diff --git a/CHANGELOG.md b/CHANGELOG.md
index a25f0d91..e343597b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,28 @@ All notable changes to the claude-plugins project will be documented in this fil
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Entries are listed newest-first; each plugin section is treated as released when merged to `main`.
 
+### vibe v1.0.76
+
+The open lessons and operator rulings from the 2026-10-22 fleet run, each with a mechanical check where one fits.
+
+#### Added
+- Questions carry a default and a deadline: `session-questions.mjs ask` needs `--default` and `--deadline-minutes` and returns the `If no answer by <time>: <default>` line that ends the message; a flag (or feature switch), copy, destructive, credential or scope-narrowing question waits with none. The recovery pass resumes an idle Codex writer on its default once the deadline passes (`proceeded-on-default`). Writers' questions once sat unanswered for seven hours overnight.
+- `watch.sh` exits with `HEARTBEAT` after `HEARTBEAT_SECONDS` (default 30 minutes) with no change, instead of `TIMEOUT` after about 6.7 hours, and `board.mjs status` fails with `WATCHER-MISSING` when a work dir that watches sessions or PRs has no running watcher.
+- `fleet.sh` refuses a prompt that hands over `Done:` claims without a `Re-verify:` line, and the takeover prompt makes the incoming writer re-verify each claim with a test or a measurement.
+- `migration-publish.mjs` refuses a push that adds a migration without a recorded `Migration test:` (an existing test that applies every migration counts), or one with a trigger, function or per-row work without a measured `Scale test:`; the environment worker runs it before every push, and handoff's diff rules run the same check. A pushed migration reaches shared preview schemas.
+- Handoff's `spec-change` diff rule blocks a change to an existing `*-spec` file or PRD Markdown without `Spec change: <path>: <human>, <date>, <where>`, and `rulings-check.mjs --criteria-before` blocks a ticket version that rewords or drops an acceptance criterion no human ruling amends.
+- `executed-check.mjs --kind ticket` refuses DONE while an acceptance criterion is unchecked without a follow-up ticket or a dated human exclusion; the ticket worker, cl-execute and cl-sweep run it before DONE, and `status-audit.mjs` needs each merged or DONE child's body and prints `UNREAD` and `UNCHECKED`.
+- One review round per pull request (operator ruling): `shepherd.mjs --round-one-fixed-at` stops with `threads` (exit 13) on an unresolved round-one thread the writer has not answered last, so armed auto-merge no longer reads as done, and with `later-threads` (exit 14) on one raised after the round-one fixes, which is triaged and never blocks the merge. `review-followup.mjs` keeps exactly one follow-up ticket per pull request (later rounds append criteria), and `review-threads.mjs` resolves a later thread answered with that ticket's link or a reason. The board and the shepherd share one thread reader (`pr-threads.mjs`).
+- A PreToolUse hook (`hooks/kill-guard.mjs`) refuses by-name and pattern kills, `xargs kill`, a command substitution, a pid of 1 or lower and a pid the session did not record (`kill-guard.mjs own <pid>`) in every Claude session with the plugin.
+- The watcher marks `STALE-PR` when an open PR with unresolved threads, a conflict, a draft flag or a failed check has had no push for 45 minutes, and `QUESTION-UNANSWERED` when an idle writer's question waited 15 minutes; `board.mjs question` does the same for Claude writers. Writers push at least every 45 minutes (`push-cadence.mjs`), never held for optional evidence, a default's deadline is at most 30 minutes, and `session-questions.mjs` refuses a question that holds a PR.
+- `rollout-gate.mjs` (handoff) needs each flag, rollback or rollout requirement in the ticket and its PRD backed by code at HEAD or a human ruling that names the ticket or PRD; `rulings-check.mjs --ruling --scope`, `executed-check.mjs --kind ticket --slug` and `status-audit.mjs` (`UNSCOPED`) refuse a ruling that names neither, and `qa-plan-check.mjs --criteria` makes each rollout requirement a checkpoint.
+- `board.mjs writer --ready` records each writer's push-ready head and `board.mjs push-check` refuses any other head, so a head is pushed on a writer's behalf only when the writer called it ready.
+- `green-watch.mjs` re-lists main's runs on every call and reports every lane of every run containing a program PR (`RED`, `PENDING`, `NO-RUN`), so a batch that starts later is not missed.
+- `claude-usage.mjs` adds a `claude-usage` watcher line from `claude -p "/usage"` (session and weekly bands on the Codex thresholds); fleet-orchestrator moves Claude writers to Codex near the limit.
+- `status-audit.mjs` is the program's status sweep: `PLAN-OPEN` for a DONE ticket whose plan is not EXECUTED and `ABSORBED-OPEN` for a child left open after its umbrella closed; `status-sweep` is a required board duty.
+- The requirements worker observes a reference product live through the signed-in browser or returns `NEEDS_PERSON`, never public help material, matching the quality loop.
+- fleet-orchestrator Program practices: green watch, load-aware placement (`fleet.sh slot heavy` refuses a machine over `MAX_LOAD_PER_CORE`), repo knowledge capture, close-out, deadline mode and runtime choice; `board.mjs status` prints `MISSING-DUTY` for a required duty (green-watch by default) with no owner.
+
 ### closedloop-core v1.5.2
 
 #### Fixed
diff --git a/plugins/vibe/.claude-plugin/plugin.json b/plugins/vibe/.claude-plugin/plugin.json
index 01fa9fa3..84a40de4 100644
--- a/plugins/vibe/.claude-plugin/plugin.json
+++ b/plugins/vibe/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "vibe",
   "description": "Vibe sessions, handoff, seed refresh, and ClosedLoop ticket workflows",
-  "version": "1.0.75",
+  "version": "1.0.76",
   "dependencies": ["closedloop-core"],
   "author": {"name": "ClosedLoop", "email": "support@closedloop.ai"}
 }
diff --git a/plugins/vibe/.codex-plugin/plugin.json b/plugins/vibe/.codex-plugin/plugin.json
index a0162987..14cc0471 100644
--- a/plugins/vibe/.codex-plugin/plugin.json
+++ b/plugins/vibe/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "vibe",
-  "version": "1.0.75",
+  "version": "1.0.76",
   "description": "Vibe sessions, handoff, seed refresh, and ClosedLoop ticket workflows",
   "author": {"name": "ClosedLoop", "email": "support@closedloop.ai"},
   "homepage": "https://github.com/closedloop-ai/claude-plugins",
diff --git a/plugins/vibe/agents/vibe-environment-worker.md b/plugins/vibe/agents/vibe-environment-worker.md
index 7fd51ada..fe82b433 100644
--- a/plugins/vibe/agents/vibe-environment-worker.md
+++ b/plugins/vibe/agents/vibe-environment-worker.md
@@ -18,9 +18,10 @@ worker an exclusive session-record and ticket-writing turn; never race another
 writer. Product questions use the graph/live-decision research and necessity
 gate, technical choices stay internal, and local plans are never deployed.
 Before every push or deployment request run
-`node <plugin-root>/skills/vibe/scripts/local-plans.mjs --worktree "<wt>"`.
-If it fails, return `BLOCKED` and publish nothing; an unchanged committed plan
-is unsafe too. Do not rewrite branch history to hide the leak.
+`node <plugin-root>/skills/vibe/scripts/local-plans.mjs --worktree "<wt>"` and
+`node <plugin-root>/skills/vibe/scripts/migration-publish.mjs --worktree "<wt>" --since <vercel.lastDeployedCommit, or baseCommit before the first push>`.
+If either fails, return `BLOCKED` with its problems and publish nothing; an
+unchanged committed plan is unsafe too. Do not rewrite branch history to hide the leak.
 Use `environment.md`, "Main-sync before publication", for EVERY create,
 redeploy, flags/Desktop request and handoff. Root supplies the exact granted
 `operationContext`, purpose and current transaction in private stdin data;
diff --git a/plugins/vibe/agents/vibe-guardrails-reviewer.md b/plugins/vibe/agents/vibe-guardrails-reviewer.md
index 99d30883..8413e004 100644
--- a/plugins/vibe/agents/vibe-guardrails-reviewer.md
+++ b/plugins/vibe/agents/vibe-guardrails-reviewer.md
@@ -303,7 +303,8 @@ path merely because another rule describes how its content should look.
     to the copy rule),
     numeric limit, criterion worded more strongly than its source and removed
     accessibility behavior; a shared-module edit lists its callers in the
-    change log.
+    change log. A spec or criterion edited to match the code is blocking
+    without a human source (`spec-change` diff rule).
 16. Tech debt and flag keys (`guardrails.md`, "No new tech debt" and
     "Feature flags"): each item of a kind that section lists with no
     `Debt:` reason is blocking: a mechanism checks 1, 7, 8 or 12 find, a
diff --git a/plugins/vibe/agents/vibe-requirements-worker.md b/plugins/vibe/agents/vibe-requirements-worker.md
index 41043d9d..40c69186 100644
--- a/plugins/vibe/agents/vibe-requirements-worker.md
+++ b/plugins/vibe/agents/vibe-requirements-worker.md
@@ -98,9 +98,12 @@ reference image paths of one (a screenshot, named or not), and the person's
 words. Open every reference image path yourself as an image (`Read` in
 Claude Code, `view_image` in Codex); never work from someone else's
 description of it. When the product is named or identifiable from the
-image, research how it does it from its public documentation, help center
-and release notes, using the harness's web search and fetch tools.
-Never sign in to it, create an account, or type credentials. Keep only the
+image, its behaviors come from the live product, observed by whoever has the
+operator's signed-in browser (`../skills/vibe/scripts/precedent-check.mjs`
+brief), never from public documentation, a help center or search results.
+When no actor here has that browser, return `NEEDS_PERSON` with the
+interactions still to observe; the image alone still gives the Visual and UX
+requirements. Never sign in to it, create an account, or type credentials. Keep only the
 behaviors the request covers, mapped onto the existing screen and the
 graph/live product decisions you would check for any request; a settled
 decision outranks the reference.
@@ -125,7 +128,7 @@ writer's existing missing-primitive path.
 Return `DONE` with a bulleted list of the behaviors to build, one plain line
 each in the person's terms, each with its source link or reference image
 path, then the Visual and UX requirements, each with its mapped component or
-token, then one line naming anything the public material or the image did
+token, then one line naming anything the live product or the image did
 not establish. The orchestrator shows the
 list to the person and keeps building without waiting, so the list is never a
 question. It names behaviors, not wording: never propose the product's labels
diff --git a/plugins/vibe/agents/vibe-ticket-worker.md b/plugins/vibe/agents/vibe-ticket-worker.md
index fe32a00d..be793eaa 100644
--- a/plugins/vibe/agents/vibe-ticket-worker.md
+++ b/plugins/vibe/agents/vibe-ticket-worker.md
@@ -232,7 +232,9 @@ flag keys, each read now from the flag service), and rerun it. Only once it
 passes, set `EXECUTED` through step F (with `expectedStatus` the status you
 read) and record it. For a source PRD, move each claimed child the
 handoff gate put in `IN_REVIEW` to `DONE` with the merge URL and commit as
-evidence; change nothing else.
+evidence, each only once
+`node ../skills/handoff/scripts/executed-check.mjs --kind ticket --file <its latest text> --slug <its slug> --prd <the PRD slug>`
+passes (return the ones it refuses). Change nothing else.
 
