opencode-thrum-pro 0.1.6 → 0.1.8

package/assets/skills/coordinator-hotpath-merge-gate/SKILL.md

@@ -90,7 +90,7 @@ the one resource it cannot replace and leaves no durable verdict artifact.
 explicitly in the merge record so the gap is visible rather than invisible.
 
 **Verdicts are artifacts:** the runner saves them to
-`dev-docs/gate-reports/<ISO-week>/<date>/<gate-slug>/` and commits them BEFORE
+`<gate-reports-dir>/<ISO-week>/<date>/<gate-slug>/` (the project's gate-reports directory) and commits them BEFORE
 removing any worktree. A verdict that exists only in a message cannot be audited
 later.
 
@@ -99,7 +99,7 @@ later.
 Mandatory checklist handed to the GATE RUNNER (and to any sub-agent it spawns in
 turn) at dispatch time. Each
 rule below currently lives only as prose warnings scattered through
-`dev-docs/hotpath-gate-efficacy.md` and gets re-learned per session — hand this
+the hotpath-gate efficacy log and gets re-learned per session — hand this
 list to the sub-agent verbatim at dispatch time instead of relying on it
 rediscovering these the hard way:
 
@@ -129,6 +129,8 @@ rediscovering these the hard way:
    `go run ./cmd/testgate classify-timeout --log <file> --shard-config <file>
    --shard <name>` (fails closed — only BOUND-TIMEOUT exits 0; HANG and
    UNCLASSIFIED both exit nonzero) before reporting it as a regression.
+   If a gate's own command line invokes the bare package path for RPC, that is a gate defect, not a passing lane.
+   A HANG or UNCLASSIFIED verdict from `classify-timeout` requires human review.
 8. Build+test the MERGED-tree result as a SEPARATE condition — neither gate
    currently runs a build of the actual post-merge tree; a clean pre-merge
    build/test does not prove the merged result compiles or passes.
@@ -159,7 +161,7 @@ rediscovering these the hard way:
     abandoned worktree pins its HEAD commit against `gc` and adds a
     `.git/worktrees` admin entry, so the object store grows monotonically.
     Before removing:
-    (a) `git -C <wt> status --porcelain` — if NON-EMPTY, **STOP and report it
+    (a) `git -C <wt> status --porcelain --untracked-files=all --ignored -- .thrum` — if NON-EMPTY, **STOP and report it
         instead of removing.** Uncommitted work in a throwaway worktree exists
         NOWHERE else; this is the category that actually loses work.
     (b) `git branch -a --contains $(git -C <wt> rev-parse HEAD)` — if EMPTY,
@@ -568,7 +570,7 @@ diff — don't bounce reflexively.
 
 ## Efficacy tracking (v1 acceptance requirement)
 
-After every gate run, record the outcome in `dev-docs/hotpath-gate-efficacy.md`
+After every gate run, record the outcome in the hotpath-gate efficacy log
 (created lazily on first run). This is a durable, committed, grep-queryable log
 that measures v1's real-world efficacy so we can iterate to v2 with data.
 
@@ -607,7 +609,7 @@ rows.
 | `CLEAN-WITH-GATE-FIXES` | Gate found only mechanical bookkeeping gaps, fixed them itself as a GATE-AUTHORED commit, re-ran only the affected checks, merge proceeded |
 
