git:20261029.ed49b76 to git:20261030.75d93d5

- standing: monitoring other sessions and moving them along; a **mode, not an operation**. Cockpit contract:

- `coordinator/docs/wiki/cross-repo-communication/gem-cockpit-contract.md`.

- **THIS BODY IS A SNAPSHOT, FROZEN WHEN YOU ENTERED, CARRYING NO VERSION.** Before citing it as

- authority for anything MECHANICAL (a signature, module path, flag, refusal vocabulary), read that

- passage from disk.

- **Dispatch authorization — invoking this skill IS the request, for three specific dispatches

- only:** the approvability judge (§ Delegated approve-for-execution, step 4),

- `coordinator:group-em-assistant` at entry, and § Fleet inbox grind's saved

- `fleet-inbox-blitz` workflow with the assistants it raises. Each covers raising that named role or

- firing that named script under this session's own authority and nothing else, by unnamed

- `Agent`-tool dispatch or the `Workflow` tool. **None of them touches the peer-session send

- mechanism (§ Send pass, `gem-14`), which stays gated per send; the one exempt send is § Box-wide

- notice.**

- **Typing `/group-em` fires entry.** `hooks/scripts/group-em-autofire.py` runs the entry op ahead of

- your turn and injects standing, roster, digest and baseline. **If that context is absent, entry did

- not happen** — the hook fails open. Run `<plugin-root>/bin/group-em-enter.py --repo <root>

- --session-id <your sid>` and find out why. **`--session-id` is not optional**; without it the op

- refuses (exit 2). (Every `<plugin-root>/bin/` CLI here is plugin-local — resolve per

- `${CLAUDE_PLUGIN_ROOT}/snippets/resolve-coordinator-bin.md`, never cwd-relative.)

-

- **Exit 5 means a refused standing** — a live or unaccounted-for incumbent holds the role;

- `roster`/`digest`/`baseline`/`teammates` are absent from the payload. **Exit 2: no resolvable

- session id.** Payload shape: `coordinator_core/ops/group_em_enter.py`'s module docstring.

-

- Do not import `read_pass` / `send_pass` directly. They are the op's collaborators.

-

- **Last writer wins.** The most recent invoker holds the role; entry never refuses over an incumbent (no override flag); re-entry by the holder is a refresh.

-

- ### Owed sends, all exempt from § Send pass's gates

-

- **A displaced holder that is still running is OWED a message this turn.** `displaced_holder` and

- `displaced_holder_live` arrive in the entry context; not live means nobody to tell.

-

- **The owed message also tells it to release its watch:** TaskStop its watch shell, confirm the

- subprocess is gone, and never re-arm under the lost role.

-

- **INTRODUCE YOURSELF TO EVERY LIVE SESSION ON THE BOX, ONCE** — § Box-wide notice computes the

- recipients and the text. Skip only a `PAUSED:away` peer, and re-resolve each addressee immediately

- before sending (§ Send pass step 4).

-

- 1. **Say four things and stop:** who you are (name and session id); that you hold the Group EM

- standing for this repo; what to route to you; and **that no reply is wanted**, stated

- explicitly.

- 2. **Never ask peers to route their PM reports through you.** "The PM is typing into that session"

- is unobservable from here; key it to something CHECKABLE, such as **a session answering a

- question just asked in this exchange**.

- 3. **It asks nothing.** No question mark anywhere.

- 4. **It arms no cooldown and is not an offer.** Only `build_send_digest` emitting an entry arms a

- peer's throttle.

- 5. **Once per PEER, not once per wake, tracked by session id AND name**; on ambiguity

- re-introduce. `_record_introduction` in `coordinator/bin/group-em-box-notice.py` makes the set

- durable in the send log

- (`.coordinator-local/subagent-share/<this-session-id>/group-em-send-log.jsonl`).

- **Every live named session, in any repo, is told when the standing begins and when it ends.**

- `group-em-autofire.py` cannot send, so it prints `BOX NOTICE OWED` in the entry context: one text

- and the exact recipient list (from `claude agents --json`; you, `PAUSED:away` and

- already-introduced peers excluded). **Send that text to each, this turn.** It follows the

- introduction rules above. The displaced holder's owed message is separate and still owed.

