tlc-claude-code 2.9.2 → 2.10.1

package/.claude/commands/tlc/build.md

@@ -106,14 +106,14 @@ process.stdout.write(JSON.stringify(result));" 2>/dev/null
 After `resolveRouting` returns, immediately write `.tlc/.build-routing-active` with the active provider name from `models[0]` before doing any other build work. Remove `.tlc/.build-routing-active` on completion, cancellation, or failure cleanup.
 
 **Routing decision:**
-- If routing says external provider (`models[0] !== 'claude'`), follow **ONLY Orchestrator Mode** below.
-- If routing says Claude (`models[0] === 'claude'`), follow **Inline Mode** below.
+- **ALWAYS use Orchestrator Mode.** Claude never writes code inline. The routing config determines which provider the orchestrator dispatches TO (codex, claude session, gemini), but Claude in this conversation is always the PM.
+- If the orchestrator is unreachable, auto-recover it (restart container, deploy latest code). If recovery fails, STOP — do not fall back to inline code.
 
-## ORCHESTRATOR MODE
+## ORCHESTRATOR MODE (ALWAYS)
 
-Use this mode only when `models[0]` is **NOT** `claude`.
+Claude is the **project manager**. Claude reads the plan, breaks tasks into small prompts, and dispatches each to the tlc-core orchestrator. Claude does NOT write code. This is not conditional on routing — it is always the mode.
 
-Claude is the **project manager**. Claude reads the plan, breaks tasks into small prompts, and dispatches each to the tlc-core orchestrator. Claude does NOT write code.
+The `models[0]` value from routing determines which provider the orchestrator uses (`codex`, `claude`, `gemini`), not whether Claude writes code inline.
 
 ### Step O1: Read the Plan
 
@@ -254,11 +254,9 @@ After PR is created (or phase completes):
 - Mark completed tasks `[x]` in PLAN.md
 - Report final summary
 
-## INLINE MODE
+## AGENT INSTRUCTIONS (Reference for Dispatched Sessions)
 
-Use this mode only when `models[0]` **IS** `claude`.
-
-The existing build instructions below are the Inline Mode instructions and should be followed unchanged.
+**These instructions are NOT for Claude in the main conversation.** They are the reference for what the dispatched orchestrator agent (Codex, Claude session, or Gemini) should do inside its tmux session. Claude packages these into the dispatch prompt — Claude does not execute them inline.
 
 ## Engineering Standards
 

package/.claude/commands/tlc/init.md

@@ -19,9 +19,62 @@ For brand new projects with no code, use `/tlc:new-project` instead.
 
 ## Process
 
-### 0. Upgrade Check (runs first, always)
+### 0. Orchestrator Enforcement (runs first, always)
 