 ## Handoff mode
 
@@ -402,7 +404,9 @@ historical inspections accurately. Preserve the existing grading block.
    the PLN matches the current local plans: repair whatever is missing or
    stale here; it is never a question for the person. A `NEEDS_CHANGE` from
    step B goes back to the same writer like any other.
-8. Write the body back with `create-document-version`, then save it to
+8. `node ../skills/handoff/scripts/rulings-check.mjs --ticket <new body> --criteria-before <current latest text>`
+   must pass (a reworded or dropped criterion is restored unless a human
+   ruling amends it). Write the body back with `create-document-version`, then save it to
    `$(git -C "<wt>" rev-parse --absolute-git-dir)/vibe-live-ticket.md` and run
    `node ../skills/handoff/scripts/live-ticket-check.mjs --file "<that file>" --base-commit <inventory baseCommit> --worktree "<wt>"`.
    Fix every problem you can from the session; a problem only the person can
diff --git a/plugins/vibe/hooks/hooks.json b/plugins/vibe/hooks/hooks.json
new file mode 100644
index 00000000..4ac5f46c
--- /dev/null
+++ b/plugins/vibe/hooks/hooks.json
@@ -0,0 +1,12 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kill-guard.mjs\"" }
+        ]
+      }
+    ]
+  }
+}
diff --git a/plugins/vibe/hooks/kill-guard.mjs b/plugins/vibe/hooks/kill-guard.mjs
new file mode 100644
index 00000000..d10e3446
--- /dev/null
+++ b/plugins/vibe/hooks/kill-guard.mjs
@@ -0,0 +1,157 @@
+#!/usr/bin/env node
+// PreToolUse guard for Bash: a session signals only processes it recorded as
+// its own. A writer once killed a shared laptop's test runs by pattern
+// (`-f "turbo test --filter"`), which can end other sessions' runs, and a
+// plugin test's kill(-1) once ended every app on the operator's machine; a
+// written rule against both already existed. So the by-name killers (the p
+// and all variants of kill), `xargs kill`, and `kill` with a pattern, a
+// variable, a command substitution, or a pid of 1 or lower (zero and negative
+// pids signal whole process groups) are refused. `kill <pid>`
+// passes only for a pid recorded here as this session's own, still running the
+// process that was recorded.
+//
+// Usage (hook): reads the PreToolUse JSON on stdin; prints a deny decision or nothing.
+//        record: kill-guard.mjs own <pid>...   (run from the session's working directory, for example with $!)
+
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const SEPARATOR = /\|\||&&|[;|&\n]|\$\(|`|\(|\)/;
+const SIGNAL_OPTION = /^-(?:[A-Za-z][A-Za-z0-9+-]*|\d+)$/;
+const SUBSTITUTED_KILL = /(?:^|[\s;&|(])kill\b[^;&|\n]*(?:\$\(|`)/;
+const BY_NAME = /^p?kill(?:all)?$/;
+const ENV_ASSIGN = /^[A-Za-z_][A-Za-z0-9_]*=/;
+const WRAPPERS = new Set(["sudo", "command", "exec", "nohup", "time", "builtin", "env"]);
+
+/** The file recording the pids each session called its own. */
+export function ledgerFile(home = os.homedir()) {
+  return path.join(home, ".claude", "vibe", "owned-pids.json");
+}
+
+/** Problems with the signal-sending commands in `command`; `isOwn(pid)` says whether a pid is recorded as this session's. */
+export function killProblems(command, isOwn) {
+  const problems = SUBSTITUTED_KILL.test(command)
+    ? ["kill with a command substitution signals whatever a search matched; kill only a pid you recorded as your own"]
+    : [];
+  for (const segment of command.split(SEPARATOR)) {
+    const words = segment.trim().split(/\s+/).filter((word) => word && !/[<>]/.test(word)).map((word) => word.replace(/^["']|["']$/g, ""));
+    while (words.length > 0 && (ENV_ASSIGN.test(words[0]) || WRAPPERS.has(path.basename(words[0])))) words.shift();
+    const name = path.basename(words[0] ?? "");
+    if (name !== "kill" && BY_NAME.test(name)) {
+      problems.push(`${name} signals by pattern, which can end other sessions' processes; record your own pid when you start a process and run kill <pid>`);
+    } else if (name === "xargs" && words.slice(1).some((word) => path.basename(word) === "kill")) {
+      problems.push("xargs kill signals whatever a search matched; kill only a pid you recorded as your own");
+    } else if (name === "kill") {
+      problems.push(...killTargets(words.slice(1), isOwn));
+    }
+  }
+  return problems;
+}
+
+function killTargets(args, isOwn) {
+  if (args.some((arg) => arg === "-l" || arg === "-L")) return [];
+  const targets = [];
+  let signalSeen = false;
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--") {
+      targets.push(...args.slice(index + 1));
+      break;
+    }
+    if (!signalSeen && (arg === "-s" || arg === "-n")) {
+      signalSeen = true;
+      index += 1;
+    } else if (!signalSeen && SIGNAL_OPTION.test(arg)) {
+      signalSeen = true;
+    } else {
+      targets.push(arg);
+    }
+  }
+  const problems = [];
+  for (const target of targets) {
+    if (/^%\d+$/.test(target)) continue;
+    if (!/^-?\d+$/.test(target)) {
+      problems.push(`kill ${target}: name the pid as a number this session recorded as its own, never a pattern, variable or command substitution`);
+    } else if (Number(target) <= 1) {
+      problems.push(`kill ${target}: a pid of 1 or lower signals every process or a whole process group`);
+    } else if (!isOwn(Number(target))) {
+      problems.push(`kill ${target}: pid ${target} is not recorded as this session's own; record a process you start with \`node <vibe plugin>/hooks/kill-guard.mjs own <pid>\``);
+    }
+  }
+  return problems;
+}
+
+/** A process's start time as ps reports it, or null when it is not running. */
+export function startTimeOf(pid) {
+  try {
+    return execFileSync("ps", ["-o", "lstart=", "-p", String(pid)], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+/** Whether `pid` is recorded for a directory containing `cwd` and still runs the recorded process. */
+export function recordedOwn(ledger, pid, cwd, startOf = startTimeOf) {
+  const entry = ledger[String(pid)];
+  if (!entry || !(cwd === entry.cwd || cwd.startsWith(`${entry.cwd}${path.sep}`))) return false;
+  const started = startOf(pid);
+  return started !== null && started === entry.started;
+}
+
+function readLedger(file) {
+  try {
+    return existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : {};
+  } catch {
+    return {};
+  }
+}
+
+function recordOwn(pids, cwd, file = ledgerFile()) {
+  const ledger = readLedger(file);
+  for (const text of pids) {
+    const pid = Number(text);
+    if (!Number.isInteger(pid) || pid <= 1 || pid === process.pid || pid === process.ppid) {
+      throw new Error(`refusing to record ${text}: only a pid above 1 that this session started`);
+    }
+    const started = startTimeOf(pid);
+    if (started === null) throw new Error(`pid ${pid} is not running`);
+    ledger[String(pid)] = { cwd, started };
+  }
+  for (const key of Object.keys(ledger)) if (startTimeOf(Number(key)) !== ledger[key].started) delete ledger[key];
+  mkdirSync(path.dirname(file), { recursive: true });
+  writeFileSync(file, `${JSON.stringify(ledger, null, 2)}\n`);
+}
+
+function hook(input) {
+  const event = JSON.parse(input || "{}");
+  const command = event?.tool_input?.command;
+  if (event?.tool_name !== "Bash" || typeof command !== "string") return null;
+  const ledger = readLedger(ledgerFile());
+  const cwd = typeof event.cwd === "string" ? event.cwd : process.cwd();
+  const problems = killProblems(command, (pid) => recordedOwn(ledger, pid, cwd));
+  if (problems.length === 0) return null;
+  return {
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "deny",
+      permissionDecisionReason: `Signal only processes this session started and recorded: ${problems.join("; ")}`,
+    },
+  };
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    if (process.argv[2] === "own") {
+      recordOwn(process.argv.slice(3), process.cwd());
+    } else {
+      const decision = hook(readFileSync(0, "utf8"));
+      if (decision) process.stdout.write(`${JSON.stringify(decision)}\n`);
+    }
+  } catch (error) {
+    process.stderr.write(`kill-guard: ${error instanceof Error ? error.message : String(error)}\n`);
+    process.exit(process.argv[2] === "own" ? 1 : 0);
+  }
+}
diff --git a/plugins/vibe/hooks/kill-guard.test.mjs b/plugins/vibe/hooks/kill-guard.test.mjs
new file mode 100644
index 00000000..950b2b38
--- /dev/null
+++ b/plugins/vibe/hooks/kill-guard.test.mjs
@@ -0,0 +1,80 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+import { killProblems, recordedOwn } from "./kill-guard.mjs";
+
+// No test here sends a signal: every case asks the guard for a decision only. The
+// commands are assembled from words (`sh`) so the repository's signal and
+// by-name scans, which read test text, never meet a live signal shape here.
+const sh = (...words) => words.join(" ");
+const byName = (variant) => (variant === "all" ? "kill" + "all" : "p" + "kill");
+const GUARD = path.join(path.dirname(fileURLToPath(import.meta.url)), "kill-guard.mjs");
+const OWN = 4242;
+const isOwn = (pid) => pid === OWN;
+
+test("pattern kills, group kills and unrecorded pids are refused; kill of a recorded pid passes (a writer killed by pattern)", () => {
+  const refused = [
+    sh(byName("p"), "-f", '"turbo test --filter"'),
+    sh(byName("all"), "node"),
+    sh("sudo", byName("p"), "-9", "vitest"),
+    sh("cd /wt &&", byName("p"), "-f e2e"),
+    sh("pgrep -f vitest | xargs", "kill"),
+    sh("kill", "$(pgrep -f vitest)"),
+    sh("kill", "$PID"),
+    sh("kill", "--", "-1"),
+    sh("kill", "-9", "-1"),
+    sh("kill", String(0)),
+    sh("kill", "-TERM", String(1)),
+    sh("kill", "--", "-4242"),
+    sh("kill", "777"),
+    sh("kill", "-s TERM", "777"),
+  ];
+  for (const command of refused) assert.notDeepEqual(killProblems(command, isOwn), [], command);
+  for (const pid of ["-1", "0", "1", "-4242"]) {
+    assert.match(killProblems(sh("kill", "--", pid), () => true).join(), /1 or lower/, `${pid} is refused even if a ledger claimed it`);
+  }
+  const allowed = [
+    `kill ${OWN}`,
+    `kill -9 ${OWN}`,
+    `kill -s TERM ${OWN} 2>/dev/null`,
+    `kill -- ${OWN} && echo done`,
+    "kill -l",
+    "kill %1",
+    'git commit -m "stop the watcher"',
+    "ps aux | grep kill",
+    "echo kill",
+  ];
+  for (const command of allowed) assert.deepEqual(killProblems(command, isOwn), [], command);
+});
+
+test("a recorded pid is own only from its directory and while the same process runs", () => {
+  const ledger = { 4242: { cwd: "/src/wt", started: "Thu Oct 22 09:00:00 2026" } };
+  const same = () => "Thu Oct 22 09:00:00 2026";
+  assert.equal(recordedOwn(ledger, 4242, "/src/wt", same), true);
+  assert.equal(recordedOwn(ledger, 4242, "/src/wt/apps/api", same), true);
+  assert.equal(recordedOwn(ledger, 4242, "/src/other", same), false, "another session's directory");
+  assert.equal(recordedOwn(ledger, 4242, "/src/wt", () => "Thu Oct 22 11:00:00 2026"), false, "the pid was reused");
+  assert.equal(recordedOwn(ledger, 4242, "/src/wt", () => null), false, "no longer running");
+  assert.equal(recordedOwn(ledger, 5000, "/src/wt", same), false);
+});
+
+test("the hook denies a refused Bash command and stays silent otherwise", (t) => {
+  const home = mkdtempSync(path.join(tmpdir(), "kill-guard-"));
+  t.after(() => rmSync(home, { recursive: true, force: true }));
+  const run = (event) => spawnSync(process.execPath, [GUARD], { input: JSON.stringify(event), encoding: "utf8", env: { ...process.env, HOME: home } });
+  const denied = run({ tool_name: "Bash", cwd: home, tool_input: { command: sh(byName("p"), "-f", '"turbo test"') } });
+  assert.equal(denied.status, 0);
+  const decision = JSON.parse(denied.stdout).hookSpecificOutput;
+  assert.equal(decision.permissionDecision, "deny");
+  assert.match(decision.permissionDecisionReason, /signals by pattern/);
+  assert.equal(run({ tool_name: "Bash", cwd: home, tool_input: { command: "kill 4242" } }).stdout.length > 0, true, "an unrecorded pid is denied");
+  assert.equal(run({ tool_name: "Bash", cwd: home, tool_input: { command: "ls -la" } }).stdout, "");
+  assert.equal(run({ tool_name: "Read", tool_input: { file_path: "x" } }).stdout, "");
+  const refusedRecord = spawnSync(process.execPath, [GUARD, "own", String(1)], { encoding: "utf8", env: { ...process.env, HOME: home } });
+  assert.equal(refusedRecord.status, 1);
+  assert.match(refusedRecord.stderr, /only a pid above 1/);
+});
diff --git a/plugins/vibe/skills/cl-execute/references/monitoring-merge-completion.md b/plugins/vibe/skills/cl-execute/references/monitoring-merge-completion.md
index 2ebc02af..d90d3fcd 100644
--- a/plugins/vibe/skills/cl-execute/references/monitoring-merge-completion.md
+++ b/plugins/vibe/skills/cl-execute/references/monitoring-merge-completion.md
@@ -115,7 +115,9 @@ specific recheck condition until merge or explicit abandonment.
    acceptance criteria and requirements evidence pass and the integrated
    feature manual QA has current, responsible-human evidence for every required
    scenario. Merge evidence alone cannot substitute for missing or stale manual
-   QA evidence.
+   QA evidence. `node ../../handoff/scripts/executed-check.mjs --kind ticket --file <its latest body> --slug <its slug> [--prd <PRD slug>]`
+   must pass first: every criterion box checked, or naming its follow-up or
+   human exclusion.
 2. Mark every linked implementation plan `EXECUTED`. If already `EXECUTED`,
    verify without redundant update.
 3. Reconcile split parents and ticket execution/review-learning workflow-memory
diff --git a/plugins/vibe/skills/cl-sweep/references/open-pr-lifecycle.md b/plugins/vibe/skills/cl-sweep/references/open-pr-lifecycle.md
index 9774adee..c417620b 100644
--- a/plugins/vibe/skills/cl-sweep/references/open-pr-lifecycle.md
+++ b/plugins/vibe/skills/cl-sweep/references/open-pr-lifecycle.md
@@ -428,7 +428,9 @@ A closed-unmerged child must return one of: a new open PR handoff;
 `BLOCKED_SKIP`/`MANUAL_INTERVENTION` after normal routing; or `CANCELED` only
 with explicit current abandonment evidence, live canceled ClosedLoop state,
 and reconciled plan state. A merged child must verify acceptance and
-requirements evidence, mark included features `DONE`, mark linked plans
+requirements evidence, mark included features `DONE` (each only once
+`../../handoff/scripts/executed-check.mjs --kind ticket --slug <its slug>`
+passes on its latest body), mark linked plans
 `EXECUTED`, verify canonical manual QA and integrated feature acceptance on the
 applicable final head, reconcile legacy split parents if present and workflow memory, and return the final
 structured result. The parent writes `DONE` only after verifying that result.
diff --git a/plugins/vibe/skills/codex-fleet-monitor/SKILL.md b/plugins/vibe/skills/codex-fleet-monitor/SKILL.md
index 68161153..d8b11dd8 100644
--- a/plugins/vibe/skills/codex-fleet-monitor/SKILL.md
+++ b/plugins/vibe/skills/codex-fleet-monitor/SKILL.md
@@ -32,6 +32,10 @@ REMOTE_HOST=user@host            # omit when there are no remote sessions
 REMOTE_STATE_DIR=/path/on/remote # remote scratch dir; also holds state files for two-column sessions
 REMOTE_SHELL="zsh -lic"          # login shell so node/codex are on PATH (default)
 STALL_SECONDS=720                # no new thread items for this long means STALLED (default 12m)
+# CLAUDE_USAGE=0                 # turn off the claude-usage line; CLAUDE_USAGE_SECONDS=600 sets how often it is read
+# QUESTION_SECONDS=900          # an idle writer's question unanswered this long is QUESTION-UNANSWERED (default 15m)
+# STALE_PR_SECONDS=2700         # a PR needing its writer with no push this long is STALE-PR (default 45m)
+# HEARTBEAT_SECONDS=1800         # with no change, watch.sh exits with HEARTBEAT after this long (default 30m)
 WATCH_NEW_PR_REPOS="owner/repo"  # optional: list open PRs here to spot new ones
 PR_SEARCH="head:feature/"        # optional: search filter for that list
 BOT_LOGIN_REGEX="vercel|codex|github-actions|copilot|bot"  # authors not counted as human feedback
@@ -71,8 +75,10 @@ Start it with `run_in_background`, never with `&`; a second copy for the same wo
 