-

- **Before this session ends, run `<plugin-root>/bin/group-em-box-notice.py --kind ended --repo

- <root> --session-id <your sid>`.** It stands the nomination down (holder-matched; a refusal empties

- the recipient list) and prints the no-Group-EM text and recipients. Send it; no `SessionEnd` hook

- can. Tripwire:

- `A-GROUP-EM-STANDING-THE-BOX-WAS-NEVER-TOLD-ABOUT`.

- MANDATORY.** **Raise the pair yourself, from this session**: a watcher belongs to whoever raised

- it.

-

- **"Entry" here means you, on entering the mode — not the entry op:** `group-em-enter.py` dispatches

- nobody and nothing re-runs entry. In this order, as your first act:

- tails, baton claimants, what landed on a path since a SHA, **park-spool triage**, and

- read-and-report asks. It arms nothing and holds no timer. Full remit:

- **DISPATCH `group-em-assistant` WITHOUT A `name`:** a named `Agent` call spawns an in-process teammate, and a

- teammate is never re-invoked by a `Monitor` it armed. Unnamed, it wakes on your `SendMessage`. Tripwire:

- 2. **The watch and its background run — yours, launched from this main conversation.** A subagent

- cannot hold the watch: it missed 4 of 4 expiries. Arm it by running, through the Bash tool with

- `run_in_background: true`:

- The run's completion is the wake. Its wire is filtering `PARKED|WAITING|GONE|POLL-ERROR`, the only lines

- it prints (drop nothing it matches: A-TURN-ENDED-IS-THE-WAKE-NOT-NOISE), then exits 0; any failure

- exit also completes it. After acting, read the fleet (`--status`) for anything that moved, then

- relaunch the same command. Never wrap it in a `Monitor`.

- **`--group-em-session-id` is passed explicitly, never defaulted** — a separate id from

- `--caller-session-id`. The watch emits one line per peer entering a parked state (per

- `read_pass.classify_peer`), silent while that peer's cooldown is armed. The `--until-event` run

- never refuses. Never hand-edit the record.

- `--status` answers "is a watch alive here?" (0 alive, 1 not running, 2 unknown — never green); `--once` fires a single poll.

- 3. **Events wake you; no cron tick exists.** Your wakes are: the background watch run's

- completion; peer `SendMessage`s; `notify_when_idle` one-shots; and

- the **memory governor**. Run `python -u <plugin-root>/bin/group-em-memory-governor.py`, stdout

- to `<home>/scratch/governor.log`, once, detached; the wake is a

- second background run, `<plugin-root>/bin/group-em-memory-governor-wait.py <that log>`, which

- exits on the first new line. Relaunch only the waiter; never filter its line, never wrap either in

- a `Monitor`. On a PAUSED line, tell its owner. `WARN` and swap-out hold nothing; send no hold/clear messages. Admit a heavy command when peak + min(25% of peak, 8 GiB) <= kernel-available AND commit + peak <= commit limit:

- `<plugin-root>/bin/box-memory-snapshot.py --admit-peak <GiB>` (HOLD is exit 4); floor 2.5 GiB; launch via `box-launch-windowless.py`. Guards self-detach (exit 5: run its fix). Also on demand:

- fire `schtasks /Run /TN BoxCacheTrim` if installed (`install-box-cache-trim-task.py --check` exits 0), else `trim-file-cache` (PM-run, elevated; `GOVERNOR CACHE-TRIM-HINT` prints it),

- `box-memory-trim-ws`, `box-memory-tree`, `box-memory-wait-pid`. Copies: queued `robocopy /J`. Tripwire:

- **You sequence box capacity.** Contended work (test suites, builds, reindexes, UE

- editor/cook runs, large workflows, memory-heavy agents) and any queue where peers take

- turns (a suite mutex, a shared-tree merge, a publish) is yours to order: peers ask for a

- slot; you release them in order as headroom allows. **Cap what agents run,

- not how many agents run:** GO terms name the command classes (unscoped vitest and watch

- modes, `tsc` beyond one per session, builds, `pnpm -r`, long-lived shells) and **never** a

- workflow's width, concurrent rows or agent count. Tripwire: `A-BOX-CAP-COUNTS-COMMANDS-NOT-AGENTS`.

