pi-gauntlet 8.2.1 → 8.4.0

package/extensions/telemetry.ts

@@ -1,6 +1,7 @@
   /**
-   * Telemetry extension: records one YAML record per gauntlet run, keyed by spec path,
-   * from pi events alone. Binds only after `phase_tracker start brainstorm` armed the
+   * Telemetry extension: records run and session-leg YAML from pi events alone.
+   * Session legs seal through telemetry-leg.ts at terminal settlement. Runs bind
+   * only after `phase_tracker start brainstorm` armed the
    * flow, writes the record to disk without ever staging or committing it (the seal bin
    * commits once at finish), and blocks `write` into an already-shipped spec while
    * brainstorm is in progress. Pure helpers: extensions/lib/telemetry-*.ts. The default
@@ -14,7 +15,7 @@
   import * as piRuntime from "@earendil-works/pi-coding-agent";
   import { SettingsManager, getAgentDir } from "@earendil-works/pi-coding-agent";
   import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
-  import { DEFAULT_TEST_COMMANDS, planDirsFor, resolveFlowGuards, resolveTelemetry, settingsErrorWarning, type TelemetryResolved } from "./lib/gauntlet-settings.ts";
+  import { DEFAULT_TELEMETRY_DIR, DEFAULT_TEST_COMMANDS, planDirsFor, resolveFlowGuards, resolveTelemetry, settingsErrorWarning, type TelemetryResolved } from "./lib/gauntlet-settings.ts";
   import { loadGauntletSettings } from "./lib/gauntlet-settings-loader.ts";
   import { checkoutOf } from "./lib/checkout.ts";
   import { CONTEXT_DRAFT_MARKER, nextGauntletEntered } from "./lib/phase-tracker-helpers.ts";
@@ -24,6 +25,8 @@
   import { COUNTED_USER_PHASES, REVIEWER_AGENTS, countFindings, countStructuredFindings, countOpenGaps, countReopens, insertedText, planTotals, textOf, usageToTokens } from "./lib/telemetry-collect.ts";
   import { addTokens, capEvents, compact, currentPhase, derive, diffPhases, emptyAccumulators, emptyPhases, foldAccumulators, implementAutoCompletes, liveShipEvent, newRecord, parseRecord, serializeRecord, type Accumulators, type BaseEvent, type PhaseAcc, type PhaseKey, type PhaseMap, type TelemetryEvent, type TelemetryRecord, type Tokens } from "./lib/telemetry-record.ts";
   import { guardReason } from "./lib/telemetry-ship.ts";
+  import { readTelemetryBranch, telemetryRepo, type syncTelemetryBranch } from "./lib/telemetry-branch.ts";
+  import { registerLegTelemetry } from "./lib/telemetry-leg.ts";
   import { buildCouncil, parseAudit, parseChairReport, resolveMembers, type Cluster, type MemberResult } from "./lib/telemetry-council.ts";
 
   // ---- deps seam -------------------------------------------------------------------
@@ -51,6 +54,9 @@
     testCommands?: string[];
   }
   export interface Deps {
+    syncTelemetryBranch?: typeof syncTelemetryBranch;
+    telemetryRepo?: typeof telemetryRepo;
+    readTelemetryBranch?: typeof readTelemetryBranch;
     fs: FsPort;
     git: (args: string[], cwd: string) => Promise<GitResult>;
     // jj runner; production uses realJj for both checkout detection and the ship-time diff.
@@ -205,13 +211,16 @@
     let boundSpec: string | undefined; // repo-relative
     let record: TelemetryRecord | undefined;
     const predecessorLinks = new Set<string>();
-    let recordRel: string | undefined; // repo-relative record path
+    let recordRel: string | undefined; // absolute record path outside the working tree
     let buffer: TelemetryEvent[] = [];
     let pending: Accumulators = emptyAccumulators();
     let frozen = false;
+    let recordWritten = false;
     let gauntletEntered = false;
     let settingsWarned = false;
     let sessionId = "";
+    const guardCache = new Map<string, Map<string, string>>();
+    let guardWarned = false;
     let currentDir = "";
     let councilPending: { memberResults: MemberResult[]; chair?: { model: string; dispatches: number; clusters?: Cluster[] } } | undefined;
 
@@ -235,7 +244,7 @@
     // Disarmed and unbound: activity outside the gauntlet is never charged to the next run.
     const live = (): Accumulators => record
       ? (record.accumulators[sessionId] ??= emptyAccumulators())
-      : gauntletEntered ? pending : emptyAccumulators();
+      : legAcc() ?? (gauntletEntered ? pending : emptyAccumulators());
 
     const canBind = (): boolean => gauntletEntered && !frozen && phases.ship.status !== "complete";
 
@@ -252,8 +261,8 @@
     const warn = (message: string) => pushEvent({ kind: "warning", message });
 
     // ---- record store ----
-    // The record is the file on disk; nothing here stages or commits. A record the seal bin
-    // already stamped is frozen so a later flush cannot overwrite the seal.
+    // The seal either keeps a stamped file for retry or removes it after committing.
+    // Neither may be overwritten by a later recorder flush.
     const sealedAt = (path: string): boolean => {
       const text = deps.fs.readFile(path);
       const parsed = text ? parseRecord(text) : undefined;
@@ -266,8 +275,8 @@
         frozen = true;
         return;
       }
-      const target = abs(recordRel);
-      if (sealedAt(target)) {
+      const target = recordRel;
+      if ((recordWritten && !deps.fs.exists(target)) || sealedAt(target)) {
         frozen = true;
         return;
       }
@@ -281,6 +290,7 @@
         deps.fs.mkdirp(dirname(target));
         deps.fs.writeFile(target + ".tmp", serializeRecord(record));
         deps.fs.rename(target + ".tmp", target);
+        recordWritten = true;
       } catch (e) {
         pushEvent({ kind: "warning", message: `record write failed: ${String((e as Error).message ?? e).split("\n")[0]}` });
       }
@@ -288,27 +298,9 @@
 
     const flush = writeRecord;
 