-**Before anything else**, check if this is already a TLC project:
+**Before anything else**, verify the orchestrator is available. All code execution goes through it — no exceptions.
+
+```bash
+# Check orchestrator health
+if curl -sf --max-time 2 http://localhost:3100/health > /dev/null 2>&1; then
+  echo "Orchestrator: ✅ healthy"
+else
+  echo "Orchestrator: ❌ not running — attempting recovery..."
+  # Try to find and restart the orchestrator container
+  ORCH_CONTAINER=$(docker ps -a --format '{{.Names}}' 2>/dev/null | grep "orchestrator" | head -1)
+  if [ -n "$ORCH_CONTAINER" ]; then
+    docker start "$ORCH_CONTAINER" 2>/dev/null
+    sleep 3
+  fi
+  # If still down and tlc-core source exists, deploy and start
+  if ! curl -sf --max-time 2 http://localhost:3100/health > /dev/null 2>&1; then
+    if command -v tlc-core >/dev/null 2>&1; then
+      tlc-core start &
+      sleep 5
+    fi
+  fi
+  # Final check
+  if curl -sf --max-time 2 http://localhost:3100/health > /dev/null 2>&1; then
+    echo "Orchestrator: ✅ recovered"
+  else
+    echo "Orchestrator: ❌ FAILED — code execution will not work"
+    echo "Install tlc-core: git clone git@github.com:TwentyTwoLabs22/tlc-core.git && cd cli && npm i && npm link"
+    echo "Then run: tlc-core start"
+  fi
+fi
+```
+
+Also verify CodeDB and agent runner:
+
+```bash
+# CodeDB
+if ! curl -sf --max-time 1 http://localhost:7719/health > /dev/null 2>&1; then
+  if command -v codedb >/dev/null 2>&1; then
+    codedb serve . &
+    echo "CodeDB: ✅ started"
+  else
+    echo "CodeDB: ❌ not installed — run: npx tlc-claude-code"
+  fi
+fi
+
+# Agent runner container
+if ! docker ps --format '{{.Names}}' 2>/dev/null | grep -q "tlc-agent-runner"; then
+  docker start tlc-agent-runner 2>/dev/null && echo "Agent Runner: ✅ started" || echo "Agent Runner: ❌ not available"
+fi
+```
+
+### 0b. Upgrade Check
+
+**After orchestrator is verified**, check if this is already a TLC project:
 
 ```bash
 # Check for existing TLC markers

package/.claude/commands/tlc/quick.md

@@ -100,14 +100,12 @@ process.stdout.write(JSON.stringify(result));" 2>/dev/null
 After `resolveRouting` returns, immediately write `.tlc/.quick-routing-active` with the active provider name from `models[0]` before doing any other quick work. Remove `.tlc/.quick-routing-active` on completion, cancellation, or failure cleanup.
 
 **Routing decision:**
-- If routing says external provider (`models[0] !== 'claude'`), follow **ONLY ORCHESTRATOR MODE** below.
-- If routing says Claude (`models[0] === 'claude'`), follow **INLINE MODE** below.
+- **ALWAYS use Orchestrator Mode.** Claude never writes code inline. Routing determines which provider the orchestrator dispatches to.
+- If orchestrator is down, auto-recover. If recovery fails, STOP — do not fall back to inline.
 
-## ORCHESTRATOR MODE
+## ORCHESTRATOR MODE (ALWAYS)
 
-Use this mode only when `models[0]` is **NOT** `claude`.
-
-Claude does not execute the quick-task instructions inline in this path. Claude acts as the orchestrator for the routed provider run:
+Claude acts as the orchestrator — dispatches the quick task to the orchestrator, monitors completion, verifies result. Claude does NOT write code.
 
 1. Treat Claude as the orchestrator for a small, test-first routed task rather than executing the work inline.
 2. Gather the minimal project context needed for the quick task, then package a focused prompt with the task request, expected failing test, implementation scope, and verification target.
@@ -123,12 +121,9 @@ Claude does not execute the quick-task instructions inline in this path. Claude
    - If the provider returns incomplete code or missing tests, issue a targeted retry for the missing part.
 7. When finished, display the routed provider result, persist any captured memory, remove `.tlc/.quick-routing-active`, and stop. Do **not** execute Inline Mode afterward.
 
-## INLINE MODE
-
-Use this mode only when `models[0]` **IS** `claude`.
-
-The existing quick-task instructions below are the Inline Mode instructions and should be followed unchanged.
+## AGENT INSTRUCTIONS (Reference for Dispatched Sessions)
 
+**These instructions are NOT for Claude in the main conversation.** They are packaged into the dispatch prompt for the orchestrator agent.
 
 ## Engineering Standards
 

package/.claude/commands/tlc/recall.md

@@ -1,6 +1,6 @@
 # /tlc:recall - Team Memory Search
 
-Search TLC team memory using plain grep. This is intentional: no vector search, no extra services.
+Search TLC team memory through the context engine hybrid search pipeline. Use FTS5 plus vector search when the engine is available, and fall back to grep only when it is not.
 
 ## Usage
 
@@ -10,33 +10,58 @@ Search TLC team memory using plain grep. This is intentional: no vector search,
 
 ## What This Does
 
-1. Searches `.tlc/memory/team/` with `grep -rl "query" .tlc/memory/team/`.
-2. Looks in both `.tlc/memory/team/decisions/` and `.tlc/memory/team/gotchas/`.
-3. Shows the file path, date from the filename, and a matching excerpt.
-4. Uses grep only because it works everywhere.
+1. Opens `.tlc/context.sqlite` through `createContextEngine()`.
+2. Builds a search pipeline with `createSearchPipeline` from `@tlc/context-engine/search-pipeline`.
+3. Runs the context leg with the engine's hybrid FTS5 plus vector search.
+4. Searches TLC memory under `.tlc/memory/team/`.
+5. Falls back to recursive grep only when the context engine or database is unavailable.
 
 ## Search Rules
 
 - Search both `decisions/` and `gotchas/`.
-- Do not use vector search.
-- Do not depend on embeddings, databases, or external services.
-- Prefer simple recursive grep so the command works across projects.
+- Prefer context-engine hybrid search over grep.
+- Use vector ranking when embeddings are available; FTS5-only results are acceptable when vectors are missing.
+- Fall back to grep if `@tlc/context-engine` cannot be loaded or `.tlc/context.sqlite` does not exist yet.
 
 ## Process
 
-### Step 1: Find matching files
+### Step 1: Try the context engine
+
+```js
+import { createContextEngine } from '@tlc/context-engine';
+import { createSearch } from '@tlc/context-engine/retrieval/search';
+import { createSearchPipeline } from '@tlc/context-engine/search-pipeline';
+
+const engine = createContextEngine({ dbPath: '.tlc/context.sqlite' });
+const hybridSearch = createSearch({
+  embeddingStore: {
+    findSimilar(db, queryVec, options) {
+      return engine.embeddings.findSimilar(queryVec, options);
+    },
+  },
+});
+
+const searchAll = createSearchPipeline({
+  search: (db, query, options) => hybridSearch(db, query, options),
+});
+
+const results = await searchAll(engine.db, query, { limit: 10 });
+```
+
+### Step 2: If the engine is unavailable, fall back to grep
 
