fix(pstack): align delegated task lifecycle with T3

CHANGES.md

@@ -2,6 +2,16 @@
 
 This file is the release changelog, with one `## <version> - <title>` entry per release, newest first. The Cursor-to-T3 rewrite rules live in [`tools/substitutions.json`](tools/substitutions.json), and the [sync boundary](CONTRIBUTING.md#the-sync-boundary) in `CONTRIBUTING.md` defines how a change to upstream's skill content is declared.
 
+## Unreleased - keep delegated work in T3 child tasks
+
+Independent review rounds now use fresh `delegate_task` calls with the original brief, prior findings, responses, and unresolved objections. Each round keeps its own retry-stable `clientRequestId` and returned `taskId`. The costly-state exception still permits `t3_thread_send` for work that needs the same child's conversation, but it cannot continue an independent review round.
+
+Autopilot-full owners are delegated children, and orchestrate manages their lifecycle through `delegate_task`, `task_status`, and `task_cancel`. Ordinary top-level conversations require an explicit user request. Writing children use T3's `isolation: "worktree"` from the parent's local commit, with project setup and without uncommitted edits. The substitutions and existing declared forks carry these rules. Regression tests read the distributed skills through the existing CI test job. All three upstream pins remain at `4ec7ffa`.
+
+Verifiers resolve the committed branch or PR head to an exact SHA before dispatch. The parent keeps its checkout. After T3 creates the isolated worktree and runs setup at the parent's commit, the verifier checks out the target SHA detached inside its assigned worktree, confirms HEAD, and reruns setup as needed before behavioral verification. A Git fixture executes the distributed recipe with the PR branch held by an active owner and the parent on main.
+
+This contributor patch leaves the release number unchanged. Include it in the next maintainer release so installed copies receive the fix.
+
 ## 2.0.0-rc.18 - Lauren's `4ec7ffa`: statechart stops on inputs it used to chart wrong without saying so
 
 t3-pstack moves to Lauren Tan's pstack at cursor/plugins `4ec7ffa` for all three components. Only pstack changed upstream, only in the `statechart` skill, and its version stays at 0.15.30 ([pstack #776](https://github.com/cursor/plugins/pull/776) and [pstack #779](https://github.com/cursor/plugins/pull/779)). Before this, a run could draw a wrong chart or exit with the wrong code and not say so. The label map now stops on a variable or field that the `--fixed` or `--against` model lacks, where it used to give it the current model's start value. New `--config`, `--fixed-config`, and `--against-config` flags name each model's config. The agreed spec is never checked with the code model's config, and a missing config stops the run and lists the configs beside the spec. A rule the agreed config does not check reads "not checked" in the stories, where they used to say the agreed spec keeps it. When TLC finds a broken rule and then throws a Java exception, the run keeps the paths TLC printed, marks the rule broken, and warns that the charts can miss states. On a file system that cannot rename into the output folder (`ENOSYS`, `EXDEV`, or `EISDIR`, as on FUSE mounts), it copies the files into place. TLC checks each rule with one worker per CPU and checks a broken rule again with one worker, which gives the shortest paths. Each `PROPERTY` gets its own TLC run, `--expect-broken` accepts it, and a rule listed as both `INVARIANT` and `PROPERTY` is checked once. With `--against`, each story says whether a config beside the agreed spec expects the bug. With `--fixed` or `--against`, the run lists each condition of an action that no `\* file:line` comment ties to code. `SKILL.md` asks for those citations, says what a valid replay is, and asks the hand-off to say whether the spec already lists each bug. The test of each TLC run's temp folder accepts `Naturals.tla` anywhere under it, where TLC 1.8.0 puts it. #779 changes no behavior. It deletes script comments that repeat the code, and renames helpers so the name says what the comment did. `splitComments` becomes `splitCommentsKeepingOffsets`, `checkTlcOutput` becomes `tlcOutputWarning`, `quote` becomes `escapeMermaidQuotes`, and `luminance` becomes `wcagRelativeLuminance`, and one `PRIMES_OR_UNCHANGED` regex replaces two copies. `bun tools/sync.mjs` updated `SKILL.md`, `lib.mjs`, `statechart.mjs`, `tlc-to-chart.mjs`, and the test file cleanly, and each is byte-identical to upstream. No substitution, fork, or hook changed, and the 15 declared forks are untouched. At `7698375`, with TLC 1.7.4 on Linux and Node 20, 66 of the 67 skill tests pass and the PID-namespace test skips. With the TLC 1.8.0 prerelease, the `PROPERTY` test fails because 1.8.0 words a broken temporal property as "Temporal property X was violated.", which the scripts do not read yet, as #776 says. At `4ec7ffa` without TLC, 29 pass and 38 skip, and `from-spec` on the bundled `OutputFolder` model with TLC 1.7.4 exits 0 with all five rules holding. The README's skill count stays at 65. The copies #776 and #779 change under `harness/pstack/claude-code/` sit outside every synced component. At `4ec7ffa` each component's dry run reports no undeclared fork, no denylist hit, and no substitution that matches nothing. Neither hooks file changes.

plugins/pstack/skills/poteto-mode/SKILL.md

@@ -99,11 +99,13 @@ Read the leaf skill in full for any principle you apply. Each entry names when i
 
 You own every subagent's work. Review the diff and write your own summary, don't pass through what it said. A second opinion is the same prompt against a different model. Agreement is high-signal.
 