 | Line | Meaning | Usual action |
 |---|---|---|
+| `HEARTBEAT ...` | nothing changed for `HEARTBEAT_SECONDS` | read every teammate message and idle writer question, then re-arm |
 | `session <where> <name> RUN` | turn in progress and producing items | none |
 | `session ... IDLE` | turn completed; the session is waiting for you | read its last message, give it the next turn |
+| `session ... IDLE QUESTION-UNANSWERED(15m+) ...` | the writer asked something and has waited `QUESTION_SECONDS` (15 minutes) | answer it now, or tell it to proceed on its default |
 | `session ... MODEL(<model>/<effort>!=<want>)` | the thread runs on another model or effort than `CODEX_MODEL` and `CODEX_EFFORT` | restart it on the configured one; other models were far slower |
 | `session ... STALLED(...)` | turn open but silent | check for a usage limit or a hung command; tell the user if it needs them |
 | `session ... FAILED(LIMIT)` | turn errored on a usage limit | tell the user right away; a reset or second account is theirs to do |
@@ -85,12 +91,14 @@ Start it with `run_in_background`, never with `&`; a second copy for the same wo
 | `supervisor ... RSS-HIGH(>NMB)` | the supervisor's RSS is over `SUPERVISOR_RSS_CAP_MB` | read its hourly summary lines; restart it and report the leak |
 | `session remote <host> UNREACHABLE` | ssh failed | check the host |
 | `codex-usage <local\|remote> under80% ok resets=<n>` / `HIGH(<band>%)` | Codex account usage on that machine: one band below `USAGE_HIGH_PERCENT` (80 here) used, so ordinary use is not an event, then the used percent floored to 10; `resets` is the count of available limit resets | none below it; on `HIGH`, warn the user at once with the band and `resets`, since applying a reset is theirs; if they are away, move the busiest writers to Claude writers |
+| `claude-usage local session=<band> week=<band>` | Claude usage from `claude -p "/usage"` on the same bands (read at most every `CLAUDE_USAGE_SECONDS`, 600) | on `HIGH`, warn the user at once with its `resets=` time; if they are away, move the busiest Claude writers to Codex writers |
 | `codex-usage ... LIMIT` / `LIMIT-STOPPED` | usage limit reached; `LIMIT` means ordinary usage is still allowed, `LIMIT-STOPPED` means sessions cannot run | tell the user right away; a reset or second account is theirs to do |
 | `codex-usage ... LIMIT-SPENDING-CREDITS` | limit reached and turns are now consuming paid credits | tell the user at once and stop sending turns unless they approve paid credits |
 | `codex-usage ... unknown` / `unreadable READFAIL` | the App Server answered without rate limits, or it or the remote host could not be read | check `codex` on that machine |
 | `requests <local\|remote> <count> <newest file>` / `requests ... UNREADABLE` | a session dropped (or you removed) a delegated-work request file | hand the new request to a Claude worker, then steer its result back to the session that asked |
 | `open-prs <repo> <numbers>` | open PR list changed | add the new PR to `prs.txt` and start its review |
 | `pr ... BLOCKED(unresolved threads)` | an open PR has unresolved review threads (`threads=<n>`), which block its merge even when it is approved with auto-merge armed | treat each thread as work: route it to the owning writer now, and never read the block as a missing approval |
+| `pr ... STALE-PR(...)` | an open PR with unresolved threads, a conflict, a draft flag or a failed check has had no push for `STALE_PR_SECONDS` (45 minutes) | ask its writer for an ETA, unblock it, or reassign it, however busy the writer looks |
 | `pr ... <state> <head> <reviewDecision> <mergeable> comments= reviews= inline= threads= checks=` | any field changed | new head: re-review; count up: read the feedback; `CONFLICTING`: tell the owning session to merge the base branch; checks: act on failures. Check counts change only once settled; while any check is pending the last settled counts show with ` (running)` |
 
 Surface everything that needs a human to the user immediately: limits, paid-credit spending, stalls, failures, and new human review comments.
@@ -102,12 +110,14 @@ Each watcher tick runs `scripts/recover.mjs` on every machine that has sessions
 1. It waits the next `RECOVERY_BACKOFF_SECONDS` value, then reloads the thread (`thread/resume`) and starts a turn with the continue prompt. The built-in prompt tells the session to check its real state (git status and HEAD, a merge or rebase in progress, its background jobs and slot or lock entries, its last push) and not to redo finished steps. Retries count across consecutive transient failures and reset once a turn completes.
 2. If the thread is still in `systemError` after the last retry, the App Server daemon must restart. With `AUTO_RESTART_DAEMON=1` it prints a loud `!!! RESTARTING` line, runs `codex app-server daemon restart`, then resumes with the continue prompt each watched session on that machine whose turn was active (the restart interrupts it) or failed. An idle session stays idle, since a prompt would start work nobody asked for. Each session's state just before the restart is a `before-restart` event. It restarts at most once per `RESTART_COOLDOWN_SECONDS`. With the switch off it prints one `ALERT ... daemon-restart-needed` line and restarts nothing.
 3. Retries used up outside `systemError` print one `gave-up` line. A usage limit or any other error is never resumed; those stay yours.
+4. An idle session whose question ends `If no answer by <ISO time>: <default>` (vibe's `session-questions.mjs`) is told to go ahead on the default once that time passes (`proceeded-on-default`).
 
 Every action is an `EVENT recovery ...` line in the events log, which the `recovery` snapshot line reports, so you see what happened when you wake.
 
