to the wrong repo. Check daemon connectivity and retry."; exit 1; }
+[ -n "$REPO" ] || { echo "ERROR: thrum agent worktree --authoritative returned empty"; exit 1; }
+AGENT=$(thrum whoami --field agent_id) || { echo "ERROR: agent not registered"; exit 1; }
+[ -n "$AGENT" ] || { echo "ERROR: empty agent_id"; exit 1; }
+mkdir -p "${REPO}/.thrum/restart"
+SNAPSHOT="${REPO}/.thrum/restart/${AGENT}.md"
+NONCE="zn6fx-$(date +%s)-$$-${RANDOM}${RANDOM}"
+echo "SNAPSHOT_PATH=${SNAPSHOT}"
+echo "SNAPSHOT_NONCE=${NONCE}"
+```
+
+Write to EXACTLY the printed `SNAPSHOT_PATH` (not a path you re-derive), and make
+sure the file contains the marker below (as its final line), with the printed `SNAPSHOT_NONCE` — verify searches the whole file for it:
+
+```text
+<!-- snapshot-nonce: <SNAPSHOT_NONCE> -->
+```
+
+**Record both values** — the verify step pastes them into its verify block, which
+fails closed unless the file at that exact path carries that nonce.
+
+Then, per Step 3 of the partial, use the Write tool to save your composed
+continuation to that exact path. `thrum prime` auto-injects this file on
 next session start regardless of whether wake comes from `thrum tmux restart` or
 operator-initiated `thrum tmux create`.
 
@@ -91,13 +123,44 @@ to preserve — strictly worse than idling. Verify the EFFECT, not the action: a
 vague "I wrote it" is not verification; check the FILE.
 
 ```bash
-SNAPSHOT="${REPO}/.thrum/restart/${AGENT}.md"
+SNAPSHOT="<PASTE SNAPSHOT_PATH FROM STEP 3>"
+NONCE="<PASTE SNAPSHOT_NONCE FROM STEP 3>"
+# Fresh authoritative re-resolution (shell state does NOT persist across Bash
+# calls); it must agree with the path you actually wrote in Step 3.
+REPO=$(
+  thrum agent worktree --authoritative 2>/dev/null
+) || { echo "ERROR: cannot authoritatively resolve your worktree via the daemon. Refusing to fall back to cwd/git-toplevel — that would risk silently verifying the wrong repo's snapshot. Check daemon connectivity and retry."; exit 1; }
+[ -n "$REPO" ] || { echo "ERROR: thrum agent worktree --authoritative returned empty"; exit 1; }
+AGENT=$(thrum whoami --field agent_id) || { echo "ERROR: agent not registered"; exit 1; }
+[ -n "$AGENT" ] || { echo "ERROR: empty agent_id"; exit 1; }