 ```bash
-grep -rl "query" .tlc/memory/team/
+grep -Ril "query" .tlc/memory/team/
 ```
 
-### Step 2: Display matches
+### Step 3: Display matches
 
 For each matching file, show:
 
 - File path
 - Date parsed from the filename prefix
 - A short matching excerpt from the file body
+- Search source: `context-engine` or `grep-fallback`
 
 ## Example Output
 
@@ -57,3 +82,4 @@ Excerpt: Local timezone conversion caused reporting drift in scheduled jobs.
 - If there are no matches, say so directly.
 - Keep excerpts short and relevant.
 - Search TLC memory under `.tlc/memory/team/`, not Claude-managed memory.
+- Close the context engine after the search when it was opened successfully.

package/.claude/commands/tlc/remember.md

@@ -17,31 +17,32 @@ Or without arguments:
 ## What This Does
 
 1. Captures the provided decision text, or extracts decisions from the recent conversation context if no argument is given.
-2. Writes a markdown file to `.tlc/memory/team/decisions/{date}-{slug}.md`.
-3. Stores TLC-owned frontmatter for later grep-based recall.
-4. Never writes to `~/.claude/projects/.../memory/` because that is Claude memory, not TLC memory.
+2. Appends a JSONL event to `.tlc/events/memory.jsonl` through the context engine event log.
+3. Replays the event into `.tlc/context.sqlite`.
+4. Exports visible `.md` memory files for git visibility under `.tlc/memory/team/decisions/`.
+5. Never writes to `~/.claude/projects/.../memory/` because that is Claude memory, not TLC memory.
 
 ## Write Format
 
-Write the decision as a markdown file with YAML frontmatter:
+Write the canonical record as a JSONL event first:
+
+```json
+{"type":"decision","category":"decision","scope":"team","subject":"use-utc-timestamps","body":"Always use UTC timestamps in the database and in exported logs."}
+```
+
+Then export the visible markdown file with YAML frontmatter:
 
 ```yaml
 ---
-provider: claude
-source: manual
 timestamp: 2026-03-28T12:34:56Z
 type: decision
 scope: team
+category: decision
+subject: "use-utc-timestamps"
 ---
 ```
 
-The filename must be:
-
-```text
-.tlc/memory/team/decisions/{date}-{slug}.md
-```
-
-Example:
+The markdown filename must be:
 
 ```text
 .tlc/memory/team/decisions/2026-03-28-use-utc-timestamps.md
@@ -53,19 +54,43 @@ Example:
 
 - Use the argument as the decision content.
 - Generate a short slug from the decision.
-- Write the file under `.tlc/memory/team/decisions/`.
+- Append the event with `engine.events.appendEvent('.tlc/events/memory.jsonl', event)`.
+- Replay the log into the database.
+- Export markdown back to `.tlc/memory/team/decisions/`.
 