 | Event | Usual action |
 |---|---|
 | `<label> transient-failure ...` / `resumed ...` / `recovered ...` | none; read the session's last message when convenient |
+| `<label> proceeded-on-default ...` | nobody answered by the deadline; answer now if the default is wrong |
 | `<label> resume-failed ...` | none while retries remain |
 | `pass-timeout after <N>s ...` | a pass outlasted `PASS_TIMEOUT_SECONDS`, usually a daemon that stopped answering; its connections were closed and the next pass runs on schedule | if it repeats, check `codex app-server daemon` on that host |
 | `pass-failed: ...` (supervisor log) | a pass could not connect or read | if it repeats, check `codex` on that host |
diff --git a/plugins/vibe/skills/codex-fleet-monitor/scripts/classify.sh b/plugins/vibe/skills/codex-fleet-monitor/scripts/classify.sh
index f7e75d07..56f6566a 100755
--- a/plugins/vibe/skills/codex-fleet-monitor/scripts/classify.sh
+++ b/plugins/vibe/skills/codex-fleet-monitor/scripts/classify.sh
@@ -3,7 +3,9 @@
 # A running turn whose progress (its newest item) has not changed for $2 seconds is STALLED (a Codex usage
 # limit leaves the turn open and silent, so "turn is open" alone is not liveness). A MODEL(...) word that
 # liveness.mjs put first in the tail (a thread on another model or effort) is kept for every state.
-H=$1; STALL=${2:-720}; touch $H; now=$(date +%s)
+# An IDLE writer whose final message asks something (NEEDS-REPLY) and has waited $3 seconds (default 900)
+# is QUESTION-UNANSWERED: a writer once held its PR six hours on a question nobody answered.
+H=$1; STALL=${2:-720}; ASK=${3:-900}; touch $H; now=$(date +%s)
 while read where n st items flag tail; do
   prev=$(grep "^$where:$n " $H | awk '{print $2, $3}'); pi=${prev% *}; pt=${prev#* }
   if [ -z "$prev" ] || [ "$pi" != "$items" ]; then pt=$now; fi
@@ -12,6 +14,7 @@ while read where n st items flag tail; do
   if [ "$flag" != "-" ]; then s="FAILED($flag)"
   elif [ "$st" = inProgress ] && [ $((now - pt)) -ge $STALL ]; then s="STALLED(no progress $((STALL / 60))m+)"
   elif [ "$st" = inProgress ]; then s=RUN
+  elif [ "$st" = completed ] && [[ $tail == NEEDS-REPLY* ]] && [ $((now - pt)) -ge $ASK ]; then s="IDLE QUESTION-UNANSWERED($((ASK / 60))m+) $tail"
   elif [ "$st" = completed ]; then s="IDLE${tail:+ $tail}"
   else s="STOPPED($st)"; fi
   echo "session $where $n $s${drift:+ $drift}"
diff --git a/plugins/vibe/skills/codex-fleet-monitor/scripts/claude-usage.mjs b/plugins/vibe/skills/codex-fleet-monitor/scripts/claude-usage.mjs
new file mode 100644
index 00000000..ff6c7949
--- /dev/null
+++ b/plugins/vibe/skills/codex-fleet-monitor/scripts/claude-usage.mjs
@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+// Prints "claude-usage <label> session=<band> week=<band>" (plus `resets=<when>` for a HIGH band) from `claude -p "/usage"`,
+// or "claude-usage <label> unreadable READFAIL". Claude usage is readable: the command prints lines such as
+//   Current session: 51% used · resets Oct 22 at 12:39pm (America/Chicago)
+//   Current week (all models): 69% used · resets Oct 27 at 9am (America/Chicago)
+// Bands follow the Codex usage line (usageBand from ratelimit.mjs, USAGE_HIGH_PERCENT), so ordinary use is
+// not a watcher event. The command runs at most once per CLAUDE_USAGE_SECONDS (default 600); between runs
+// the last line is reused from <workDir>/claude-usage.txt.
+//
+// Usage: claude-usage.mjs <workDir> [label]   (CLAUDE_BIN overrides the claude binary)
+
+import { execFileSync } from 'node:child_process';
+import { readFileSync, statSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { isEntryPoint } from './liveness.mjs';
+import { highUsagePercent, usageBand } from './ratelimit.mjs';
+
+const LINE = /^\s*Current (session|week \(all models\)):\s*(\d+(?:\.\d+)?)%\s*used(?:\s*·\s*resets\s+(.+?))?\s*$/gim;
+export const DEFAULT_INTERVAL_SECONDS = 600;
+
+/** The session and all-models weekly percentages and reset times in `/usage` output, or null when absent. */
+export function parseUsage(text) {
+  const found = {};
+  for (const match of String(text ?? '').matchAll(LINE)) {
+    const key = match[1].toLowerCase().startsWith('session') ? 'session' : 'week';
+    found[key] = { used: Number(match[2]), resets: match[3]?.trim() ?? null };
+  }
+  return found.session || found.week ? found : null;
+}
+
+/** The monitor line for parsed usage. */
+export function claudeUsageLine(label, usage, high = highUsagePercent()) {
+  if (!usage) return `claude-usage ${label} unreadable READFAIL`;
+  const band = (part) => (part ? usageBand(part.used, high) : 'unknown');
+  const high_ = (part) => part && part.used >= high;
+  const when = high_(usage.session) ? usage.session.resets : high_(usage.week) ? usage.week.resets : null;
+  const resets = when ? ` resets=${when.replace(/\s+/g, '_')}` : '';
+  return `claude-usage ${label} session=${band(usage.session)} week=${band(usage.week)}${resets}`;
+}
+
+function cachedLine(file, maxAgeSeconds, now = Date.now()) {
+  try {
+    if ((now - statSync(file).mtimeMs) / 1000 < maxAgeSeconds) return readFileSync(file, 'utf8').trim();
+  } catch {}
+  return null;
+}
+
+function main() {
+  const [workDir, label = 'local'] = process.argv.slice(2);
+  if (!workDir) {
+    process.stderr.write('Usage: claude-usage.mjs <workDir> [label]\n');
+    process.exit(2);
+  }
+  const file = join(workDir, 'claude-usage.txt');
+  const interval = Number(process.env.CLAUDE_USAGE_SECONDS) > 0 ? Number(process.env.CLAUDE_USAGE_SECONDS) : DEFAULT_INTERVAL_SECONDS;
+  let line = cachedLine(file, interval);
+  if (!line) {
+    let output = '';
+    try {
+      output = execFileSync(process.env.CLAUDE_BIN || 'claude', ['-p', '/usage'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 60_000 });
+    } catch {}
+    line = claudeUsageLine(label, parseUsage(output));
+    writeFileSync(file, `${line}\n`);
+  }
+  console.log(line);
+}
+
+if (isEntryPoint(import.meta.url)) main();
diff --git a/plugins/vibe/skills/codex-fleet-monitor/scripts/claude-usage.test.mjs b/plugins/vibe/skills/codex-fleet-monitor/scripts/claude-usage.test.mjs
new file mode 100644
index 00000000..6e42a2d5
--- /dev/null
+++ b/plugins/vibe/skills/codex-fleet-monitor/scripts/claude-usage.test.mjs
@@ -0,0 +1,25 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { claudeUsageLine, parseUsage } from './claude-usage.mjs';
+
+// The real `claude -p "/usage"` lines, as the operator's session printed them.
+const REAL = [
+  'Current session: 51% used · resets Oct 22 at 12:39pm (America/Chicago)',
+  'Current week (all models): 69% used · resets Oct 27 at 9am (America/Chicago)',
+].join('\n');
+
+test('parses the session and all-models weekly usage from the real /usage output', () => {
+  assert.deepEqual(parseUsage(REAL), {
+    session: { used: 51, resets: 'Oct 22 at 12:39pm (America/Chicago)' },
+    week: { used: 69, resets: 'Oct 27 at 9am (America/Chicago)' },
+  });
+  assert.equal(parseUsage('Usage is not available in this mode.'), null);
+});
+
+test('the line uses the Codex bands: one band below the threshold, HIGH with the reset time from it', () => {
+  assert.equal(claudeUsageLine('local', parseUsage(REAL), 80), 'claude-usage local session=under80% week=under80%');
+  const high = parseUsage(REAL.replace('51%', '86%'));
+  assert.equal(claudeUsageLine('local', high, 80), 'claude-usage local session=HIGH(80%) week=under80% resets=Oct_22_at_12:39pm_(America/Chicago)');
+  assert.equal(claudeUsageLine('local', parseUsage(REAL.replace('69%', '95%')), 80), 'claude-usage local session=under80% week=HIGH(90%) resets=Oct_27_at_9am_(America/Chicago)');
+  assert.equal(claudeUsageLine('local', null), 'claude-usage local unreadable READFAIL');
+});
diff --git a/plugins/vibe/skills/codex-fleet-monitor/scripts/liveness.test.mjs b/plugins/vibe/skills/codex-fleet-monitor/scripts/liveness.test.mjs
index 01dfbe52..0c339745 100644
--- a/plugins/vibe/skills/codex-fleet-monitor/scripts/liveness.test.mjs
+++ b/plugins/vibe/skills/codex-fleet-monitor/scripts/liveness.test.mjs
@@ -302,3 +302,16 @@ else process.exit(1);
     ]);
   });
 });
+
+test('an idle writer whose question waited 15 minutes is QUESTION-UNANSWERED; a report is not (#9118)', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'fleet-ask-'));
+  const history = join(dir, 'history.txt');
+  const asked = 'w completed i-9 - NEEDS-REPLY "Sort by rank or updated? / If no answer by 2026-10-22T09:04:00Z: rank"';
+  const now = Math.floor(Date.now() / 1000);
+  writeFileSync(history, `remote:w i-9 ${now - 16 * 60}\nremote:r i-3 ${now - 60 * 60}\n`);
+  const run = (line) => spawnSync('zsh', [CLASSIFY, history, '720', '900'], { input: `remote ${line}\n`, encoding: 'utf8' }).stdout;
+  assert.equal(run(asked), `session remote w IDLE QUESTION-UNANSWERED(15m+) ${asked.slice('w completed i-9 - '.length)}\n`);
+  assert.equal(run('r completed i-3 - LAST "Pushed abc; QA ready."'), 'session remote r IDLE LAST "Pushed abc; QA ready."\n', 'a report waits on nobody');
+  writeFileSync(history, `remote:w i-9 ${now - 5 * 60}\n`);
+  assert.doesNotMatch(run(asked), /QUESTION-UNANSWERED/, 'a fresh question is not flagged yet');
+});
diff --git a/plugins/vibe/skills/codex-fleet-monitor/scripts/recover.mjs b/plugins/vibe/skills/codex-fleet-monitor/scripts/recover.mjs
index b6876989..edc6fe75 100644
--- a/plugins/vibe/skills/codex-fleet-monitor/scripts/recover.mjs
+++ b/plugins/vibe/skills/codex-fleet-monitor/scripts/recover.mjs
@@ -5,6 +5,10 @@
 // is resumed after a backoff with a continue prompt. A thread still in systemError after the retries needs
 // the App Server daemon restarted: that happens only with AUTO_RESTART_DAEMON=1, otherwise it is an ALERT.
 // After a restart only sessions whose turn was active or failed are resumed; idle sessions stay idle.
+// An idle session whose final message ends a question with `If no answer by <ISO time>: <default>` (the line
+// vibe's session-questions.mjs returns) is resumed once that time passes, told to go ahead on the default,
+// unless the question waits for a person (flag, copy, destructive, credential, scope): writers once sat seven
+// hours overnight on stated defaults with nobody answering.
 // Every action prints an EVENT line and is appended to <stateDir>/.fleet-recovery/events.log, which rotates
 // to events.log.1 at LOG_MAX_BYTES. A pass that outlasts PASS_TIMEOUT_SECONDS is abandoned with a
 // pass-timeout EVENT: its App Server connections are closed and its pass lock is released.
@@ -19,6 +23,7 @@ import { homedir, hostname } from 'node:os';
 import {
   classifyTurnError, connectViaProxy, daemonSocket, Failure, isEntryPoint, parseSession, readThreadState,
 } from './liveness.mjs';
+import { waitsForPerson } from '../../vibe/scripts/session-questions.mjs';
 
 export const DEFAULT_BACKOFF_SECONDS = [120, 300, 600];
 export const DEFAULT_RESTART_COOLDOWN_SECONDS = 1800;
@@ -34,6 +39,24 @@ export const DEFAULT_CONTINUE_PROMPT = [
   'Do not redo steps that are already finished. Then continue the task from where it actually stands.',
 ].join('\n');
 
+const IF_NO_ANSWER = /^\s*If no answer by (\S+): (.+?)\s*$/m;
+
+/** The default an idle writer asked to proceed on and when, or null; never for a question that waits for a person. */
+export function statedDefault(text) {
+  const match = IF_NO_ANSWER.exec(String(text ?? ''));
+  const deadline = Date.parse(match?.[1] ?? '');
+  if (!match || !Number.isFinite(deadline) || waitsForPerson(text.slice(0, match.index))) return null;
+  return { deadline, fallback: match[2] };
+}
+
+export function defaultPrompt(fallback, deadline) {
+  return [
+    `Nobody answered your question by ${new Date(deadline).toISOString()}, its deadline.`,
+    `Go ahead on your stated default: ${fallback}`,
+    'Say in your next report that you proceeded on the default, so the person can override it.',
+  ].join('\n');
+}
+
 export function supervisorLockPath(env = process.env) {
   return env.FLEET_SUPERVISOR_LOCK || `${homedir()}/.codex/fleet-supervisor.lock`;
 }
@@ -122,9 +145,9 @@ export function recoveryDir(stateDir) {
 function loadState(stateDir) {
   try {
     const state = JSON.parse(readFileSync(`${recoveryDir(stateDir)}/state.json`, 'utf8'));
-    return { sessions: state.sessions ?? {}, lastRestartAt: state.lastRestartAt ?? null, alerted: state.alerted ?? null, beforeRestart: state.beforeRestart ?? null };
+    return { sessions: state.sessions ?? {}, lastRestartAt: state.lastRestartAt ?? null, alerted: state.alerted ?? null, beforeRestart: state.beforeRestart ?? null, defaults: state.defaults ?? {} };
   } catch {
-    return { sessions: {}, lastRestartAt: null, alerted: null, beforeRestart: null };
+    return { sessions: {}, lastRestartAt: null, alerted: null, beforeRestart: null, defaults: {} };
   }
 }
 