-    // Excluded untracked paths are invisible to `git status --porcelain`, skipped by
-    // `git add -A`, and never block `git worktree remove`; the seal stages with `git add -f`.
-    const ensureExcluded = async () => {
-      const common = await deps.git(["rev-parse", "--path-format=absolute", "--git-common-dir"], toplevel!);
-      const commonDir = common.stdout.trim();
-      if (common.code !== 0 || !commonDir) return void warn(`exclude skipped: git rev-parse --git-common-dir failed: ${common.stderr.trim().split("\n")[0]}`);
-      const line = `${currentDir.replace(/\/+$/, "")}/`;
-      const file = join(commonDir, "info", "exclude");
-      const existing = deps.fs.readFile(file) ?? "";
-      if (existing.split("\n").some((l) => l.trim() === line)) return;
-      try {
-        deps.fs.mkdirp(dirname(file));
-        deps.fs.writeFile(file, existing + (existing && !existing.endsWith("\n") ? "\n" : "") + line + "\n");
-      } catch (e) {
-        warn(`exclude write failed: ${String((e as Error).message ?? e).split("\n")[0]}`);
-      }
-    };
-
     const loadOrCreate = (specRel: string): TelemetryRecord => {
       const rel = recordPathFor(currentDir, specRel);
-      const existing = deps.fs.readFile(abs(rel));
+      const existing = deps.fs.readFile(rel);
       const parsed = existing ? parseRecord(existing) : undefined;
       if (parsed) {
         // fold stale live blocks (sessions that died without shutdown) into total
@@ -324,13 +316,40 @@
       return newRecord({ spec: specRel, session: sessionId, now: buffer[0]?.ts ?? deps.now(), runId: randomUUID() });
     };
 
-    const sealedOnDisk = (top: string, rel: string, dir: string): boolean => sealedAt(join(top, recordPathFor(dir, rel)));
+    const shippedRecords = (top: string, snap: SettingsSnapshot): Map<string, string> => {
+      const key = JSON.stringify([top, snap.telemetry.remote]);
+      let records = guardCache.get(key);
+      if (!records) {
+        records = new Map();
+        guardCache.set(key, records);
+        const repo = (deps.telemetryRepo ?? telemetryRepo)(top);
+        const result = (deps.readTelemetryBranch ?? readTelemetryBranch)(top, { remote: snap.telemetry.remote, prefix: `${repo}/brainstorming/` });
+        for (const entry of result.records) {
+          const parsed = parseRecord(entry.bytes);
+          if (parsed?.shipped_at) records.set(parsed.spec, parsed.shipped_at);
+        }
+        if (result.warning && !guardWarned) {
+          guardWarned = true;
+          pi.sendMessage({ customType: "telemetry-warning", content: `telemetry guard unavailable: ${result.warning}`, display: true });
+        }
+      }
+      return records;
+    };
 
     const bind = async (specRel: string, snap: SettingsSnapshot, specToplevel: string, via: "git" | "jj") => {
-      if (sealedOnDisk(specToplevel, specRel, snap.telemetry.dir)) return;
+      if (via === "git" && shippedRecords(specToplevel, snap).has(specRel)) return;
+      let metadataDir = join(specToplevel, ".jj");
+      if (via === "git") {
+        const common = await deps.git(["rev-parse", "--path-format=absolute", "--git-common-dir"], specToplevel);
+        if (common.code !== 0 || !common.stdout.trim()) {
+          warn(`record bind skipped: git common dir unavailable: ${common.stderr.trim().split("\n")[0]}`);
+          return;
+        }
+        metadataDir = common.stdout.trim();
+      }
       toplevel = specToplevel;
       checkoutVia = via;
-      currentDir = snap.telemetry.dir;
+      currentDir = join(metadataDir, "gauntlet", "telemetry");
       boundSpec = specRel;
       recordRel = recordPathFor(currentDir, specRel);
       predecessorLinks.clear();
@@ -363,7 +382,6 @@
         if (snap.errors.length) warn(settingsErrorWarning(snap.errors));
         if (snap.telemetry.warning) warn(snap.telemetry.warning);
       }
-      if (via === "git") await ensureExcluded();
       refreshLinks();
     };
 
@@ -374,6 +392,7 @@
       record = undefined;
       recordRel = undefined;
       frozen = false;
+      recordWritten = false;
       councilPending = undefined;
     };
 
@@ -400,18 +419,13 @@
     const rebind = async (newSpec: string): Promise<boolean> => {
       const from = recordRel!;
       const to = recordPathFor(currentDir, newSpec);
-      if (deps.fs.exists(abs(to))) {
+      if (deps.fs.exists(to)) {
         warn(`record move skipped: ${to} already exists`);
         return false;
       }
-      const trackedResult = await deps.git(["ls-files", "--error-unmatch", "--", from], toplevel!);
-      const tracked = trackedResult.code === 0 && trackedResult.stdout.trim() !== "";
       try {
-        deps.fs.mkdirp(dirname(abs(to)));
-        if (tracked) {
-          const mv = await deps.git(["mv", "--", from, to], toplevel!);
-          if (mv.code !== 0) deps.fs.rename(abs(from), abs(to));
-        } else deps.fs.rename(abs(from), abs(to));
+        deps.fs.mkdirp(dirname(to));
+        deps.fs.rename(from, to);
       } catch (e) {
         warn(`record move failed: ${String((e as Error).message ?? e).split("\n")[0]}`);
         return false;
@@ -493,8 +507,11 @@
       lastPlanTasks = undefined;
       amendmentOpen = false;
       pendingTest.clear();
+      if (sessionId !== ctx.sessionManager.getSessionId()) {
+        guardCache.clear();
+        guardWarned = false;
+      }
       sessionId = ctx.sessionManager.getSessionId();
-      currentDir = snap.telemetry.dir;
       const replay = replayBranch(ctx.sessionManager.getBranch(), snap.specDirs);
       lastPlanTasks = replay.lastPlanTasks;
       phases = replay.phases;
@@ -535,6 +552,10 @@
         await applyPhaseDetails(event.details as never, snap);
         return undefined;
       }
+      if (event.toolName === "subagent" && legAcc()) {
+        await onSubagentResult(event.details, event.content, event.isError);
+        return undefined;
+      }
       if (!record && !canBind()) return undefined;
       if (event.toolName === "plan_check" && !event.isError) {
         const d = event.details as { status?: string; specPath?: string; planPath?: string } | undefined;
@@ -605,7 +626,7 @@
       }
       if (loc.toplevel !== toplevel) {
         // Another checkout: a fresh run, never a rename of this record.
-        if ((tool === "write" || tool === "edit") && isSpecPath(rel, snap.specDirs) && canBind() && !sealedOnDisk(loc.toplevel, rel, snap.telemetry.dir)) {
+        if ((tool === "write" || tool === "edit") && isSpecPath(rel, snap.specDirs) && canBind() && (loc.via === "jj" || !shippedRecords(loc.toplevel, snap).has(rel))) {
           unbind();
           await bind(rel, snap, loc.toplevel, loc.via);
           if (!boundSpec) return undefined;
@@ -751,7 +772,7 @@
       if (!record || !toplevel || liveShipEvent(record.events)) return;
       record.status = "shipped";
       record.shipped_at = deps.now();
-      const out = await computeJjDiff({ jj: deps.jj ?? realJj, cwd: toplevel, spec: record.spec, dir: currentDir, buckets: snap.telemetry.buckets, planDirs: snap.planDirs });
+      const out = await computeJjDiff({ jj: deps.jj ?? realJj, cwd: toplevel, spec: record.spec, dir: DEFAULT_TELEMETRY_DIR, buckets: snap.telemetry.buckets, planDirs: snap.planDirs });
       if (out.warning) warn(out.warning);
       record.derived.modified_files = out.modified_files;
       record.derived.diff = out.diff;
@@ -766,11 +787,9 @@
         const rawPath = (event.input as { path?: unknown }).path;
         if (typeof rawPath === "string" && phases.brainstorm.status === "in_progress") {
           const loc = await locate(ctx, rawPath);
-          if (loc && isSpecPath(loc.rel, snap.specDirs)) {
-            const recRel = recordPathFor(snap.telemetry.dir, loc.rel);
-            const existing = deps.fs.readFile(join(loc.toplevel, recRel));
-            const parsed = existing ? parseRecord(existing) : undefined;
-            if (parsed?.shipped_at) return { block: true, reason: guardReason(loc.rel, parsed.shipped_at, recRel) };
+          if (loc?.via === "git" && isSpecPath(loc.rel, snap.specDirs)) {
+            const shippedAt = shippedRecords(loc.toplevel, snap).get(loc.rel);
+            if (shippedAt) return { block: true, reason: guardReason(loc.rel, shippedAt, "gauntlet/telemetry") };
           }
         }
         return undefined;
@@ -874,4 +893,5 @@
       refreshLinks();
     };
 