+SESSION_RAW=$(thrum whoami --field tmux_session)
+SESSION=${SESSION_RAW%%:*}
+EXPECTED="${REPO}/.thrum/restart/${AGENT}.md"
+BIND_OK=1
+if [ -z "$SNAPSHOT" ] || [ -z "$NONCE" ] || [[ "$SNAPSHOT$NONCE" == *"<PASTE"* ]]; then
+  echo "VERIFY FAILED: SNAPSHOT/NONCE not filled in — paste SNAPSHOT_PATH and SNAPSHOT_NONCE from Step 3. SNAPSHOT_OK=0"; BIND_OK=0
+elif [ "$SNAPSHOT" != "$EXPECTED" ]; then
+  echo "VERIFY FAILED: identity/worktree DRIFT between write time and verify time. Written path: $SNAPSHOT — re-resolved path: $EXPECTED. SNAPSHOT_OK=0"; BIND_OK=0
+fi
 NOW=$(date +%s)
-MTIME=$(stat -f %m "$SNAPSHOT" 2>/dev/null || stat -c %Y "$SNAPSHOT" 2>/dev/null)
+# mtime: choose the stat dialect explicitly. GNU `stat -f` means --file-system
+# (succeeds with multiline garbage), so the `stat -f %m || stat -c %Y` one-liner
+# breaks on Linux — branch on which dialect this box speaks.
+if stat -f %m . >/dev/null 2>&1; then
+  MTIME=$(
+    stat -f %m "$SNAPSHOT" 2>/dev/null
+  )
+else
+  MTIME=$(
+    stat -c %Y "$SNAPSHOT" 2>/dev/null
+  )
+fi
 AGE=$(( NOW - ${MTIME:-0} ))
 SNAPSHOT_OK=1
 
-if [ ! -f "$SNAPSHOT" ]; then
+if [ "$BIND_OK" = 0 ]; then
+  SNAPSHOT_OK=0   # binding failure already reported above
+elif [ ! -f "$SNAPSHOT" ]; then
   echo "VERIFY FAILED: no snapshot at $SNAPSHOT"; SNAPSHOT_OK=0
 elif [ ! -s "$SNAPSHOT" ]; then
   echo "VERIFY FAILED: snapshot at $SNAPSHOT is empty"; SNAPSHOT_OK=0
@@ -105,6 +168,8 @@ elif [ ! -r "$SNAPSHOT" ]; then
   echo "VERIFY FAILED: snapshot at $SNAPSHOT is not readable"; SNAPSHOT_OK=0
 elif [ "$AGE" -gt 300 ]; then
   echo "VERIFY FAILED: snapshot at $SNAPSHOT is ${AGE}s old — stale (from a prior restart), not this session's write"; SNAPSHOT_OK=0
+elif ! grep -qF -- "$NONCE" "$SNAPSHOT"; then
+  echo "VERIFY FAILED: nonce not found in $SNAPSHOT — file at that path is not this session's write"; SNAPSHOT_OK=0
 else
   echo "VERIFY OK: snapshot exists, non-empty, readable, written ${AGE}s ago"
 fi
@@ -120,8 +185,16 @@ else
   echo "VERIFY FAILED: tmux session '$SESSION' (stripped from '$SESSION_RAW') does not resolve to a live tmux session"
   SESSION_OK=0
 fi
+echo "SNAPSHOT_OK=${SNAPSHOT_OK} SESSION_OK=${SESSION_OK}"
 ```
 