 **Retrospective reclassification:** When triaging a new wedge or incident, grep
-`dev-docs/hotpath-gate-efficacy.md` for the merged branch/date. If the gate
+the hotpath-gate efficacy log for the merged branch/date. If the gate
 previously logged `CLEAN` for that branch, append a follow-up line referencing
 the original entry:
 `- YYYY-MM-DD | branch=<branch> | RECLASSIFIED: CLEAN->SLIPPED | notes=<what the gate missed + which lens should have caught it>`.
@@ -623,13 +625,13 @@ gaps and lens improvements for the next version.
   patterns, reference functions, incident prose)
 - `project-hotpath-gate` — the companion builder skill that generates/reconciles
   the config (analog of `project-philosophy`)
-- `dev-docs/brainstorms/hotpath-merge-gate/` — the locked brainstorm (evidence,
+- the hotpath-merge-gate brainstorm record — the locked brainstorm (evidence,
   gap analysis, lens details, decisions)
 - `coordinator-philosophy-merge-gate` — the companion general-structural gate
   (runs in parallel)
 - `.thrum/philosophy.md` — canonical source for general anti-patterns (cross-
   referenced by Lenses 1–2, 6–7 where they overlap)
-- `dev-docs/hotpath-gate-efficacy.md` — running efficacy log (created lazily on
+- the hotpath-gate efficacy log — running efficacy log (created lazily on
   first gate run, appended after each run)
 
 <!-- THRUM-GATE: stage=skill next=review -->

package/assets/skills/coordinator-interacting-with-the-owner/SKILL.md

@@ -162,8 +162,7 @@ bd update thrum-abc --notes "$notes"
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session (the user corrects you), capture it
 via the `coordinator-maintaining-memory` skill — it references the

package/assets/skills/coordinator-maintaining-memory/SKILL.md

@@ -40,7 +40,7 @@ thrum memory create --kind agent_rule --scope role \
 ```
 
 `--short`/`--full` carry real prose — compose via heredoc or file, never
-double-quoted inline; see your role preamble's 🔴 PROSE INTO A COMMAND rule.
+double-quoted inline; see the heredoc-or-file rule in your role preamble.
 
 Body shape uniform across all role-rule writes — see `memory-write-discipline`.
 

package/assets/skills/coordinator-managing-state-and-lifecycle/SKILL.md

@@ -130,9 +130,17 @@ run the two-command destroy sequence **in this order**:
 