+    const legAcc = registerLegTelemetry(pi, deps, () => !!record);
 }

package/extensions/test-support/git-env.mjs

@@ -0,0 +1,13 @@
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+export function isolatedGitEnv(scratch) {
+  const env = {
+    GIT_CONFIG_GLOBAL: join(scratch, "gitconfig"),
+    GIT_CONFIG_NOSYSTEM: "1",
+    GIT_AUTHOR_NAME: "test", GIT_AUTHOR_EMAIL: "test@example.test",
+    GIT_COMMITTER_NAME: "test", GIT_COMMITTER_EMAIL: "test@example.test",
+  };
+  writeFileSync(env.GIT_CONFIG_GLOBAL, "");
+  return env;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-gauntlet",
-  "version": "8.2.1",
+  "version": "8.4.0",
   "description": "Opinionated, gated workflow skills, subagent personas, and runtime extensions for the pi coding agent.",
   "author": "Jacek Juraszek",
   "type": "module",

package/skills/brainstorming/SKILL.md

@@ -69,7 +69,7 @@ The spec is the first commit in a dedicated worktree, never a separate commit on
 
 Read [reference/legs.md](reference/legs.md) and settle membership before creation. Invoke `/skill:using-git-worktrees` for each member with explicit `$ROOT` = its primary and `$BRANCH` = the shared branch; carry every `Worktree ready at <full-path>` value, home first. Root the home spec at `<home worktree>/<home spec dir>/<filename>.md`; root each dispatch and `git -C` in its owning leg's worktree. Keep the process cwd unchanged. Gather each leg's rules and record portable contracts and companion artifacts using that reference; a one-member run adds only its one-block `## Legs` section.
 
-Spec, plan, and implementation share this worktree. The spec and its telemetry record (`<telemetry.dir>/<spec path with .md -> .yaml>`, default `.pi/gauntlet/telemetry/doc/specs/<spec>.yaml`) are deliverables and ship in the squash; only the plan is stripped. `/skill:finishing-a-development-branch` strips the plan, then seals the record before landing (a `telemetry:` commit under git; the working-copy snapshot in a plain jj workspace). Explicit trivial one-off edits outside this flow need no worktree.
+Keep spec, plan, and implementation in this worktree. Ship the spec and implementation; strip only the plan. Let `/skill:finishing-a-development-branch` seal and publish the telemetry record to the orphan `gauntlet/telemetry` branch before landing; keep recorder state in Git common-dir metadata, outside the working tree. In a plain jj workspace, retain local metadata and report that publication is unavailable. Use no worktree for explicit trivial one-off edits outside this flow.
 
 ## The Process
 
@@ -155,6 +155,8 @@ Start the message with `gauntlet: question` alone at column zero on the first ph
 
 Use two rounds, targeting 300-500 words each, with one approval each; revisions remain within that approval point. Ask once per round; round-1 approval without correction confirms the predecessor. Round 1 covers architecture, responsibilities, data flow, and `supersedes <path>, <scope>` when applicable. Round 2 covers errors, edges, tests, and `## Documentation impact`. In round 2, read and apply [Documentation impact](reference/documentation-impact.md), including its verbatim template; cite that portable relative path in the spec; do not restate its categories. Ask the user when doc impact is unclear. Unreadable -> stop the step with a blocking error. Cite the draft's `Docs touched:` entries as candidates for "Materially amended existing docs"; admit or drop each by that owner's materiality bar, never list them automatically. In round 1, carry chosen `Removes:`/`Adds:` into Design as exhaustive `Remove:`/`Add:` imperatives naming every moving part; route unlisted parts through `reference/amendment-surface.md`. In round 2, write `## Tests`: one `<observable> - <test name or file>` per acceptance row and Design edge/error clause; `<observable> - none: <why>` for untestable.
 
+In round 2, name every paid or external action needed for implementation or verification in Design with its runner, inputs and count for the whole flow across seed, rows, repairs and finish. Treat design approval as authorization within those bounds without per-step permission prompts; state that the loop treats an action without such a clause as unreachable, and require separate explicit authorization to add an unnamed action to Design.
+
 ## Ticket Handling
 
 Read [Ticket Handling](reference/ticket-acceptance.md) at first use - before gathering context, even with no ticket. Steps 4 and 8 carry the same read behind an in-context check so a restored session (`gauntlet-resume` routes there) loads it once; a same-session redraw or a second brainstorm in one session reuses the content already in context. Unreadable -> stop with a blocking error, never reconstruct from memory.

package/skills/check-delivery/SKILL.md

@@ -262,6 +262,8 @@ Start the message with `gauntlet: gate=check-delivery/confirmation-gate` before
 
 Start the message with `gauntlet: done delivered` when the batched write landed. Start the message with `gauntlet: done already-recorded` for idempotent delivery. Start the message with `gauntlet: done manual` when the write halves are emitted for manual execution. Start the message with `gauntlet: stuck` followed on that line by the concrete reason once the findings-comment gate is answered or no comment is offered; use this for any partial write failure too. A declined success write ends with `gauntlet: stuck write declined`.
 