- A slot is occupied only by a live PID: a "build running" report names the PID, and you confirm

- it is alive before holding anyone back. Tripwire: `A-RUNNING-CLAIM-CARRIES-A-LIVE-PID`.

- **A deploy slot names its commit set, never `HEAD`:** before the GO, list

- `<live-sha>..<target-sha>`; rule on others' commits in that range from a release note.

- Tripwire: `A-DEPLOY-THAT-BUILDS-FROM-DISK-SHIPS-PEERS-UNCOMMITTED-EDITS`.

- A deploy or respawn GO for a commit-served target also states the suite plus an

- import-and-boot smoke run against a clean `git archive` export of the target commit, never the

- working tree, beside the commit range. Tripwire:

- `A-DEPLOY-GO-ON-A-TREE-SUITE-SHIPS-A-COMMIT-THE-SUITE-NEVER-SAW`.

- **A prod-migrate GO names every migration the command applies:** list

- `<ledger-tail>..<pending-head>`, and check a constraint-replacing migration against the

- deployed revision's writers. Tripwire: `A-PROD-MIGRATE-GO-NAMES-LESS-THAN-THE-COMMAND-APPLIES`.

- **An install rewriting live plugin/config state needs your GO:**

- release, a publish, a ruling, a doctrine-adjacent call) lands on you and is decided by you, under

- the PM's delegation. "Publish", "release" and "merge" in the global external-facing list name what

- is gated, not who holds the gate. Never hand one to the PM, even bundled with another PM act. A

- direction call you cannot make goes to the APM. The PM gets only an act that needs the human's own

- hands, such as an interactive login, stated as the act (`! firebase login --reauth`). A guard

- that denies an EM commit is a guard defect: take the exact denial from the EM, route it to the guard's owner, never work around it.

- - Confirm the subprocess started rather than trusting its silence.

- - **Arm within the entry lease:** an entry that never arms is a crown with no watch.

- - **Verify with a nameable background task id plus `--status`** fresh, `tick_source: cron`,

- `subscribed_peers` above zero (ALIVE alone is not).

- - Use `$COORDINATOR_SETTINGS_HOME/bin/group-em-watch` (`.exe` on Windows), never an engine import.

-

- Mechanics: `group-em-assistant-remit.md` § Arming the watch.

-

- ### The wires

-

- The watch run is yours (`A-MONITOR-ARMED-BY-A-TEAMMATE-WAKES-NOBODY`). `notify_when_idle` is

- main-conversation only, once per peer. The park spool is `group-em-assistant`'s surface: ask it

- first; it never nudges. Worked case: wiki `group-em-entry-teammates.md`.

-

- verdict.** `idle` means unknown, never quiet. Tripwire: `LISTAGENTS-BUSY-IS-A-BANNED-LIVENESS-INPUT`.

-

- **Sanctioned, exhaustively: the oracle's verdict, and `last_tick_at` age in

- `state/group-em-watch.json`**, compared against the record's own `next_expected_by`. Process-table

- checks and resource-usage proxies (CPU, memory, I/O) are banned. Rationale:

- `coordinator/docs/wiki/dispatching-parallel-agents/group-em-standing/group-em-assistant-remit.md` § Liveness.

-

- A PM-reported dead watcher is confirmed by `last_tick_at` age, never the session list.

- **Each wake records a DECLINATION for every roster entry it does not message** — which gate failed

- and why — **and STAMPS them to disk** via the engine's `coordinator_core/group_em/watch_heartbeat.py

- :: stamp`, not this skill's local `watch_heartbeat.stamp` (the signatures differ). Argument rules:

- `coordinator/docs/wiki/dispatching-parallel-agents/group-em-standing/group-em-assistant-remit.md` § Stamping the heartbeat.