 ```bash
 thrum tmux kill <session>          # kills tmux + runtime first
-thrum worktree teardown <name>     # then removes worktree + identity
+thrum worktree teardown <name>     # then retires the agent + removes the worktree (salvage first)
+thrum agent delete <agent>         # SEPARATE reap, after the worktree is gone
 ```
 
+`worktree teardown` does NOT delete the agent: it is preparation for deleting
+one. The row stays `retired` (hidden from default `agent list` / `team` /
+overview / UI; visible with `--include-inactive` / `--phase retired`) until
+`thrum agent delete` or the sweeper reaps it. `agent delete` refuses an agent
+whose linked worktree still exists or whose process (pid/tmux) is live, and
+refuses coordinators; correct order is teardown (with salvage) THEN delete.
+
 Sanity-check: after teardown, `tmux list-sessions` should NOT show the agent's
 session. If it does, the runtime was never killed and step 1 was skipped.
 
@@ -184,8 +192,7 @@ orchestrators to for the implementers **they** launched.
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session (the user corrects you), capture it via
 the `coordinator-maintaining-memory` skill — it references the

package/assets/skills/coordinator-merging-code/SKILL.md

@@ -169,13 +169,18 @@ The §3 lens gates (hotpath + philosophy) are the judgement half. The per-merge
 executed half is **scoped to the change**:
 
 - Build the merged tree (`go build ./...`).
-- Full-*package* `-race` on the **changed packages only** — full-package, never
-  targeted `-run` (a targeted run misses cross-test races), but only what the diff
-  touches.
+- 🔴 **RULING:** the full sharded race suite —
+  `scripts/test-run.sh race all` (~15-20 min) — on the **merged tree**, every
+  Pass-3 verdict. This replaces the prior "changed packages only (+ rpc shard
+  sweep)" race scoping below the ruling; a targeted `-run` is still never
+  acceptable (a targeted run misses cross-test races). Never on primary (the
+  shared fleet build box) — it is CPU-heavy; run it on the gate box.
 - The fast structural checks on the merged tree — `gate-ban-check`,
   `gate-omitempty-check`, `gate-lockspan-check`, `gate-marker-diff`,
-  `gate-stamp-protocol-check` (seconds each; they catch banned flags, `omitempty`
-  drift, lock-span, marker and stamp drift regardless of the change).
+  `gate-stamp-protocol-check`, `gate-plugin-bundle-leaks` (seconds each; they
+  catch banned flags, `omitempty` drift, lock-span, marker and stamp drift
+  regardless of the change; `gate-plugin-bundle-leaks` self-skips when no plugin
+  path changed).
 - The `merge-base --is-ancestor` fast-forward check (§6).
 - Any `*_tripwire_test.go` the change touches must stay green or the diff must
   state why its premise changed; a tripwire edited to accommodate the change is a
@@ -211,9 +216,10 @@ executed half is **scoped to the change**:
   MERGED tree every merge: `go test ./internal/testgate/... -run
   TestNoMainStateDBWriteOwnerBypasses`.
 
-**Establish branch-attributable vs pre-existing from the changed-package `-race`
-result** — a regression adds failures the same packages did not have before. Do
-not classify a scoped change by replaying the whole known-red suite.
+**Establish branch-attributable vs pre-existing from the full-race `-race`
+result** — a regression adds failures the packages touched by the diff did not
+have before. Do not classify a scoped change by replaying the whole known-red
+suite.
 
 🔴 **Do NOT run the full all-lanes `make gate` for a merge.** The full suite —
 every package across lanes A/B/C/D, the integration lane, `gate-ci-mutation-check`,
@@ -221,7 +227,9 @@ the UI lane, the full tripwire/boxstate reconciliation — is the **periodic
 full-gate cadence**, an agent run on the dedicated isolation box, and it is its own
 skill: **`coordinator-full-gate`**. A merge never triggers it, and its merge-base
 replay is not a per-merge step. Running it per merge is ~2h that on a common-mode-
-red trunk fails on the baseline every time.
+red trunk fails on the baseline every time. The RULING above
+widens only the **race lane** to full-sharded per merge — it does not pull the
+other lanes (integration, UI, mutation-check) into the per-merge path.
 