 ### Without an argument
 
 - Review the recent conversation context.
 - Extract concrete decisions, conventions, or constraints worth preserving.
 - Summarize them clearly.
-- Write one decision file under `.tlc/memory/team/decisions/`.
+- Append one JSONL event.
+- Export one visible markdown file under `.tlc/memory/team/decisions/`.
+
+## Implementation Sketch
+
+```js
+import { createContextEngine } from '@tlc/context-engine';
+import { exportFactsToMarkdown } from '@tlc/context-engine/import/markdown-exporter';
+
+const engine = createContextEngine({ dbPath: '.tlc/context.sqlite' });
+const event = engine.events.appendEvent('.tlc/events/memory.jsonl', {
+  type: 'decision',
+  category: 'decision',
+  scope: 'team',
+  subject: slug,
+  body: decisionText,
+});
+
+engine.events.replayEvents([event]);
+exportFactsToMarkdown(engine.db, '.tlc/memory/team/decisions');
+engine.close();
+```
 
 ## Confirmation
 
 ```text
 Remembered: {summary}
+Event: .tlc/events/memory.jsonl
 File: .tlc/memory/team/decisions/2026-03-28-use-utc-timestamps.md
 ```
 
@@ -74,3 +99,4 @@ File: .tlc/memory/team/decisions/2026-03-28-use-utc-timestamps.md
 - Prefer concise, durable statements over raw transcript dumps.
 - Record decisions, not general chatter.
 - Use `.tlc/memory/team/gotchas/` for gotchas, not this command.
+- JSONL is the source of truth; markdown is the human-visible export.

package/.claude/commands/tlc/tlc.md

@@ -181,6 +181,31 @@ Only mention upgrade details in `--verbose` mode.
 
 ## One-Pass Detection
 
+### Step 0: Quick Health Check
+
+Before phase detection, run a fast health check (no auto-recovery — that's the SessionStart hook's job). Just report status in one line:
+
+```bash
+# Check key systems in parallel (each with 1s timeout)
+CODEDB=$(curl -sf --max-time 1 http://localhost:7719/health > /dev/null 2>&1 && echo "✅" || echo "❌")
+ORCH=$(curl -sf --max-time 1 http://localhost:3100/health > /dev/null 2>&1 && echo "✅" || echo "❌")
+RUNNER=$(docker ps --format '{{.Names}}' 2>/dev/null | grep -q "tlc-agent-runner" && echo "✅" || echo "❌")
+```
+
+Print one compact line:
+
+```
+Systems: CodeDB ${CODEDB} | Orchestrator ${ORCH} | Agent Runner ${RUNNER}
+```
+
+If any system is ❌, **auto-recover immediately** before continuing:
+
+1. CodeDB ❌ → run `codedb serve . &` (or `npx tlc-claude-code` if binary missing), wait 2s, re-check
+2. Orchestrator ❌ → find orchestrator container (`docker ps | grep orchestrator`), deploy latest code from `../tlc-core/orchestrator/`, restart container, wait 3s, re-check
+3. Agent Runner ❌ → `docker start tlc-agent-runner` if stopped, report if container doesn't exist
+
+After recovery attempts, print updated status. Only continue to phase detection after all recoverable systems are up. If recovery fails, print the failure and continue anyway — don't block indefinitely.
+
 ### Step 1: Load Core Context
 
 Read, in this order:
@@ -256,11 +281,22 @@ Backward compatibility:
 
 ## Output Format
 
-Normal output must stay within 3-5 lines.
+Normal output must stay compact — health line + phase status + action.
 
 Use this pattern:
 
 ```text
+Systems: CodeDB ✅ | Orchestrator ✅ | Agent Runner ✅
+TLC v{version} | Phase {PHASE_ID}: {Name} | {done}/{total} tasks done
+Next: {action summary}
+Running /tlc:{command} {PHASE_ID}...
+```
+
+If any system is down:
+
+```text
+Systems: CodeDB ✅ | Orchestrator ❌ | Agent Runner ✅
+⚠️  Orchestrator down — run /tlc:init to recover
 TLC v{version} | Phase {PHASE_ID}: {Name} | {done}/{total} tasks done
 Next: {action summary}
 Running /tlc:{command} {PHASE_ID}...
@@ -269,6 +305,7 @@ Running /tlc:{command} {PHASE_ID}...
 If there is nothing safe to auto-run:
 