@@ -259,6 +282,7 @@ export async function recoverPass({ stateDir, specs, config, connect, restart, n
         emit(`${label} gave-up after ${plural(retries, 'retry', 'retries')}; needs a human`);
       }
     }
+    await proceedOnDefaults({ client, sessions, state, now, emit });
     if (stuck.length) client = await handleStuck({ stuck, sessions, state, config, connect, restart, now, host, emit, client });
     else state.alerted = null;
   } finally {
@@ -268,6 +292,27 @@ export async function recoverPass({ stateDir, specs, config, connect, restart, n
   return events;
 }
 
+/**
+ * Resumes each idle session whose completed turn ended on a question with a passed `If no answer by` deadline,
+ * once per turn. A finished turn's final message is read once, or until its deadline passes.
+ */
+async function proceedOnDefaults({ client, sessions, state, now, emit }) {
+  for (const { label, threadId, options, thread, turn } of sessions) {
+    const idle = ['idle', 'notLoaded'].includes(thread?.status?.type);
+    if (!idle || turn?.status !== 'completed' || turn.error || state.defaults[label] === turn.id) continue;
+    try {
+      const { lastItem } = await readThreadState(client, threadId, { progress: true });
+      const stated = statedDefault(lastItem?.text);
+      if (stated && now < stated.deadline) continue;
+      state.defaults[label] = turn.id;
+      if (!stated) continue;
+      emit(`${label} proceeded-on-default turn=${await resumeSession(client, threadId, defaultPrompt(stated.fallback, stated.deadline), options)} asked=${turn.id}: ${oneLine(stated.fallback)}`);
+    } catch (error) {
+      emit(`${label} default-resume-failed: ${oneLine(error.message)}`);
+    }
+  }
+}
+
 /** A turn the restart interrupts (active) or that already failed needs the continue prompt; an idle one does not. */
 export function needsResumeAfterRestart(thread, turn) {
   return thread?.status?.type === 'active' || turn?.status === 'inProgress' || turn?.status === 'failed';
diff --git a/plugins/vibe/skills/codex-fleet-monitor/scripts/recover.test.mjs b/plugins/vibe/skills/codex-fleet-monitor/scripts/recover.test.mjs
index 7cd01e0d..97be81a1 100644
--- a/plugins/vibe/skills/codex-fleet-monitor/scripts/recover.test.mjs
+++ b/plugins/vibe/skills/codex-fleet-monitor/scripts/recover.test.mjs
@@ -355,3 +355,30 @@ test('the events log moves to events.log.1 at LOG_MAX_BYTES', async () => {
     h.close();
   }
 });
+
+test('an idle writer whose question passed its deadline is resumed once on its stated default; a flag question is not (7 quiet hours)', async () => {
+  const asked = (text) => ({ id: 'q-1', status: 'completed', error: null, items: [{ id: 'i-1', type: 'agentMessage', text }] });
+  const threads = {
+    T1: { status: { type: 'idle' }, turns: [asked('Sort the board by rank or by updated time?\nIf no answer by 2026-10-22T06:15:00.000Z: sort by rank')] },
+    T2: { status: { type: 'notLoaded' }, turns: [asked('May I add the feature flag key board-v2?\nIf no answer by 2026-10-22T06:15:00.000Z: add it')] },
+    T3: { status: { type: 'idle' }, turns: [asked('Pushed abc123; QA ready.')] },
+  };
+  const h = await harness(threads);
+  const at = (iso) => Date.parse(iso);
+  try {
+    assert.deepEqual(await h.pass(at('2026-10-22T06:14:00Z')), [], 'before the deadline nothing moves');
+    const events = await h.pass(at('2026-10-22T06:16:00Z'));
+    assert.deepEqual(events, ['EVENT recovery t1 proceeded-on-default turn=new-1 asked=q-1: sort by rank']);
+    const [start] = turnStarts(h.fake.calls);
+    assert.equal(start.params.threadId, 'T1');
+    assert.match(start.params.input[0].text, /Go ahead on your stated default: sort by rank/);
+    threads.T1.turns.at(-1).status = 'completed';
+    threads.T1.status = { type: 'idle' };
+    threads.T1.turns.at(-1).items = threads.T1.turns[0].items;
+    threads.T1.turns.at(-1).id = 'q-1';
+    assert.deepEqual(await h.pass(at('2026-10-22T07:00:00Z')), [], 'once per asking turn');
+    assert.equal(turnStarts(h.fake.calls).length, 1);
+  } finally {
+    h.close();
+  }
+});
diff --git a/plugins/vibe/skills/codex-fleet-monitor/scripts/snapshot.sh b/plugins/vibe/skills/codex-fleet-monitor/scripts/snapshot.sh
index de0d3261..28abbf58 100755
--- a/plugins/vibe/skills/codex-fleet-monitor/scripts/snapshot.sh
+++ b/plugins/vibe/skills/codex-fleet-monitor/scripts/snapshot.sh
@@ -18,6 +18,7 @@ remote_node() {
     ${REMOTE_HOST:?set REMOTE_HOST} "mkdir -p $d && tar -C $d -xf - && $REMOTE_SHELL 'env $e node $d/$*'" 2>/dev/null
 }
 # A failed gh call prints nothing; keep the last non-empty value for that key so a blip is not an event.
+zmodload zsh/datetime
 keep() { local f=$W/keep-${1//[^A-Za-z0-9_-]/_}.txt; if [ -n "$2" ]; then echo "$2" > $f; echo "$2"; elif [ -f $f ]; then cat $f; fi; }
 # "requests <where> <count> <newest file>" from a newest-first listing command.
 requests() {
@@ -46,10 +47,11 @@ if [ -n "${R// }" ]; then
   else echo "session remote $REMOTE_HOST UNREACHABLE"; fi
 fi
 USAGE_HIGH_PERCENT=$HIGH node $K/ratelimit.mjs local 2>/dev/null
+[ "${CLAUDE_USAGE:-1}" = 0 ] || USAGE_HIGH_PERCENT=$HIGH CLAUDE_USAGE_SECONDS=${CLAUDE_USAGE_SECONDS:-} node $K/claude-usage.mjs $W local 2>/dev/null
 if [ -n "${REMOTE_HOST:-}" ]; then out=$(remote_node ratelimit.mjs remote); echo "${out:-codex-usage remote unreadable READFAIL}"; fi
 if [ -n "${REQUESTS_DIR:-}" ]; then requests local ls -t $REQUESTS_DIR; fi
 if [ -n "${REMOTE_REQUESTS_DIR:-}" ]; then requests remote ssh -o ConnectTimeout=10 ${REMOTE_HOST:?set REMOTE_HOST} "ls -t $REMOTE_REQUESTS_DIR"; fi
-zsh $K/classify.sh $W/item-history.txt $STALL_SECONDS < $W/live.txt
+zsh $K/classify.sh $W/item-history.txt $STALL_SECONDS ${QUESTION_SECONDS:-900} < $W/live.txt
 for r in ${=WATCH_NEW_PR_REPOS}; do
   op=$(gh pr list -R $r --state open --search "${PR_SEARCH:-}" --json number --jq '.[].number' 2>/dev/null | sort -n | tr '\n' ' ')
   echo "open-prs $r $(keep open-$r "$op")"
@@ -58,7 +60,7 @@ done
 prune_pr_state() {
   local -A live; local r n f rest
   [ -f $W/prs.txt ] && while read r n; do [ -n "$n" ] && live[${r//[^A-Za-z0-9_-]/_}-$n]=1 && live[${r//\//_}-$n]=1; done < $W/prs.txt
-  for f in $W/keep-(st|c|v|i|t|ck)-*.txt(N) $W/merge-*.txt(N) $W/checks-*.txt(N); do
+  for f in $W/keep-(st|c|v|i|t|ck|pu)-*.txt(N) $W/merge-*.txt(N) $W/checks-*.txt(N); do
     rest=${${f:t:r}#keep-}; rest=${rest#*-}
     [ -n "${live[$rest]:-}" ] || rm -f $f
   done
@@ -89,5 +91,14 @@ while read r n; do
   elif [[ "$ck" == *pending* ]]; then ck=$(keep ck-$r-$n "$(cat $kc 2>/dev/null) (running)")
   else echo "$ck" > $kc; ck=$(keep ck-$r-$n "$ck"); fi
   blocked=; [[ ${st%% *} == OPEN && ${t:-0} -gt 0 ]] && blocked=" BLOCKED(unresolved threads)"
-  echo "pr $r#$n $st comments=$c reviews=$v inline=$i threads=$t checks=$ck$blocked"
+  # An open PR that needs its writer (threads, a conflict, a draft, a failed check) with no push for
+  # STALE_PR_SECONDS is STALE-PR, however busy the writer looks: one sat 6 hours on 5 threads with no push.
+  pu=$(gh pr view $n -R $r --json isDraft,commits --jq '"\(.isDraft) \(.commits[-1].commit.committedDate)"' 2>/dev/null); pu=$(keep pu-$r-$n "$pu")
+  stale=; pushed=0
+  [[ -n ${pu#* } ]] && TZ=UTC strftime -r -s pushed '%Y-%m-%dT%H:%M:%SZ' "${pu#* }" 2>/dev/null
+  if [[ ${st%% *} == OPEN && $pushed -gt 0 && $(( EPOCHSECONDS - pushed )) -ge ${STALE_PR_SECONDS:-2700} ]] &&
+     [[ ${t:-0} -gt 0 || $m == CONFLICTING || ${pu%% *} == true || $ck == *fail* ]]; then
+    stale=" STALE-PR(no push for ${STALE_PR_SECONDS:-2700}s+)"
+  fi
+  echo "pr $r#$n $st comments=$c reviews=$v inline=$i threads=$t checks=$ck$blocked$stale"
 done < $W/prs.txt
diff --git a/plugins/vibe/skills/codex-fleet-monitor/scripts/snapshot.test.mjs b/plugins/vibe/skills/codex-fleet-monitor/scripts/snapshot.test.mjs
index cefec714..2bbdfe8c 100644
--- a/plugins/vibe/skills/codex-fleet-monitor/scripts/snapshot.test.mjs
+++ b/plugins/vibe/skills/codex-fleet-monitor/scripts/snapshot.test.mjs
@@ -16,7 +16,8 @@ case "$*" in
   "api user"*) echo me ;;
   "api graphql"*) cat "$FAKE_ROOT/threads" 2>/dev/null || echo 0 ;;
   "pr list"*) printf '5\\n7\\n' ;;
-  "pr view"*) echo "OPEN abcdef12 APPROVED MERGEABLE" ;;
+  "pr view"*isDraft*) cat "$FAKE_ROOT/push" 2>/dev/null || echo "false $(date -u +%Y-%m-%dT%H:%M:%SZ)" ;;
+  "pr view"*) cat "$FAKE_ROOT/view" 2>/dev/null || echo "OPEN abcdef12 APPROVED MERGEABLE" ;;
   "pr checks"*) printf 'build\\tpass\\t1m\\nlint\\tpass\\t1m\\n' ;;
   *"/issues/"*) echo 2 ;;
   *"/reviews"*) echo 1 ;;
@@ -34,7 +35,8 @@ function fixture() {
   writeFileSync(join(bin, 'gh'), FAKE_GH);
   // No App Server here: codex fails, so the usage line reads READFAIL on every run.
   writeFileSync(join(bin, 'codex'), '#!/bin/sh\nexit 1\n');
-  for (const name of ['gh', 'codex']) chmodSync(join(bin, name), 0o755);
+  writeFileSync(join(bin, 'claude'), `#!/bin/sh\ncat "${root}/claude-usage" 2>/dev/null || exit 1\n`);
+  for (const name of ['gh', 'codex', 'claude']) chmodSync(join(bin, name), 0o755);
   writeFileSync(join(work, 'config.env'), 'WATCH_NEW_PR_REPOS="acme/app"\n');
   writeFileSync(join(work, 'prs.txt'), 'acme/app 42\n');
   const env = { ...process.env, FAKE_ROOT: root, PATH: `${bin}:${process.env.PATH}`, FLEET_SUPERVISOR_LOCK: join(root, 'supervisor.lock') };
@@ -125,3 +127,29 @@ test('an approved PR with unresolved review threads is BLOCKED, apart from its r
   assert.match(clear, /^pr acme\/app#42 .* threads=0 checks=/m);
   assert.doesNotMatch(clear, /BLOCKED/);
 });
+
+test('an open PR needing its writer with no push for 45 minutes is STALE-PR, however busy the writer looks (#9123)', TIMEOUT, () => {
+  const f = fixture();
+  const ago = (minutes) => new Date(Date.now() - minutes * 60_000).toISOString().replace(/\.\d{3}Z$/, 'Z');
+  writeFileSync(join(f.root, 'threads'), '5\n');
+  writeFileSync(join(f.root, 'push'), `false ${ago(46)}\n`);
+  assert.match(f.run('ok'), /^pr acme\/app#42 .* threads=5 .*BLOCKED\(unresolved threads\) STALE-PR\(no push for 2700s\+\)$/m);
+  writeFileSync(join(f.root, 'push'), `false ${ago(30)}\n`);
+  assert.doesNotMatch(f.run('ok'), /STALE-PR/, 'a push within 45 minutes is fresh');
+  writeFileSync(join(f.root, 'threads'), '0\n');
+  writeFileSync(join(f.root, 'push'), `false ${ago(300)}\n`);
+  assert.doesNotMatch(f.run('ok'), /STALE-PR/, 'an old PR with nothing for its writer to do is not stale');
+  writeFileSync(join(f.root, 'push'), `true ${ago(60)}\n`);
+  assert.match(f.run('ok'), /STALE-PR/, 'a draft needs its writer');
+  writeFileSync(join(f.root, 'push'), `false ${ago(60)}\n`);
+  writeFileSync(join(f.root, 'view'), 'OPEN abcdef12 APPROVED CONFLICTING\n');
+  assert.match(f.run('ok'), /STALE-PR/, 'a conflict needs its writer');
+});
+
+test('the Claude usage line reads claude -p /usage on the Codex bands, at most once per CLAUDE_USAGE_SECONDS', TIMEOUT, () => {
+  const f = fixture();
+  writeFileSync(join(f.root, 'claude-usage'), 'Current session: 51% used \u00b7 resets Oct 22 at 12:39pm (America/Chicago)\nCurrent week (all models): 69% used \u00b7 resets Oct 27 at 9am (America/Chicago)\n');
+  assert.match(f.run('ok'), /^claude-usage local session=under80% week=under80%$/m);
+  writeFileSync(join(f.root, 'claude-usage'), 'Current session: 91% used \u00b7 resets Oct 22 at 12:39pm (America/Chicago)\nCurrent week (all models): 69% used\n');
+  assert.match(f.run('ok'), /^claude-usage local session=under80%/m, 'the cached line holds within the interval');
+});
diff --git a/plugins/vibe/skills/codex-fleet-monitor/scripts/watch.sh b/plugins/vibe/skills/codex-fleet-monitor/scripts/watch.sh
index d81471d8..02672ef7 100755
--- a/plugins/vibe/skills/codex-fleet-monitor/scripts/watch.sh
+++ b/plugins/vibe/skills/codex-fleet-monitor/scripts/watch.sh
@@ -1,6 +1,11 @@
 #!/bin/zsh
-# Usage: watch.sh <workDir> [intervalSeconds]. Exits with the diff on the first change.
+# Usage: watch.sh <workDir> [intervalSeconds]. Exits with the diff on the first change, or with HEARTBEAT
+# after HEARTBEAT_SECONDS (config.env or environment, default 1800) with none, so an armed watcher wakes its
+# orchestrator at least that often to read teammate messages: writers' questions once sat unread for 7 hours.
 K=${0:A:h}; W=${1:?workDir}; I=${2:-120}
+H=${HEARTBEAT_SECONDS:-$([ -f $W/config.env ] && sed -n 's/^HEARTBEAT_SECONDS=\([0-9][0-9]*\).*/\1/p' $W/config.env | tail -1)}
+H=${H:-1800}; T=$(( H / I )); (( T < 1 )) && T=1
+S=${WATCH_SNAPSHOT:-$K/snapshot.sh}
 # One watcher per work dir. A second copy (one started with `&` in a foreground shell, then started again)
 # double-reports every event and outlives the turn that started it, so it is refused, not run.
 lock=$W/watch.lock
@@ -23,15 +28,15 @@ beat() {
 }
 beat
 # Compare against the last snapshot the previous run saw, so a change between runs is still reported.
-if [ -s $W/last-snapshot.txt ]; then base=$(cat $W/last-snapshot.txt); else base=$(zsh $K/snapshot.sh $W); echo "$base" > $W/last-snapshot.txt; fi
-for _ in $(seq 1 200); do
+if [ -s $W/last-snapshot.txt ]; then base=$(cat $W/last-snapshot.txt); else base=$(zsh $S $W); echo "$base" > $W/last-snapshot.txt; fi
+for _ in $(seq 1 $T); do
   sleep $I
   # Each tick runs a recovery pass first (recover.mjs), so a transient failure is resumed without you.
-  now=$(RECOVER=1 zsh $K/snapshot.sh $W)
+  now=$(RECOVER=1 zsh $S $W)
   beat
   if [ -n "$now" ] && [ "$now" != "$base" ]; then
     echo "$now" > $W/last-snapshot.txt; beat ",\"exitedAt\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\""; echo EVENT; diff <(echo "$base") <(echo "$now") | grep '^[<>]'; exit 0
   fi
 done
 beat ",\"exitedAt\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\""
-echo TIMEOUT; cat $W/last-snapshot.txt
+echo "HEARTBEAT no change for ${H}s: read every teammate message and each idle writer's question, then re-arm"; cat $W/last-snapshot.txt
diff --git a/plugins/vibe/skills/codex-fleet-monitor/scripts/watcher.test.mjs b/plugins/vibe/skills/codex-fleet-monitor/scripts/watcher.test.mjs
index d41b18f9..ce4f28b0 100644
--- a/plugins/vibe/skills/codex-fleet-monitor/scripts/watcher.test.mjs
+++ b/plugins/vibe/skills/codex-fleet-monitor/scripts/watcher.test.mjs
@@ -137,3 +137,14 @@ test('a second watch.sh on the same work dir is refused while the first runs, an
   }
   assert.equal(state?.pid, third.pid);
 });
+
+test('an armed watcher with no change exits with HEARTBEAT after HEARTBEAT_SECONDS (7 quiet hours overnight)', { timeout: 30_000 }, (t) => {
+  const dir = workDir(t);
+  const snapshot = join(dir, 'fake-snapshot.sh');
+  writeFileSync(snapshot, 'print "session local a RUN"\n');
+  writeFileSync(join(dir, 'config.env'), 'HEARTBEAT_SECONDS=2\n');
+  const run = spawnSync('zsh', [WATCH, dir, '1'], { encoding: 'utf8', timeout: 20_000, env: { ...process.env, WATCH_SNAPSHOT: snapshot } });
+  assert.equal(run.status, 0);
+  assert.match(run.stdout, /^HEARTBEAT no change for 2s: read every teammate message/m);
+  assert.ok(JSON.parse(readFileSync(join(dir, 'watcher.json'), 'utf8')).exitedAt, 'the heartbeat exit is recorded, so watcher.mjs says to re-arm');
+});
diff --git a/plugins/vibe/skills/fleet-orchestrator/SKILL.md b/plugins/vibe/skills/fleet-orchestrator/SKILL.md
index 7be966c7..14baaee9 100644
--- a/plugins/vibe/skills/fleet-orchestrator/SKILL.md
+++ b/plugins/vibe/skills/fleet-orchestrator/SKILL.md
@@ -12,7 +12,7 @@ You run a program of several PRs at once: you plan, route, review, push back and
 1. **The operator's attention is the scarcest resource.** Decide everything you can yourself (precedent, sibling consistency, repo rules, measurements), act on it, and tell the operator the ruling in one line so they can override. Escalate only what needs them (product trade-offs, irreversible actions, approvals the repo reserves for humans), one question at a time with a recommendation. Never forward a worker's question or result without first trying to settle or verify it.
    Before any ruling on behavior, follow the single ordered product-question
    research list in [vibe's quality loop](../vibe/references/quality-loop.md#communication-and-product-questions); do not copy or reorder it here. Under fleet orchestration, a writer's `NEEDS_PERSON` comes to you, and you finish that list before asking the operator.
-   A scope exclusion, deferral or "obsolete" call counts only with a human source (operator ruling): a ticket AC, a PRD line, a recorded operator ruling, or a plan with a named human approver. A self-approved plan or a handoff note never counts, and writers ask before dropping or narrowing anything.
+   A scope exclusion, deferral or "obsolete" call counts only with a human source that names the ticket or its PRD (operator ruling; `rulings-check.mjs --ruling <words> --scope <ticket>,<PRD>`): a ticket AC, a PRD line, a recorded operator ruling, or a plan with a named human approver. A self-approved plan or a handoff note never counts, and writers ask before dropping or narrowing anything.
    Every question to the operator names where you checked the code first (`checked in code: <file>:<line>`); drop one the code already answers. `scripts/review-page-check.mjs` refuses a decision row without it.
 