 🔴 **Never kill a test run to stop a collision.** Killing skips Go's cleanup, which
 leaks fixed-name tmux fixtures onto the shared socket and breaks that suite box-
@@ -280,12 +288,12 @@ agreeing (`rev-parse origin/<branch>` and `ls-remote`). **Assert the branch TIP*
 ## 7. AFTER THE MERGE — four things, none optional
 
 1. **The verdict artifact.** The runner saves verdicts to
-   `dev-docs/gate-reports/<ISO-week>/<date>/<gate-slug>/` and **commits them
+   `<gate-reports-dir>/<ISO-week>/<date>/<gate-slug>/` (the project's gate-reports directory) and **commits them
    BEFORE removing any worktree.** Save → commit → then destroy. A verdict that
    exists only in a message cannot be audited later. The artifact must be able to
    carry a `CLEAN-WITH-GATE-FIXES` outcome, and when one applies it cites the
    `GATE-AUTHORED` commit SHA.
-2. **The efficacy row**, in `dev-docs/hotpath-gate-efficacy.md` — required for
+2. **The efficacy row**, in the hotpath-gate efficacy log — required for
    **every** trigger-dir merge, including `SKIPPED_WITH_EVIDENCE` rows and
    orchestrator-run merges. The log measures gate **coverage**, not just outcomes.
    Record `FALSE_POSITIVE=0` explicitly on a clean run so the zero is a
@@ -356,13 +364,12 @@ hides staleness.
 - `coordinator-hotpath-merge-gate` · `coordinator-philosophy-merge-gate` — the lenses
 - `coordinator-running-review-cycles` — the dual-review cycle feeding §1
 - `coordinator-branch-split-on-block` — when a gate blocks one concern of a bundled branch
-- `dev-docs/gate-reports/README.md` — the artifact contract
+- the gate-reports README — the artifact contract
 - `.thrum/hotpath-gate.json` · `.thrum/philosophy.md` — the configs; read these, not prose
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session (the user corrects you), capture it via
 the `coordinator-maintaining-memory` skill — it references the

package/assets/skills/coordinator-philosophy-merge-gate/SKILL.md

@@ -63,7 +63,7 @@ the one resource it cannot replace and leaves no durable verdict artifact.
 explicitly in the merge record so the gap is visible rather than invisible.
 
 **Verdicts are artifacts:** the runner saves them to
-`dev-docs/gate-reports/<ISO-week>/<date>/<gate-slug>/` and commits them BEFORE
+`<gate-reports-dir>/<ISO-week>/<date>/<gate-slug>/` (the project's gate-reports directory) and commits them BEFORE
 removing any worktree. A verdict that exists only in a message cannot be audited
 later.
 
@@ -204,7 +204,7 @@ detection is the 10a/10b/10d probe set, not a single grep.
 ## Lens 10 — Conflated multi-responsibility service (Anti-Pattern #10)
 
 This lens uses three sub-procedures from the single-responsibility standing rule
-(`dev-docs/decisions/2026-07-09-single-responsibility-standing-rule.md`).
+(the project's single-responsibility decision record).
 
 ### 10a — Structural backstop (grep before you trust prose review)
 
@@ -453,14 +453,13 @@ diff — don't bounce reflexively.
 
 - `.thrum/philosophy.md` — canonical source for all anti-patterns and red flags
   checked by this gate
-- `dev-docs/decisions/2026-07-09-single-responsibility-standing-rule.md` — full
+- the single-responsibility decision record — full
   standing rule with the three-class scope model, enforcement architecture
   (3a/3b/3c/3d), and worked examples of previously-traced conflated services
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session (the user corrects you), capture it via
 the `coordinator-maintaining-memory` skill — it references the

package/assets/skills/coordinator-plan-reconcile-gate/SKILL.md

@@ -189,8 +189,7 @@ unambiguously so an implementer doesn't re-litigate them.
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session about multi-plan reconciliation,
 capture it via the `coordinator-maintaining-memory` skill — it references the

package/assets/skills/coordinator-rolling-out-to-nodes/SKILL.md

@@ -90,3 +90,4 @@ The node's local runbook is `coordinator-deploying-a-node` — reference that sk
 - If `fleet.deployment.thrum.products` exists (vestigial), STOP — products live only at `fleet.deployment.products`.
 - If a node reports success by exit code alone without observed-effect verification, treat as not-verified.