+After every selected write or follow-on step finishes, put one plain `<ref>: <outcome>` line below the terminal marker, including singleton and early STOP paths. Use the supplied ticket ref and exactly one outcome: `delivered`, `manual`, `declined`, `already recorded`, `skipped`, or `failed - <reason>`. Map a declined success write to `declined`, skipped-no-tracker to `skipped`, and a failed stage, findings-only path or partial write to `failed - <reason>`; report a terminal ticket without recorded delivery as `skipped`. Keep rows outside tracker payloads, without bullets, code fences or emphasis. In set mode use `reference/batch.md`'s one final roster settlement, never a per-ticket terminal marker while siblings continue.
+
 Any `unexplained gap` or failed stage -> **failure path**: no status
 advance, no delivery comment, no marker. The findings may be offered as a
 **findings comment** (no `Delivered:` line, so it never trips idempotency) -

package/skills/finishing-a-development-branch/SKILL.md

@@ -226,7 +226,7 @@ Rows 1-2 run the Option 1/2 blocks; row 3 runs the Keep block and row 4 the Disc
 
 #### Strip the plan, seal the record (Options 1-3)
 
-Run this on the feature branch before any landing path. The spec and its telemetry record (`<telemetry.dir>/<spec path with .md -> .yaml>`, default `.pi/gauntlet/telemetry/doc/specs/<spec>.yaml`) are deliverables and ship in the squash; only the plan is stripped. The record is an untracked, git-excluded file until this step commits it (in a plain jj workspace there is no commit; jj snapshots the stamped record into the working-copy change). `<bin>` is `<directory of this skill's SKILL.md>/../../bin`, resolved from the skill's `<location>` in the system prompt.
+Run this on the feature branch before any landing path. Ship the spec and implementation; strip only the plan. Let the seal publish the telemetry record to the orphan `gauntlet/telemetry` branch without changing the product checkout, index or HEAD. Keep in-progress records in Git common-dir metadata, outside the working tree. Resolve `<bin>` as `<directory of this skill's SKILL.md>/../../bin` from the skill's `<location>` in the system prompt.
 
 Read the existing artifact's path-only `**Spec:**` header (repo-relative, backticks stripped) before removal; pass that value as `--spec`, including for a line-1 ledger. Resolve the spec dirs with `gauntlet_setting({ key: "flowGuards" })` and use their sibling `plans` dirs for plan paths. Enumerate both PLAN_PATH candidates: the task plan paired by basename and `<sibling plans dir>/<spec stem>-ledger.md`. Preserve the spec and telemetry.
 
@@ -242,13 +242,13 @@ elif [ -f "$WORKTREE/$PLAN_PATH" ] && jj -R "$WORKTREE" root >/dev/null 2>&1; th
 fi
 done
 
-# Seal the telemetry record: stamp shipped, compute the diff, commit it once.
-# The bin detects a plain jj workspace (no .git) itself: jj diff, no commit step.
+# Seal the telemetry record: stamp shipped, compute the diff, publish to gauntlet/telemetry.
+# The bin reports publication unavailable in a plain jj workspace and keeps local metadata.
 # --option is pr for Options 1-2 and squash for Option 3; --spec is the artifact header's **Spec:** value (omit when no artifact is known).
 node <bin>/gauntlet-telemetry-seal.mjs --worktree "$WORKTREE" --option <pr|squash> --base <base-branch> --spec <spec path>
 ```
 
-The seal prints one line per record (`sealed <path>`, `already sealed <path>`) or one bare outcome (`no telemetry run`, `telemetry disabled`) and exits 0; print its stdout verbatim in the ship completion message. Any nonzero exit stops the flow before the first landing command, quoting the bin's line: exit 2 (`no record at <path>`, `unparseable record <path>: <reason>`) means this gauntlet run's recorder never armed or its record is corrupt; exit 1 is a usage, environment, or git/jj failure (`seal failed <path>: <reason>` restored the pre-seal bytes). The user decides; never land without the seal.
+Print the seal's stdout verbatim in the ship completion message. Continue landing on exit 0 for every telemetry outcome, including `no telemetry run`, `telemetry: skipped (unparseable record <path>)` and `telemetry: not pushed (<reason>)`; missing or malformed records and publication failures never block shipping. Retain an unparseable record in place and preserve unpublished telemetry for retry. In a plain jj workspace, report `telemetry: not pushed (jj workspace: no git remote)` and retain local metadata. Stop before the first landing command only on exit 1 for a usage error (invalid arguments or base), quote the bin's line and ask the user how to proceed.
 #### PR-subject row 1: Push to the PR branch
 For the close-absorbed-PR question, start the message with `gauntlet: gate=finishing-a-development-branch/pr-subject-row-1`. Read and apply [menu-layout](../brainstorming/reference/menu-layout.md). Do not report `done pushed` while this gate awaits an answer. Capture the scoped verification set and accepted-complete task/thread evidence before the strip. Refetch threads per recorded PR using the paginated single-`$n` query (one invocation per PR) owned by [pr-head](../using-git-worktrees/reference/pr-head.md); retain PR attribution and use the query's location rendering. For home, use the table below and omit threads now resolved on GitHub. For members, copy recorded dispositions and mark newly resolved or newly opened states from the refresh; never use home's first-parent history as member-fix proof.
 | Refetched thread / evidence | Resolution |
@@ -346,7 +346,7 @@ git -C "$PRIMARY" commit -m "<imperative summary> (ref <ticket-id>)"
 (cd "$PRIMARY" && <the Step 1 set>)
 ```
 
-The plan was already removed and the telemetry record sealed on the branch, so the staged squash tree carries the spec, the telemetry record, and the implementation - never the plan.
+Keep only the spec and implementation in the staged squash tree; the stripped plan stays in feature history and the sealed telemetry record belongs to `gauntlet/telemetry`.
 
 The post-squash re-verify is not optional - `git merge --squash` can surface conflict-resolution mistakes the worktree-side run couldn't catch. For a ledger, run the per-pair post-squash recipe in [verification-set.md](reference/verification-set.md) instead of the non-ledger subshell above.
 
@@ -356,7 +356,7 @@ Cleanup worktree (Step 6), then, if Step 6 removed the worktree, `git -C "$PRIMA
 
 #### Option 4: Keep As-Is
 
-Report: "Keeping branch <name>. Worktree preserved at <path>." The telemetry record stays untracked and in_progress in the worktree; a later finishing run on this worktree seals it.
+Report: "Keeping branch <name>. Worktree preserved at <path>." Leave telemetry in local metadata; Keep As-Is publishes no record.
 
 **Don't cleanup worktree.**
 
@@ -374,7 +374,7 @@ Type 'discard' to confirm.
 
 Wait for exact confirmation.
 
-If confirmed: Cleanup worktree (Step 6), then, if Step 6 removed the worktree, `git -C "$PRIMARY" branch -D "$FEATURE"`. The record is git-excluded, so git worktree remove needs no --force; it goes with the worktree.
+If confirmed: Cleanup worktree (Step 6), then, if Step 6 removed the worktree, `git -C "$PRIMARY" branch -D "$FEATURE"`. Publish no telemetry for Discard; leave common-dir metadata outside worktree cleanup.
 