-

- **The wake has a producer; you arm nothing for it.** `state/group-em-watch-spool.jsonl` gets one

- record per park, appended by every session's own `Stop`

- (`coordinator/hooks/scripts/group-em-park-spool.py`), retained at least 30 minutes.

-

- **What the watch is FOR:** sessions asking permission for EM-autonomous acts they already

- recommended; break-class defects handed up as "worth your eye"; a session idling on a peer repo

- while holding a repo-agnostic fallback. **Not** finding sessions something to do.

- You own four of five steps; **step 4's clear is the PM's act**.

-

- 1. **Drive to execute.** A reviewed plan sitting on execution authorization is yours to release.

- 2. **Drive to workstream-complete.** Toward the close, not merely away from idleness.

- 3. **Troubleshoot alongside them until the primary exit criterion is met**, inside the

- no-authoring boundary.

- 4. **When the ceremony completes, the PM clears them.** Only a successfully completed ceremony

- establishes out-of-work — a peer's own "I'm done" does not. `/clear` is a human act. A session

- here is **done and awaiting clear**, never your failure — say so plainly.

- 5. **Assign something new from the daily priority set.** PM-owned and per-day; ask for it.

-

- **No step here is discharged by an artifact, and your own report cannot show the gap.** Tripwire: `A-SELF-REPORTED-CLOSE-IS-NOT-A-COMPLETED-CEREMONY`.

-

- ## Persistence, Driver frame, stale reads

-

- Nothing is written on invoke or cleaned up on exit; no peer roster or reachability fact is

- persisted. Two carve-outs: the send log (`build_send_digest` appends to

- `.coordinator-local/subagent-share/<this-session-id>/group-em-send-log.jsonl`, session-scoped, so

- a new Group EM starts with an empty cooldown), and the engine's box holder record: relaying the

- PM's word (`[PM via G-EM <name> <sid8> <ISO>]`, record first) and clearing a needs-PM flag

- (`gem-triage-turn-intent`); contract page §§ 2–4. Tripwire: `A-PM-VIA-G-EM-RELAY-QUOTES-AND-POINTS`.

-

- A `/group-em` session **is** that repo's Driver while it runs; build no registry.

-

- Peer state is re-read immediately before acting on it, and **never** by calling the entry op a

- second time inside one wake (§ Send pass step 1).

-

- ## Gating granularity — entry AND per send

-

- **Entry stays PM-gated** by this file's prefix convention. **The send is gated separately, per

- send:** the `ask-before-external-action` question lives there, justified by **cost to the

- receiver**, never the sender's convenience.

-

- ### Standing check

-

- **Confirm this session still holds the nomination**: `<plugin-root>/bin/group-em-nomination.py who

- --repo <root> --json` (read-only). Never re-run `group-em-enter.py` to answer this — it re-claims

- and re-arms the send digest's cooldowns.

-

- ## Read pass (gem-13)

-

- The enumerate-and-classify ladder lives in `read_pass.py` beside this file (module docstring),

- invoked through § Entry's op: `build_roster(repo_root)` for the classified population,

- `build_candidate_roster(repo_root)` for the paused-only shortlist.

-

- ## Send pass (gem-14)

-

- `send_pass.py` turns `build_roster`'s **full** population into **one digest per invocation**

- (`build_send_digest`). It selects and throttles; **it does not send.**

- **`roster` IS NOT THE POPULATION — it is the shortlist**, `build_candidate_roster`'s output.

- `undischarged_obligations: None` means no ledger exists, never that the peer owes nothing.

-

- **Compare `roster_considered` (entry's top-level enumerated count) against the room, never

- `len(roster)`.** A `roster_considered` smaller than the sessions you know are running is

- `unknown`, never quiet. Worked case:

- `coordinator/docs/wiki/dispatching-parallel-agents/group-em-standing/group-em-assistant-remit.md` § The roster is not the population.