 - Never wrap a service restart in a blind timeout on the node (see node skill `service.never_timeout` and `migration.signal_rules`).
+- 🔴 A **macOS** node (including the build host / primary) restarted with the plain `service.restart_command` instead of `service.mac_restart_command` (Thrum: `scripts/mac-daemon-restart-via-cron.sh`). The daemon loses its Local Network permission and its LAN peers go dark while it looks healthy. Put the mac command in every macOS node's dispatch, and use it yourself when you roll the build host last.

package/assets/skills/coordinator-running-brainstorm-cycles/SKILL.md

@@ -113,7 +113,7 @@ forwarding.
 
 5. **Authored-against stamp (required, top of every artifact):** Before writing
    a brainstorm.md or plan.md, derive and emit the stamp per
-   `claude-plugin/commands/_stamp-protocol.md` § "Stamp format" — the canonical
+   the /thrum:stamp-protocol skill § "Stamp format" — the canonical
    format, derivation commands, and never-type rule.
 
 ### Soft pre-flight greps (the SOFT enforcement tier)
@@ -477,7 +477,7 @@ contract-drift and quality issues a single author would miss.
 
 1. Researcher writes plan v1 directly.
 2. Researcher authors the `## Deviations from Source` block per
-   `claude-plugin/commands/_deviations-protocol.md`, diffing plan v1 against
+   the /thrum:deviations-protocol skill, diffing plan v1 against
    the brainstorm + design spec — BEFORE dual-review, so
    `verify-against-source` validates it as part of conformance. Required even
    when empty ("No deviations from source.").
@@ -504,7 +504,7 @@ contract-drift and quality issues a single author would miss.
    coordinator instead of being folded inline.
 6. Researcher repeats only if cycle-1 introduces new design surface (rare for
    bounded mechanical plans); otherwise v2 LOCKED. Before stamping, compute
-   `plan_obj`/`src_lock` per `_stamp-protocol.md` § "Review-object binding"
+   `plan_obj`/`src_lock` per `stamp-protocol.md` § "Review-object binding"
    (strip-then-hash the plan against itself for `plan_obj`; plain-hash the
    LOCKED source for `src_lock`), then stamp
    `<!-- THRUM-REVIEW: stage=plan verdict=Ready:Yes cycle=<N> date=<YYYY-MM-DD> verify=Ready:Yes plan_obj=<blob> src_lock=<blob> -->`.
@@ -636,8 +636,7 @@ don't rebind the agent name to a different topic in place.
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session about brainstorm orchestration, capture
 it via the `coordinator-maintaining-memory` skill — it references the

package/assets/skills/coordinator-running-review-cycles/SKILL.md

@@ -156,8 +156,7 @@ AFTER they report DONE. They target different artifacts and both are needed.
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session (the user corrects you), capture it via
 the `coordinator-maintaining-memory` skill — it references the

package/assets/{commands/thrum-_deviations-protocol.md → skills/deviations-protocol/SKILL.md}

@@ -1,19 +1,13 @@
 ---
-description:
-  Shared Deviations-from-Source protocol — canonical block format, the
-  required-even-when-empty rule, and derivation discipline. Not
-  user-invocable directly.
+name: deviations-protocol
+description: "Use when authoring a plan or implementation prompt - Deviations-from-Source block format, required even when empty."
 ---
 
-# Deviations from Source Protocol (shared partial)
 
+# Deviations from Source Protocol
 This file is the canonical source-of-truth for the "Deviations from Source"
-block emitted by planning-loop artifacts (plans, implementation prompts). Do
-NOT invoke this file directly; it has no terminal action.
-
-(To find what currently points here: `grep -rn "_deviations-protocol.md"
-claude-plugin/` — a hand-listed consumer roster in this file would rot the
-moment a new emitter or reader is added, so none is kept here.)
+block emitted by planning-loop artifacts (plans, implementation prompts).
+Invoke this skill to author the block, even when empty.
 
 ## Purpose
 
@@ -33,7 +27,7 @@ FAILS the gate, whether or not it actually dropped anything.
 ## Format (emitted artifact — verbatim)
 
 Every plan and implementation prompt carries this heading, placed immediately
-after its Authored-against stamp block (see `_stamp-protocol.md`):
+after its Authored-against stamp block (see `stamp-protocol.md`):
 