 ### Step 6: Cleanup Workspace
 
@@ -449,12 +449,12 @@ A host-owned worktree (Step 6: no `home:` match, or the legacy "Otherwise") keep
 - **Fix:** Require typed "discard" confirmation
 
 **Skipping the strip-and-seal block in Options 1-3 (any path that lands on base)**
-- **Problem:** Plan docs are ephemeral and shouldn't land on `<base-branch>`; the telemetry record is a deliverable and must. Skipping the block ships the plan, or drops the record the spec index reads.
-- **Fix:** Run the block on `$WORKTREE` before the squash or the push. The plan stays in the branch's git history (`git -C "$PRIMARY" log --all -- doc/plans/...`). Spec and telemetry record stay on `<base-branch>`; plan does not.
+- **Problem:** Skipping the block ships an ephemeral plan or skips publication of the record the spec index reads.
+- **Fix:** Run the block on `$WORKTREE` before the squash or push. Preserve the spec on `<base-branch>` and the telemetry record on `gauntlet/telemetry`; retain the plan only in feature history.
 
-**Widening the plan strip to the telemetry record**
-- **Problem:** `.pi/gauntlet/telemetry/**` looks like scaffolding next to the plan and gets deleted in the same commit - main then has no record for the run.
-- **Fix:** Never `git rm` under the telemetry dir. Until the seal the record is untracked and git-excluded, so a plan strip cannot reach it; after the seal it is a committed deliverable.
+**Treating telemetry as a checkout deliverable**
+- **Problem:** Staging a recorder file pollutes the product diff and bypasses branch publication.
+- **Fix:** Let the seal own publication from common-dir metadata; stage no telemetry record in the product checkout.
 
 ## Completion
 Start the final outcome message with exactly one terminal line before summaries. Start the message with `gauntlet: done pr-created` after successful normal or draft PR creation. Start the message with `gauntlet: done merged` after successful squash-merge and post-merge verification. Start the message with `gauntlet: done kept` after Keep. Start the message with `gauntlet: done discarded` only after typed discard authorization and successful discard. Start the message with `gauntlet: done pushed` after successful PR-subject push and body edit, only after the close-member gate is answered or no members qualify. Start the message with `gauntlet: stuck` followed on that line by a short concrete reason for an executed operation that fails, before error evidence or a return menu. Do not combine a terminal marker with a gate marker in one message; a subsequent menu starts a new gate message. Pending choices, implementation stalls and conformance escalation are not terminal outcomes. Read and apply [menu-layout](../brainstorming/reference/menu-layout.md). Preserve strip, seal, cleanup and ship-state rules below; terminal reporting does not complete ship after Discard or failure. Once the chosen option (Options 1-4 or PR-subject row 1 - not Discard) is executed successfully, mark the ship phase complete:
@@ -478,7 +478,7 @@ Once the merge (and any deploy) has landed, `/skill:check-delivery <ticket-ref>`
 - Run any step without the `<worktree-path>` argument
 - Auto-proceed past an undispositioned carried-open gap
 - Skip the strip-and-seal block before the Option 3 squash or the Option 1/2 push
-- Delete the telemetry record (`.pi/gauntlet/telemetry/**` or the configured `telemetry.dir`) on any path
+- Delete common-dir telemetry metadata or stage it into the product checkout
 
 **Always:**
 - Verify, or apply the Step 1 skip rule, before offering options

package/skills/finishing-a-development-branch/reference/verification-set.md

@@ -19,7 +19,7 @@ For ledger commands outside a checkout's configured test-command matcher, verify
 
 ## Skip proof
 
-**Skip rule.** Skip the run only when this set passed on a known clean commit in the verify phase of this session and no edit or write landed outside `<telemetry.dir>` since. Check the current tree: `git -C "$WORKTREE" diff --quiet <commit the run passed on> -- . ':!<telemetry.dir>'` must exit 0, and `git -C "$WORKTREE" status --porcelain --untracked-files=all -- . ':!<telemetry.dir>'` must exit 0 with empty output (`<telemetry.dir>` defaults to `.pi/gauntlet/telemetry`). These checks cover committed, staged, unstaged, and untracked changes outside telemetry. Otherwise run it once; a missing verified commit, a failed check, or uncertainty means run.
+**Skip rule.** Skip the run only when this set passed on a known clean commit in the verify phase of this session and no checkout edit or write landed since. Check the entire current tree: `git -C "$WORKTREE" diff --quiet <commit the run passed on> -- .` must exit 0, and `git -C "$WORKTREE" status --porcelain --untracked-files=all -- .` must exit 0 with empty output. Cover committed, staged, unstaged, and untracked changes without path exclusions; recorder metadata lives outside the working tree. Otherwise run it once; a missing verified commit, a failed check, or uncertainty means run.
 
 Apply the proof independently in each owning checkout. Post-squash verification is mandatory; the skip proof does not cover a changed primary tree.
 
@@ -31,4 +31,4 @@ For a fresh-session retry after a ledger was stripped, recover the committed pre
 
 ## Post-squash execution
 
-For Option 3, run each delivered leg's retained pairs in order as `(cd "<leg primary>" && <command>) > "$LOG_DIR/gate-<i>.log" 2>&1`, one command per pair, retaining its gate index and fail-fast exit reporting. For coordinated delivery, run only the just-squashed leg's pairs at that leg's delivery step; every remaining leg gets its own post-squash run when delivered. A failed-squash receipt retry runs those same pairs against the delivered primary, not the feature worktree, and never repeats the squash. Retain the Step 1 command set and execution form for non-ledger subjects.
+For Option 3, run each delivered leg's retained pairs in order as `(cd "<leg primary>" && <command>) > "$LOG_DIR/gate-<i>.log" 2>&1`, one command per pair; print `gate <i> exit <code> <log path>` after each and stop on the first failure. For coordinated delivery, run only the just-squashed leg's pairs at that leg's delivery step; every remaining leg gets its own post-squash run when delivered. A failed-squash receipt retry runs those same pairs against the delivered primary, not the feature worktree, and never repeats the squash. Retain the Step 1 command set and execution form for non-ledger subjects.

package/skills/gatekeep-pr/reference/batch.md

@@ -92,6 +92,8 @@ Show evidence only in-place from record/helper paths, then re-ask. Queue all oth
 
 Run parent cleanup/stop only after all children finish, never on a live child's tree. For cleanup apply cleanup guards and ordered overrides. Keep the PR and post rows in the roster, set cleanup_done, and re-render with cleanup gone. Cleanup does not retire.
 
