opencode-thrum-pro 0.1.7 → 0.1.8

package/assets/commands/thrum-restart.md

@@ -361,7 +361,7 @@ Every archive already self-verifies: `sessionarchive.Archive` computes a
 SHA-256 checksum of the snapshot content it read *before* the move, then
 re-reads the file it just wrote at the destination and confirms the
 checksums match (`sessionarchive.VerifyArchivedIdentity` /
-`ChecksumContent` — see `internal/daemon/sessionarchive/verify.go`) before
+`ChecksumContent` in the daemon's session-archive package) before
 reporting success. A destination that exists but doesn't hash-match its
 own pre-move content is treated as a hard failure of the archive call, not
 a warning. This is what actually proves "the file at

package/assets/skills/brainstorm-queue-aware/SKILL.md

@@ -32,7 +32,7 @@ answer," do this instead:
    clear question, plus 2-3 concrete options (A/B/C) so the Steward has
    something to decide between, not an open-ended essay prompt.
 2. Send it as a `NEED` to your steward, per the NEED/ANSWER convention
-   (`dev-docs/specs/2026-08-24-brainstorm-need-answer-convention.md`):
+   (the NEED/ANSWER convention spec in the project's design docs):
 
    ```bash
    thrum send --to @<steward> --stdin <<'EOF'

package/assets/skills/brainstorm-steward/SKILL.md

@@ -72,7 +72,7 @@ thread:
 - **Push — inbox scan.** Each cycle, read your inbox (`thrum inbox`) for
   messages from a roster brainstormer whose first line matches
   `NEED [<topic>]:` (the convention from
-  `dev-docs/specs/2026-08-24-brainstorm-need-answer-convention.md`). Read
+  the NEED/ANSWER convention spec in the project's design docs). Read
   the topic, question, and options straight from the prose — there is no
   structured payload to parse; you are a judgment agent reading a message
   the way you'd read any message. The sender identity tells you which
@@ -242,9 +242,9 @@ state as soon as the brainstormer advances past it.
 
 ## Reuse note
 
-`dev-docs/templates/brainstorm-steward-watch_params.json` is the canonical
+The brainstorm-steward watch-params template in the project's design docs is the canonical
 starting config for a new Brainstorm Steward — it uses the schema documented
-in `dev-docs/specs/2026-07-22-watch-params-schema.md` unchanged, with an
+in the watch-params schema spec unchanged, with an
 empty `roster` to be populated as brainstormers are launched under it. Its
 `parent` field ships pre-filled with this fleet's own escalation target —
 when copying the template to a different fleet or box, replace that value

package/assets/skills/choosing-subagent-models/SKILL.md

@@ -36,14 +36,8 @@ Every subagent you spawn MUST pass an explicit, resolved `model:` (plus effort
 where the runtime supports it). Omitting it runs the subagent on YOUR model —
 the single biggest avoidable cost leak in agent work.
 
-**The mechanical tier never resolves to a below-floor model, for any runtime.**
-On Claude specifically that means **Haiku is banned entirely** — there is no
-mechanical-task carve-out that reaches for it; lint runs, grep-and-collect,
-file maps, config edits, and all other "simple" work dispatch at the
-mechanical tier's Claude resolution (sonnet-low), not Haiku. Never select
-Haiku on own judgment on Claude — use the mechanical tier's resolved value
-instead. Other runtimes floor at their own mechanical-tier value
-(`RuntimePreset.TierModels`), not at a Claude name.
+Haiku 5.5 is eligible for summarization and mechanical work.
+Read the effective model and effort at use from `runtime.role_models`.
 
 ### Read the tiers at the moment of use
 
@@ -75,9 +69,10 @@ same tier from your own runtime's preset (`RuntimePreset.TierModels`) or
 | **Sub-agent** (investigation, grep, mechanical) | `mechanical` | **`sonnet` / low** |
 
 - **`mechanical` tier (sub-agents ONLY)** — investigation, grep-and-collect,
-  file maps, lint runs, mechanical tasks. Resolves to `sonnet` @ low effort on
-  Claude. This is the floor for a *sub-agent*, NOT for an implementer or a
-  reviewer, and NOT the tier a non-Claude runtime should read as its default.
+  file maps, lint runs, mechanical tasks. Read the effective model and effort
+  at use from `runtime.role_models`. For other runtimes, use their own
+  mechanical-tier value (`RuntimePreset.TierModels`), not a Claude name.
+  The mechanical tier is for sub-agents only, never for an implementer or a reviewer.
 - **`judgment` tier (implementers, verifiers, reviewers)** — resolves to
   `sonnet` @ MEDIUM effort on Claude. Not low. A reviewer on low effort is a
   rubber stamp with extra steps, and rubber-stamped reviews are how a merge
@@ -159,9 +154,8 @@ reviewer "from memory", and never dispatch one at the mechanical tier.
 **AND VERIFY, DO NOT ASSERT:** any claim about what a tool does or does not expose
 must be checked against the schema in front of you.
 
-Never select the `orchestration` tier or a below-floor model on your own
-judgment — use the `judgment` tier's resolved value for your runtime, at the
-floor of that tier's lowest effort.
+Never select the `orchestration` tier on your own judgment — use the
+`judgment` tier's configured value from `runtime.role_models`.
 
 ## Where the tier-model mapping lives
 
@@ -238,9 +232,8 @@ that stops at depth 1 is absent where the work happens.
   work, wait for the completion notification.
 - Every sub-agent YOU spawn gets an explicit `model:`, resolved for your
   runtime's tier — `mechanical` (rote/find-replace) or `judgment` (real
-  analysis). On Claude that's sonnet-low / sonnet-medium and HAIKU IS BANNED;
-  on another runtime, use that runtime's own resolved row. The
-  `orchestration` tier is never yours to spawn.
+  analysis). Read the effective model and effort from `runtime.role_models` at
+  use. The `orchestration` tier is never yours to spawn.
 - READ-ONLY git outside your own worktree. NEVER `checkout`/`reset`/`restore`/
   `stash`/`clean` in ANY directory — `stash` is one shared stack across all
   worktrees and the shared tree holds live agents' uncommitted state.
@@ -252,10 +245,10 @@ signal this condition produces.
 
 ### Cheap subagents → fan out, don't pile up
 
-Because `mechanical`-tier subagents are cheap (sonnet-low on Claude; the
-mechanical-tier row for your runtime otherwise), prefer MANY small parallel subagents
-over one subagent handed a pile of tasks. When a research or investigation task
-has independent parts, partition it and dispatch the parts in parallel (use the
+Because Haiku 5.5 supports summarization and mechanical sub-agent work, prefer
+MANY small parallel subagents over one agent handed a pile of tasks. Read the
+effective model and effort from `runtime.role_models` at dispatch. When research or
+investigation has independent parts, partition them in parallel (use the
 `efficient-multi-agent-research` skill) — smaller scopes are cheaper, run
 concurrently (faster), and keep each subagent's context tight. One subagent
 given ten tasks is the anti-pattern.

package/assets/skills/coordinator-assessing-agent-completion/SKILL.md

@@ -176,11 +176,10 @@ salvaged files distinct names and land the salvage somewhere durable (the main r
 
 ## 🔴 The reap is worktree-removal-only — and TEST every step on ONE item first
 
-**`thrum agent delete --force` is REFUSED by the CAS guard on a stale agent with an empty
-`agent_pid_start_time`** (*"expected-state premise is required … refusing rather than treating
-an empty/never-read premise as a match"*). `--force` does NOT bypass it; the guard is
-correct. So the reap that actually frees load is worktree removal — but salvage BEFORE you remove,
-then remove PLAIN (no `--force`):
+**`thrum agent delete` refuses an agent whose linked worktree still exists** (and any agent
+with a live pid/tmux process, and coordinators); `--force` does NOT bypass these guards. So
+the reap that frees load is worktree removal first — salvage BEFORE you remove, then remove
+PLAIN (no `--force`), then `thrum agent delete`:
 
 1. Enumerate untracked+ignored `.thrum` content — BOTH flags, one flag alone misses a class:
    `git status --untracked-files=all --ignored -- .thrum`
@@ -200,9 +199,10 @@ then remove PLAIN (no `--force`):
    mistake it for protecting the ignored-file class. (Not a pipe — a pipe returns the last
    command's rc, not `git`'s.)
 