 ```
 ## Deviations from Source

package/assets/skills/efficient-multi-agent-research/SKILL.md

@@ -59,7 +59,7 @@ read-only scoping) are in "Core Pattern" below.
    **Every prompt MUST scope the read-only restriction around its own output
    file, in the same breath:** `READ-ONLY EVERYWHERE EXCEPT YOUR OUTPUT FILE —
    do not modify source, tests, config, git state, or the issue tracker; you
-   MUST write exactly dev-docs/<topic>/findings_N.md, and that write is
+   MUST write exactly <topic-dir>/findings_N.md, and that write is
    expected and authorized.` Omitting the exception is the most common cause of
    a fan-out that returns nothing — see Common Mistakes.
 
@@ -134,7 +134,7 @@ Prefer `cat >> <path> <<'EOF'` to append on later rounds.
 ```text
 READ-ONLY EVERYWHERE EXCEPT YOUR OUTPUT FILE.
 Do not modify source, tests, config, git state, or the issue tracker.
-You MUST write your findings to exactly: dev-docs/<topic>/findings_N.md
+You MUST write your findings to exactly: <topic-dir>/findings_N.md
 Write is fine for creating it. To UPDATE it on a later round, Read it first or
 append with a heredoc (cat >> <path> <<'EOF' ... EOF) — Write refuses to
 overwrite a file it has not Read. That single write is expected and authorized.

package/assets/skills/generator-idempotency-protocol/SKILL.md

@@ -0,0 +1,9 @@
+---
+name: generator-idempotency-protocol
+description: "Use when generating config or docs from templates - idempotency invariant for generator skills."
+---
+
+
+# Generator Idempotency Protocol
+The modes are idempotent — running the skill repeatedly on a stable project
+should produce no file changes after the first run.

package/assets/skills/implementer-maintaining-memory/SKILL.md

@@ -40,7 +40,7 @@ thrum memory create --kind agent_rule --scope role \
 ```
 
 `--short`/`--full` carry real prose — compose via heredoc or file, never
-double-quoted inline; see your role preamble's 🔴 PROSE INTO A COMMAND rule.
+double-quoted inline; see the heredoc-or-file rule in your role preamble.
 
 Body shape is uniform across all role-rule writes — see
 `memory-write-discipline`. The `Why:` line is load-bearing: future-you needs the
@@ -48,9 +48,8 @@ reason to judge edge cases the rule doesn't literally cover.
 
 ## Implementer does NOT write
 
-- **Refactoring opportunities discovered mid-task** → file under the project's
-  refactoring epic, e.g. `<refactor-epic-id>`, NOT memory. Memory is for AGENT
-  BEHAVIOR rules; bd tracks code work.
+- **Refactoring opportunities discovered mid-task** → report them to the
+  coordinator, NOT memory and not bd. Memory is for AGENT BEHAVIOR rules.
 - **Research findings about the codebase** → ping the researcher; they own
   `kind: research_note` writes.
 - **Per-task notes / scratch state** → use the conversation context or task

package/assets/skills/implementer-orchestrating-execution/SKILL.md

@@ -114,8 +114,7 @@ prefix, blinding the evaluation harness.
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 Capture new rules mid-session via the `implementer-maintaining-memory` skill —
 it references the `memory-write-discipline` common for the canonical

package/assets/skills/implementer-receiving-dispatch/SKILL.md

@@ -38,7 +38,7 @@ config loading, string sanitization, validation), run a targeted grep.
 something similar exists, use it. If it needs extension, extend it. Only create
 a new function when nothing exists.
 
-## Don't refactor for free — log opportunities, don't implement them
+## Don't refactor for free — report opportunities, don't implement them
 
 **Why:** A bug fix doesn't need surrounding cleanup. A one-shot operation
 doesn't need a helper. Inlining "improvements" into a scoped task expands the
@@ -46,26 +46,25 @@ diff, complicates review, and risks introducing bugs unrelated to the work.
 Three similar lines is better than a premature abstraction.
 
 **How to apply:** When you spot duplicated patterns, hardcoded values that
-should be shared, or missed abstractions during implementation, log them to the
-project's refactor backlog (a beads epic, e.g. `<refactor-epic-id>`):
+should be shared, or missed abstractions during implementation, report them to
+the coordinator; do not file a bd issue yourself.
 
-`--description` is multi-line prose — never double-quoted inline. On
-`scripts/bd-shared`, `--stdin`/`--body-file` are refused (remote-path
-resolution + silent-empty-body hazards), so write it to a scratch file and
-pass `-d "$(cat <file>)"`; see your role preamble's 🔴 PROSE INTO A COMMAND
-rule.
+The report body is multi-line prose — never double-quoted inline; see the
+heredoc-or-file rule in your role preamble.
 
 ```bash
-cat > /tmp/refactor-task-desc.md <<'EOF'
-**Discovered during:** <task-id>
-**Files:** <paths>
-**Opportunity:** <what could be improved>
-**Effort:** small/medium/large
+thrum send --to @<coordinator> --stdin <<'EOF'
+Refactoring opportunity (discovered during <task-id>)
+Files: <paths>
+Opportunity: <what could be improved>
+Effort: small/medium/large
 EOF
-bd create --title="Refactor: <short description>" --type=task \
-  --parent=<refactor-epic-id> --priority=3 -d "$(cat /tmp/refactor-task-desc.md)"
 ```
 
+If the coordinator asks you to file the bead, write the description to a scratch
+file and pass `--body-file <file>` to `scripts/bd-shared` (and
+`comments add <id> -f <file>` for comments).
+
 Then continue with the assigned work. Do not implement the refactoring.
 