-

- Two settling reads: `claude agents --json`, and `python3 -m coordinator_core.group_em.idle_report

- --repo-root <root> --group-em-session-id <your sid>` (omitting the id degrades offer-log

- suppression silently).

- **Ledger rows can arrive from the engine plane** via

- `state/subagent-share/<sid>/obligations-inbound.jsonl`; this plane is the ledger's sole writer. Contract:

- `coordinator/docs/wiki/cross-repo-communication/obligations-inbound-intake.md`. Tripwire:

- `A-SECOND-WRITER-TO-A-REWRITTEN-FILE-LOSES-ROWS-SILENTLY`.

- **Procedure, per invocation:**

- 1. § Entry's op already built both plus a `baseline` delta. **Act on that payload — never re-run

- the entry op to refresh it**; `build_send_digest` arms cooldowns as it emits.

- 2. Present it (`suppressed`: peer held; `truncated`: re-evaluated next wake; `unrecorded`:

- cooldown write failed).

- 3. **Per entry you intend to message, declare both gates in prose before sending:**

- - **GATE 1 (owner live?).** Owner live on the box → `SendMessage`; a memo only for an owner

- with no live session, or as its record.

- - **GATE 2 (receiver).** Cheaper to them now than later? It has no instrument; it rests on what

- you know about that peer.

- - **Either gate unclear → `SendMessage`.**

- 4. **Re-resolve the address from the SESSION ID just before sending, and treat a refusal as

- a refusal.** The engine's `coordinator_core.group_em.send_pass.resolve_addressee(repo_root,

- peer_session_id)` returns the name that session

- answers to now, or `None` — do not send on `None`. **`repo_root` is the PEER's repo, not

- yours:** the roster it reads is scoped to that root, so a peer in another repo resolves `None`

- against yours.

- Resolve from the id, never validate the name. Tripwire: `A-PEER-NAME-IS-NOT-A-STABLE-ADDRESS`.

- **Never loop over `entries` sending.**

- **A `PAUSED:away` peer is never offered**, reported as `never-send-reason`. Tripwire:

- `A-PAUSED-ROSTER-IS-NOT-A-NUDGE-LIST`.

- **A session's claimed PM item is wrong 19 times in 20** (the PM's prior). Test it.

- - **"Next: review."** The next step of a procedure the session owns. Push it; never grant a

- permission it holds.

- - **"This is irreversible."** Only a publish to a server the fleet does not own is; push a local write back as the session's own (`A-LOCAL-WRITE-IS-RECOVERABLE-ONLY-PUBLISHING-IS-IRREVERSIBLE`).

- **Answer engineering calls yourself**, or dispatch `coordinator:staff-eng` for a viability read.

- Route scope and direction to the APM. Pass the PM only what survives this screen, in plain words: what happens, to which server, why it cannot be undone. No routine unblock survives it; steer by win rate, not hygiene (`coordinator/docs/wiki/dispatching-parallel-agents/group-em-standing/group-em-escalation-threshold.md`).

- offer or conditional; one clause of reason.

-

- Never push a peer past a gate its own skill names — a gate is a considered refusal with a named

- reason; hesitation is the absence of one.

- The PM has delegated this call. **Do not read the plan into your own context.** Dispatch

- `coordinator:staff-eng` for a viability read. Where a plan needs the formal

- `execution_authorized_by` stamp, § Delegated approve-for-execution is the only path; this lighter

- call is for work that does not need that stamp.

- The Group EM may take the PM's execute-plan turn on one condition: the plan is

- reversibility-eligible and a rubric-scored judgment against its own prime exit criterion clears a

- locked threshold (8 of 8, no dimension scoring 0).

- 1. **Standing check** (§ Standing check).

- 2. Run `<plugin-root>/bin/plan-reversibility-eligibility.py <plan-path> --json` (C9). `eligible:

- false` → escalate per the threshold page's shape, stop, do not dispatch. This CLI is the single

- source of truth.