-The delete (`thrum agent delete`) best-effort-fails and leaves a **benign orphan DB row**,
-which you LEAVE (filtered at query per the fleet ruling; never `agent cleanup --force` to
-tidy them).
+Then REAP the agent row with `thrum agent delete <agent>` once the worktree is gone and no
+process is live: orphan rows must be reaped, not left. Never use `thrum agent cleanup
+--force` (it can flag live fleet agents). A refused reap on a dead, worktree-less agent is a
+bug: report it, do not route around it.
 
 ⚠️ **After a large reap you may see a `DeadAgentSweeper` skip alert + elevated write-RPC
 latency — do NOT assume the reap caused it.** This box carries a standing single-writer
@@ -302,8 +302,9 @@ RSS-MB.
   list AND disk), not just the exit code.
 - **Rank candidates by last-message CONTENT, not elapsed time** — your own
   broadcasts reset every recipient's idle clock.
-- **`--force` on agent-delete does NOT bypass the CAS guard** on a stale agent — the
-  reap that frees load is worktree removal, not the delete.
+- **`--force` on agent-delete does NOT bypass its guards** — the worktree must go first
+  (teardown with salvage or plain `git worktree remove`), then `thrum agent delete` reaps
+  the row.
 - **Reap order is `thrum tmux kill <session>` FIRST, THEN `git worktree remove`** —
   removing the worktree alone leaves the agent's tmux session alive with a
   now-deleted cwd, which the fleet flags as recurring "cwd drift" and whose runtime

package/assets/skills/coordinator-context-monitoring/SKILL.md

@@ -30,13 +30,13 @@ What's forbidden is a script that bypasses this skill and fires
 
 This skill's tier ladder (Steps 3–5) governs how the coordinator restarts
 **other** agents. When the **coordinator restarts ITSELF**, a different rule
-applies and it is absolute — but D5 (owner-ruled)
+applies and it is absolute — but the current ruling
 REVERSES which command that is:
 
 > **The coordinator ALWAYS uses the EXTENDED snapshot grade for itself — never
 > the standard/compact form. Which command carries that grade is
 > runtime-directed: `/thrum:compact-extended` on any runtime with a verified
-> compact-equivalent skill (D6, the default), `/thrum:restart-extended` ONLY
+> compact-equivalent skill (the default), `/thrum:restart-extended` ONLY
 > as the fallback on a runtime without one (today: muse, copilot).**
 
 This is a REVERSAL of the prior absolute rule ("ALWAYS restart-extended, NEVER
@@ -62,7 +62,7 @@ Practical trigger points for coordinator self-restart/compact:
 In every one of these: run `/thrum:compact-extended` if the coordinator's
 runtime has a compact equivalent (the default); `/thrum:restart-extended` only
 if it does not. (The role-rule `coord-always-restart-extended` — `Coordinator
-ALWAYS uses /thrum:restart-extended` — is RETIRED as of D5; see
+ALWAYS uses /thrum:restart-extended` — is RETIRED; see
 `thrum memory` for its retirement record. This skill is the always-loaded home
 so the CURRENT rule survives even when memory isn't consulted.)
 
@@ -163,7 +163,7 @@ is a single monitor for all lenses in v1, not one per lens.
 | `idle_mid_task`             | ON      | L2 — 30-min idle-with-open-task detection (bead cross-ref). RECOMMEND `/thrum:sleep-extended`; a no-task variant REPORTs `idle-no-task` at lower priority.        |
 | `snapshot_awaiting_restart` | ON      | L3 — pane text + fresh-snapshot two-signal heuristic. RECOMMEND `thrum tmux restart <agent>` (never autonomous).                                                  |
 | `blocked_on_human_modal`    | ON      | L4 — detects spend-limit/permission/consent modal prompts. DETECTION ONLY, never auto-answers; routes into the L5 ledger.                                         |
-| `pending_human_ledger`      | ON      | L5 — flat JSONL ledger of items awaiting a human. EXEMPT from D5 backoff — surfaces every tick. `hb_ledger_resolve` (the resolution path) is defined but has zero call sites — nothing marks an entry resolved, so the ledger is append-only-forever, not "until resolved." |
+| `pending_human_ledger`      | ON      | L5 — flat JSONL ledger of items awaiting a human. EXEMPT from progressive backoff — surfaces every tick. `hb_ledger_resolve` (the resolution path) is defined but has zero call sites — nothing marks an entry resolved, so the ledger is append-only-forever, not "until resolved." |
 | `waiting_on_coord`          | ON      | L9 — 21-rule pattern match (folded in from the standalone waiting-on-coord sweep) + warm-hold exemption. RECOMMEND coordinator answer.                            |
 
 ### Default-OFF lenses (E8, flag-gated — NOT YET IMPLEMENTED as of E7)
@@ -183,8 +183,7 @@ produce no output until enabled.
 ## Configuration
 