+**Fail-closed binding rule:** the block passes only for the exact path and nonce
+the Step 3 PREP block printed (paste them into its first two lines). Empty or
+placeholder values, identity/worktree drift between write and verify time, or a
+file at that path without the nonce all mean VERIFY FAILED — a fresh file merely
+sitting at the re-derived path is NOT proof you wrote it. Use the
+`SNAPSHOT_OK`/`SESSION_OK` values it prints in Step 6.
+
 **"Properly" means, explicitly:** snapshot exists at your OWN worktree's
 `.thrum/restart/<your-agent-id>.md`, non-empty, readable, AND recently written
 by Step 3 of THIS session (not a leftover from a previous restart that Step 3

package/assets/commands/thrum-restart.md

@@ -15,12 +15,17 @@ orchestrate the handoff.
 
 ```bash
 # $REPO must be YOUR worktree — the directory `thrum prime` reads the restart
-# snapshot back from. Resolve it from the daemon's authoritative identity, NOT
-# `git rev-parse` (which keys off the current shell CWD and would write to the
-# wrong .thrum/restart/ if a bash step left your worktree). Fall back to git
-# only if whoami can't answer.
-REPO=$(thrum whoami --field worktree 2>/dev/null)
-[ -n "$REPO" ] || REPO=$(git rev-parse --show-toplevel) || { echo "ERROR: cannot resolve your worktree"; exit 1; }
+# snapshot back from. Resolve it ONLY via the daemon's authoritative,
+# peercred-resolved identity (`thrum agent worktree --authoritative`) — NEVER
+# via `thrum whoami --field worktree` or `git rev-parse --show-toplevel`
+# (both cwd-resolved). A cwd-derived pattern could silently
+# resolve to a DIFFERENT agent's worktree, or the main repo, saving this
+# snapshot where nothing ever reads it back. There is NO git fallback — if
+# the daemon can't answer, refuse and stop rather than guess.
+REPO=$(
+  thrum agent worktree --authoritative 2>/dev/null
+) || { echo "ERROR: cannot authoritatively resolve your worktree via the daemon. Refusing to fall back to cwd/git-toplevel — that would risk silently saving this snapshot to the wrong repo. Check daemon connectivity and retry."; exit 1; }
+[ -n "$REPO" ] || { echo "ERROR: thrum agent worktree --authoritative returned empty"; exit 1; }
 AGENT=$(thrum whoami --field agent_id) || { echo "ERROR: agent not registered"; exit 1; }
 [ -n "$AGENT" ] || { echo "ERROR: empty agent_id"; exit 1; }
 mkdir -p "${REPO}/.thrum/restart"
@@ -130,12 +135,36 @@ always be present so future-you can scan for what's covered and what isn't.
 
 ### 3. Write the continuation directly to your restart file
 
-Use your Write tool to save the composed continuation to:
+First run this PREP block (it mints the path and a per-run nonce):
+
+```bash
+# The Bash tool does NOT persist shell state across calls, so this block
+# re-resolves identity itself. Fail closed: no cwd/git fallback.
+REPO=$(
+  thrum agent worktree --authoritative 2>/dev/null
+) || { echo "ERROR: cannot authoritatively resolve your worktree via the daemon. Refusing to fall back to cwd/git-toplevel — that would risk silently saving this snapshot to the wrong repo. Check daemon connectivity and retry."; exit 1; }
+[ -n "$REPO" ] || { echo "ERROR: thrum agent worktree --authoritative returned empty"; exit 1; }
+AGENT=$(thrum whoami --field agent_id) || { echo "ERROR: agent not registered"; exit 1; }
+[ -n "$AGENT" ] || { echo "ERROR: empty agent_id"; exit 1; }
+mkdir -p "${REPO}/.thrum/restart"
+SNAPSHOT="${REPO}/.thrum/restart/${AGENT}.md"
+NONCE="zn6fx-$(date +%s)-$$-${RANDOM}${RANDOM}"
+echo "SNAPSHOT_PATH=${SNAPSHOT}"
+echo "SNAPSHOT_NONCE=${NONCE}"
+```
+
+Write to EXACTLY the printed `SNAPSHOT_PATH` (not a path you re-derive), and make
+sure the file contains the marker below (as its final line), with the printed `SNAPSHOT_NONCE` — verify searches the whole file for it:
 
 ```text
-${REPO}/.thrum/restart/${AGENT}.md
+<!-- snapshot-nonce: <SNAPSHOT_NONCE> -->
 ```
 
+**Record both values** — the verify step pastes them into its verify block, which
+fails closed unless the file at that exact path carries that nonce.
+
+Then use your Write tool to save the composed continuation to that exact path.
+
 `thrum prime` will auto-inject this file at next session start. No bash heredoc
 or `cat <<EOF` redirection is needed — write the file directly.
 
@@ -161,13 +190,44 @@ to preserve — strictly worse than idling. Verify the EFFECT, not the action: a
 vague "I wrote it" is not verification; check the FILE.
 