 ## Flag scope deviations immediately — not in the final report
@@ -96,8 +95,7 @@ related files.
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session (the user corrects you), capture it via
 the `implementer-maintaining-memory` skill — it references the

package/assets/skills/implementer-receiving-review-feedback/SKILL.md

@@ -71,8 +71,8 @@ trade-off explicitly:
 - Is the fix a few lines? Default to fix-now
 - Does verification require running the same tests as the main fix? Default to
   fix-now
-- Is the fix a meaningful refactor or design change? Defer is legitimate; file
-  the bd issue and link it in the commit message
+- Is the fix a meaningful refactor or design change? Defer is legitimate; report
+  it to the coordinator (not a bd issue) and cite the report in the commit message
 
 Don't reach for "deferred" as a shortcut to ship faster.
 
@@ -117,8 +117,7 @@ list, file them as bd issues — don't slip them into the fix commit.
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session (the user corrects you), capture it via
 the `implementer-maintaining-memory` skill — it references the

package/assets/skills/implementer-status-and-handoff/SKILL.md

@@ -107,22 +107,9 @@ make test PASS (race), make lint PASS.
 
 For first-pass DONE (not review-fix), cite the closing SHA and the test result.
 
-## Close beads tasks with `--suggest-next` when relevant
-
-**Why:** `bd close <id>` works fine, but `bd close <id> --suggest-next` prints
-newly-unblocked downstream issues immediately. If you're in the middle of an
-epic, the next task is often the most useful next move; the flag saves a
-`bd ready` round-trip.
-
-**How to apply:** When closing a task that has dependents, use
-`bd close <id> --suggest-next`. For the last task in an epic where you're
-stopping at a review gate, plain `bd close` is fine — you're not picking up the
-next task anyway.
-
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session (the user corrects you), capture it via
 the `implementer-maintaining-memory` skill — it references the

package/assets/skills/implementer-tdd-and-quality/SKILL.md

@@ -86,13 +86,13 @@ that would otherwise come back as findings.
    package searched -> primitive adopted, or none exists + bounded cost formula
    (frequency x production cardinality, at production scale). Include it in
    your DONE report.
+   - Before writing a raw read-in-loop, `db.Query`-in-loop, `COUNT(DISTINCT ...)`, or a second transaction or pool acquisition per logical unit under a hot root, search the callee package for an existing targeted, cached, covering or batch primitive.
 
 Fix what you find before sending the ping.
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session (the user corrects you), capture it via
 the `implementer-maintaining-memory` skill — it references the

package/assets/skills/memory-audit-recover/SKILL.md

@@ -44,7 +44,7 @@ monotonic-ish and globally comparable; the larger ULID wins.
 | Concurrent edits to the SAME field                                              | Larger-ULID event wins. Loser preserved in JSONL.        |
 | Concurrent tombstones                                                           | Idempotent. One delete-event wins by ts; status=purged.  |
 | Edit + delete, delete-ULID > edit-ULID                                          | Final `status=purged`.                                   |
-| Edit + delete, edit-ULID > delete-ULID AND edit explicitly sets `status=active` | Edit wins → `status=active` (undelete).                  |
+| Edit + delete, edit-ULID > delete-ULID AND edit explicitly sets `status=active` | Edit wins → `status=active` (undelete; needs a license). |
 | Edit + delete, edit-ULID > delete-ULID AND edit does NOT touch `status`         | Patch applies to body/tags but `status=purged` persists. |
 