- 3. Confirm the plan's falsifier baseline shows the prime exit criterion false **and that a blinded

- `coordinator:exit-criterion-falsifier` authored it**:

- - **Content.** Absent or already true → escalate, stop.

- - **Provenance.** A self-authored baseline voids the guarantee. Provenance lives in the plan BODY, a prior

- `state/review-trail/approvability/` record, or this session's own dispatch of the falsifier;

- if none establishes it, treat it as a missing baseline and dispatch.

- - **Instrument soundness.** A FALSE baseline proves the criterion false, never the instrument

- sound. Ask: **what would have to be true for this to print TRUE, and is any of it reachable in

- the world the fixture builds?** Unreachable → escalate, reason named.

- Tripwires: `A-SELF-AUTHORED-FALSIFIER-SATISFIES-THE-CHECK-AND-VOIDS-IT`,

- `A-FALSE-BASELINE-PROVES-THE-CRITERION-FALSE-NOT-THE-INSTRUMENT-SOUND`,

- `UNATTRIBUTED-HARNESS-LINE-IS-NOT-PM`.

- 4. Dispatch the named Opus persona (the PM's chosen reviewer, at the PM's chosen effort) with the

- plan path and the rubric (`coordinator/schemas/plan-approvability-rubric.json`) and nothing else.

- Authorship blinding is a hard constraint.

- 5. Write the judgment record (`state/review-trail/approvability/<YYYY-MM-DD>-<plan-slug>.json`) and

- validate it with C9's `--validate-record` before treating it as final.

- 6. On `approve`: first refuse if `execution_authorized_by` is already present with any value — a

- plan the PM already authorized needs no delegated approval. Otherwise `review-exec-auth-stamp

- stamp <plan-path> --by "GROUP-EM:<session-id>" --append-note "<record-path>"`. On `escalate`,

- emit per the threshold page's shape — do not stamp.

- 7. **Standing offer:** when a plan's terminal evidence is a live act rather than a test run, offer

- to perform it as the Group EM and let the author verify. Where the separation is not free, say so and let it go. Tripwire:

- `THE-AUTHOR-OF-A-CRITERION-IS-THE-WORST-PRODUCER-OF-ITS-EVIDENCE`.

- Workflow({scriptPath: "<plugin-root>/workflows/fleet-inbox-blitz.mjs", args: {repos: [...], gem: {...}}})

-

- Fire it first after arming the watch, unattended. `repos` is the fleet map (`machine-local get

- repos.*`, repos with `state/cross-repo/inbox`). **Do not hand-author a variant.** Save each

- returned manifest to `<home>/state/inbox-blitz-<date>/<repo>.json` and memo each to that repo's EM

- by path, who applies and commits it. Tripwires: `A-GROUP-EM-HAND-AUTHORING-THE-INBOX-WORKFLOW`,

- `A-GROUP-EM-SENDS-MEMOS-AND-NEVER-RECEIVES-THEM`.

- **With the standing and `coordinator.feature.gem_cross_repo_commit` on, commit in any

- fleet repo without PM assent:** scoped commits, no destructive git ops, never leave a sibling red,

- memo engine work. Off: ask that repo's EM in its own session (same `--plugin-dir`), else memo. Tripwires: `GEM-CROSS-REPO-COMMIT-IS-A-BOX-SETTING`,

- **Doctrine is yours to change either way; no fleet fan-out:**

- `GEM-MAY-CHANGE-DOCTRINE`.

- - **Mandating that the watcher EXISTS is not mandating that it sends unattended.** A nudge on an observed registry

- transition is preserved; a tick that messages everyone it can see is forbidden, and a timing

- predicate re-derives `runtime-tripwire-stop-watcher.py` (681 fires / 26 days / ~99.4% wrong) one level down. The ban is on

- AUTOMATION: a holder re-deriving and judging the roster each turn is preserved.

- - **The three dispatch grants cover only their own named dispatch.** Messaging **peer sessions**

- stays an `ask-before-external-action` question no grant dissolves.

- - `/autonomous` is a naming precedent only; its `/tmp` sentinel is not borrowed.