-**Fresh subagents by default.** Give new work to a fresh subagent with consolidated scope, meaning the original brief, every later directive, and the prior agent's report and branch. This holds for a fix round, a follow-up, a retry, and the next queue item. Send a follow-up to an existing child (`t3_thread_send` to its `childThreadId`) only when the new work strictly needs state that lives in that agent and is costly to move: its local checkout, its uncommitted changes, or a process it still runs, such as a dev server, a simulator, or a babysit watcher. A stop or hold order to a running agent is not reuse. A role such as a PR owner outlives its agent. Once that agent returns, a fresh agent takes the role's next round. Interrupt-chained resumes silently drop directives, so fire a fresh subagent with consolidated scope rather than trusting a "done" summary. **Stop the abandoned agent first, and confirm it stopped,** when its writes could overlap its replacement's, in the same worktree or the same files. Autopilot-full's audit still replaces a stuck agent at once, without waiting for its stop, per that playbook. A child whose turn completed can still have live work, and it can keep editing after a fresh agent takes its role. `task_cancel` it, which also stops the tasks it delegated, and read `task_status` until the task is terminal with no `hasPendingChildRuns`. A claim about the working tree that `git status` contradicts means it is still running.
+**Fresh subagents by default.** Give new work to a fresh subagent with consolidated scope, meaning the original brief, every later directive, and the prior agent's report and branch. This holds for a fix round, a follow-up, a retry, and the next queue item. Send a follow-up to an existing child (`t3_thread_send` to its `childThreadId`) only when the new work strictly needs state that lives in that agent and is costly to move: its local checkout, its uncommitted changes, or a process it still runs, such as a dev server, a simulator, or a babysit watcher. This same-conversation exception never applies to independent review rounds. A stop or hold order to a running agent is not reuse. A role such as a PR owner outlives its agent. Once that agent returns, a fresh agent takes the role's next round. Interrupt-chained resumes silently drop directives, so fire a fresh subagent with consolidated scope rather than trusting a "done" summary. **Stop the abandoned agent first, and confirm it stopped,** when its writes could overlap its replacement's, in the same worktree or the same files. Autopilot-full's audit still replaces a stuck agent at once, without waiting for its stop, per that playbook. A child whose turn completed can still have live work, and it can keep editing after a fresh agent takes its role. `task_cancel` it, which also stops the tasks it delegated, and read `task_status` until the task is terminal with no `hasPendingChildRuns`. A claim about the working tree that `git status` contradicts means it is still running.
 
-**Dispatch on T3.** Every subagent is a `delegate_task` call from the chat that runs the playbook, same model family included, so every child shows up in T3. Give each call its own `clientRequestId`, stable across retries of that call, and keep each returned `taskId`. A child's completion wakes this thread, so end the turn instead of polling, and call `task_status` only when a result is needed mid-turn. `task_cancel` stops a child, and `task_status` confirms it stopped. A child gets only its brief, never your context, so pass absolute paths. `<plugin root>` is the absolute path of the directory that holds this plugin's `skills/` and `agents/`. A persona (`poteto-agent`, `comment-sicko`, `thermo-nuclear-review-subagent`, `thermo-nuclear-code-quality-review-subagent`) is a brief that opens with "Read `<plugin root>/agents/<name>.md` in full and act as it says", and a `poteto-agent` brief also names this file's absolute path.
+**Dispatch on T3.** Every subagent is a `delegate_task` call from the chat that runs the playbook, same model family included, so every child shows up in T3. Give each call its own `clientRequestId`, stable across retries of that call, and keep each returned `taskId`. A child's completion wakes this thread, so end the turn instead of polling, and call `task_status` only when a result is needed mid-turn. `task_cancel` stops a child, and `task_status` confirms it stopped. A child gets only its brief, never your context, so include explicit task context and absolute paths. `childThreadId` is the child's backing conversation. `t3_thread_launch` and `create_threads` create ordinary top-level conversations only for an explicit user request for separate threads; a request for parallel workers or subagents alone does not authorize them. `<plugin root>` is the absolute path of the directory that holds this plugin's `skills/` and `agents/`. A persona (`poteto-agent`, `comment-sicko`, `thermo-nuclear-review-subagent`, `thermo-nuclear-code-quality-review-subagent`) is a brief that opens with "Read `<plugin root>/agents/<name>.md` in full and act as it says", and a `poteto-agent` brief also names this file's absolute path.
 