 LWW is acceptable here because memories aren't a high-write-conflict surface
@@ -94,6 +94,8 @@ Undelete by writing `status=active`:
 thrum memory edit <id> --status active
 ```
 
+Note: `memory edit` (including `--status active` undelete) requires a license (memory.substrate); soft delete (`memory delete`) and reads stay open.
+
 Undelete works regardless of who won the concurrent edit/delete race (see LWW
 table above). The audit history is intact, so the recovered memory carries its
 full provenance.
@@ -116,10 +118,10 @@ Type DELETE <id> to confirm: DELETE <id>
 The exact token (`DELETE <id>`) must be typed back — matches beads'
 `DESTROY-<prefix>` pattern. There is no `--yes` bypass.
 
-| Mode            | Mechanism                                                      | Recovery                                 |
-| --------------- | -------------------------------------------------------------- | ---------------------------------------- |
-| Soft (default)  | `memory.delete` → projection `status=purged`                   | `thrum memory edit <id> --status active` |
-| Hard (`--hard`) | `memory.purge_executed` → physical JSONL removal at compaction | Not recoverable post-compaction          |
+| Mode            | Mechanism                                                      | Recovery                                                    |
+| --------------- | -------------------------------------------------------------- | ----------------------------------------------------------- |
+| Soft (default)  | `memory.delete` → projection `status=purged`                   | `thrum memory edit <id> --status active` (license required) |
+| Hard (`--hard`) | `memory.purge_executed` → physical JSONL removal at compaction | Not recoverable post-compaction                             |
 
 ## When NOT to hard-delete
 

package/assets/skills/memory-curate/SKILL.md

@@ -25,7 +25,7 @@ Edge kind is an open string (same hybrid pattern as memory kind). Future edges
 like `blocks`, `duplicates`, or `parent-child` can be added without schema
 change.
 
-Add and remove edges:
+Add and remove edges. `memory link` and `memory edit` require a license (memory.substrate); `memory unlink` does not.
 
 ```bash
 thrum memory link <a> supersedes <b>
@@ -59,7 +59,7 @@ thrum memory unlink <new-id> supersedes <old-id>
 thrum memory edit <old-id> --status active
 ```
 
-Both steps are required. If you only need to keep the historical link but
+The `--status active` step needs a license; without one the superseded memory stays superseded. Both steps are required. If you only need to keep the historical link but
 re-surface the old memory, just run the `--status active` edit and leave the
 edge in place.
 
@@ -108,7 +108,7 @@ thrum memory create --kind comment \
 ```
 
 `--short`/`--full` carry real prose — compose via heredoc or file, never
-double-quoted inline; see your role preamble's 🔴 PROSE INTO A COMMAND rule.
+double-quoted inline; see the heredoc-or-file rule in your role preamble.
 
 `--parent` shorthand creates the `child_of` edge in the same operation. Author =
 `agent_id`, timestamp = `created_at`. Threading walks via the daemon's

package/assets/skills/memory-maintenance/SKILL.md

@@ -21,6 +21,8 @@ thrum memory edit <id> --title "<updated title>"
 thrum memory edit <id> --add-tag <new-tag>    # appends (repeatable); --rm-tag removes
 ```
 
+`memory edit` requires a license (memory.substrate); `delete` and `unlink` do not.
+
 Edits create a **history record** — the daemon retains the prior version. View
 edit history:
 

package/assets/skills/memory-write-discipline/SKILL.md

@@ -25,7 +25,7 @@ thrum memory create --kind <K> --scope <S> \
 ```
 
 `--short`/`--full` carry real prose — compose via heredoc or file, never
-double-quoted inline; see the role preamble's 🔴 PROSE INTO A COMMAND rule.
+double-quoted inline; see the heredoc-or-file rule in your role preamble.
 
 Three flags are **REQUIRED** (schema NOT NULL): `--kind`, `--title`,
 `--oneline`. The daemon rejects any `memory.create` call missing these.