 ```text
+Systems: CodeDB ✅ | Orchestrator ✅ | Agent Runner ✅
 TLC v{version} | All phases complete
 Next: release or start the next milestone
 Run /tlc:complete or /tlc:new-milestone
@@ -338,7 +375,8 @@ Run /tlc:complete or /tlc:new-milestone
 ## Example
 
 ```text
-TLC v2.4.2 | Phase TLC-8: Auth System | 3/5 tasks done
+Systems: CodeDB ✅ | Orchestrator ✅ | Agent Runner ✅
+TLC v2.9.2 | Phase TLC-8: Auth System | 3/5 tasks done
 Next: build task 4 (JWT middleware)
 Running /tlc:build TLC-8...
 ```

package/.claude/hooks/tlc-session-init.sh

@@ -26,8 +26,15 @@ if [ "$INSTALLED_VER" = "not-installed" ]; then
   echo "  TLC Package:     ❌ not installed (run: npm i -g tlc-claude-code)"
   ERRORS=$((ERRORS + 1))
 elif [ "$INSTALLED_VER" != "$LATEST_VER" ] && [ "$LATEST_VER" != "unknown" ]; then
-  echo "  TLC Package:     ⚠️  ${INSTALLED_VER} (latest: ${LATEST_VER}) — run: npm i -g tlc-claude-code"
-  WARNINGS=$((WARNINGS + 1))
+  echo "  TLC Package:     ⏳ ${INSTALLED_VER} → ${LATEST_VER} — auto-updating..."
+  npm i -g tlc-claude-code@latest > /dev/null 2>&1
+  NEW_VER=$(node -e "try{console.log(require('tlc-claude-code/package.json').version)}catch{console.log('?')}" 2>/dev/null)
+  if [ "$NEW_VER" = "$LATEST_VER" ]; then
+    echo "  TLC Package:     ✅ updated to v${NEW_VER}"
+  else
+    echo "  TLC Package:     ⚠️  update failed — still on v${INSTALLED_VER}"
+    WARNINGS=$((WARNINGS + 1))
+  fi
 else
   echo "  TLC Package:     ✅ v${INSTALLED_VER} (latest)"
 fi
@@ -37,6 +44,15 @@ mkdir -p "$PROJECT_DIR/.tlc/memory/team/decisions" \
          "$PROJECT_DIR/.tlc/memory/team/gotchas" \
          "$PROJECT_DIR/.tlc/memory/.local/sessions" 2>/dev/null
 
+# Bootstrap context engine on first run by importing visible markdown memory.
+CONTEXT_BOOTSTRAP=""
+if node -e "import('@tlc/context-engine/bootstrap').then(()=>process.exit(0)).catch(()=>process.exit(1))" >/dev/null 2>&1; then
+  CONTEXT_BOOTSTRAP="import('@tlc/context-engine').then(async ({ createContextEngine }) => { const { createBootstrap } = await import('@tlc/context-engine/bootstrap'); const { importMarkdownMemories } = await import('@tlc/context-engine/import/markdown-importer'); const { indexProject } = await import('@tlc/context-engine/retrieval/indexer'); const bootstrap = createBootstrap({ contextEngine: createContextEngine, markdownImporter: { importMarkdownMemories }, indexer: { indexProject } }); const result = await bootstrap(process.argv[1]); if ((result.imported || 0) > 0 || (result.indexed || 0) > 0) { console.log('  Context Engine:  ✅ bootstrapped (' + result.imported + ' imported, ' + result.indexed + ' indexed)'); } }).catch(() => {})"
+elif [ -d "$PROJECT_DIR/server/node_modules/@tlc/context-engine" ]; then
+  CONTEXT_BOOTSTRAP="(async () => { const [{ createContextEngine }, { createBootstrap }, { importMarkdownMemories }, { indexProject }] = await Promise.all([import('$PROJECT_DIR/server/node_modules/@tlc/context-engine/src/index.js'), import('$PROJECT_DIR/server/node_modules/@tlc/context-engine/src/bootstrap.js'), import('$PROJECT_DIR/server/node_modules/@tlc/context-engine/src/import/markdown-importer.js'), import('$PROJECT_DIR/server/node_modules/@tlc/context-engine/src/retrieval/indexer.js')]); const bootstrap = createBootstrap({ contextEngine: createContextEngine, markdownImporter: { importMarkdownMemories }, indexer: { indexProject } }); const result = await bootstrap(process.argv[1]); if ((result.imported || 0) > 0 || (result.indexed || 0) > 0) { console.log('  Context Engine:  ✅ bootstrapped (' + result.imported + ' imported, ' + result.indexed + ' indexed)'); } })().catch(() => {})"
+fi
+[ -n "$CONTEXT_BOOTSTRAP" ] && node -e "$CONTEXT_BOOTSTRAP" "$PROJECT_DIR" 2>/dev/null
+
 if curl -sf --max-time 1 "http://localhost:${TLC_PORT}/api/health" > /dev/null 2>&1; then
   echo "  TLC Server:      ✅ running (:${TLC_PORT})"
   # Drain spool
@@ -100,8 +116,20 @@ MCPEOF
     echo "  CodeDB MCP:      ✅ created .mcp.json"
   fi
 else
-  echo "  CodeDB:          ❌ not installed (run: npx tlc-claude-code)"
-  ERRORS=$((ERRORS + 1))
+  # Auto-install CodeDB binary
+  echo "  CodeDB:          ⏳ not installed — auto-installing..."
+  if npx -y tlc-claude-code 2>/dev/null | tail -1; then
+    if command -v codedb >/dev/null 2>&1; then
+      codedb serve "$PROJECT_DIR" > /dev/null 2>&1 &
+      echo "  CodeDB:          ✅ installed and started"
+    else
+      echo "  CodeDB:          ❌ install failed"
+      ERRORS=$((ERRORS + 1))
+    fi
+  else
+    echo "  CodeDB:          ❌ install failed"
+    ERRORS=$((ERRORS + 1))
+  fi
 fi
 