    A human-sourced line that conflicts with the ruling goes to the operator as a question with a recommendation. Record every ruling with its source in the resume log as `- Ruling (<who>): <decision>`, and have the writer add it to the ticket with the criteria it amends (`../handoff/scripts/rulings-check.mjs` fails until it is there) and cite it on the relevant thread.
@@ -74,7 +74,11 @@ The closedloop-graph MCP server is required; decide from it, not from guesses. T
 Run [codex-fleet-monitor](../codex-fleet-monitor/SKILL.md) (`vibe:codex-fleet-monitor`) on the same `<orchDir>` in the background for the whole program and act on its lines as its table says, including usage bands, paid-credit spending and request files. It reads the session state files `fleet.sh` writes, listed as `local|remote <name>` in `sessions.txt`.
 
 - The watcher resumes a session after a transient provider failure on its own; read its `recovery` lines when you wake. Run its supervisor on every machine that hosts Codex writers, so recovery also happens while you are not running. Set `AUTO_RESTART_DAEMON=1` in `config.env` only when the operator agrees that a stuck daemon may be restarted unattended.
-- Re-arm the watcher in the same step you read each event. It only watches while running, and it costs nothing while waiting. Before ending any turn that handled an event, `node ../codex-fleet-monitor/scripts/watcher.mjs <orchDir>` must print `watcher ok`; on `MISSING`, re-arm it. A lost re-arm once left pushes unhandled for two hours. Start it with the harness's background option (`run_in_background`), never with `&`, which left a stray copy twice; `watch.sh` refuses a second copy for the same work dir.
+- Re-arm the watcher in the same step you read each event. It only watches while running, and it costs nothing while waiting. Before ending any turn that handled an event, `node ../codex-fleet-monitor/scripts/watcher.mjs <orchDir>` must print `watcher ok`; on `MISSING` (`board.mjs status` prints `WATCHER-MISSING`), re-arm it. A lost re-arm once left writers' questions unread for seven hours overnight. Start it with the harness's background option (`run_in_background`), never with `&`, which left a stray copy twice; `watch.sh` refuses a second copy for the same work dir.
+- The armed watcher is your heartbeat (`HEARTBEAT` every 30 quiet minutes); on every wake read every teammate message first. While the operator is away, also keep a recurring schedule (loop or cron, 20 to 30 minutes) that does the same and checks `watcher.mjs`. Recovery resumes an idle Codex writer on its default once its question's deadline passes.
+- Answer a writer's question within 15 minutes: the watcher's `QUESTION-UNANSWERED` (Codex) and `board.mjs status`'s (questions Claude writers record with `board.mjs question`) mark the late ones; answer, or tell the writer to proceed on its default.
+- On `STALE-PR` (a PR needing its writer with no push for 45 minutes), ask the owning writer for an ETA, unblock it, or reassign it, whatever the writer reports it is busy with; one PR sat six hours on five threads while its writer looked busy.
+- Push for a writer only the head it declared push-ready (`board.mjs <orchDir> writer <name> --ready <sha>`): `board.mjs <orchDir> push-check <writer> --head <sha>` must print `READY` first. Otherwise ask the writer for its ready head and wait. A writer's committed head once went to auto-merge while the writer was still fixing two regressions in it.
 - Before you or a reviewer inspect a head, check it equals the pushed PR head (`gh pr view <n> --json headRefOid`). Sessions sometimes report local, unpushed commits.
 