-For non-final stop run `cleanup.md` `## Non-final stop` after all children finish. Under terminal overlays leave checkout as found and print leftover path/branch. Delete only that PR's record, helper outputs, and log_path files under existing teardown rules, then retire it. Await all next-batch results and re-render every nonretired PR; repeat until all retire.
+For non-final stop run `cleanup.md` `## Non-final stop` after all children finish. Under terminal overlays leave checkout as found and print leftover path/branch. Retain the PR's row from `post-selection-loop.md` `### Settlement rows` in the parent roster before deleting only that PR's record, helper outputs, and log_path files under existing teardown rules, then retire it. While any PR remains, start a retirement message with `gauntlet: retired #<N> - <reason>`, never `gauntlet: done` or `gauntlet: stuck`; keep private child result lines unchanged. Await all next-batch results and re-render every nonretired PR; repeat until all retire.
+
+After the last PR retires and every selected cleanup or follow-on step finishes, render one final message. Start the message with `gauntlet: stuck retired` when any retained outcome is `stuck - <reason>`, otherwise `gauntlet: done retired`. Print every retained PR row below it in roster order, including PRs retired in earlier rounds. Emit no per-PR terminal message before this set settlement.
 
 Initialize parent tracker tasks `pr-<N> state: <record path>`; mark in_progress on dispatch, complete on retirement, failed on unretried failure. Child trackers are session-local stages, not parent roster tasks. Use a plain checklist if plan_tracker is unavailable.

package/skills/gatekeep-pr/reference/cleanup.md

@@ -22,7 +22,7 @@ Consequence clause for the menu row (`decision-menu.md`): `remove <worktree.path
 
 Follow the [shared layout](../../brainstorming/reference/menu-layout.md).
 
-Start the message with `gauntlet: stuck` followed on that line by the reason: use the obstacle's `stuck - ` text as the reason, or `stopped at <template id>` for initial, assess-terminal, and contract-exception. On a failed reset/assertion use the actual error instead. Put cleanup results below that one first line.
+Finish the stop consequences below before the final message. Start the message with `gauntlet: stuck` followed on that line by the reason: use the obstacle's `stuck - ` text as the reason, or `stopped at <template id>` for initial, assess-terminal, and contract-exception. On a failed reset/assertion use the actual error instead. Print the PR row from `post-selection-loop.md` `### Settlement rows` with `stuck - <reason>` below the marker, then cleanup results. In set mode use `batch.md`'s per-PR retirement marker and retain the row for the final roster settlement.
 
 Enter here for `stop` on the initial, assess-terminal, obstacle, or contract-exception menu. On a `rebased locally` head, run `git -C <worktree.path> reset --hard <pre_head>` first; assert `HEAD == <pre_head>` and a clean tree. Stop on a failed assertion.
 

package/skills/gatekeep-pr/reference/post-selection-loop.md

@@ -195,9 +195,15 @@ On completion or timeout, refresh then run steps 2-5 of Re-render plus step 1's
 
 Before posting or committing any external payload - review bodies, replies, commit subjects, tracker comments - re-read it against SKILL.md `## Wording rules` and any `## comms style` rules: ASCII only; no headings or template scaffolding under ~150 words; findings `file:line`-specific where one exists; ends on the fix or asked action, not a recap; never invents content to fill a section. The `AC coverage` block is the one exception: it posts verbatim, heading and checkbox rows included.
 
+### Settlement rows
+
+Emit the terminal message only after every selected follow-on step finishes and the cleanup pick is answered (run or declined by stop); a report or menu is not settlement. Below its marker print one plain `#<N>@<head sha>: <outcome>[ (<ticket ref>)]` row per PR in roster order, singleton included. Use the full assessed `headRefOid`, not the merge commit or a shortened display SHA. Use the last gathered head when assessment could not start. Append the parenthetical only when the PR title or body's first line names a ticket under the overrides `## Issue tracker` `refs:` convention; otherwise omit it. Use exactly `approved`, `merged`, `closed-pr`, `final`, `merge-queued`, or `stuck - <reason>`, retaining the actual stop/error reason. Keep rows without bullets, code fences or emphasis; put checkout paths and cleanup results after them.
+
+For set mode, retain each row before deleting its PR record and follow `batch.md`'s retirement and final-settlement rules. Keep private child result lines unchanged.
+
 ### Teardown
 
-Start the message with `gauntlet: done approved` for stop on approved. Start the message with `gauntlet: done merged` for stop on own-merge. Start the message with `gauntlet: done closed-pr` for stop on closed-pr. Start the message with `gauntlet: done final` for stop on final. Start the message with `gauntlet: done merge-queued` for stop on merge-queued. Put the checkout path and local branch below the terminal line. A report Verdict above a menu is not a terminal. Start the message with `gauntlet: stuck` followed by the actual error on any hard assertion failure, including a delegated fix-wave restore/assert failure, and end with the actual error; do not render a continuation menu.
+Start the message with `gauntlet: done approved` for stop on approved. Start the message with `gauntlet: done merged` for stop on own-merge. Start the message with `gauntlet: done closed-pr` for stop on closed-pr. Start the message with `gauntlet: done final` for stop on final. Start the message with `gauntlet: done merge-queued` for stop on merge-queued. Print the row from `### Settlement rows`, then the checkout path and local branch. A report Verdict above a menu is not a terminal. Start the message with `gauntlet: stuck` followed by the actual error on any hard assertion failure, including a delegated fix-wave restore/assert failure; print the PR row with `stuck - <actual error>` below it and end with the actual error, without a continuation menu. In set mode use `batch.md`'s per-PR retirement marker until every PR retires.
 
 Delegate non-final stop (initial, assess terminal, obstacle, contract exception) to `cleanup.md` `## Non-final stop`. Keep terminal cleanup behind its own pick; terminal stop leaves the checkout as found and reports its path and local branch. Render cleanup only on terminal templates; never run cleanup steps 2-4 for a non-final stop.
 