 # ─── 4. tlc-core Orchestrator + Containers ────────────────
@@ -125,17 +153,49 @@ elif curl -sf --max-time 2 "http://localhost:${TLC_CORE_PORT}/health" > /dev/nul
 
   # Check session monitor + watchdog
   ORCH_LOGS=$(docker logs tlc-core-orchestrator-1 --tail 50 2>&1)
+  MONITOR_OK=false
+  WATCHDOG_OK=false
   if echo "$ORCH_LOGS" | grep -q "Session monitor started"; then
+    MONITOR_OK=true
     echo "  Session Monitor: ✅ active (10s interval)"
-  else
-    echo "  Session Monitor: ❌ not running — orchestrator needs restart"
-    ERRORS=$((ERRORS + 1))
   fi
   if echo "$ORCH_LOGS" | grep -q "Watchdog started\|watchdog.*Started"; then
+    WATCHDOG_OK=true
     echo "  Watchdog:        ✅ active (60s interval)"
-  else
-    echo "  Watchdog:        ⚠️  not detected in logs"
-    WARNINGS=$((WARNINGS + 1))
+  fi
+
+  # Auto-recover: if monitor or watchdog missing, deploy latest code and restart
+  if [ "$MONITOR_OK" = false ] || [ "$WATCHDOG_OK" = false ]; then
+    echo "  Monitor/Watchdog: ⏳ missing — deploying latest code and restarting..."
+    # Find orchestrator source
+    ORCH_SRC=""
+    if [ -d "$PROJECT_DIR/../tlc-core/orchestrator" ]; then
+      ORCH_SRC="$PROJECT_DIR/../tlc-core/orchestrator"
+    elif [ -d "$(dirname "$PROJECT_DIR")/tlc-core/orchestrator" ]; then
+      ORCH_SRC="$(dirname "$PROJECT_DIR")/tlc-core/orchestrator"
+    fi
+    if [ -n "$ORCH_SRC" ]; then
+      ORCH_CONTAINER=$(docker ps --format '{{.Names}}' 2>/dev/null | grep "orchestrator" | head -1)
+      if [ -n "$ORCH_CONTAINER" ]; then
+        docker cp "$ORCH_SRC/lib/." "$ORCH_CONTAINER:/app/lib/" 2>/dev/null
+        docker cp "$ORCH_SRC/index.js" "$ORCH_CONTAINER:/app/index.js" 2>/dev/null
+        docker cp "$ORCH_SRC/migrations/." "$ORCH_CONTAINER:/app/migrations/" 2>/dev/null
+        docker restart "$ORCH_CONTAINER" > /dev/null 2>&1
+        sleep 3
+        if curl -sf --max-time 2 "http://localhost:${TLC_CORE_PORT}/health" > /dev/null 2>&1; then
+          echo "  Monitor/Watchdog: ✅ restarted with latest code"
+        else
+          echo "  Monitor/Watchdog: ❌ restart failed"
+          ERRORS=$((ERRORS + 1))
+        fi
+      else
+        echo "  Monitor/Watchdog: ❌ orchestrator container not found"
+        ERRORS=$((ERRORS + 1))
+      fi
+    else
+      [ "$MONITOR_OK" = false ] && echo "  Session Monitor: ❌ not running (tlc-core source not found)" && ERRORS=$((ERRORS + 1))
+      [ "$WATCHDOG_OK" = false ] && echo "  Watchdog:        ⚠️  not detected" && WARNINGS=$((WARNINGS + 1))
+    fi
   fi
 else
   if command -v tlc-core >/dev/null 2>&1; then
@@ -180,6 +240,14 @@ PROVIDER_LIST=$(echo "$PROVIDER_LIST" | sed 's/, $//')
 