 ## Codex sessions
@@ -111,7 +115,7 @@ scripts/fleet.sh <orchDir> local|remote session last  <name> [--count <n>]
 
 Writers that could not see each other's work collided, a QA guide never heard its checkpoint was ready, and a UX ruling reached one writer while another PR rendered the same behavior. `scripts/board.mjs` keeps `<orchDir>/board.md`, the page every writer reads:
 
-- At every writer assignment and every merge, gather each in-scope PRD's children (status, assigned writer, linked pull requests and their state) into a snapshot and run `node scripts/status-audit.mjs --snapshot <file>`. It fails until each `MISMATCH` (a merged PR means DONE; an open PR or a writer means IN_PROGRESS or IN_REVIEW) and `UNOWNED` child (not done, no writer) is fixed, or listed under `outOfScope` with who ruled it out. Statuses once drifted until the operator noticed.
+- The status sweep, a standing `status-sweep` duty. At every writer assignment and every merge, and at every status report, gather each in-scope PRD's children (status, assigned writer, linked pull requests and their state, the latest body of each merged or DONE one, its plans, and the umbrella that absorbed it) into a snapshot and run `node scripts/status-audit.mjs --snapshot <file>`. It fails until each `MISMATCH`, `UNOWNED`, `UNREAD`, `UNCHECKED`, `PLAN-OPEN` and `ABSORBED-OPEN` child is fixed or listed under `outOfScope` with who ruled it out. Closing an umbrella ticket closes the children it absorbed in the same step, with its merge as evidence. A merge alone never makes a ticket DONE: its criteria are checked against the merged code first.
 - When you launch a writer, add its row (`board.mjs <orchDir> writer <name> --runtime codex|claude --pr <n> --repo <owner/repo> --head <sha> --status <text> --deps <a,b>`) and give it the board path and the messaging recipe ([worker preamble](./references/templates.md#worker-preamble)). Update the row on every push report.
 - Writers message each other directly: Codex writers through the `app-server-orchestrator` skill's send, Claude workers and QA guides through SendMessage.
 - A settled UX ruling is saved once as a reference file with its screenshots in a shared evidence location. Find every renderer of the behavior with `code_grep` across each open PR's diff and main, then `board.mjs <orchDir> deliver <ruling> --kind ruling --reference <file> --to <every owning writer and QA guide>`. Every QA plan for that behavior cites the reference, and one shared component beats each PR building its own.
@@ -120,7 +124,7 @@ Writers that could not see each other's work collided, a QA guide never heard it
 
 ## Moving work between runtimes and accounts
 
-- When a machine's `codex-usage` band reaches `MOVE_AT_PERCENT`, or its trend says it will before the work is done, tell the operator at once with the band and `resets=<n>`: applying a limit reset is theirs. When they are away, move its busiest writers to Claude writers now instead of waiting for an answer. Move them on any `LIMIT` or `LIMIT-SPENDING-CREDITS` line too. Move a Claude writer when it hits its usage or rate limit; the monitor cannot read Claude usage, so you learn it from the worker's errors or from the operator.
+- When a machine's `codex-usage` band reaches `MOVE_AT_PERCENT`, or its trend says it will before the work is done, tell the operator at once with the band and `resets=<n>`: applying a limit reset is theirs. When they are away, move its busiest writers to Claude writers now instead of waiting for an answer. Move them on any `LIMIT` or `LIMIT-SPENDING-CREDITS` line too. Claude usage is the watcher's `claude-usage` line (from `claude -p "/usage"`, session and weekly bands on the same threshold): on a `HIGH` band tell the operator at once with its reset time, and when they are away move the busiest Claude writers to Codex writers; move one at once when it hits its limit.
 - When the operator reports high Claude usage, stop idle and polling Claude workers first, ask active ones to push a checkpoint and end, move their remaining work to Codex writers, and widen the Claude polling interval.
 - Before any move the old writer stops, or is confirmed dead, after committing and pushing or reporting its uncommitted state. One writer per branch holds through every move.
 - Codex to another Codex machine or account: a fresh thread through `fleet.sh` in the branch's worktree there, with a [resume prompt](./references/templates.md#resume-prompt).
@@ -135,7 +139,7 @@ Writers that could not see each other's work collided, a QA guide never heard it
 - Cap heavy runs per machine at its `HEAVY_SLOTS` or `REMOTE_HEAVY_SLOTS`: `scripts/fleet.sh <orchDir> local|remote slot heavy <owner> <worktree> <command...>`.
 - A shared e2e stack with fixed ports runs only under vibe's machine-wide e2e lock, the one every vibe session's e2e command already takes: `node ../vibe/scripts/e2e-lock.mjs run <command...>` on the machine that runs the stack. A second lock for the same stack would let two runs collide. The lock gives each run its own compose project, so a teardown removes only its own stack; name a stack another tool started on the same ports with `--foreign-compose <project>`. Only runs that start that stack take it; tests against a stand-in server, component story runs, unit tests and typecheck run outside it in parallel.
 - `scripts/slot-lock.sh` underneath frees the slot when the command exits or is interrupted and reclaims one whose holder pid died; `scripts/slot-lock.sh --status <lockName>` on that machine lists holders.
-- Kill only processes you started, matched by pid or worktree path, never an unscoped `pkill`. Other runs on that machine belong to someone else. Never signal a pid of 1 or lower or a process group you did not spawn: `kill(-1)` from a plugin test once ended every app on the operator's machine. Tests that send signals run on another machine, never the operator's daily one.
+- Kill only processes you started, by recorded pid, never by pattern: vibe's `hooks/kill-guard.mjs` refuses `pkill`, `killall` and `kill` of an unrecorded pid in every Claude session with the plugin. Other runs on that machine belong to someone else. Never signal a pid of 1 or lower or a process group you did not spawn: `kill(-1)` from a plugin test once ended every app on the operator's machine. Tests that send signals run on another machine, never the operator's daily one.
 - Plugin marketplaces and env files on a remote machine live in persistent paths too.
 
 ## Quality gates and QA
@@ -152,11 +156,11 @@ Writers that could not see each other's work collided, a QA guide never heard it
 - Before an audit, reconcile operator chat and AskUserQuestion answers plus guide-session and QA records into `<orchDir>/rulings.md`, then run `node ../handoff/scripts/rulings-check.mjs --program <orchDir>/rulings.md --record <transcript-or-record> ...`; audit the acceptance criteria together with those rulings. The applicable per-ticket entries remain enforced by handoff's `rulings-check.mjs`.
 - Before showing `<orchDir>/review.md`, run `node scripts/review-page-check.mjs <orchDir>/review.md`; duplicate or untyped finding IDs block the report.
 - The QA plan is a two-way trace between that list and the diff: each checkpoint cites one criterion ID, a diff change mapping to no criterion is a finding, never a checkpoint, and a criterion with no change and no coverage is a gap. Regression checks on neighboring surfaces the diff touches are labeled separately; a regression failure is a bug, never a new requirement.
-- Agent-first QA, zero human checkpoints by default: an agent verifies everything it can (e2e on the current head, DOM and accessibility reads, API second views, headless screenshots it compares with the saved reference itself) and records it. The operator gets only checkpoints an agent cannot cover: real-device feel, assistive tech, flows an agent cannot drive, a product call no reference settles; measure the rest (contrast ratios, box geometry, focus targets). `node scripts/qa-plan-check.mjs --plan <QA record>` must pass before the plan reaches the operator; it refuses a human checkpoint without such a reason, a visual one included. A defect an agent already observed goes to the writer with its measurement, not to the human checklist.
+- Agent-first QA, zero human checkpoints by default: an agent verifies everything it can (e2e on the current head, DOM and accessibility reads, API second views, headless screenshots it compares with the saved reference itself) and records it. The operator gets only checkpoints an agent cannot cover: real-device feel, assistive tech, flows an agent cannot drive, a product call no reference settles; measure the rest (contrast ratios, box geometry, focus targets). `node scripts/qa-plan-check.mjs --plan <QA record> --criteria <ticket body> --prd <PRD body>` must pass before the plan reaches the operator: every rollout, flag and rollback requirement is a checkpoint, and it refuses a human checkpoint without such a reason, a visual one included. A defect an agent already observed goes to the writer with its measurement, not to the human checklist.
 - A confirmed visual-QA finding on a surface the change touches is a required fix even when it predates the branch, is already on main or was called an owner's decision. User-facing copy still needs a human source: reuse approved copy or escalate the wording.
 - Before handoff, `node scripts/finding-brief.mjs <orchDir> --findings <findings.json> --require-disposition` must pass. Every touched-surface finding records `fixed: <sha>` or, only when a fix cannot be made in this pull request, `ticket: <id>`.
 - A QA rerun that toggles flags or moves data never uses the stack handed to the operator: `helpers.mjs <orchDir> hand <stack> --to <guide>` when the guide gets it, `unhand` when QA ends, and start the rerun helper with `--stack <its own stack>` (refused on a handed one).
-- Writers push a tested checkpoint at least every 90 minutes of active work (vibe's commit reports `pushDue`); review findings after that go out as follow-up commits reviewed per diff, and never add new scope to an unpushed checkpoint. A critical-path PR once sat unpushed for 5 hours while each review pass added scope.
+- Writers push a tested checkpoint at least every 45 minutes of active work and never hold one for optional evidence (vibe's commit reports `pushDue`); review findings after that go out as follow-up commits reviewed per diff, and never add new scope to an unpushed checkpoint. A critical-path PR once sat unpushed for 5 hours while each review pass added scope.
 - Human QA runs in a dedicated Claude QA-guide session per PR that the operator talks to directly. When the PR's QA plan is ready:
   1. Save the [QA guide prompt](./references/templates.md#qa-guide-prompt) to `prompts/`.
   2. Launch it headless from the repo root (`claude -p --output-format json` with the tools it needs allowed).
@@ -169,6 +173,7 @@ Writers that could not see each other's work collided, a QA guide never heard it
   Before filing a ticket or moving one to in review, run `node ../vibe/scripts/ticket-write-check.mjs` with its project, parents and status; it refuses a past sprint, a parent that is executed, obsolete, done or canceled, and in review without the delivering pull request. Set the project explicitly rather than taking the default.
 - Check the test selection in each push report (the PR evidence file's selected tests and their runs) and have QA compare it with the specs the PR edits; selection covers the whole branch diff, not the latest push.
 - Every PR gets an independent review, then a verification pass of the fixes, before it is QA-ready. Resolve a thread only after the fix is verified in code, with a reply naming the fixing SHA.
+- One review round per PR (operator ruling): threads raised after the round-one fixes are pushed never block or delay the merge. A valid one becomes a criterion on the PR's one follow-up ticket (created once in the current sprint project, assigned to the operator, `TODO`, related to the PR's ticket, titled `<PR ticket>: follow-ups from #<PR> review`; later rounds append to it), and the thread gets that ticket's link or why it is invalid, then is resolved. `shepherd.mjs --round-one-fixed-at` and `review-followup.mjs` enforce both.
 - Before enqueue, run the lanes the diff can affect wherever PR CI skips them (the repo's lane selector, never full suites by default), and resolve shared version-file conflicts right before each enqueue, in merge order. The queue rebuilds on current main, and a skipped suite is not a pass.
 - A release-version bump every UI PR touches (a component catalog version and its history entry) is made only at enqueue time, and the operator arms auto-merge in the same minute; made earlier, it re-conflicts with every other open PR.
 - A fix merged to main reaches a preview only once the ref the preview's backing environment deploys from contains it: check ancestry against that ref (`git merge-base --is-ancestor <fix> <ref>`) before calling a preview fix live.
@@ -186,6 +191,15 @@ Pushback applies principle 2; more judgment patterns from past programs: [refere
 - Respect operator boundaries on other teams' work, such as "don't fix main" while another owner is fixing it.
 - Work outside the program goes to its owner (operator ruling): a security or infrastructure finding outside its scope, such as a runtime advisory, becomes a ticket assigned to that owner, and the worker investigating it stops. The program does not take the fix.
 