-A child starts in your checkout. One that writes gets its own worktree, created with `git worktree add` from `HEAD` so it builds on your branch's commits. The brief names that absolute path as the only place it writes, and tells it to run every command there (`workdir` on Codex) and to edit by absolute path. Record your own `git status --porcelain` before you dispatch, check after the result that it is unchanged, then remove the worktree and its branch. A step a playbook says to delegate goes to `delegate_task` on that role's sheet entry, not into your own tool calls, unless you state a reason such as a step too small to brief. A research delegate no role names runs on the `how explorer` entry. A model's family is the first segment of its ID's last `/` part, such as `claude`, `gpt`, or `grok`, whatever provider instance serves it, and your own family is the one in `orchestrator_capabilities`' `inheritedModel`. A rejected target runs on another target of the same family from `orchestrator_capabilities`, and you say so. A required review with no reviewer from another family stays `BLOCKED: independent review`.
+**Independent review rounds.** Call a fresh `delegate_task` for every new round, with the original brief, prior findings, responses, and unresolved objections. Give each round a distinct `clientRequestId`, stable across retries of that round, and retain its returned `taskId`. Never start a new review round through `t3_thread_send` to the previous child's `childThreadId`.
+
+A child that needs a separate checkout uses `delegate_task` with `isolation: "worktree"`. Every child that writes gets this isolation. T3 creates the worktree from the parent's local commit and runs project setup. Uncommitted edits are not copied, so commit what it builds on before dispatch. The brief tells it to write and run every command only in its assigned worktree (`workdir` on Codex). Record your own `git status --porcelain` before dispatch and check after the result that it is unchanged. A step a playbook says to delegate goes to `delegate_task` on that role's sheet entry, not into your own tool calls, unless you state a reason such as a step too small to brief. A research delegate no role names runs on the `how explorer` entry. A model's family is the first segment of its ID's last `/` part, such as `claude`, `gpt`, or `grok`, whatever provider instance serves it, and your own family is the one in `orchestrator_capabilities`' `inheritedModel`. A rejected target runs on another target of the same family from `orchestrator_capabilities`, and you say so. A required review with no reviewer from another family stays `BLOCKED: independent review`.
 
 **A review gate stays closed when no independent reviewer can run.** A reviewer child that fails or is interrupted gets a fresh `delegate_task` in its place. Keep the results of reviewers that finished. Never count your own review, passing tests, or CI as the independent verdict. While the gate is blocked, record `BLOCKED: independent review` in the todolist, keep merge-ready and shipping closed, and report which reviewers ran and which are missing. Work that doesn't depend on the review continues. A fan-out run only to explore may fall back to one labelled sequential pass.
 

plugins/pstack/skills/poteto-mode/playbooks/autopilot-full.md

@@ -5,7 +5,7 @@
 A verdict covers one patch and green CI covers one head. Step 4 runs a full swarm once, and again only for a major change. The patch-id rule in `playbooks/shipping.md` can carry a lane's result, and every new head needs its own green CI.
 
 1. **The operator's gates come first.** The grant covers only the queue's items, so items the operator names as theirs and PRs outside the queue stop at merge-ready. A request to state the plan is not a go.
-2. **Spawn one owner per PR, and keep its work where a replacement can find it.** Resolve the forge once for the program. GitHub CLI (`gh`) is the default. If `command -v origin` succeeds and Origin can resolve the repository, use `origin pr` for every PR operation. Otherwise stay on `gh` and record the fallback. Never require Graphite (`gt`). Each owner is a top-level T3 thread that `t3_thread_launch` starts with `workspaceStrategy: {type: "worktree", baseRef, branch, startFromOrigin: false}` and a brief that names this playbook and this thread's ID, so the owner reports back with `t3_thread_send`. It builds, opens its PR per `playbooks/opening-a-pr.md`, proves the change on the real artifact, babysits to green per `playbooks/babysit.md`, and merges once steps 4 and 5 clear it.
+2. **Spawn one owner per PR, and keep its work where a replacement can find it.** Resolve the forge once for the program. GitHub CLI (`gh`) is the default. If `command -v origin` succeeds and Origin can resolve the repository, use `origin pr` for every PR operation. Otherwise stay on `gh` and record the fallback. Never require Graphite (`gt`). Each owner is a `delegate_task` child with `mode: "async"` and `isolation: "worktree"`, started from the parent's committed trunk checkout. Its brief names this playbook and the PR scope. Retain its `taskId`; completion wakes the parent, and `task_status` reads progress when needed. It builds, opens its PR per `playbooks/opening-a-pr.md`, proves the change on the real artifact, babysits to green per `playbooks/babysit.md`, and merges once steps 4 and 5 clear it.
 
    Open the PR early so CI and bots run alongside the work. The code is ready only after the slop-strip (the **deslop** skill, `/deslop`) and the `/no-comments` pass, so the full swarm runs on finished code. Then rebase onto current trunk and report the code-ready head before self-proof, so verification runs on the base the patch lands on. Report every later head, and merge-ready once self-proof, CI, and babysit are done. Fix rounds stay on that base unless trunk conflicts or breaks CI, because each rebase restarts CI. Run the repo's checks for the touched paths on the committed head before the code-ready push and before a later push that needs a verifier.