 if [ "$PROVIDER_COUNT" -gt 0 ]; then
   echo "  LLM Providers:   ✅ ${PROVIDER_COUNT} available — ${PROVIDER_LIST}"
+  # Check for updates (non-blocking, just warn)
+  if [ "$CODEX_VER" != "not installed" ]; then
+    CODEX_LATEST=$(npm view @openai/codex version 2>/dev/null || echo "")
+    if [ -n "$CODEX_LATEST" ] && [ "$CODEX_VER" != *"$CODEX_LATEST"* ] 2>/dev/null; then
+      echo "  Codex Update:    ⚠️  latest: ${CODEX_LATEST} — run: npm i -g @openai/codex"
+      WARNINGS=$((WARNINGS + 1))
+    fi
+  fi
 else
   echo "  LLM Providers:   ❌ none found"
   ERRORS=$((ERRORS + 1))
@@ -209,6 +277,8 @@ cat > "$STATE_FILE" <<STATEEOF
 STATEEOF
 
 # ─── 6. Git + Remote Sync ────────────────────────────────
+# Fetch remote to get accurate ahead/behind counts
+git fetch --quiet 2>/dev/null
 CURRENT_BRANCH=$(git branch --show-current 2>/dev/null)
 BEHIND=$(git rev-list --count HEAD..@{u} 2>/dev/null || echo "?")
 AHEAD=$(git rev-list --count @{u}..HEAD 2>/dev/null || echo "?")
@@ -254,11 +324,16 @@ if [ -n "$WORKSPACE_FILE" ]; then
       const rp = path.resolve(wsRoot, repo.path);
       try {
         fs.accessSync(rp);
+        // Fetch remote for accurate state
+        try { execSync('git -C ' + JSON.stringify(rp) + ' fetch --quiet', { stdio: ['pipe','pipe','pipe'], timeout: 10000 }); } catch {}
         const branch = execSync('git -C ' + JSON.stringify(rp) + ' branch --show-current', { encoding: 'utf8', stdio: ['pipe','pipe','pipe'] }).trim();
         let status = 'unknown';
         try {
           const behind = execSync('git -C ' + JSON.stringify(rp) + ' rev-list --count HEAD..@{u}', { encoding: 'utf8', stdio: ['pipe','pipe','pipe'] }).trim();
-          status = behind === '0' ? 'in sync' : behind + ' behind';
+          const ahead = execSync('git -C ' + JSON.stringify(rp) + ' rev-list --count @{u}..HEAD', { encoding: 'utf8', stdio: ['pipe','pipe','pipe'] }).trim();
+          if (behind === '0' && ahead === '0') status = 'in sync';
+          else if (behind !== '0') status = behind + ' behind — needs pull';
+          else status = ahead + ' ahead — push pending';
         } catch { status = 'no remote tracking'; }
         console.log('    [' + repo.prefix + '] ' + branch + ': ' + status);
       } catch {

package/CLAUDE.md

@@ -10,6 +10,7 @@
 4. **No direct implementation.** User says "build X" → run `/tlc:progress` then `/tlc:build`.
 5. **No Co-Authored-By in commits.** The user is the author. Claude is a tool.
 6. **Ask before `git push`.** Never push without explicit approval.
+7. **Claude NEVER writes code.** All code execution goes through the orchestrator (tlc-core :3100). Claude is PM — read, plan, dispatch, review. Sub-agents writing code is a bug. If the orchestrator is down, recover it first — never fall back to inline code.
 
 ## CodeDB
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tlc-claude-code",
-  "version": "2.9.2",
+  "version": "2.10.1",
   "description": "TLC - Test Led Coding for Claude Code",
   "bin": {
     "tlc-claude-code": "./bin/install.js",