 The heartbeat system is configured under the `heartbeat` key in
-`.thrum/config.json` (Go type: `HeartbeatConfig` in
-`internal/config/heartbeat.go`). Example:
+`.thrum/config.json` (Go type: `HeartbeatConfig`). Example:
 
 ```json
 {
@@ -222,10 +221,10 @@ The heartbeat system is configured under the `heartbeat` key in
 | -------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `cadence_minutes_day`                                    | Daytime cadence target (default 30 min). The underlying monitor runs `@every 30m` and self-gates so only busy-fleet daytime ticks fire.                                |
 | `cadence_minutes_overnight`                              | Overnight cadence target (default 60 min). The monitor fires every other `@every 30m` tick overnight (effective 60-min rate).                                          |
-| `busy_only_daytime`                                      | When `true`, daytime ticks are skipped unless any agent has `agent_status=working` (D3 busy-signal gate).                                                              |
+| `busy_only_daytime`                                      | When `true`, daytime ticks are skipped unless any agent has `agent_status=working` (busy-signal gate).                                                              |
 | `busy_signal`                                            | Algorithm for "is the fleet busy?" Default `working_or_activity_30m`: any agent working OR activity in the last 30 min.                                                |
 | `overnight_window.tz`                                    | **MUST be an explicit IANA timezone** (e.g. `"America/New_York"`). If unset, the sweep warns and falls back to always-daytime-rate rather than silently guessing. |
-| `backoff.start_after`                                    | Number of consecutive unchanged detections of the same problem before D5 progressive backoff begins.                                                                   |
+| `backoff.start_after`                                    | Number of consecutive unchanged detections of the same problem before progressive backoff begins.                                                                   |
 | `backoff.multiplier`                                     | Each backoff step multiplies the surface interval by this factor (default 2×).                                                                                         |
 | `backoff.floor_every`                                    | The surface interval is capped at this many ticks — the problem is never fully silenced (always surfaces at least once per `floor_every` ticks).                       |
 | `lenses.<name>.enabled`                                  | Enable/disable a lens individually.                                                                                                                                    |
@@ -238,8 +237,8 @@ The heartbeat system is configured under the `heartbeat` key in
 `.thrum/config.json`** to configure the heartbeat. Two gotchas make this
 non-obvious; both bite silently.
 
-**1. All-or-nothing merge (the sharp footgun).** The loader
-(`internal/config/daemon.go`, `LoadThrumConfig`) applies
+**1. All-or-nothing merge (the sharp footgun).** The config
+loader (`LoadThrumConfig`) applies
 `DefaultHeartbeatConfig()` **only when the stanza is effectively absent**
 (`schema_version == 0` AND zero lenses):
 
@@ -254,7 +253,7 @@ There is **no field-level deep merge.** The moment you write a stanza with
 `cadence_minutes_day: 0`, `enabled: false`, and **all 12 lenses disabled**. So
 "I'll just set the timezone" with a three-line stanza silently turns the whole
 sweep off. **Always write the COMPLETE stanza** — copy
-`DefaultHeartbeatConfig()` (`internal/config/heartbeat.go`) in full, then change
+`DefaultHeartbeatConfig()` in full, then change
 only what you need.
 
 **2. `overnight_window.tz` MUST be an explicit IANA zone.** Default is `""` (the
@@ -332,7 +331,7 @@ repeals fix-while-warm.
   restart is **under one turn** once context is meaningfully above the re-prime
   floor.
 - **Orchestrators re-prime far cheaper than coordinators, and it is structural:**
-  `internal/cli/prime_filter.go` gives ONLY `role=="coordinator"` the full
+  the prime output filter gives ONLY `role=="coordinator"` the full
   project-state passthrough. Measured orchestrator re-prime ≈ 30k tokens.
 - Coordinators keep the ladder below for a stated reason — larger re-entry cost,
   plus decision-dense context a snapshot cannot faithfully reconstruct.

package/assets/skills/coordinator-deploying-a-node/SKILL.md

@@ -48,7 +48,9 @@ If the project has no WAL/SHM, this section is N/A — skip and note.
 
 ## 4. Never wrap service start/restart in a blind timeout
 
-Run the project's service restart command (`fleet.deployment.thrum.service.restart_command` or product equivalent) without a blind timeout wrapper. A timeout that kills a migrating restart mid-migration manufactures a half-migrated store.
+🔴 **On macOS, the restart command is NOT `service.restart_command` — it is `service.mac_restart_command`** (Thrum: `scripts/mac-daemon-restart-via-cron.sh`, run from inside the repo). A daemon restarted from a terminal or agent pane gets its Local Network (TCC) permission attributed to that terminal and is silently denied LAN peer dials (`no route to host`): peers go dark while the node itself looks healthy, and `PPID 1` does NOT prove it was re-parented correctly. Check the node's OS before choosing the command; this has been forgotten on primary repeatedly. After a mac restart, verify the peers on the LAN reconnect, not just the version.
+
+Run the project's service restart command (`fleet.deployment.thrum.service.restart_command`, or `service.mac_restart_command` on macOS, or product equivalent) without a blind timeout wrapper. A timeout that kills a migrating restart mid-migration manufactures a half-migrated store.
 
 - Adapter flag `service.never_timeout` is true.
 - Signal-window rules are adapter data: `migration.signal_rules` (`SIGQUIT` fatal-always, `SIGUSR1` fatal-before-socket). Respect them — do not send fatal signals in the forbidden window.

package/assets/skills/coordinator-dispatching-work/SKILL.md

@@ -26,7 +26,9 @@ send. See `coordinator-managing-state-and-lifecycle` § "Destroy an agent before
 tearing down its worktree" for the canonical sequence (`thrum tmux kill` BEFORE
 `thrum worktree teardown`). The dispatching skill mentions it here so you find
 the cross-reference when planning a wave recycle, not just when reading the
-lifecycle skill end-to-end.
+lifecycle skill end-to-end. Teardown does not delete the agent row: it stays
+retired until a separate `thrum agent delete <agent>` (after the worktree is
+gone) or the sweeper reaps it.
 
 ## Never spawn sub-agents into worktrees where Thrum agents are running
 

package/assets/skills/coordinator-hotpath-merge-gate/SKILL.md

@@ -90,7 +90,7 @@ the one resource it cannot replace and leaves no durable verdict artifact.
 explicitly in the merge record so the gap is visible rather than invisible.
 
 **Verdicts are artifacts:** the runner saves them to
-`dev-docs/gate-reports/<ISO-week>/<date>/<gate-slug>/` and commits them BEFORE
+`<gate-reports-dir>/<ISO-week>/<date>/<gate-slug>/` (the project's gate-reports directory) and commits them BEFORE
 removing any worktree. A verdict that exists only in a message cannot be audited
 later.
 
@@ -99,7 +99,7 @@ later.
 Mandatory checklist handed to the GATE RUNNER (and to any sub-agent it spawns in
 turn) at dispatch time. Each
 rule below currently lives only as prose warnings scattered through
-`dev-docs/hotpath-gate-efficacy.md` and gets re-learned per session — hand this
+the hotpath-gate efficacy log and gets re-learned per session — hand this
 list to the sub-agent verbatim at dispatch time instead of relying on it
 rediscovering these the hard way:
 
@@ -570,7 +570,7 @@ diff — don't bounce reflexively.
 
 ## Efficacy tracking (v1 acceptance requirement)
 
-After every gate run, record the outcome in `dev-docs/hotpath-gate-efficacy.md`
+After every gate run, record the outcome in the hotpath-gate efficacy log
 (created lazily on first run). This is a durable, committed, grep-queryable log
 that measures v1's real-world efficacy so we can iterate to v2 with data.
 
@@ -609,7 +609,7 @@ rows.
 | `CLEAN-WITH-GATE-FIXES` | Gate found only mechanical bookkeeping gaps, fixed them itself as a GATE-AUTHORED commit, re-ran only the affected checks, merge proceeded |
 
 **Retrospective reclassification:** When triaging a new wedge or incident, grep
-`dev-docs/hotpath-gate-efficacy.md` for the merged branch/date. If the gate
+the hotpath-gate efficacy log for the merged branch/date. If the gate
 previously logged `CLEAN` for that branch, append a follow-up line referencing
 the original entry:
 `- YYYY-MM-DD | branch=<branch> | RECLASSIFIED: CLEAN->SLIPPED | notes=<what the gate missed + which lens should have caught it>`.
@@ -625,13 +625,13 @@ gaps and lens improvements for the next version.
   patterns, reference functions, incident prose)
 - `project-hotpath-gate` — the companion builder skill that generates/reconciles
   the config (analog of `project-philosophy`)
-- `dev-docs/brainstorms/hotpath-merge-gate/` — the locked brainstorm (evidence,
+- the hotpath-merge-gate brainstorm record — the locked brainstorm (evidence,
   gap analysis, lens details, decisions)
 - `coordinator-philosophy-merge-gate` — the companion general-structural gate
   (runs in parallel)
 - `.thrum/philosophy.md` — canonical source for general anti-patterns (cross-
   referenced by Lenses 1–2, 6–7 where they overlap)
-- `dev-docs/hotpath-gate-efficacy.md` — running efficacy log (created lazily on
+- the hotpath-gate efficacy log — running efficacy log (created lazily on
   first gate run, appended after each run)
 
 <!-- THRUM-GATE: stage=skill next=review -->

package/assets/skills/coordinator-managing-state-and-lifecycle/SKILL.md

@@ -130,9 +130,17 @@ run the two-command destroy sequence **in this order**:
 