package/skills/gauntlet-resume/reference/reconstruction.md

@@ -94,16 +94,16 @@ After confirmation:
 2. Call `phase_tracker({ action: "start", phase: "brainstorm" })`, then `phase_tracker({ action: "skip", phase: "brainstorm", reason: "resume: <spec path>" })`, then `phase_tracker({ action: "start", phase: "plan" })`.
 3. Admit exactly one positive safe-integer `cap:` or `allowance:` header; both or neither is `ledger header malformed: <observed header lines>`, requiring human repair by hand. Call `plan_check({ planPath: <absolute ledger path> })` with legacy-compatible admission. On FAIL, stop with findings, retaining plan in_progress. Start the message with `gauntlet: stuck` followed by the findings reason on that line; never enter `## Plan repair` or writing-plans. On PASS, call `phase_tracker({ action: "skip", phase: "plan", reason: "resume: <spec> (loop engine)" })`, then `phase_tracker({ action: "start", phase: "implement" })`. Use the resolved absolute spec path as `<spec>` in the reason. Restore implement through refresh, not `init`.
 4. **Shared allowance boundary (every ledger restore, before phase continuation).** Read `/skill:loop-implementation`. Skip Entry step 1's allowance seeding; restore base, verification, iterations, row attempts and decisions from the ledger without reseeding. Resolve `gauntlet_setting({ key: "loopEngine" })` exactly once at the driver's authorized-restore grant boundary and retain `escalateAfter` in driver memory for this run; share this read with step 4.2, never refresh it inside the loop. On an unavailable tool, stop before any dispatch or write with `cannot resolve escalation threshold: settings tool unavailable (loopEngine.escalateAfter)`. Apply the following order on bare-worktree and brief routes alike:
-   1. Apply pending recovery below against the unmigrated ledger, including home returns whose child commit removed the tuple. Validate the original one-commit `<pre-dispatch HEAD>..HEAD` range against its unchanged before-image. For companions, retain unchanged home HEAD and admit the expected iterations-bump-plus-tuple dirt. On unrecoverable attribution or before-image, stop before refresh. Resolve ambiguous-history admission before tracker calls as required below. Retain every discard/reset and interrupted-dispatch gate; migration changes neither admission ranges nor the home HEAD used for recovery.
+   1. Apply pending recovery below against the unmigrated ledger, including home returns whose child commit removed the tuple. Validate the original one-commit `<pre-dispatch HEAD>..HEAD` range against its unchanged before-image. For companions, retain unchanged home HEAD and admit the expected iterations-bump-plus-tuple dirt. On unrecoverable attribution or before-image, stop before refresh. Resolve ambiguous-history admission before tracker calls as required below. Apply the driver's ownership-fenced interrupted recovery before migration; migration changes neither admission ranges nor the home HEAD used for recovery.
    2. Migrate only an admitted, clean, tuple-free ledger with no retained recovery stop. With `cap:` and no `allowance:`, reuse the single restore-boundary settings read and replace the cap line with `allowance: <maxIterationsPerRow>`. Commit only that header replacement as parent `loop: migrate allowance`; preserve iterations, every attempts cell and all decisions. With an existing allowance, use it without allowance resolution or a migration commit; the restore read supplies `escalateAfter` only. Defer migration through any retained recovery stop or dirty tree; after authorized recovery reaches a clean tuple-free tree, migrate before the next dispatch or verification.
    3. Require `allowance:` and no `cap:` before continuation, including for all-closed ledgers; otherwise stop with `ledger has no allowance: line - resume through /skill:gauntlet-resume`. For a retained recovery stop or unresolved dirty tree, defer this final validation with migration and project the unmigrated ledger solely to report the stop.
    4. Call `plan_tracker({ action: "refresh", path: <absolute ledger path> })` exactly once after phase restoration, recovery and eligible migration/final validation, before any unresolved dirty-tree stop or dispatch. On verify/ship, restore the saved mixed task list first as `brief-contract.md` specifies; on implement, use no `init`. On refresh failure, stop with its findings and leave the existing task list untouched. Read `plan_tracker status` and report its exact observed state, never an inferred list.
-   Render the allowance header, rows, iterations, attempts, effective allowances and all decisions; distinguish the latest operational `row <n> ...` decision from the last physical history line. Compute each effective allowance as the header plus one per matching retry decision; ignore the retry's audit ceiling. Keep `cap +N` history as inert text and restore no funded rounds. Report any retained recovery stop now with no redispatch, using the driver's unresolved-row counts and discard-authorization menu for dirty trees. Resume the original phase only after this boundary: implement at `Before each dispatch`; verify/ship at `After the loop` step 1.
+   Render the allowance header, rows, iterations, attempts, effective allowances and all decisions; distinguish the latest operational `row <n> ...` decision from the last physical history line. Compute each effective allowance as the header plus one per matching retry decision; ignore the retry's audit ceiling. Keep `cap +N` history as inert text and restore no funded rounds. For a recovered pending tuple with a recoverable before-image, apply the driver's ## Interrupted recovery below allowance before continuation; require exclusive checkout provenance and confirmed owned-job exits before any reset. Report unresolved cleanup or ownership with the driver's recovery-incomplete header, saved unresolved-row counts and discard-authorization menu, preserving changes and making no redispatch. Keep unrecoverable before-image and ambiguous-history stops. Resume the original phase only after this boundary: implement at `Before each dispatch`; verify/ship at `After the loop` step 1.
 5. Continue at loop step 5, the delivered driver's `Before each dispatch`, with durable iterations and retry data; an all-closed ledger completes implement through refresh and takes `After the loop` step 0. A migrated unresolved row at or above its effective allowance stops under rule 2 without an attempt; keep an allowance-stopped row `failed`. Render a row whose `pending:` tuple is restored or retained as `row <n> in_progress (pending tuple restored)`. Never reset counters or reseed a validated seed.
 
 ### Pending recovery
 
-Recover before dispatch or verification on every ledger restore. Run the read-only admission-evidence check below before phase/task restoration on every ledger route, including briefs; resolve its human question before any tracker call. Apply recovery writes only at the ordered pending-recovery step. Read the durable `pending:` tuple (target row or seed, repo, pre-dispatch HEAD); the parent's uncommitted iterations bump plus tuple is expected dispatch dirt, not a reason to skip recovery.
+Recover before dispatch or verification on every ledger restore. Run the read-only admission-evidence check below before phase/task restoration on every ledger route, including briefs; resolve its human question before any tracker call. Apply recovery writes only at the ordered pending-recovery step. Read the durable `pending:` tuple (target row, seed or verify, repo, pre-dispatch HEAD); the parent's uncommitted iterations bump plus tuple is expected dispatch dirt, not a reason to skip recovery. Route `pending: verify` through the loop driver's After the loop step 1 repair admission/recovery before the row/seed paths below; preserve its reserved count and consumed iteration without a second marker or bump.
 
 With no `pending:` on disk, inspect home commit history before any refresh. Find the latest home child row/seed commit that changed this ledger, even when unrelated commits follow it; read its subject and body with `git -C <worktree> log --format=%H -- <ledger path>` and `git -C <worktree> show -s --format=%B <sha>`. Exclude returns superseded by a parent admission/repair or approved ledger mutation proven by the evidence below; never replay those over the parent's current ledger.
 