 ```bash
-SNAPSHOT="${REPO}/.thrum/restart/${AGENT}.md"
+SNAPSHOT="<PASTE SNAPSHOT_PATH FROM STEP 3>"
+NONCE="<PASTE SNAPSHOT_NONCE FROM STEP 3>"
+# Fresh authoritative re-resolution (shell state does NOT persist across Bash
+# calls); it must agree with the path you actually wrote in Step 3.
+REPO=$(
+  thrum agent worktree --authoritative 2>/dev/null
+) || { echo "ERROR: cannot authoritatively resolve your worktree via the daemon. Refusing to fall back to cwd/git-toplevel — that would risk silently verifying the wrong repo's snapshot. Check daemon connectivity and retry."; exit 1; }
+[ -n "$REPO" ] || { echo "ERROR: thrum agent worktree --authoritative returned empty"; exit 1; }
+AGENT=$(thrum whoami --field agent_id) || { echo "ERROR: agent not registered"; exit 1; }
+[ -n "$AGENT" ] || { echo "ERROR: empty agent_id"; exit 1; }
+SESSION_RAW=$(thrum whoami --field tmux_session)
+SESSION=${SESSION_RAW%%:*}
+EXPECTED="${REPO}/.thrum/restart/${AGENT}.md"
+BIND_OK=1
+if [ -z "$SNAPSHOT" ] || [ -z "$NONCE" ] || [[ "$SNAPSHOT$NONCE" == *"<PASTE"* ]]; then
+  echo "VERIFY FAILED: SNAPSHOT/NONCE not filled in — paste SNAPSHOT_PATH and SNAPSHOT_NONCE from Step 3. SNAPSHOT_OK=0"; BIND_OK=0
+elif [ "$SNAPSHOT" != "$EXPECTED" ]; then
+  echo "VERIFY FAILED: identity/worktree DRIFT between write time and verify time. Written path: $SNAPSHOT — re-resolved path: $EXPECTED. SNAPSHOT_OK=0"; BIND_OK=0
+fi
 NOW=$(date +%s)
-MTIME=$(stat -f %m "$SNAPSHOT" 2>/dev/null || stat -c %Y "$SNAPSHOT" 2>/dev/null)
+# mtime: choose the stat dialect explicitly. GNU `stat -f` means --file-system
+# (succeeds with multiline garbage), so the `stat -f %m || stat -c %Y` one-liner
+# breaks on Linux — branch on which dialect this box speaks.
+if stat -f %m . >/dev/null 2>&1; then
+  MTIME=$(
+    stat -f %m "$SNAPSHOT" 2>/dev/null
+  )
+else
+  MTIME=$(
+    stat -c %Y "$SNAPSHOT" 2>/dev/null
+  )
+fi
 AGE=$(( NOW - ${MTIME:-0} ))
 SNAPSHOT_OK=1
 