 ```bash
 thrum tmux kill <session>          # kills tmux + runtime first
-thrum worktree teardown <name>     # then removes worktree + identity
+thrum worktree teardown <name>     # then retires the agent + removes the worktree (salvage first)
+thrum agent delete <agent>         # SEPARATE reap, after the worktree is gone
 ```
 
+`worktree teardown` does NOT delete the agent: it is preparation for deleting
+one. The row stays `retired` (hidden from default `agent list` / `team` /
+overview / UI; visible with `--include-inactive` / `--phase retired`) until
+`thrum agent delete` or the sweeper reaps it. `agent delete` refuses an agent
+whose linked worktree still exists or whose process (pid/tmux) is live, and
+refuses coordinators; correct order is teardown (with salvage) THEN delete.
+
 Sanity-check: after teardown, `tmux list-sessions` should NOT show the agent's
 session. If it does, the runtime was never killed and step 1 was skipped.
 

package/assets/skills/coordinator-merging-code/SKILL.md

@@ -169,7 +169,7 @@ The §3 lens gates (hotpath + philosophy) are the judgement half. The per-merge
 executed half is **scoped to the change**:
 
 - Build the merged tree (`go build ./...`).
-- 🔴 **RULING 2026-09-29:** the full sharded race suite —
+- 🔴 **RULING:** the full sharded race suite —
   `scripts/test-run.sh race all` (~15-20 min) — on the **merged tree**, every
   Pass-3 verdict. This replaces the prior "changed packages only (+ rpc shard
   sweep)" race scoping below the ruling; a targeted `-run` is still never
@@ -227,7 +227,7 @@ the UI lane, the full tripwire/boxstate reconciliation — is the **periodic
 full-gate cadence**, an agent run on the dedicated isolation box, and it is its own
 skill: **`coordinator-full-gate`**. A merge never triggers it, and its merge-base
 replay is not a per-merge step. Running it per merge is ~2h that on a common-mode-
-red trunk fails on the baseline every time. The RULING 2026-09-29 above
+red trunk fails on the baseline every time. The RULING above
 widens only the **race lane** to full-sharded per merge — it does not pull the
 other lanes (integration, UI, mutation-check) into the per-merge path.
 
@@ -288,12 +288,12 @@ agreeing (`rev-parse origin/<branch>` and `ls-remote`). **Assert the branch TIP*
 ## 7. AFTER THE MERGE — four things, none optional
 
 1. **The verdict artifact.** The runner saves verdicts to
-   `dev-docs/gate-reports/<ISO-week>/<date>/<gate-slug>/` and **commits them
+   `<gate-reports-dir>/<ISO-week>/<date>/<gate-slug>/` (the project's gate-reports directory) and **commits them
    BEFORE removing any worktree.** Save → commit → then destroy. A verdict that
    exists only in a message cannot be audited later. The artifact must be able to
    carry a `CLEAN-WITH-GATE-FIXES` outcome, and when one applies it cites the
    `GATE-AUTHORED` commit SHA.
-2. **The efficacy row**, in `dev-docs/hotpath-gate-efficacy.md` — required for
+2. **The efficacy row**, in the hotpath-gate efficacy log — required for
    **every** trigger-dir merge, including `SKIPPED_WITH_EVIDENCE` rows and
    orchestrator-run merges. The log measures gate **coverage**, not just outcomes.
    Record `FALSE_POSITIVE=0` explicitly on a clean run so the zero is a
@@ -364,7 +364,7 @@ hides staleness.
 - `coordinator-hotpath-merge-gate` · `coordinator-philosophy-merge-gate` — the lenses
 - `coordinator-running-review-cycles` — the dual-review cycle feeding §1
 - `coordinator-branch-split-on-block` — when a gate blocks one concern of a bundled branch
-- `dev-docs/gate-reports/README.md` — the artifact contract
+- the gate-reports README — the artifact contract
 - `.thrum/hotpath-gate.json` · `.thrum/philosophy.md` — the configs; read these, not prose
 
 ## Project-specific rules (already loaded)

package/assets/skills/coordinator-philosophy-merge-gate/SKILL.md

@@ -63,7 +63,7 @@ the one resource it cannot replace and leaves no durable verdict artifact.
 explicitly in the merge record so the gap is visible rather than invisible.
 
 **Verdicts are artifacts:** the runner saves them to
-`dev-docs/gate-reports/<ISO-week>/<date>/<gate-slug>/` and commits them BEFORE
+`<gate-reports-dir>/<ISO-week>/<date>/<gate-slug>/` (the project's gate-reports directory) and commits them BEFORE
 removing any worktree. A verdict that exists only in a message cannot be audited
 later.
 
@@ -204,7 +204,7 @@ detection is the 10a/10b/10d probe set, not a single grep.
 ## Lens 10 — Conflated multi-responsibility service (Anti-Pattern #10)
 
 This lens uses three sub-procedures from the single-responsibility standing rule
-(`dev-docs/decisions/2026-07-09-single-responsibility-standing-rule.md`).
+(the project's single-responsibility decision record).
 
 ### 10a — Structural backstop (grep before you trust prose review)
 
@@ -453,7 +453,7 @@ diff — don't bounce reflexively.
 
 - `.thrum/philosophy.md` — canonical source for all anti-patterns and red flags
   checked by this gate
-- `dev-docs/decisions/2026-07-09-single-responsibility-standing-rule.md` — full
+- the single-responsibility decision record — full
   standing rule with the three-class scope model, enforcement architecture
   (3a/3b/3c/3d), and worked examples of previously-traced conflated services
 

package/assets/skills/coordinator-rolling-out-to-nodes/SKILL.md

@@ -90,3 +90,4 @@ The node's local runbook is `coordinator-deploying-a-node` — reference that sk
 - If `fleet.deployment.thrum.products` exists (vestigial), STOP — products live only at `fleet.deployment.products`.
 - If a node reports success by exit code alone without observed-effect verification, treat as not-verified.
 - Never wrap a service restart in a blind timeout on the node (see node skill `service.never_timeout` and `migration.signal_rules`).
+- 🔴 A **macOS** node (including the build host / primary) restarted with the plain `service.restart_command` instead of `service.mac_restart_command` (Thrum: `scripts/mac-daemon-restart-via-cron.sh`). The daemon loses its Local Network permission and its LAN peers go dark while it looks healthy. Put the mac command in every macOS node's dispatch, and use it yourself when you roll the build host last.

package/assets/skills/efficient-multi-agent-research/SKILL.md

@@ -59,7 +59,7 @@ read-only scoping) are in "Core Pattern" below.
    **Every prompt MUST scope the read-only restriction around its own output
    file, in the same breath:** `READ-ONLY EVERYWHERE EXCEPT YOUR OUTPUT FILE —
    do not modify source, tests, config, git state, or the issue tracker; you
-   MUST write exactly dev-docs/<topic>/findings_N.md, and that write is
+   MUST write exactly <topic-dir>/findings_N.md, and that write is
    expected and authorized.` Omitting the exception is the most common cause of
    a fan-out that returns nothing — see Common Mistakes.
 
@@ -134,7 +134,7 @@ Prefer `cat >> <path> <<'EOF'` to append on later rounds.
 ```text
 READ-ONLY EVERYWHERE EXCEPT YOUR OUTPUT FILE.
 Do not modify source, tests, config, git state, or the issue tracker.
-You MUST write your findings to exactly: dev-docs/<topic>/findings_N.md
+You MUST write your findings to exactly: <topic-dir>/findings_N.md
 Write is fine for creating it. To UPDATE it on a later round, Read it first or
 append with a heredoc (cat >> <path> <<'EOF' ... EOF) — Write refuses to
 overwrite a file it has not Read. That single write is expected and authorized.

package/assets/skills/memory-audit-recover/SKILL.md

@@ -44,7 +44,7 @@ monotonic-ish and globally comparable; the larger ULID wins.
 | Concurrent edits to the SAME field                                              | Larger-ULID event wins. Loser preserved in JSONL.        |
 | Concurrent tombstones                                                           | Idempotent. One delete-event wins by ts; status=purged.  |
 | Edit + delete, delete-ULID > edit-ULID                                          | Final `status=purged`.                                   |
-| Edit + delete, edit-ULID > delete-ULID AND edit explicitly sets `status=active` | Edit wins → `status=active` (undelete).                  |
+| Edit + delete, edit-ULID > delete-ULID AND edit explicitly sets `status=active` | Edit wins → `status=active` (undelete; needs a license). |
 | Edit + delete, edit-ULID > delete-ULID AND edit does NOT touch `status`         | Patch applies to body/tags but `status=purged` persists. |
 
 LWW is acceptable here because memories aren't a high-write-conflict surface
@@ -94,6 +94,8 @@ Undelete by writing `status=active`:
 thrum memory edit <id> --status active
 ```
 
+Note: `memory edit` (including `--status active` undelete) requires a license (memory.substrate); soft delete (`memory delete`) and reads stay open.
+
 Undelete works regardless of who won the concurrent edit/delete race (see LWW
 table above). The audit history is intact, so the recovered memory carries its
 full provenance.
@@ -116,10 +118,10 @@ Type DELETE <id> to confirm: DELETE <id>
 The exact token (`DELETE <id>`) must be typed back — matches beads'
 `DESTROY-<prefix>` pattern. There is no `--yes` bypass.
 
-| Mode            | Mechanism                                                      | Recovery                                 |
-| --------------- | -------------------------------------------------------------- | ---------------------------------------- |
-| Soft (default)  | `memory.delete` → projection `status=purged`                   | `thrum memory edit <id> --status active` |
-| Hard (`--hard`) | `memory.purge_executed` → physical JSONL removal at compaction | Not recoverable post-compaction          |
+| Mode            | Mechanism                                                      | Recovery                                                    |
+| --------------- | -------------------------------------------------------------- | ----------------------------------------------------------- |
+| Soft (default)  | `memory.delete` → projection `status=purged`                   | `thrum memory edit <id> --status active` (license required) |
+| Hard (`--hard`) | `memory.purge_executed` → physical JSONL removal at compaction | Not recoverable post-compaction                             |
 
 ## When NOT to hard-delete
 

package/assets/skills/memory-curate/SKILL.md

@@ -25,7 +25,7 @@ Edge kind is an open string (same hybrid pattern as memory kind). Future edges
 like `blocks`, `duplicates`, or `parent-child` can be added without schema
 change.
 
-Add and remove edges:
+Add and remove edges. `memory link` and `memory edit` require a license (memory.substrate); `memory unlink` does not.
 
 ```bash
 thrum memory link <a> supersedes <b>
@@ -59,7 +59,7 @@ thrum memory unlink <new-id> supersedes <old-id>
 thrum memory edit <old-id> --status active
 ```
 
-Both steps are required. If you only need to keep the historical link but
+The `--status active` step needs a license; without one the superseded memory stays superseded. Both steps are required. If you only need to keep the historical link but
 re-surface the old memory, just run the `--status active` edit and leave the
 edge in place.
 

package/assets/skills/memory-maintenance/SKILL.md

@@ -21,6 +21,8 @@ thrum memory edit <id> --title "<updated title>"
 thrum memory edit <id> --add-tag <new-tag>    # appends (repeatable); --rm-tag removes
 ```
 
+`memory edit` requires a license (memory.substrate); `delete` and `unlink` do not.
+
 Edits create a **history record** — the daemon retains the prior version. View
 edit history:
 

package/assets/skills/orchestrate/SKILL.md

@@ -653,7 +653,7 @@ thrum worktree teardown <name>
 ```
 
 > After set-phase=retired, `thrum team` and the active UI views no longer show
-> this agent (sidebar, pickers, badge, kbd-nav). It remains in the Retired tab.
+> this agent (sidebar, pickers, badge, kbd-nav). It remains in the Retired tab (teardown retires, it does not delete the row).
 > Its messages + runtime transcript persist for audit. `thrum agent delete` is
 > operator-only (gated to the coordinator) and is NOT an orchestrator tool —
 > `set-phase retired` is the orchestrator's retirement command for both normal

package/assets/skills/persistent-watcher-archetype/SKILL.md

@@ -131,7 +131,7 @@ The procedure, every time, no shortcuts:
   another peer's panes read-only regardless of capability.
 
 **Worked example** — the standard two-variant Claude Code tool-confirmation
-modal (`internal/daemon/permission/patterns.go`, pattern `tool_confirmation`,
+modal (the daemon's permission patterns, pattern `tool_confirmation`,
 dialect `claude-tui`), captured verbatim:
 
 ```
@@ -149,7 +149,7 @@ dialect `claude-tui`), captured verbatim:
   allow-rule beyond this one command; the modal judgment rubric above is a
   per-command judgment, not a license to mint blanket permissions. This is
   pinned by `ApproveKey: "1", // Yes (once) — NEVER "2"` in
-  `internal/daemon/permission/patterns.go` and tested by
+  the daemon's permission patterns and tested by
   `TestApproveKeyNeverForeverAllow`.
 
 ## Your own restart (auto-restart-at-ctx-threshold)

package/assets/skills/persistent-watcher-archetype/resources/jev_watcher_filter.py

@@ -45,8 +45,8 @@ NOTIFY_CLASSES = VALID_CLASSES - {"ordinary"}
 REDACTION_TOKEN = "[REDACTED_SECRET]"
 LOCAL_PATH_REDACTION_TOKEN = "[REDACTED_LOCAL_PATH]"
 SECRET_PATTERNS: tuple[tuple[str, re.Pattern[str]], ...] = (
-    ("private_key_block", re.compile(r"-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----.*?-----END [A-Z0-9 ]*PRIVATE KEY-----", re.S)),
-    ("env_secret_assignment", re.compile(r"(?im)^\s*(?:export\s+)?[A-Z0-9_]*(?:API[_-]?KEY|TOKEN|SECRET|PASSWORD|PRIVATE[_-]?KEY|AUTH[_-]?KEY)[A-Z0-9_]*\s*=\s*([^\s#]+)")),
+    ("private_key_block", re.compile(r"-----BEGIN [0-9A-Z ]*PRIVATE KEY-----.*?-----END [0-9A-Z ]*PRIVATE KEY-----", re.S)),
+    ("env_secret_assignment", re.compile(r"(?im)^\s*(?:export\s+)?[0-9A-Z_]*(?:API[_-]?KEY|TOKEN|SECRET|PASSWORD|PRIVATE[_-]?KEY|AUTH[_-]?KEY)[0-9A-Z_]*\s*=\s*([^\s#]+)")),
     ("bearer_token", re.compile(r"(?i)\bBearer\s+[A-Za-z0-9._~+/=-]{16,}")),
     ("openai_key", re.compile(r"\bsk-[A-Za-z0-9_-]{20,}\b")),
     ("thrum_key", re.compile(r"\btskey-[A-Za-z0-9_-]{16,}\b")),
@@ -318,7 +318,7 @@ def prompt_payload(state: dict[str, Any], provider: str = TYPESAFE_PROVIDER) ->
         },
     }
     if provider == OPENROUTER_PROVIDER:
-        payload["user"] = "thrum-roster-watch-filter"
+        payload["user"] = "roster-watch-filter"
     return payload
 
 
@@ -462,8 +462,8 @@ def classify_remote(state: dict[str, Any], provider: str, api_key: str, timeout:
     }
     if provider == OPENROUTER_PROVIDER:
         headers.update({
-            "HTTP-Referer": "https://github.com/falconleon/thrum",
-            "X-Title": "thrum-roster-watch-filter",
+            "HTTP-Referer": "https://github.com/leonletto/thrum-pro.git",
+            "X-Title": "roster-watch-filter",
         })
     last_error = None
     last_category = None

package/assets/skills/persistent-watcher-archetype/resources/roster-watch.sh

@@ -32,7 +32,7 @@
 # GHOST-TIP DETECTION: Claude Code's TUI renders an unaccepted inline
 # autocomplete suggestion in the input box using the literal SGR
 # "dim/faint" escape code (ESC[2m ... ESC[0m) — confirmed by direct byte
-# inspection (2026-08-17, a reconciler agent's "Stop the sweep loop
+# inspection (a reconciler agent's "Stop the sweep loop
 # for now" tip). Real typed/submitted text never carries that code. `thrum
 # tmux capture` returns plain text with all styling stripped, so a script
 # parsing ONLY that output cannot tell a live ghost-tip apart from real
@@ -50,7 +50,7 @@
 #
 # REDIRECT FIX (the actual bug this reconciliation targets):
 # `watch_params.json` lives under the SHARED, redirect-resolved `agents/`
-# tree (`internal/paths/paths.go` AgentDir: "the agents/ tree is shared,
+# tree (the AgentDir path helper: "the agents/ tree is shared,
 # not per-worktree"), not under this script's own worktree. Both source
 # scripts read it as if it were always reachable via a hardcoded/relative
 # main-repo path (`cd /Users/you/dev/thrum` +
@@ -60,7 +60,7 @@
 # feature worktree. `resolve_watch_params()` below replaces that implicit
 # assumption with the same explicit `.thrum/redirect`-following idiom
 # already used by `scripts/heartbeat-lib.sh:225-232` and
-# `scripts/thrum-check-inbox.sh:25-41`.
+# the check-inbox hook script.
 #
 # PORTABILITY FIX: both source scripts also hardcoded a single operator's
 # absolute paths (`cd /Users/you/dev/thrum`,
@@ -105,7 +105,7 @@ set -uo pipefail
 # ---------------------------------------------------------------------------
 # Args: worktree_root. Prints the redirect-resolved absolute .thrum/ dir.
 # Matches the idiom already used by scripts/heartbeat-lib.sh's
-# hb_sessions_dir() and scripts/thrum-check-inbox.sh's SPOOL_THRUM
+# hb_sessions_dir() and the check-inbox hook script's SPOOL_THRUM
 # resolution: no redirect file present (main repo) -> use the local .thrum/
 # as-is; redirect file present (feature worktree) -> follow it to the main
 # repo's .thrum/.
@@ -648,7 +648,7 @@ except: print(0)
 # entry resolves to a real agent_id via `thrum team --offline --json`, and
 # log ROSTER-CHECK OK/FAIL. Cheap and valuable regardless of execution
 # model (catches the exact "bare `<box>`-as-hostname" class of stale-
-# roster-entry bug watcher-primary hit 2026-07-24..2026-09-06). Runs AFTER
+# roster-entry bug watcher-primary hit). Runs AFTER
 # the dynamic roster is loaded from watch_params.json, not against a
 # hardcoded array.
 # ---------------------------------------------------------------------------

package/assets/skills/persistent-watcher-archetype/resources/roster-watch_test.sh

@@ -69,8 +69,8 @@ AGENT="watcher_primary"
 # Scenario 1 (MANDATORY, cmain-required regression guard): a worktree that
 # redirects to a main-repo tree. The "roster-editing agent's Edit-tool write"
 # lands in the REDIRECT TARGET (main-repo) copy -- that's the physically
-# correct, shared, redirect-resolved location per internal/paths/paths.go
-# AgentDir ("the agents/ tree is shared, not per-worktree"), and it's what
+# correct, shared, redirect-resolved location per the AgentDir path helper
+# ("the agents/ tree is shared, not per-worktree"), and it's what
 # resolve_watch_params must read. A worktree-LOCAL copy at the naive,
 # unresolved path is a decoy: it's what a broken script (SCRIPT_DIR-relative,
 # no redirect-follow) would read instead, and it must be ignored.

package/assets/skills/persistent-watcher-archetype/resources/thrum-capture-fallback.sh

@@ -94,7 +94,7 @@ run_ssh() {
 }
 
 # ssh-add retry: if the SSH hop itself fails at the connection layer (not a
-# thrum-level error), the caller's identities may need re-adding to the
+# CLI-level error), the caller's identities may need re-adding to the
 # keychain-backed ssh-agent. No default keys ship here -- this is a
 # generic plugin script, and baking in one operator's specific key
 # filenames would be wrong for every other fleet/operator that copies it.

package/assets/skills/persistent-watcher-archetype/resources/thrum-watch-pane-capture.sh

@@ -74,7 +74,7 @@ AGENT_NAME="$(basename -- "${SCRIPT_DIR}")"
 REPO_ROOT="$(cd -- "${SCRIPT_DIR}/../../.." >/dev/null 2>&1 && pwd)"
 # Resolve watch_params.json through .thrum/redirect. The
 # agents/ tree is the SHARED, redirect-resolved (main-repo) tree, not
-# per-worktree (see internal/paths/paths.go AgentDir) -- reading it
+# per-worktree (see the AgentDir path helper) -- reading it
 # straight off SCRIPT_DIR (this copy's own worktree-local location) reads
 # the wrong, stale file whenever this script is deployed into a feature
 # worktree that redirects: a roster-editing agent's Edit-tool write lands
@@ -185,7 +185,7 @@ log "roster: ${ROSTER[*]}"
 #
 # NOTE ON THE TWO-STEP TOPOLOGY LOOKUP: `thrum state list --kind topology
 # --json`'s CLI output does NOT include each entry's `.value` (verified
-# against cmd/thrum/state.go's stateListEntry struct, which has no Value
+# against the CLI's stateListEntry struct, which has no Value
 # field, and confirmed live -- `state list --json` returns only
 # kind/scope/method/as_of/established_by). Only `state get`/`state show`
 # emit the full entry including `.value`. So topology resolution is
@@ -338,7 +338,7 @@ for agent in "${ROSTER[@]}"; do
   STATUS="clean"
   MATCH_NAME=""
 
-  # thrum detect exit-code contract (cmd/thrum/detect.go):
+  # thrum detect exit-code contract:
   #   exit 0 + matched entry name on stdout  -> match
   #   exit 1, silent                         -> no match
   # `if VAR=$(...); then` is exempt from `set -e` semantics for this

package/assets/skills/project-philosophy/SKILL.md

@@ -231,7 +231,7 @@ undetected or unprovided. Fill in:
 
 ### Step 6a: MANDATORY — wire the project's security/threat model into the Decision Framework
 
-If the project has a written threat model (search `docs/security_model/`,
+If the project has a written threat model (search the project's security-model directory,
 `docs/security*.md`, `SECURITY.md`), the rendered philosophy MUST carry a
 Decision Framework row pointing at it — and that row MUST NOT be keyed on the
 word "attacker".

package/assets/skills/project-setup/SKILL.md

@@ -260,8 +260,8 @@ components, data flow, and interfaces.
 
 ### 🔴 Phase 1a — MANDATORY security-frame check (do this BEFORE decomposing)
 
-**Read the project's threat model** (`docs/security_model/master.md` §1 and §1.2
-on thrum; otherwise `docs/security*.md` / `SECURITY.md`) **whenever the plan
+**Read the project's threat model** (its security-model document, or
+`docs/security*.md` / `SECURITY.md`) **whenever the plan
 contains ANY of the following — and note that NONE of them need name an
 attacker:**
 

package/assets/skills/researcher-maintaining-memory/SKILL.md

@@ -94,6 +94,8 @@ EOF
 thrum memory edit <id> --full "@/tmp/memory-verify-body.md"
 ```
 
+Re-verifying with `memory edit` needs a license.
+
 ## Staleness check via git diff
 
 For research notes that cite specific files, structural staleness review filters

package/assets/skills/thrum/SKILL.md

@@ -86,14 +86,19 @@ thrum tmux launch <session> [--runtime <r>]   Start runtime in session (REQUIRED
 ### Monitor Jobs
 
 ```bash
-thrum monitor add <name> --cmd "..." --on-match "msg"   Add a monitored process
-thrum monitor list                   List all monitor jobs
-thrum monitor show <name>            Show job details and recent matches
+thrum monitor start --name <n> --match <re> --to @agent [--schedule "<cron>"] [--notify-on-success] -- <cmd> [args...]
+thrum monitor list [--all]           List monitor jobs (running; --all adds stopped)
+thrum monitor show <name>            Show job details
+thrum monitor logs <name>            Recent matched lines
+thrum monitor update <name>          Change match, schedule, target or debounce in place
 thrum monitor stop <name>            Stop a monitor job
-thrum monitor logs <name>            Tail job output
+thrum monitor delete <name>          Remove a job and free its name
 thrum monitor restart <name>         Restart a stopped job
 ```
 
+Reminders, periodic script checks and delivery verification: see the
+`using-monitors` skill.
+
 ### Daemon & Sync
 
 ```bash

package/assets/skills/thrum/resources/CLI_REFERENCE.md

@@ -255,7 +255,7 @@ Flags:
 --runtime string         Runtime preset: claude, codex, cursor, gemini, opencode, auggie, cli-only
 --preamble-file string   Custom preamble file to compose with default preamble
 --no-init                Skip runtime config generation, just register agent
---force                  Overwrite existing runtime config files
+--force                  Force runtime config reinitialization; project instruction files are preserved
 --dry-run                Preview changes without writing files or registering
 --no-agent-pid           Persist agent_pid=0 instead of detecting the runtime ancestor; defers PID claim to first /thrum:prime (used for inline tmux quickstart)
 ```
@@ -379,6 +379,10 @@ thrum agent delete <name>
 thrum agent delete coordinator_1B9K --force
 ```
 
+Refuses an agent whose linked worktree still exists (run `worktree teardown`
+first), a live pid/tmux process, and coordinators. Order: teardown (with
+salvage), then delete.
+
 Flags:
 
 ```text
@@ -858,7 +862,7 @@ thrum tmux cancel <command-id>                 # Cancel a queued or active comma
 --intent string    Initial work intent description
 --runtime string   Runtime preset: claude, codex, cursor, gemini, opencode, auggie
 --no-agent         Skip agent registration (create session only)
---force            Overwrite existing runtime config files
+--force            Re-register even if agent exists; kill and recreate an existing session
 ```
 
 Without `--no-agent`, the command errors if `--name`, `--role`, and `--module`
@@ -900,7 +904,7 @@ thrum worktree create <name> --detach          # Detached HEAD worktree
 thrum worktree create <name> \
   --name <agent> --role <role> --module <mod>  # Create worktree + register agent
 thrum worktree setup <name>                    # Alias for worktree create
-thrum worktree teardown <name>                       # Remove worktree, keep branch
+thrum worktree teardown <name>                       # Retire agent + remove worktree, keep branch (does NOT delete the agent; reap with `thrum agent delete` after)
 thrum worktree teardown <name> --delete-branch       # Also delete the worktree's branch
 thrum worktree list                                  # List worktrees with agent info
 ```
@@ -939,51 +943,52 @@ later.
 
 ## Monitor Jobs
 
-Run a long-lived command, filter output through a regex, and deliver matching
-lines as Thrum messages. Jobs persist across daemon restarts. Max 100
-concurrent. The command must follow `--`.
+Run a command, filter its output through a regex, and deliver matching lines as
+Thrum messages. Without `--schedule` the command runs continuously and restarts
+with backoff; with `--schedule` it runs once per cron tick. Jobs persist across
+daemon restarts. Max 100 concurrent. The command must follow `--`.
 
 ```bash
 thrum monitor start --name <n> --match <re> --to @agent -- <cmd> [args...]
 thrum monitor start --name <n> --match <re> --to @agent \
-  --debounce 120s --env KEY=VALUE -- <cmd>
+  --schedule "*/5 * * * *" --notify-on-success --debounce 120s --env KEY=VALUE -- <cmd>
 thrum monitor list                             # Running jobs only
 thrum monitor list --all                       # Include stopped/dead (<1 week)
 thrum monitor show <id|name>                   # Full detail (env values redacted)
-thrum monitor stop <id|name>                   # SIGTERM → 5s → SIGKILL
-thrum monitor logs <id|name>                   # Last 20 matched lines
-thrum monitor logs <id|name> -n 50             # Last 50 matched lines
+thrum monitor logs <id|name> -n 50             # Last 50 matched lines (default 20)
+thrum monitor update <id|name> --match <re>    # Change match/schedule/target/debounce in place
+thrum monitor stop <id|name>                   # SIGTERM, 5s, SIGKILL
 thrum monitor restart <id|name>                # Restart dead/stopped monitor
+thrum monitor delete <id|name>                 # Remove the record and free the name
+thrum monitor adopt <id|name>                  # Claim a monitor for this daemon
 ```
 
-Note: `monitor add` is retained as an alias for `monitor start`.
+`monitor add` is an alias for `monitor start`.
 
 `monitor start` flags:
 
 ```text
 --name string         Unique monitor name (required)
---match string        Regex pattern — matching lines trigger a message (required)
+--match string        Regex pattern - matching lines trigger a message (required)
 --to string           Target agent or group, e.g. @coordinator (required)
---debounce duration   Leading-edge debounce window, minimum 30s (default 60s)
---env strings         Environment variable in KEY=VALUE form (repeatable)
+--schedule string     5-field cron expression; runs the command once per tick
+--notify-on-success   Deliver a generic [OK] message for a successful run in which no line matched
+--debounce duration   Leading-edge debounce window, minimum 30s (default 1m)
+--env stringArray     Environment variable in KEY=VALUE form (repeatable)
 --cwd string          Working directory for the command (default: current dir)
 ```
 
-`monitor list` flags:
-
-```text
---all   Include stopped/dead monitors younger than one week
-```
+`monitor update` flags: `--match`, `--to`, `--schedule`, `--debounce`.
+`--schedule` changes the cron of a scheduled monitor at any time; setting or
+removing a schedule switches the mode, which is refused while the monitor is
+running and allowed while it is stopped.
 
-`monitor logs` flags:
-
-```text
--n, --limit int   Max number of matches to return (default 20)
-```
+`monitor logs` flag: `-n, --limit int` (default 20).
 
-Key constraints: local Unix socket only, max line length 2KB (lines truncated),
-leading-edge debounce (min 30s), auto-persists across daemon restart, sends a
-notify-only message on child exit.
+Key constraints: local Unix socket only, lines over 2KB are truncated with a
+marker, one matching line is delivered per debounce window, and a message is
+sent when the child exits non-zero. See the `using-monitors` skill for
+reminders, script checks and delivery rules.
 
 ---
 

package/assets/skills/thrum-memory/SKILL.md

@@ -70,7 +70,7 @@ thrum memory edit <id> --short @newshort.md
 thrum memory edit <id> --add-tag v0.11 --rm-tag draft
 ```
 