@@ -116,13 +116,13 @@ Revalidate a clean, exactly-one-commit return through the home row below. For la
 | Confirmed admission state | Action |
 |---|---|
 | Confirmed settled | Preserve the current ledger and continue normal restore; require fresh verification/conformance, not historical gate credit. |
-| Confirmed interrupted | Validate the entire `<pre-dispatch HEAD>..HEAD` range, never just `HEAD^..HEAD`, through the home row below. Render the interrupted/ambiguous-history answer in one sentence: validate the full `<HEAD_BEFORE>..HEAD` range (using the recovered pre-dispatch SHA, including later commits), restore every row the child changed (target and extras) and remove their unadmitted decisions from the pre-dispatch copy with the tuple before refresh on boundary rejection, state that iterations stay at the recovered count and child commits/changes are kept; use the saved cells for any other pre-dispatch status/attempts, or all dispatched non-cut rows for seed. Use the recovered tuple/count without another bump or a new commit. |
+| Confirmed interrupted | Validate the entire `<pre-dispatch HEAD>..HEAD` range, never just `HEAD^..HEAD`, through the home row below. Use the recovered tuple and before-image without another bump. Confirmation that admission was interrupted proves no ownership of later writes: apply the driver's ## Interrupted recovery only with retained exclusive checkout/write provenance and owned-job exit evidence. Missing evidence preserves child and unrelated changes at recovery incomplete; project saved row cells without overwriting the ledger. A completed recovery writes the parent repair with iterations at the recovered consumed count. |
 | Still unknown | Stop without mutation; ask for the missing admission evidence, never turn uncertainty into a discard/reset decision. |
 
 | Tuple target | Recovery |
 |---|---|
-| Home leg or single-member `home` | Reconstruct the pre-dispatch ledger from `HEAD:<ledger path>` when HEAD is the tuple SHA, otherwise from `<pre-dispatch HEAD>:<ledger path>`. Compare live HEAD with that SHA. Admit exactly one new home commit with subject `loop: row <n> <status>` or `loop: seed evidence` only through the driver's `## Validate the return`: require a clean tree and the bounded row/decision result, allowing only the consumed iteration and pending removal header deltas. Clear the tuple through the admitted close or ordinary-miss repair. With zero new commits, keep the tuple and consumed iteration and take the interrupted-dispatch stop. Unrelated movement or multiple commits stop without redispatch or double counting. For a rejected terminal child result, restore every row the child changed (target and extras) and remove their unadmitted decisions in the working-tree ledger from the pre-dispatch copy with the tuple before refresh (all dispatched non-cut rows for seed); preserve other child changes, child commits and consumed iterations for the human's discard/reset decision. |
-| Actual multi-member companion | Apply `/skill:loop-implementation` `reference/coordinated-legs.md` `## Resume`: require unchanged home HEAD and exactly one new companion commit with tuple attribution, then validate its result. Record that leg's admitted rows, decisions or seeded state and SHA, removing the tuple in the home-ledger commit; never rerun the recovered row or its admitted extras. Stop preserving state on boundary/attribution failures (zero, unrelated or multiple commits or attribution mismatch); route post-boundary result-validation misses through ordinary `loop: repair row <n>` or seed `loop: repair seed` repair in that protocol, clear `pending:` and preserve the consumed iteration. |
+| Home leg or single-member `home` | Reconstruct the pre-dispatch ledger from `HEAD:<ledger path>` when HEAD is the tuple SHA, otherwise from `<pre-dispatch HEAD>:<ledger path>`. Compare live HEAD with that SHA. Admit exactly one new home commit with subject `loop: row <n> <status>` or `loop: seed evidence` only through the driver's `## Validate the return`: require a clean tree and the bounded row/decision result, allowing only the consumed iteration and pending removal header deltas. Clear the tuple through the admitted close or ordinary-miss repair. Route zero new commits, multiple commits, dirty or non-DONE returns through the driver's ## Interrupted recovery against the tuple HEAD and its ledger before-image. Require exclusive checkout provenance and verified process identity/exit before reset; after clean/zero-commit observations write the repair with the already-consumed iteration, clear pending and continue at Before each dispatch. Preserve every change at recovery incomplete when ownership or cleanup is unresolved. Unrelated movement, attribution mismatch or an unrecoverable before-image stops without redispatch or double counting. |
+| Actual multi-member companion | Apply `/skill:loop-implementation` `reference/coordinated-legs.md` `## Resume`: require unchanged home HEAD and exactly one new companion commit with tuple attribution, then validate its result. Record that leg's admitted rows, decisions or seeded state and SHA, removing the tuple in the home-ledger commit; never rerun the recovered row or its admitted extras. Route dirty, zero/multiple-commit or non-DONE boundaries through that reference's ownership-fenced interrupted recovery, using the companion tuple HEAD and saved home ledger; preserve state on unrelated movement, attribution mismatch, unrecoverable before-image or unresolved ownership/cleanup; route post-boundary result-validation misses through ordinary `loop: repair row <n>` or seed `loop: repair seed` repair in that protocol, clear `pending:` and preserve the consumed iteration. |
 
 ## Spec with plan
 

package/skills/gauntlet-resume/reference/seed.md

@@ -13,12 +13,7 @@ Before starting the seed sequence, read the seed's header. A `**Home:**` header
    stop: `not tracked: <seed> - commit it first`. Line 1 of `<seed>` equal to
    `# CONTEXT DRAFT - NOT A SPEC - fully replaced at spec-writing` -> stop:
    `context draft, not a spec: <seed> - finish brainstorming`.
-3. **Not shipped.** Read `<primary>/<telemetry.dir>/<rel with .md -> .yaml>`
-   (`piGauntlet.telemetry.dir`, default `.pi/gauntlet/telemetry`). A `shipped_at:` or
-   `abandoned_at:` line carrying a value -> stop:
-   `spec already shipped at <ts> - write a superseding spec`. No record, or
-   `in_progress`: continue; the extension folds this run into the record on
-   `plan_check` pass.
+3. **Not shipped.** Resolve `piGauntlet.telemetry` from preset and primary project settings; `enabled: false` skips this check. Run `git -C <primary> rev-parse --git-common-dir`; resolve a relative result against `<primary>` and read `<git common dir>/gauntlet/telemetry/<rel with .md -> .yaml>`. When git resolution fails and `jj root` in `<primary>` succeeds, read `<jj root>/.jj/gauntlet/telemetry/<rel with .md -> .yaml>` instead. When the local record is absent, fetch `gauntlet/telemetry` from `telemetry.remote` (default `origin`) and read `<owner>/<repo>/brainstorming/<rel with .md -> .yaml>` from the fetched ref, using the last fetched ref on fetch failure. Degrade to the local-only check when no fetched ref is available, including jj-only workspaces. A valued `shipped_at:` or `abandoned_at:` stops: `spec already shipped at <ts> - write a superseding spec`. No record or `in_progress`: continue; let the extension bind on `plan_check` pass.
 4. **Name.** `<name>` = basename of `<rel>` minus `.md`, minus a leading `YYYY-MM-DD-`:
    `2026-09-17-gh-31-gauntlet-resume.md` -> `gh-31-gauntlet-resume`. Same shape as
    brainstorming's Filename Convention slug; wrappers receive it as `<name>`.