-if [ ! -f "$SNAPSHOT" ]; then
+if [ "$BIND_OK" = 0 ]; then
+  SNAPSHOT_OK=0   # binding failure already reported above
+elif [ ! -f "$SNAPSHOT" ]; then
   echo "VERIFY FAILED: no snapshot at $SNAPSHOT"; SNAPSHOT_OK=0
 elif [ ! -s "$SNAPSHOT" ]; then
   echo "VERIFY FAILED: snapshot at $SNAPSHOT is empty"; SNAPSHOT_OK=0
@@ -175,6 +235,8 @@ elif [ ! -r "$SNAPSHOT" ]; then
   echo "VERIFY FAILED: snapshot at $SNAPSHOT is not readable"; SNAPSHOT_OK=0
 elif [ "$AGE" -gt 300 ]; then
   echo "VERIFY FAILED: snapshot at $SNAPSHOT is ${AGE}s old — stale (from a prior restart), not this session's write"; SNAPSHOT_OK=0
+elif ! grep -qF -- "$NONCE" "$SNAPSHOT"; then
+  echo "VERIFY FAILED: nonce not found in $SNAPSHOT — file at that path is not this session's write"; SNAPSHOT_OK=0
 else
   echo "VERIFY OK: snapshot exists, non-empty, readable, written ${AGE}s ago"
 fi
@@ -190,8 +252,16 @@ else
   echo "VERIFY FAILED: tmux session '$SESSION' (stripped from '$SESSION_RAW') does not resolve to a live tmux session"
   SESSION_OK=0
 fi
+echo "SNAPSHOT_OK=${SNAPSHOT_OK} SESSION_OK=${SESSION_OK}"
 ```
 
+**Fail-closed binding rule:** the block passes only for the exact path and nonce
+the Step 3 PREP block printed (paste them into its first two lines). Empty or
+placeholder values, identity/worktree drift between write and verify time, or a
+file at that path without the nonce all mean VERIFY FAILED — a fresh file merely
+sitting at the re-derived path is NOT proof you wrote it. Use the
+`SNAPSHOT_OK`/`SESSION_OK` values it prints in Step 6.
+
 **"Properly" means, explicitly:** snapshot exists at your OWN worktree's
 `.thrum/restart/<your-agent-id>.md`, non-empty, readable, AND recently written
 by Step 3 of THIS session (not a leftover from a previous restart that Step 3
@@ -267,9 +337,17 @@ the operator:
 
 ## After Restart: Session Archive
 
-After restart, your snapshot doesn't disappear — it moves to
+After restart, IF you saved a snapshot within the graceful window, it moves to
 `.thrum/agents/<your-agent-id>/sessions/` and stays there as a persistent log
-entry. Browse the archive with:
+entry. If the graceful save window elapsed before you saved (e.g. you were
+mid-task and missed the interrupt), the daemon writes NO snapshot and records
+a `.timeout-marker` sibling file instead — `thrum tmux restart` reports this
+via `snapshot_outcome: timeout` (CLI shows a 🔴 warning) rather than silently
+looking like success. Do not infer success from an empty `.thrum/restart/`
+directory alone — an empty source directory is consistent with either a
+genuine successful archive OR a bug that resolved to the wrong destination,
+silently aliased another agent's archive, or wrote truncated content. Browse
+the archive with:
 
 ```bash
 thrum agent sessions list                    # default: this agent
@@ -278,6 +356,20 @@ thrum agent sessions list --json             # NDJSON for scripts
 thrum agent sessions list --all              # every agent, grouped
 ```
 
+**Verify the RESOLVED DESTINATION's identity, not just its existence.**
+Every archive already self-verifies: `sessionarchive.Archive` computes a
+SHA-256 checksum of the snapshot content it read *before* the move, then
+re-reads the file it just wrote at the destination and confirms the
+checksums match (`sessionarchive.VerifyArchivedIdentity` /
+`ChecksumContent` — see `internal/daemon/sessionarchive/verify.go`) before
+reporting success. A destination that exists but doesn't hash-match its
+own pre-move content is treated as a hard failure of the archive call, not
+a warning. This is what actually proves "the file at
+`.thrum/agents/<id>/sessions/<ts>-restart.md` IS the artifact that was
+captured," as opposed to merely "a file with a plausible name is sitting
+there" — the latter is what `thrum agent sessions list`'s presence-only
+view alone would let you assume.
+
 Permissions are user-only (`0600` for each snapshot file, `0700` for the
 sessions folder). Operators on multi-user machines must copy explicitly to share
 archives with another account.

package/assets/commands/thrum-send.md

@@ -11,7 +11,7 @@ content.
 thrum send --to @agent_name --stdin <<'EOF'       # Direct message (quoted heredoc body)
 message here
 EOF
-thrum send --to @everyone --stdin <<'EOF'         # Broadcast to all agents
+thrum send --to @agent_a --to @agent_b --stdin <<'EOF'   # Multiple explicit recipients
 message here
 EOF
 ```
@@ -19,6 +19,9 @@ EOF
 Unknown recipients are a hard error. Use `thrum team` to verify agent names
 before sending.
 
+`@everyone` was removed by design (P0 ruling); do not restore it — name
+every recipient explicitly, or address a scoped agent-type group.
+
 If the body has backticks, `$(...)`, `$VAR`, or quotes, pass it via a quoted
 heredoc so the shell doesn't corrupt it: