pi-gauntlet 8.3.0 → 8.4.1

package/extensions/telemetry.ts

@@ -1,6 +1,7 @@
   /**
-   * Telemetry extension: records one YAML record per gauntlet run, keyed by spec path,
-   * from pi events alone. Binds only after `phase_tracker start brainstorm` armed the
+   * Telemetry extension: records run and session-leg YAML from pi events alone.
+   * Session legs seal through telemetry-leg.ts at terminal settlement. Runs bind
+   * only after `phase_tracker start brainstorm` armed the
    * flow, writes the record to disk without ever staging or committing it (the seal bin
    * commits once at finish), and blocks `write` into an already-shipped spec while
    * brainstorm is in progress. Pure helpers: extensions/lib/telemetry-*.ts. The default
@@ -14,7 +15,7 @@
   import * as piRuntime from "@earendil-works/pi-coding-agent";
   import { SettingsManager, getAgentDir } from "@earendil-works/pi-coding-agent";
   import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
-  import { DEFAULT_TEST_COMMANDS, planDirsFor, resolveFlowGuards, resolveTelemetry, settingsErrorWarning, type TelemetryResolved } from "./lib/gauntlet-settings.ts";
+  import { DEFAULT_TELEMETRY_DIR, DEFAULT_TEST_COMMANDS, planDirsFor, resolveFlowGuards, resolveTelemetry, settingsErrorWarning, type TelemetryResolved } from "./lib/gauntlet-settings.ts";
   import { loadGauntletSettings } from "./lib/gauntlet-settings-loader.ts";
   import { checkoutOf } from "./lib/checkout.ts";
   import { CONTEXT_DRAFT_MARKER, nextGauntletEntered } from "./lib/phase-tracker-helpers.ts";
@@ -24,6 +25,8 @@
   import { COUNTED_USER_PHASES, REVIEWER_AGENTS, countFindings, countStructuredFindings, countOpenGaps, countReopens, insertedText, planTotals, textOf, usageToTokens } from "./lib/telemetry-collect.ts";
   import { addTokens, capEvents, compact, currentPhase, derive, diffPhases, emptyAccumulators, emptyPhases, foldAccumulators, implementAutoCompletes, liveShipEvent, newRecord, parseRecord, serializeRecord, type Accumulators, type BaseEvent, type PhaseAcc, type PhaseKey, type PhaseMap, type TelemetryEvent, type TelemetryRecord, type Tokens } from "./lib/telemetry-record.ts";
   import { guardReason } from "./lib/telemetry-ship.ts";
+  import { readTelemetryBranch, telemetryRepo, type syncTelemetryBranch } from "./lib/telemetry-branch.ts";
+  import { registerLegTelemetry } from "./lib/telemetry-leg.ts";
   import { buildCouncil, parseAudit, parseChairReport, resolveMembers, type Cluster, type MemberResult } from "./lib/telemetry-council.ts";
 
   // ---- deps seam -------------------------------------------------------------------
@@ -51,6 +54,9 @@
     testCommands?: string[];
   }
   export interface Deps {
+    syncTelemetryBranch?: typeof syncTelemetryBranch;
+    telemetryRepo?: typeof telemetryRepo;
+    readTelemetryBranch?: typeof readTelemetryBranch;
     fs: FsPort;
     git: (args: string[], cwd: string) => Promise<GitResult>;
     // jj runner; production uses realJj for both checkout detection and the ship-time diff.
@@ -205,13 +211,16 @@
     let boundSpec: string | undefined; // repo-relative
     let record: TelemetryRecord | undefined;
     const predecessorLinks = new Set<string>();
-    let recordRel: string | undefined; // repo-relative record path
+    let recordRel: string | undefined; // absolute record path outside the working tree
     let buffer: TelemetryEvent[] = [];
     let pending: Accumulators = emptyAccumulators();
     let frozen = false;
+    let recordWritten = false;
     let gauntletEntered = false;
     let settingsWarned = false;
     let sessionId = "";
+    const guardCache = new Map<string, Map<string, string>>();
+    let guardWarned = false;
     let currentDir = "";
     let councilPending: { memberResults: MemberResult[]; chair?: { model: string; dispatches: number; clusters?: Cluster[] } } | undefined;
 
@@ -235,7 +244,7 @@
     // Disarmed and unbound: activity outside the gauntlet is never charged to the next run.
     const live = (): Accumulators => record
       ? (record.accumulators[sessionId] ??= emptyAccumulators())
-      : gauntletEntered ? pending : emptyAccumulators();
+      : legAcc() ?? (gauntletEntered ? pending : emptyAccumulators());
 
     const canBind = (): boolean => gauntletEntered && !frozen && phases.ship.status !== "complete";
 
@@ -252,8 +261,8 @@
     const warn = (message: string) => pushEvent({ kind: "warning", message });
 
     // ---- record store ----
-    // The record is the file on disk; nothing here stages or commits. A record the seal bin
-    // already stamped is frozen so a later flush cannot overwrite the seal.
+    // The seal either keeps a stamped file for retry or removes it after committing.
+    // Neither may be overwritten by a later recorder flush.
     const sealedAt = (path: string): boolean => {
       const text = deps.fs.readFile(path);
       const parsed = text ? parseRecord(text) : undefined;
@@ -266,8 +275,8 @@
         frozen = true;
         return;
       }
-      const target = abs(recordRel);
-      if (sealedAt(target)) {
+      const target = recordRel;
+      if ((recordWritten && !deps.fs.exists(target)) || sealedAt(target)) {
         frozen = true;
         return;
       }
@@ -281,6 +290,7 @@
         deps.fs.mkdirp(dirname(target));
         deps.fs.writeFile(target + ".tmp", serializeRecord(record));
         deps.fs.rename(target + ".tmp", target);
+        recordWritten = true;
       } catch (e) {
         pushEvent({ kind: "warning", message: `record write failed: ${String((e as Error).message ?? e).split("\n")[0]}` });
       }
@@ -288,27 +298,9 @@
 
     const flush = writeRecord;
 
-    // Excluded untracked paths are invisible to `git status --porcelain`, skipped by
-    // `git add -A`, and never block `git worktree remove`; the seal stages with `git add -f`.
-    const ensureExcluded = async () => {
-      const common = await deps.git(["rev-parse", "--path-format=absolute", "--git-common-dir"], toplevel!);
-      const commonDir = common.stdout.trim();
-      if (common.code !== 0 || !commonDir) return void warn(`exclude skipped: git rev-parse --git-common-dir failed: ${common.stderr.trim().split("\n")[0]}`);
-      const line = `${currentDir.replace(/\/+$/, "")}/`;
-      const file = join(commonDir, "info", "exclude");
-      const existing = deps.fs.readFile(file) ?? "";
-      if (existing.split("\n").some((l) => l.trim() === line)) return;
-      try {
-        deps.fs.mkdirp(dirname(file));
-        deps.fs.writeFile(file, existing + (existing && !existing.endsWith("\n") ? "\n" : "") + line + "\n");
-      } catch (e) {
-        warn(`exclude write failed: ${String((e as Error).message ?? e).split("\n")[0]}`);
-      }
-    };
-
     const loadOrCreate = (specRel: string): TelemetryRecord => {
       const rel = recordPathFor(currentDir, specRel);
-      const existing = deps.fs.readFile(abs(rel));
+      const existing = deps.fs.readFile(rel);
       const parsed = existing ? parseRecord(existing) : undefined;
       if (parsed) {
         // fold stale live blocks (sessions that died without shutdown) into total
@@ -324,13 +316,40 @@
       return newRecord({ spec: specRel, session: sessionId, now: buffer[0]?.ts ?? deps.now(), runId: randomUUID() });
     };
 
-    const sealedOnDisk = (top: string, rel: string, dir: string): boolean => sealedAt(join(top, recordPathFor(dir, rel)));
+    const shippedRecords = (top: string, snap: SettingsSnapshot): Map<string, string> => {
+      const key = JSON.stringify([top, snap.telemetry.remote]);
+      let records = guardCache.get(key);
+      if (!records) {
+        records = new Map();
+        guardCache.set(key, records);
+        const repo = (deps.telemetryRepo ?? telemetryRepo)(top);
+        const result = (deps.readTelemetryBranch ?? readTelemetryBranch)(top, { remote: snap.telemetry.remote, prefix: `${repo}/brainstorming/` });
+        for (const entry of result.records) {
+          const parsed = parseRecord(entry.bytes);
+          if (parsed?.shipped_at) records.set(parsed.spec, parsed.shipped_at);
+        }
+        if (result.warning && !guardWarned) {
+          guardWarned = true;
+          pi.sendMessage({ customType: "telemetry-warning", content: `telemetry guard unavailable: ${result.warning}`, display: true });
+        }
+      }
+      return records;
+    };
 
     const bind = async (specRel: string, snap: SettingsSnapshot, specToplevel: string, via: "git" | "jj") => {
-      if (sealedOnDisk(specToplevel, specRel, snap.telemetry.dir)) return;
+      if (via === "git" && shippedRecords(specToplevel, snap).has(specRel)) return;
+      let metadataDir = join(specToplevel, ".jj");
+      if (via === "git") {
+        const common = await deps.git(["rev-parse", "--path-format=absolute", "--git-common-dir"], specToplevel);
+        if (common.code !== 0 || !common.stdout.trim()) {
+          warn(`record bind skipped: git common dir unavailable: ${common.stderr.trim().split("\n")[0]}`);
+          return;
+        }
+        metadataDir = common.stdout.trim();
+      }
       toplevel = specToplevel;
       checkoutVia = via;
-      currentDir = snap.telemetry.dir;
+      currentDir = join(metadataDir, "gauntlet", "telemetry");
       boundSpec = specRel;
       recordRel = recordPathFor(currentDir, specRel);
       predecessorLinks.clear();
@@ -363,7 +382,6 @@
         if (snap.errors.length) warn(settingsErrorWarning(snap.errors));
         if (snap.telemetry.warning) warn(snap.telemetry.warning);
       }
-      if (via === "git") await ensureExcluded();
       refreshLinks();
     };
 
@@ -374,6 +392,7 @@
       record = undefined;
       recordRel = undefined;
       frozen = false;
+      recordWritten = false;
       councilPending = undefined;
     };
 
@@ -400,18 +419,13 @@
     const rebind = async (newSpec: string): Promise<boolean> => {
       const from = recordRel!;
       const to = recordPathFor(currentDir, newSpec);
-      if (deps.fs.exists(abs(to))) {
+      if (deps.fs.exists(to)) {
         warn(`record move skipped: ${to} already exists`);
         return false;
       }
-      const trackedResult = await deps.git(["ls-files", "--error-unmatch", "--", from], toplevel!);
-      const tracked = trackedResult.code === 0 && trackedResult.stdout.trim() !== "";
       try {
-        deps.fs.mkdirp(dirname(abs(to)));
-        if (tracked) {
-          const mv = await deps.git(["mv", "--", from, to], toplevel!);
-          if (mv.code !== 0) deps.fs.rename(abs(from), abs(to));
-        } else deps.fs.rename(abs(from), abs(to));
+        deps.fs.mkdirp(dirname(to));
+        deps.fs.rename(from, to);
       } catch (e) {
         warn(`record move failed: ${String((e as Error).message ?? e).split("\n")[0]}`);
         return false;
@@ -493,8 +507,11 @@
       lastPlanTasks = undefined;
       amendmentOpen = false;
       pendingTest.clear();
+      if (sessionId !== ctx.sessionManager.getSessionId()) {
+        guardCache.clear();
+        guardWarned = false;
+      }
       sessionId = ctx.sessionManager.getSessionId();
-      currentDir = snap.telemetry.dir;
       const replay = replayBranch(ctx.sessionManager.getBranch(), snap.specDirs);
       lastPlanTasks = replay.lastPlanTasks;
       phases = replay.phases;
@@ -535,6 +552,10 @@
         await applyPhaseDetails(event.details as never, snap);
         return undefined;
       }
+      if (event.toolName === "subagent" && legAcc()) {
+        await onSubagentResult(event.details, event.content, event.isError);
+        return undefined;
+      }
       if (!record && !canBind()) return undefined;
       if (event.toolName === "plan_check" && !event.isError) {
         const d = event.details as { status?: string; specPath?: string; planPath?: string } | undefined;
@@ -605,7 +626,7 @@
       }
       if (loc.toplevel !== toplevel) {
         // Another checkout: a fresh run, never a rename of this record.
-        if ((tool === "write" || tool === "edit") && isSpecPath(rel, snap.specDirs) && canBind() && !sealedOnDisk(loc.toplevel, rel, snap.telemetry.dir)) {
+        if ((tool === "write" || tool === "edit") && isSpecPath(rel, snap.specDirs) && canBind() && (loc.via === "jj" || !shippedRecords(loc.toplevel, snap).has(rel))) {
           unbind();
           await bind(rel, snap, loc.toplevel, loc.via);
           if (!boundSpec) return undefined;
@@ -751,7 +772,7 @@
       if (!record || !toplevel || liveShipEvent(record.events)) return;
       record.status = "shipped";
       record.shipped_at = deps.now();
-      const out = await computeJjDiff({ jj: deps.jj ?? realJj, cwd: toplevel, spec: record.spec, dir: currentDir, buckets: snap.telemetry.buckets, planDirs: snap.planDirs });
+      const out = await computeJjDiff({ jj: deps.jj ?? realJj, cwd: toplevel, spec: record.spec, dir: DEFAULT_TELEMETRY_DIR, buckets: snap.telemetry.buckets, planDirs: snap.planDirs });
       if (out.warning) warn(out.warning);
       record.derived.modified_files = out.modified_files;
       record.derived.diff = out.diff;
@@ -766,11 +787,9 @@
         const rawPath = (event.input as { path?: unknown }).path;
         if (typeof rawPath === "string" && phases.brainstorm.status === "in_progress") {
           const loc = await locate(ctx, rawPath);
-          if (loc && isSpecPath(loc.rel, snap.specDirs)) {
-            const recRel = recordPathFor(snap.telemetry.dir, loc.rel);
-            const existing = deps.fs.readFile(join(loc.toplevel, recRel));
-            const parsed = existing ? parseRecord(existing) : undefined;
-            if (parsed?.shipped_at) return { block: true, reason: guardReason(loc.rel, parsed.shipped_at, recRel) };
+          if (loc?.via === "git" && isSpecPath(loc.rel, snap.specDirs)) {
+            const shippedAt = shippedRecords(loc.toplevel, snap).get(loc.rel);
+            if (shippedAt) return { block: true, reason: guardReason(loc.rel, shippedAt, "gauntlet/telemetry") };
           }
         }
         return undefined;
@@ -874,4 +893,5 @@
       refreshLinks();
     };
 
+    const legAcc = registerLegTelemetry(pi, deps, () => !!record);
 }

package/extensions/test-support/git-env.mjs

@@ -0,0 +1,13 @@
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+export function isolatedGitEnv(scratch) {
+  const env = {
+    GIT_CONFIG_GLOBAL: join(scratch, "gitconfig"),
+    GIT_CONFIG_NOSYSTEM: "1",
+    GIT_AUTHOR_NAME: "test", GIT_AUTHOR_EMAIL: "test@example.test",
+    GIT_COMMITTER_NAME: "test", GIT_COMMITTER_EMAIL: "test@example.test",
+  };
+  writeFileSync(env.GIT_CONFIG_GLOBAL, "");
+  return env;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-gauntlet",
-  "version": "8.3.0",
+  "version": "8.4.1",
   "description": "Opinionated, gated workflow skills, subagent personas, and runtime extensions for the pi coding agent.",
   "author": "Jacek Juraszek",
   "type": "module",

package/skills/brainstorming/SKILL.md

@@ -69,7 +69,7 @@ The spec is the first commit in a dedicated worktree, never a separate commit on
 
 Read [reference/legs.md](reference/legs.md) and settle membership before creation. Invoke `/skill:using-git-worktrees` for each member with explicit `$ROOT` = its primary and `$BRANCH` = the shared branch; carry every `Worktree ready at <full-path>` value, home first. Root the home spec at `<home worktree>/<home spec dir>/<filename>.md`; root each dispatch and `git -C` in its owning leg's worktree. Keep the process cwd unchanged. Gather each leg's rules and record portable contracts and companion artifacts using that reference; a one-member run adds only its one-block `## Legs` section.
 
-Spec, plan, and implementation share this worktree. The spec and its telemetry record (`<telemetry.dir>/<spec path with .md -> .yaml>`, default `.pi/gauntlet/telemetry/doc/specs/<spec>.yaml`) are deliverables and ship in the squash; only the plan is stripped. `/skill:finishing-a-development-branch` strips the plan, then seals the record before landing (a `telemetry:` commit under git; the working-copy snapshot in a plain jj workspace). Explicit trivial one-off edits outside this flow need no worktree.
+Keep spec, plan, and implementation in this worktree. Ship the spec and implementation; strip only the plan. Let `/skill:finishing-a-development-branch` seal and publish the telemetry record to the orphan `gauntlet/telemetry` branch before landing; keep recorder state in Git common-dir metadata, outside the working tree. In a plain jj workspace, retain local metadata and report that publication is unavailable. Use no worktree for explicit trivial one-off edits outside this flow.
 
 ## The Process
 

package/skills/check-delivery/SKILL.md

@@ -262,6 +262,8 @@ Start the message with `gauntlet: gate=check-delivery/confirmation-gate` before
 
 Start the message with `gauntlet: done delivered` when the batched write landed. Start the message with `gauntlet: done already-recorded` for idempotent delivery. Start the message with `gauntlet: done manual` when the write halves are emitted for manual execution. Start the message with `gauntlet: stuck` followed on that line by the concrete reason once the findings-comment gate is answered or no comment is offered; use this for any partial write failure too. A declined success write ends with `gauntlet: stuck write declined`.
 
+After every selected write or follow-on step finishes, put one plain `<ref>: <outcome>` line below the terminal marker, including singleton and early STOP paths. Use the supplied ticket ref and exactly one outcome: `delivered`, `manual`, `declined`, `already recorded`, `skipped`, or `failed - <reason>`. Map a declined success write to `declined`, skipped-no-tracker to `skipped`, and a failed stage, findings-only path or partial write to `failed - <reason>`; report a terminal ticket without recorded delivery as `skipped`. Keep rows outside tracker payloads, without bullets, code fences or emphasis. In set mode use `reference/batch.md`'s one final roster settlement, never a per-ticket terminal marker while siblings continue.
+
 Any `unexplained gap` or failed stage -> **failure path**: no status
 advance, no delivery comment, no marker. The findings may be offered as a
 **findings comment** (no `Delivered:` line, so it never trips idempotency) -

package/skills/finishing-a-development-branch/SKILL.md

@@ -226,7 +226,7 @@ Rows 1-2 run the Option 1/2 blocks; row 3 runs the Keep block and row 4 the Disc
 
 #### Strip the plan, seal the record (Options 1-3)
 
-Run this on the feature branch before any landing path. The spec and its telemetry record (`<telemetry.dir>/<spec path with .md -> .yaml>`, default `.pi/gauntlet/telemetry/doc/specs/<spec>.yaml`) are deliverables and ship in the squash; only the plan is stripped. The record is an untracked, git-excluded file until this step commits it (in a plain jj workspace there is no commit; jj snapshots the stamped record into the working-copy change). `<bin>` is `<directory of this skill's SKILL.md>/../../bin`, resolved from the skill's `<location>` in the system prompt.
+Run this on the feature branch before any landing path. Ship the spec and implementation; strip only the plan. Let the seal publish the telemetry record to the orphan `gauntlet/telemetry` branch without changing the product checkout, index or HEAD. Keep in-progress records in Git common-dir metadata, outside the working tree. Resolve `<bin>` as `<directory of this skill's SKILL.md>/../../bin` from the skill's `<location>` in the system prompt.
 
 Read the existing artifact's path-only `**Spec:**` header (repo-relative, backticks stripped) before removal; pass that value as `--spec`, including for a line-1 ledger. Resolve the spec dirs with `gauntlet_setting({ key: "flowGuards" })` and use their sibling `plans` dirs for plan paths. Enumerate both PLAN_PATH candidates: the task plan paired by basename and `<sibling plans dir>/<spec stem>-ledger.md`. Preserve the spec and telemetry.
 
@@ -242,13 +242,13 @@ elif [ -f "$WORKTREE/$PLAN_PATH" ] && jj -R "$WORKTREE" root >/dev/null 2>&1; th
 fi
 done
 
-# Seal the telemetry record: stamp shipped, compute the diff, commit it once.
-# The bin detects a plain jj workspace (no .git) itself: jj diff, no commit step.
+# Seal the telemetry record: stamp shipped, compute the diff, publish to gauntlet/telemetry.
+# The bin reports publication unavailable in a plain jj workspace and keeps local metadata.
 # --option is pr for Options 1-2 and squash for Option 3; --spec is the artifact header's **Spec:** value (omit when no artifact is known).
 node <bin>/gauntlet-telemetry-seal.mjs --worktree "$WORKTREE" --option <pr|squash> --base <base-branch> --spec <spec path>
 ```
 
-The seal prints one line per record (`sealed <path>`, `already sealed <path>`) or one bare outcome (`no telemetry run`, `telemetry disabled`) and exits 0; print its stdout verbatim in the ship completion message. Any nonzero exit stops the flow before the first landing command, quoting the bin's line: exit 2 (`no record at <path>`, `unparseable record <path>: <reason>`) means this gauntlet run's recorder never armed or its record is corrupt; exit 1 is a usage, environment, or git/jj failure (`seal failed <path>: <reason>` restored the pre-seal bytes). The user decides; never land without the seal.
+Print the seal's stdout verbatim in the ship completion message. Continue landing on exit 0 for every telemetry outcome, including `no telemetry run`, `telemetry: skipped (unparseable record <path>)` and `telemetry: not pushed (<reason>)`; missing or malformed records and publication failures never block shipping. Retain an unparseable record in place and preserve unpublished telemetry for retry. In a plain jj workspace, report `telemetry: not pushed (jj workspace: no git remote)` and retain local metadata. Stop before the first landing command only on exit 1 for a usage error (invalid arguments or base), quote the bin's line and ask the user how to proceed.
 #### PR-subject row 1: Push to the PR branch
 For the close-absorbed-PR question, start the message with `gauntlet: gate=finishing-a-development-branch/pr-subject-row-1`. Read and apply [menu-layout](../brainstorming/reference/menu-layout.md). Do not report `done pushed` while this gate awaits an answer. Capture the scoped verification set and accepted-complete task/thread evidence before the strip. Refetch threads per recorded PR using the paginated single-`$n` query (one invocation per PR) owned by [pr-head](../using-git-worktrees/reference/pr-head.md); retain PR attribution and use the query's location rendering. For home, use the table below and omit threads now resolved on GitHub. For members, copy recorded dispositions and mark newly resolved or newly opened states from the refresh; never use home's first-parent history as member-fix proof.
 | Refetched thread / evidence | Resolution |
@@ -346,7 +346,7 @@ git -C "$PRIMARY" commit -m "<imperative summary> (ref <ticket-id>)"
 (cd "$PRIMARY" && <the Step 1 set>)
 ```
 
-The plan was already removed and the telemetry record sealed on the branch, so the staged squash tree carries the spec, the telemetry record, and the implementation - never the plan.
+Keep only the spec and implementation in the staged squash tree; the stripped plan stays in feature history and the sealed telemetry record belongs to `gauntlet/telemetry`.
 
 The post-squash re-verify is not optional - `git merge --squash` can surface conflict-resolution mistakes the worktree-side run couldn't catch. For a ledger, run the per-pair post-squash recipe in [verification-set.md](reference/verification-set.md) instead of the non-ledger subshell above.
 
@@ -356,7 +356,7 @@ Cleanup worktree (Step 6), then, if Step 6 removed the worktree, `git -C "$PRIMA
 
 #### Option 4: Keep As-Is
 
-Report: "Keeping branch <name>. Worktree preserved at <path>." The telemetry record stays untracked and in_progress in the worktree; a later finishing run on this worktree seals it.
+Report: "Keeping branch <name>. Worktree preserved at <path>." Leave telemetry in local metadata; Keep As-Is publishes no record.
 
 **Don't cleanup worktree.**
 
@@ -374,7 +374,7 @@ Type 'discard' to confirm.
 
 Wait for exact confirmation.
 
-If confirmed: Cleanup worktree (Step 6), then, if Step 6 removed the worktree, `git -C "$PRIMARY" branch -D "$FEATURE"`. The record is git-excluded, so git worktree remove needs no --force; it goes with the worktree.
+If confirmed: Cleanup worktree (Step 6), then, if Step 6 removed the worktree, `git -C "$PRIMARY" branch -D "$FEATURE"`. Publish no telemetry for Discard; leave common-dir metadata outside worktree cleanup.
 
 ### Step 6: Cleanup Workspace
 
@@ -449,12 +449,12 @@ A host-owned worktree (Step 6: no `home:` match, or the legacy "Otherwise") keep
 - **Fix:** Require typed "discard" confirmation
 
 **Skipping the strip-and-seal block in Options 1-3 (any path that lands on base)**
-- **Problem:** Plan docs are ephemeral and shouldn't land on `<base-branch>`; the telemetry record is a deliverable and must. Skipping the block ships the plan, or drops the record the spec index reads.
-- **Fix:** Run the block on `$WORKTREE` before the squash or the push. The plan stays in the branch's git history (`git -C "$PRIMARY" log --all -- doc/plans/...`). Spec and telemetry record stay on `<base-branch>`; plan does not.
+- **Problem:** Skipping the block ships an ephemeral plan or skips publication of the record the spec index reads.
+- **Fix:** Run the block on `$WORKTREE` before the squash or push. Preserve the spec on `<base-branch>` and the telemetry record on `gauntlet/telemetry`; retain the plan only in feature history.
 
-**Widening the plan strip to the telemetry record**
-- **Problem:** `.pi/gauntlet/telemetry/**` looks like scaffolding next to the plan and gets deleted in the same commit - main then has no record for the run.
-- **Fix:** Never `git rm` under the telemetry dir. Until the seal the record is untracked and git-excluded, so a plan strip cannot reach it; after the seal it is a committed deliverable.
+**Treating telemetry as a checkout deliverable**
+- **Problem:** Staging a recorder file pollutes the product diff and bypasses branch publication.
+- **Fix:** Let the seal own publication from common-dir metadata; stage no telemetry record in the product checkout.
 
 ## Completion
 Start the final outcome message with exactly one terminal line before summaries. Start the message with `gauntlet: done pr-created` after successful normal or draft PR creation. Start the message with `gauntlet: done merged` after successful squash-merge and post-merge verification. Start the message with `gauntlet: done kept` after Keep. Start the message with `gauntlet: done discarded` only after typed discard authorization and successful discard. Start the message with `gauntlet: done pushed` after successful PR-subject push and body edit, only after the close-member gate is answered or no members qualify. Start the message with `gauntlet: stuck` followed on that line by a short concrete reason for an executed operation that fails, before error evidence or a return menu. Do not combine a terminal marker with a gate marker in one message; a subsequent menu starts a new gate message. Pending choices, implementation stalls and conformance escalation are not terminal outcomes. Read and apply [menu-layout](../brainstorming/reference/menu-layout.md). Preserve strip, seal, cleanup and ship-state rules below; terminal reporting does not complete ship after Discard or failure. Once the chosen option (Options 1-4 or PR-subject row 1 - not Discard) is executed successfully, mark the ship phase complete:
@@ -478,7 +478,7 @@ Once the merge (and any deploy) has landed, `/skill:check-delivery <ticket-ref>`
 - Run any step without the `<worktree-path>` argument
 - Auto-proceed past an undispositioned carried-open gap
 - Skip the strip-and-seal block before the Option 3 squash or the Option 1/2 push
-- Delete the telemetry record (`.pi/gauntlet/telemetry/**` or the configured `telemetry.dir`) on any path
+- Delete common-dir telemetry metadata or stage it into the product checkout
 
 **Always:**
 - Verify, or apply the Step 1 skip rule, before offering options

package/skills/finishing-a-development-branch/reference/verification-set.md

@@ -19,7 +19,7 @@ For ledger commands outside a checkout's configured test-command matcher, verify
 
 ## Skip proof
 
-**Skip rule.** Skip the run only when this set passed on a known clean commit in the verify phase of this session and no edit or write landed outside `<telemetry.dir>` since. Check the current tree: `git -C "$WORKTREE" diff --quiet <commit the run passed on> -- . ':!<telemetry.dir>'` must exit 0, and `git -C "$WORKTREE" status --porcelain --untracked-files=all -- . ':!<telemetry.dir>'` must exit 0 with empty output (`<telemetry.dir>` defaults to `.pi/gauntlet/telemetry`). These checks cover committed, staged, unstaged, and untracked changes outside telemetry. Otherwise run it once; a missing verified commit, a failed check, or uncertainty means run.
+**Skip rule.** Skip the run only when this set passed on a known clean commit in the verify phase of this session and no checkout edit or write landed since. Check the entire current tree: `git -C "$WORKTREE" diff --quiet <commit the run passed on> -- .` must exit 0, and `git -C "$WORKTREE" status --porcelain --untracked-files=all -- .` must exit 0 with empty output. Cover committed, staged, unstaged, and untracked changes without path exclusions; recorder metadata lives outside the working tree. Otherwise run it once; a missing verified commit, a failed check, or uncertainty means run.
 
 Apply the proof independently in each owning checkout. Post-squash verification is mandatory; the skip proof does not cover a changed primary tree.
 
@@ -31,4 +31,4 @@ For a fresh-session retry after a ledger was stripped, recover the committed pre
 
 ## Post-squash execution
 
-For Option 3, run each delivered leg's retained pairs in order as `(cd "<leg primary>" && <command>) > "$LOG_DIR/gate-<i>.log" 2>&1`, one command per pair, retaining its gate index and fail-fast exit reporting. For coordinated delivery, run only the just-squashed leg's pairs at that leg's delivery step; every remaining leg gets its own post-squash run when delivered. A failed-squash receipt retry runs those same pairs against the delivered primary, not the feature worktree, and never repeats the squash. Retain the Step 1 command set and execution form for non-ledger subjects.
+For Option 3, run each delivered leg's retained pairs in order as `(cd "<leg primary>" && <command>) > "$LOG_DIR/gate-<i>.log" 2>&1`, one command per pair; print `gate <i> exit <code> <log path>` after each and stop on the first failure. For coordinated delivery, run only the just-squashed leg's pairs at that leg's delivery step; every remaining leg gets its own post-squash run when delivered. A failed-squash receipt retry runs those same pairs against the delivered primary, not the feature worktree, and never repeats the squash. Retain the Step 1 command set and execution form for non-ledger subjects.

package/skills/gatekeep-pr/reference/batch.md

@@ -92,6 +92,8 @@ Show evidence only in-place from record/helper paths, then re-ask. Queue all oth
 
 Run parent cleanup/stop only after all children finish, never on a live child's tree. For cleanup apply cleanup guards and ordered overrides. Keep the PR and post rows in the roster, set cleanup_done, and re-render with cleanup gone. Cleanup does not retire.
 
-For non-final stop run `cleanup.md` `## Non-final stop` after all children finish. Under terminal overlays leave checkout as found and print leftover path/branch. Delete only that PR's record, helper outputs, and log_path files under existing teardown rules, then retire it. Await all next-batch results and re-render every nonretired PR; repeat until all retire.
+For non-final stop run `cleanup.md` `## Non-final stop` after all children finish. Under terminal overlays leave checkout as found and print leftover path/branch. Retain the PR's row from `post-selection-loop.md` `### Settlement rows` in the parent roster before deleting only that PR's record, helper outputs, and log_path files under existing teardown rules, then retire it. While any PR remains, start a retirement message with `gauntlet: retired #<N> - <reason>`, never `gauntlet: done` or `gauntlet: stuck`; keep private child result lines unchanged. Await all next-batch results and re-render every nonretired PR; repeat until all retire.
+
+After the last PR retires and every selected cleanup or follow-on step finishes, render one final message. Start the message with `gauntlet: stuck retired` when any retained outcome is `stuck - <reason>`, otherwise `gauntlet: done retired`. Print every retained PR row below it in roster order, including PRs retired in earlier rounds. Emit no per-PR terminal message before this set settlement.
 
 Initialize parent tracker tasks `pr-<N> state: <record path>`; mark in_progress on dispatch, complete on retirement, failed on unretried failure. Child trackers are session-local stages, not parent roster tasks. Use a plain checklist if plan_tracker is unavailable.

package/skills/gatekeep-pr/reference/cleanup.md

@@ -22,7 +22,7 @@ Consequence clause for the menu row (`decision-menu.md`): `remove <worktree.path
 
 Follow the [shared layout](../../brainstorming/reference/menu-layout.md).
 
-Start the message with `gauntlet: stuck` followed on that line by the reason: use the obstacle's `stuck - ` text as the reason, or `stopped at <template id>` for initial, assess-terminal, and contract-exception. On a failed reset/assertion use the actual error instead. Put cleanup results below that one first line.
+Finish the stop consequences below before the final message. Start the message with `gauntlet: stuck` followed on that line by the reason: use the obstacle's `stuck - ` text as the reason, or `stopped at <template id>` for initial, assess-terminal, and contract-exception. On a failed reset/assertion use the actual error instead. Print the PR row from `post-selection-loop.md` `### Settlement rows` with `stuck - <reason>` below the marker, then cleanup results. In set mode use `batch.md`'s per-PR retirement marker and retain the row for the final roster settlement.
 
 Enter here for `stop` on the initial, assess-terminal, obstacle, or contract-exception menu. On a `rebased locally` head, run `git -C <worktree.path> reset --hard <pre_head>` first; assert `HEAD == <pre_head>` and a clean tree. Stop on a failed assertion.
 

package/skills/gatekeep-pr/reference/post-selection-loop.md

@@ -195,9 +195,15 @@ On completion or timeout, refresh then run steps 2-5 of Re-render plus step 1's
 
 Before posting or committing any external payload - review bodies, replies, commit subjects, tracker comments - re-read it against SKILL.md `## Wording rules` and any `## comms style` rules: ASCII only; no headings or template scaffolding under ~150 words; findings `file:line`-specific where one exists; ends on the fix or asked action, not a recap; never invents content to fill a section. The `AC coverage` block is the one exception: it posts verbatim, heading and checkbox rows included.
 
+### Settlement rows
+
+Emit the terminal message only after every selected follow-on step finishes and the cleanup pick is answered (run or declined by stop); a report or menu is not settlement. Below its marker print one plain `#<N>@<head sha>: <outcome>[ (<ticket ref>)]` row per PR in roster order, singleton included. Use the full assessed `headRefOid`, not the merge commit or a shortened display SHA. Use the last gathered head when assessment could not start. Append the parenthetical only when the PR title or body's first line names a ticket under the overrides `## Issue tracker` `refs:` convention; otherwise omit it. Use exactly `approved`, `merged`, `closed-pr`, `final`, `merge-queued`, or `stuck - <reason>`, retaining the actual stop/error reason. Keep rows without bullets, code fences or emphasis; put checkout paths and cleanup results after them.
+
+For set mode, retain each row before deleting its PR record and follow `batch.md`'s retirement and final-settlement rules. Keep private child result lines unchanged.
+
 ### Teardown
 
-Start the message with `gauntlet: done approved` for stop on approved. Start the message with `gauntlet: done merged` for stop on own-merge. Start the message with `gauntlet: done closed-pr` for stop on closed-pr. Start the message with `gauntlet: done final` for stop on final. Start the message with `gauntlet: done merge-queued` for stop on merge-queued. Put the checkout path and local branch below the terminal line. A report Verdict above a menu is not a terminal. Start the message with `gauntlet: stuck` followed by the actual error on any hard assertion failure, including a delegated fix-wave restore/assert failure, and end with the actual error; do not render a continuation menu.
+Start the message with `gauntlet: done approved` for stop on approved. Start the message with `gauntlet: done merged` for stop on own-merge. Start the message with `gauntlet: done closed-pr` for stop on closed-pr. Start the message with `gauntlet: done final` for stop on final. Start the message with `gauntlet: done merge-queued` for stop on merge-queued. Print the row from `### Settlement rows`, then the checkout path and local branch. A report Verdict above a menu is not a terminal. Start the message with `gauntlet: stuck` followed by the actual error on any hard assertion failure, including a delegated fix-wave restore/assert failure; print the PR row with `stuck - <actual error>` below it and end with the actual error, without a continuation menu. In set mode use `batch.md`'s per-PR retirement marker until every PR retires.
 
 Delegate non-final stop (initial, assess terminal, obstacle, contract exception) to `cleanup.md` `## Non-final stop`. Keep terminal cleanup behind its own pick; terminal stop leaves the checkout as found and reports its path and local branch. Render cleanup only on terminal templates; never run cleanup steps 2-4 for a non-final stop.
 

package/skills/gauntlet-resume/reference/seed.md

@@ -13,12 +13,7 @@ Before starting the seed sequence, read the seed's header. A `**Home:**` header
    stop: `not tracked: <seed> - commit it first`. Line 1 of `<seed>` equal to
    `# CONTEXT DRAFT - NOT A SPEC - fully replaced at spec-writing` -> stop:
    `context draft, not a spec: <seed> - finish brainstorming`.
-3. **Not shipped.** Read `<primary>/<telemetry.dir>/<rel with .md -> .yaml>`
-   (`piGauntlet.telemetry.dir`, default `.pi/gauntlet/telemetry`). A `shipped_at:` or
-   `abandoned_at:` line carrying a value -> stop:
-   `spec already shipped at <ts> - write a superseding spec`. No record, or
-   `in_progress`: continue; the extension folds this run into the record on
-   `plan_check` pass.
+3. **Not shipped.** Resolve `piGauntlet.telemetry` from preset and primary project settings; `enabled: false` skips this check. Run `git -C <primary> rev-parse --git-common-dir`; resolve a relative result against `<primary>` and read `<git common dir>/gauntlet/telemetry/<rel with .md -> .yaml>`. When git resolution fails and `jj root` in `<primary>` succeeds, read `<jj root>/.jj/gauntlet/telemetry/<rel with .md -> .yaml>` instead. When the local record is absent, fetch `gauntlet/telemetry` from `telemetry.remote` (default `origin`) and read `<owner>/<repo>/brainstorming/<rel with .md -> .yaml>` from the fetched ref, using the last fetched ref on fetch failure. Degrade to the local-only check when no fetched ref is available, including jj-only workspaces. A valued `shipped_at:` or `abandoned_at:` stops: `spec already shipped at <ts> - write a superseding spec`. No record or `in_progress`: continue; let the extension bind on `plan_check` pass.
 4. **Name.** `<name>` = basename of `<rel>` minus `.md`, minus a leading `YYYY-MM-DD-`:
    `2026-09-17-gh-31-gauntlet-resume.md` -> `gh-31-gauntlet-resume`. Same shape as
    brainstorming's Filename Convention slug; wrappers receive it as `<name>`.

package/skills/shape-ticket/SKILL.md

@@ -112,7 +112,7 @@ See Roast below. Surface source-gap findings at step 8; never apply them by inve
 
 ### 8 - Confirmation gate
 
-Finish initial preparation and roasts for all eligible tickets before the first gate. Present only the current ticket in ref order: decline skips it; revision rechecks and re-presents its exact diff; approval completes step 9 before the next ticket prints. Never treat a reply as approval of an unseen ticket. Present stopped tickets' draft/report at their turn with no approval option; preserve a split's N-body subset-selection gate. End with one line per ref: `<ref>: written | closed | close failed (<operation>: <reason>) | close by hand | dropped | declined | stopped | no-op | unfetched` (use the drafted title for create).
+Finish initial preparation and roasts for all eligible tickets before the first gate. Present only the current ticket in ref order: decline skips it; revision rechecks and re-presents its exact diff; approval completes step 9 before the next ticket prints. Never treat a reply as approval of an unseen ticket. Present stopped tickets' draft/report at their turn with no approval option; preserve a split's N-body subset-selection gate. End with the settlement and per-ref rows from `reference/repo-audit.md` after the selected writes finish, including singleton creates.
 
 Present, per proposed issue:
 

package/skills/shape-ticket/reference/repo-audit.md

@@ -206,6 +206,6 @@ Stop on the first nonzero exit without retry or fallback body write. Report the
 
 Drop runs nothing and ends `<drafted title>: dropped`; create anyway files only the displayed premise-rewritten body with its contradiction in the premise report. Preserve headless stops and split subset selection.
 
-Apply a reply only to the current ticket: decline skips it; revision rechecks and re-presents it; approval runs step 9's re-fetch, comparison, and body-then-comment write before the next gate. Treat another ticket's reply as no approval for an unseen diff. Give stopped tickets a hard-stop report without an approval number. Retain the N-body subset-selection gate for a split within one ticket. On an ended run, start the message with one batch settlement line: `gauntlet: done <counters>`. Start the message with `gauntlet: stuck` followed on that line by the dynamic counters instead when any `close-failed`, `close-by-hand`, or `unfetched` count is nonzero. Emit nonzero counters only, comma-joined without spaces, in this fixed order: `written,closed,declined,dropped,no-op,stopped,unfetched,close-failed,close-by-hand`; format each as `<key>=<count>`. Start the message with `gauntlet: done written=1` for an ended singleton whose only outcome is one written ticket; use the same counters rule for every singleton, including `gauntlet: done stopped=1`. Count an integrity stop left without recovery values as `stopped`, not declined; human decline and drop are not failures. While a hard-stop recovery question remains active, emit `gauntlet: question` and no settlement line. Keep ended stopped items settled, without reopening questions or offering new writes.
+Apply a reply only to the current ticket: decline skips it; revision rechecks and re-presents it; approval runs step 9's re-fetch, comparison, and body-then-comment write before the next gate. Treat another ticket's reply as no approval for an unseen diff. Give stopped tickets a hard-stop report without an approval number. Retain the N-body subset-selection gate for a split within one ticket. On an ended run, after every selected write and follow-on step finishes, start the final message with one batch settlement line: `gauntlet: done <counters>`. Start the message with `gauntlet: stuck` followed on that line by the dynamic counters instead when any `close-failed`, `close-by-hand`, or `unfetched` count is nonzero. Emit nonzero counters only, comma-joined without spaces, in this fixed order: `written,closed,declined,dropped,no-op,stopped,unfetched,close-failed,close-by-hand`; format each as `<key>=<count>`. Start the message with `gauntlet: done written=1` for an ended singleton whose only outcome is one written ticket; use the same counters rule for every singleton, including `gauntlet: done stopped=1`. Count an integrity stop left without recovery values as `stopped`, not declined; human decline and drop are not failures. While a hard-stop recovery question remains active, emit `gauntlet: question` and no settlement line. Keep ended stopped items settled, without reopening questions or offering new writes.
 
-Preserve one line per ref below the settlement line: `<ref>: written | closed | close failed (<operation>: <reason>) | close by hand | dropped | declined | stopped | no-op | unfetched` (use the drafted title for create).
+Print one plain line per item below the settlement line, in roster order, including singletons: `<ref>: <outcome>`. Use the actual ref returned by the write for a successful create or enrichment; use the drafted title only for a dropped or declined create with no ticket. Keep the outcome exactly one of `written`, `closed`, `close failed (<operation>: <reason>)`, `close by hand`, `dropped`, `declined`, `stopped`, `no-op`, `unfetched`; put other explanations on separate lines. Render rows without bullets, code fences or emphasis.