-Link an edge:
+Link an edge. `memory create`, `edit` and `link` need a license (memory.substrate); reads, `delete`, `purge` and `unlink` do not.
 
 ```bash
 thrum memory link <new-id> supersedes <old-id>

package/assets/skills/using-monitors/SKILL.md

@@ -0,0 +1,198 @@
+---
+name: using-monitors
+description: "Use when scheduling a reminder, watching a log, or running a periodic check that must reach an agent - thrum monitor start, cron --schedule, --match, --notify-on-success, --debounce, recurring nudge, script check with exit codes, why a monitor message did not arrive, how to verify a monitor delivered."
+---
+
+# Thrum Monitors - Reminders And Script Checks
+
+## Overview
+
+A monitor runs a command, keeps the output lines that match a regex, and
+delivers them as Thrum messages to a target: a continuous monitor sends each
+kept line, a scheduled monitor sends all the lines of a run in one message. With
+`--schedule` it runs the command once per cron tick; without it the command runs continuously
+and restarts with backoff when it exits. Monitors persist across daemon
+restarts and run only on the daemon that owns them.
+
+Every flag below appears in `thrum monitor start --help`. Re-read the help
+before relying on a flag not listed here.
+
+## Command Surface
+
+```bash
+thrum monitor start --name <n> --match <re> --to @agent [--schedule "<cron>"] \
+  [--notify-on-success] [--debounce 60s] [--env K=V] [--cwd <dir>] -- <cmd> [args...]
+thrum monitor list [--all]
+thrum monitor show <name|id>
+thrum monitor logs <name|id> [-n 50]
+thrum monitor update <name|id> [--match <re>] [--to <t>] [--debounce <d>] [--schedule "<cron>"]
+thrum monitor stop <name|id>
+thrum monitor restart <name|id>
+thrum monitor delete <name|id>
+```
+
+- `--name`, `--match` and `--to` are required; the command follows `--`.
+- `--schedule` takes a 5-field cron expression. `update --schedule` changes the
+  cron of a scheduled monitor at any time. Setting a first schedule or removing
+  it (`--schedule ""`) switches the mode, which is refused while the monitor is
+  running and allowed while it is stopped.
+- `--debounce` is leading-edge with a 30s minimum (default 1m).
+- `stop` leaves a stopped record that still holds the name; `delete` frees the
+  name. Use a unique name per monitor.
+
+## What Is Delivered
+
+Each output line is tested against `--match` on its own. A line is truncated at
+2048 bytes with a marker appended.
+
+A scheduled (`--schedule`) job is a one-shot run, so its exit code is
+authoritative. It delivers ONE message at exit that carries every matched line,
+in order. A continuous job has no exit code per line, so it classifies and
+delivers and classifies each matched line on its own, by its words.
+
+| Scheduled job                                                   | Delivered as                                  |
+| --------------------------------------------------------------- | --------------------------------------------- |
+| Non-zero exit, or the command failed to start                   | `[FAIL] <name>: exit code N` with the output tail, then the matched lines |
+| Exit 0, a matched line starts `ERROR:`, `FATAL:` or `FAIL:`     | `[FAIL] <name>: matched error pattern` + all matched lines |
+| Exit 0, highest prefix is `WARN:`, `WARNING:` or `ALERT:`        | `[WARN] <name>: matched WARNING` + all matched lines |
+| Exit 0, lines matched, no such prefix                           | All matched lines, in order, verbatim         |
+| Exit 0, nothing matched, `--notify-on-success`                  | `[OK] <name>: succeeded`                      |
+| Exit 0, nothing matched                                         | Nothing (logged only)                         |
+
+Cadence: the first non-zero scheduled run sends its `[FAIL]` notice; repeats of
+that failure are not sent again until the outcome changes or the re-escalation
+interval (30 minutes) passes. An exit-0 run that matched lines sends its message
+on every run.
+
+On a scheduled job only these prefixes, at the very start of a line, label the
+output, with the colon directly after the word: `ERROR:`, `FATAL:` and `FAIL:`
+fail it; `WARN:`, `WARNING:` and `ALERT:` warn. Any other prefix, including
+`ALERT-<NAME>:`, `ERROR :`, `INFO:`, `OK:`, `NOT_OK:` and lowercase forms, is
+neutral. They are read before any wording in the body, and
+the highest one decides the label. Words such as `done`, `ok`, `complete`, `failures` or `error` neither
+drop nor relabel a line, and `WARN: batch not complete` stays a warning.
+`--notify-on-success` adds the generic `[OK]` only for a run in which nothing
+matched; an empty matched line counts as a match and is announced as
+`[matched N empty line(s)]`.
+
+The whole message, including its label and framing, never exceeds the daemon's
+configured message-body limit. Matched lines are sent whole while they fit both
+budgets: the in-memory retention budget (each line costs its bytes plus a small
+fixed overhead, so a line close to the limit, or many short lines, can be cut
+or omitted earlier than their plain total would suggest) and the final rendered
+message including its label. Lines that do not fit are replaced by `[N more
+matched lines omitted]`, and a first line that does not fit is cut and
+marked. The limit is never below 1024 bytes (the configuration floor), enough for
+the framing and an omission marker with ordinary job names; when variable
+framing such as a very long job name does not fit, the monitor sends a bounded
+summary that starts with `+N omitted` instead of the lines. A run keeps only a bounded prefix of its lines in memory (at most
+the delivery limit, or 1 MiB when the limit is disabled, counting a small fixed
+overhead per line) but
+counts every match, so the omitted count is exact and an `ERROR:`/`WARN:` line
+past the retained prefix still sets the label.
+
+| Continuous job (no `--schedule`)                                | Delivered as                                  |
+| --------------------------------------------------------------- | --------------------------------------------- |
+| Contains `error`, `fatal`, `fail`, `permission denied`          | `[FAIL] <name>: matched error pattern` + line |
+| Contains `warn` or `warning`                                    | `[WARN] <name>: matched WARNING` + line       |
+| Contains a whole word `success`, `succeeded`, `complete`, `completed`, `done`, `ok` | Not delivered (logged only)   |
+| Any other matched line                                          | The line, verbatim                            |
+
+A continuous job checks a line for a negated completion word (`not complete`)
+first, then for a level prefix (`ERROR:`, `WARN:`, `INFO:`, optionally after a
+timestamp), then for the words above. Tokens such as `fail=0` are not failures;
+the phrase `0 errors` still contains `error`.
+
+Delivery limits:
+
+- A continuous job delivers the first matching line in each debounce window at
+  once and holds later ones for a trailing summary. A scheduled job has no
+  debounce; its lines are aggregated as above.
+- The `[FAIL]` body for a non-zero exit carries only the last 500 bytes of
+  output, so the message that matters goes last.
+
+## Prompt-Only Reminder
+
+A reminder is a monitor whose command only prints a fixed line. Give the line a
+stable prefix and match exactly that prefix.
+
+```bash
+thrum monitor start --name standup-nudge --to @me \
+  --match '^REMINDER-STANDUP:' --schedule "0 9 * * 1-5" -- \
+  echo "REMINDER-STANDUP: post the status update, then reply to the open review"
+```
+
+- Schedule the reminder; words in its text, including "failures", "error" and
+  "done", then neither relabel nor drop it, and the exit code decides success.
+- Make the body an instruction with the next concrete step; a bare "reminder"
+  carries no action.
+- Add `--notify-on-success` only when a delivered line must be guaranteed for a
+  run that matched nothing.
+- A delivered reminder shows the schedule fired. It does not show that the work
+  moved. Check the work itself (commits, queue, state) before treating the
+  reminder as progress.
+
+## Script Check
+
+A script check runs a bounded, synchronous probe and reports through its exit
+code and one structured line.
+
+```bash
+thrum monitor start --name disk-check --to @me \
+  --match '^CHECK-DISK:' --schedule "*/15 * * * *" -- \
+  bash -c 'u=$(df --output=pcent / | tail -1 | tr -dc 0-9)
+  [ "$u" -lt 90 ] && exit 0
+  echo "CHECK-DISK: root volume at ${u} percent used, free space then rerun df -h /"
+  exit 3'
+```
+
+Rules:
+
+1. Bound every probe with `timeout <secs>`; a hung probe holds the tick.
+2. Exit 0 for healthy and print nothing matching, which keeps the run quiet.
+3. Exit non-zero for a failure; the daemon sends the `[FAIL]` notice with the
+   exit code and output tail.
+4. Print a matching line that names the subject, the observed value and the
+   next action. A generic `OK` or `done` line carries no information.
+5. Use a distinct stable prefix per outcome (`CHECK-DISK:` for a finding,
+   `REMINDER-DISK:` for a nudge) so `--match` selects what must reach the
+   target.
+
+| Outcome  | Script does                              | Target receives                    |
+| -------- | ---------------------------------------- | ---------------------------------- |
+| Quiet    | Exit 0, no matching line                 | Nothing                            |
+| Failure  | Non-zero exit, finding line last         | One `[FAIL] <name>: exit code N` message with the tail and the finding line |
+| Finding  | Exit 0, matching line(s)                 | The line(s), verbatim (labeled only by an `ERROR:`/`FATAL:`/`FAIL:` or `WARN:`/`WARNING:`/`ALERT:` prefix) |
+| Reminder | Exit 0, one stable-prefix instruction    | The line, verbatim                 |
+
+A `--match` that never matches the script's real output delivers nothing and
+raises no error. Test the regex against the exact output before starting.
+
+## Verify By Delivery
+
+Start the monitor with a unique name, `--to` the verifying agent, and a
+one-minute schedule, then read the delivered message back in full.
+
+```bash
+thrum monitor start --name verify-<unique> --to @me --match '^VERIFY-<unique>:' \
+  --schedule "* * * * *" -- echo "VERIFY-<unique>: delivery body check"
+thrum inbox --unread
+thrum message get <message-id>      # the complete delivered body
+thrum monitor logs verify-<unique>  # the matches the daemon recorded
+thrum monitor delete verify-<unique>
+```
+
+Confirm the body carries the prefix, the wording and no unexpected `[FAIL]`
+or `[WARN]` label. Delete the monitor when done; never alter a monitor another
+agent owns.
+
+## Troubleshooting
+
+- Nothing arrived: `thrum monitor show` for state and last exit, `thrum
+  monitor logs` for recorded matches. No recorded match means the regex did not
+  match, or (continuous job) the line was completion-classified and suppressed;
+  run the command by hand and compare its output with the regex.
+- Message labeled `[FAIL]` unexpectedly: the job exited non-zero, the line starts
+  with `ERROR:`/`FATAL:`/`FAIL:`, or (continuous job) the line contains a fail or
+  error substring.
+- Name already in use: a stopped record holds it. `thrum monitor delete` it.

package/assets/skills/using-the-queue/SKILL.md

@@ -191,7 +191,7 @@ so this wrapper is defense-in-depth, not load-bearing on its own.
   non-peercred transport (browser/WS, unit tests) - but that is a general,
   already-documented property of the RPC layer (identity trust depends on
   transport), not something unique to `state.set`, and it is explicitly out
-  of scope per `docs/security_model/master.md` §1.5: "Thrum does not attempt
+  of scope per the project's security model: "Thrum does not attempt
   to prevent agent identity forgery" is an owner ruling, stated as
   [INTENDED] and permanent, not tracked as debt.
 
@@ -204,8 +204,7 @@ shapes, chosen by domain, not an oversight.
 
 Non-goal: fail-closed reject-symmetry for `state.set` (mirroring queue's
 `RejectIdentityKeysHandler`) is a possible future non-security hardening
-preference, not built here - out of scope per `docs/security_model/master.md`
-§1.5.
+preference, not built here - out of scope per the project's security model.
 
 ## Common Mistakes
 

package/assets/skills/using-thrum-state/SKILL.md

@@ -73,7 +73,7 @@ yourself.
 
 ## Field Mutability Matrix
 
-`Entry` (`internal/state/types.go`) has five mutability classes, not one
+The state `Entry` type has five mutability classes, not one
 uniform "immutable field" guard:
 
 - **immutable-identity** — part of the `(Kind, Scope)` addressing key, or

package/dist/hooks/block-sync-cd.js

@@ -29,7 +29,7 @@ const SYNC = String.raw `\.git/thrum-sync/a-sync`;
 // Command-position anchor: line start or immediately after a shell separator
 // (;, &&, ||), then optional whitespace. This matches `cd`/`git` only when they
 // are the actual command — NOT when those words appear inside a quoted argument
-// preceded by a bare space (the D5 false-positive: `bd remember "... cd
+// preceded by a bare space (the quoted-argument false-positive: `bd remember "... cd
 // .git/thrum-sync/a-sync ..."` must NOT be denied). Match op-shape, not the mere
 // presence of the path string.
 const CMDPOS = String.raw `(^|;|&&|\|\|)\s*`;

package/dist/hooks/block-sync-cd.test.js

@@ -31,7 +31,7 @@ const ALLOW = [
     ["git -C a-sync push", `git -C ${ASYNC} push`],
     ["git -C a-sync log (not branch-changing)", `git -C ${ASYNC} log --oneline`],
     ["ls the path", `ls ${ASYNC}/`],
-    // D5 false-positive guard: cd inside a quoted argument (bare space before it),
+    // quoted-argument false-positive guard: cd inside a quoted argument (bare space before it),
     // not at command position -> must be ALLOWED.
     ["quoted cd inside bd remember", `bd remember "note: do not cd ${ASYNC} directly"`],
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-thrum-pro",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Thrum multi-agent coordination plugin for Open Code",
   "type": "module",
   "main": "./dist/index.js",