+## Program practices
+
+- Green watch: `board.mjs` requires a `green-watch` owner while PRs are watched (`MISSING-DUTY`). After program PRs merge, that owner follows each post-merge batch until `GREEN_REF` advances, with `GREEN_WATCH_AGENT` where the repo has one, and runs `node scripts/green-watch.mjs --repo <owner/repo> --worktree <clone> --program <merge shas>` before every report: it re-lists main's runs each time and covers every lane of every run containing a program PR, so a batch that starts later is not missed. It attributes every red to its PR and author, fixes ours in one PR, and files one ticket per other author in the current sprint, assigned to them with evidence and a fix. It never cuts a release.
+- Placement: `fleet.sh slot heavy` refuses a machine whose load per core is over `MAX_LOAD_PER_CORE` (exit 4); send the run to the other machine. E2e and desktop app runs never go on the operator's daily machine.
+- Repo knowledge: a repo fact a worker learns goes into the team's repo memory (`REPO_MEMORY_CMD`), and into the nearest `AGENTS.md` through that worker's PR when it binds code.
+- Close-out: `executed-check.mjs --kind prd` before a PRD is executed (its flags section first) and `status-audit.mjs` at every merge and writer assignment.
+- Deadline mode, only when the operator rules it (record it in `rulings.md` with its end): no pre-merge e2e, follow-up pushes run focused tests plus the affected typecheck and leave full lanes to CI, and extras ship in follow-up PRs.
+- Runtime choice: judgment-heavy work and takeovers go to Claude writers, which are faster; bulk mechanical work goes to Codex on `CODEX_MODEL`, which is cheaper. Move work on usage and speed.
+
 ## Lessons loop
 
 - Log every finding you route to a writer in the lessons ledger at the same moment, tagged new or repeat, with owner and fix. Batched later, they get lost. Format: [references/state.md](./references/state.md#lessons-ledger).
@@ -210,4 +224,4 @@ Hard rule. A ticket, PR body, PR comment, review reply or any other artifact wri
 - When the operator steps away, keep `<orchDir>/attention.md` current (decision needed, recommendation, what is blocked), keep reading idle writers' last messages, and lead with that list on return.
 - Put every finding the operator reviews on one page using the stable `D`, `X`, `N`, `S` and `R` IDs in the [operator review template](./references/templates.md#operator-review-page); never restart numbering across audits.
 - The final report lists, per PRD, which flags must be on to see each change.
-- Before a PRD is marked executed, its first section is `## Production visual QA`: each feature flag its shipped changes rely on, where to see it in production and its current production state (or `No flags: <why>`), then `Checked: <ISO time>` taken after the last merge, so someone else can visual-QA it in production. `node ../handoff/scripts/executed-check.mjs --kind prd --file <PRD text> --last-merge <time> --children <its PRODUCES children read now>` must pass first; it also refuses while any child is not DONE or CANCELED, so report the open ones instead. A PRD was once marked executed with four children open.
+- Before a PRD is marked executed, `node ../handoff/scripts/executed-check.mjs --kind prd --file <PRD text> --last-merge <time> --children <its PRODUCES children read now>` must pass: its first section lists each flag its shipped changes rely on, where to see it in production and its state checked after the last merge, and every child is DONE or CANCELED; report open ones instead.
diff --git a/plugins/vibe/skills/fleet-orchestrator/references/setup.md b/plugins/vibe/skills/fleet-orchestrator/references/setup.md
index d47e9291..7d558d53 100644
--- a/plugins/vibe/skills/fleet-orchestrator/references/setup.md
+++ b/plugins/vibe/skills/fleet-orchestrator/references/setup.md
@@ -22,14 +22,22 @@ CODEX_MODEL=<model for each Codex writer thread>
 CODEX_EFFORT=<the high effort level, not the maximum>
 
 HEAVY_SLOTS=<concurrent heavy checks this machine can take>
+MAX_LOAD_PER_CORE=1.5                       # a heavy slot refuses this machine above this load per core
 MOVE_AT_PERCENT=<codex-usage band at which to move writers off a machine>
 
+# The target repo's own names for the program practices
+GREEN_REF=<the ref post-merge CI advances when main is healthy>
+GREEN_WATCH_AGENT=<the repo's agent that fixes a red post-merge batch, if it has one>
+REPO_MEMORY_CMD=<the command that adds an entry to the team's repo memory>
+REQUIRED_DUTIES="green-watch"               # board.mjs status prints MISSING-DUTY for each one without an owner
+
 # One other machine; leave all of these out for a single machine
 REMOTE_HOST=<ssh host or alias>
 REMOTE_STATE_DIR=<orchestration dir on that machine>/sessions
 REMOTE_REQUESTS_DIR=<orchestration dir on that machine>/requests
 REMOTE_SHELL="zsh -lic"                     # a login shell there that puts node, codex and gh on PATH
 REMOTE_HEAVY_SLOTS=<concurrent heavy checks that machine can take>
+REMOTE_MAX_LOAD_PER_CORE=1.5
 ```
 
 `fleet.sh` uses `LOCAL_STATE_DIR` (default `<orchDir>/sessions`), `CODEX_MODEL` and `CODEX_EFFORT` as `turn` defaults, the slot counts, and the `REMOTE_*` keys. Sub-agent models are not configured here: vibe's worker-model policy owns them. `MOVE_AT_PERCENT` is for you: compare it with each `codex-usage` line.
diff --git a/plugins/vibe/skills/fleet-orchestrator/references/templates.md b/plugins/vibe/skills/fleet-orchestrator/references/templates.md
index 83155137..f1375884 100644
--- a/plugins/vibe/skills/fleet-orchestrator/references/templates.md
+++ b/plugins/vibe/skills/fleet-orchestrator/references/templates.md
@@ -26,19 +26,20 @@ Prepend to every Claude writer prompt; keep the `Takeover` line only when replac
 ```
 Invoke vibe:vibe first: resume the vibe session for <ticket or PRD>, or start one for it, and follow its rules for all of the work below.
 You are the only writer on <owner/repo>#<number>, worktree <path> on <machine>, branch <branch>.
-Takeover: a Codex vibe session wrote this branch and stopped (<usage-limit|runtime-unavailable>). Resume that same vibe session and, before any other step, move its writer to you with vibe's harness switch (`writer-state.mjs migrate` with `harnessSwitch`, vibe's quality loop, "A writer whose runtime cannot run"). Never start a second session on this branch. Continue from its last pushed head <sha>; commit normally.
+Takeover: a Codex vibe session wrote this branch and stopped (<usage-limit|runtime-unavailable>). Resume that same vibe session and, before any other step, move its writer to you with vibe's harness switch (`writer-state.mjs migrate` with `harnessSwitch`, vibe's quality loop, "A writer whose runtime cannot run"). Never start a second session on this branch. Continue from its last pushed head <sha>; commit normally. Re-verify every "done" claim in its report, change log and thread replies with a test or a measurement before building on it.
 Inherited scope: trace every exclusion, deferral, "obsolete" or narrowed criterion you inherit from the previous writer (its plan, PLN, change log or report) to a human source: a ticket AC, a PRD line, an operator ruling, or a plan with a named human approver. Anything without one is built or escalated, never dropped; `rulings-check.mjs --plan` lists a linked PLN's uncited exclusions.
 Before editing, read the repo docs that own the paths you touch (AGENTS.md files or contributor guide) or the team knowledge base.
 Research graph-first with closedloop-graph before searching files by hand, as vibe requires: ticket_detail for the ticket and its PRD, query_collisions and blast_radius_tickets for overlapping work, code_callers and code_importers before a shared change.
 Tests: after any change, fix or merge (a conflict resolution included), run exactly the tests code_tests_for maps to the files it touched, nothing broader by default; files that map to no tests (changelog, README, version text) run none and CI confirms.
 Heavy checks go through <fleet.sh slot command for the chosen machine>. Never run e2e that opens windows on the operator's daily machine.
 Commands expected to take more than a few minutes run in the background. Check the worker inbox between steps so orchestration rulings are applied before more work.
+Questions to the orchestrator end with `If no answer by <time, 30 minutes on>: <your default>` and are recorded with `board.mjs <orchDir> question <you> --text <question>`; keep working meanwhile and past it proceed on the default (never for a flag, copy, destructive, credential or scope question). A question never holds your PR: ship what is done, arm auto-merge, put the answer-dependent part in a follow-up.
 Git: commit messages per the repo's conventions; regular push only, never force or amend after push.
 Review threads: reply on the thread naming the fixing SHA and resolve it only after the fix is verified in code.
 Artifacts for people (tickets, PR bodies, PR comments, review replies): never name a path on the operator's machine (home, temp, scratchpad or worktree paths) or say something is on someone's laptop. Embed screenshots as uploaded images and quote text evidence inline, briefly. A plan is attached, never pointed at: link the implementation plan as a plan document, and upload a QA plan or other working file as a ticket attachment named by its attachment name.
 Fleet board: <orchDir>/board.md shows every writer's PR, head, status and dependencies. Message another writer directly when your work touches theirs: Codex writers through the app-server-orchestrator skill's send, Claude workers and QA guides through SendMessage.
 Program rulings: read <orchDir>/rulings.md before planning, editing or auditing; the ticket carries the applicable per-ticket rulings through handoff's rulings check.
-Push a tested checkpoint at least every 90 minutes of active work; send review findings after that as follow-up commits, and add no new scope to an unpushed checkpoint.
+Declare each push-ready head with `board.mjs <orchDir> writer <you> --ready <sha>`; nobody pushes a head of yours you have not declared. Push a tested checkpoint at least every 45 minutes of active work, never held for optional evidence; send review findings after that as follow-up commits, and add no new scope to an unpushed checkpoint.
 Report when done: pushed head SHA, files changed, tests run and results, open items, anything that needs the operator.
 
 Task:
@@ -47,12 +48,13 @@ Task:
 
 ## Resume prompt
 
-Starts a Codex writer on work another writer began, or a fresh thread after a move or reboot. Fill it from the resume log and the last writer's report; for a Claude writer use the worker preamble with its `Takeover` line instead.
+Starts a Codex writer on work another writer began, or a fresh thread after a move or reboot. Fill it from the resume log and the last writer's report; for a Claude writer use the worker preamble with its `Takeover` line instead. `fleet.sh` refuses a prompt with a `Done:` line and no `Re-verify:` line.
 
 ```
 $vibe resume the vibe session for <ticket or PRD>.
 Worktree <path> on <machine>, branch <branch>, PR <owner/repo>#<number>, pushed head <full sha>. You are its only writer.
 Done: <what is finished and pushed>
+Re-verify: each Done claim with a test or a measurement before building on it.
 Left: <what remains, in order>
 Inherited scope: trace every exclusion, deferral, "obsolete" or narrowed criterion the previous writer left (its plan, PLN, change log or report) to a human source: a ticket AC, a PRD line, an operator ruling, or a plan with a named human approver. Anything without one is built or escalated, never dropped; `rulings-check.mjs --plan` lists a linked PLN's uncited exclusions.
 Rulings in force: read <orchDir>/rulings.md; the ticket carries the applicable per-ticket rulings through handoff's rulings check.
diff --git a/plugins/vibe/skills/fleet-orchestrator/scripts/board.mjs b/plugins/vibe/skills/fleet-orchestrator/scripts/board.mjs
index d8fd16ca..c7b23082 100644
--- a/plugins/vibe/skills/fleet-orchestrator/scripts/board.mjs
+++ b/plugins/vibe/skills/fleet-orchestrator/scripts/board.mjs
@@ -4,10 +4,12 @@
 // a QA guide never heard that its checkpoint was ready, and a UX ruling
 // reached one writer as text while another PR rendered the same behavior.
 //
-// Usage: board.mjs <orchDir> writer <name> [--pr <n>] [--repo <owner/repo>] [--head <sha>] [--status <text>] [--deps <a,b>] [--runtime codex|claude]
+// Usage: board.mjs <orchDir> writer <name> [--pr <n>] [--repo <owner/repo>] [--head <sha>] [--ready <sha>] [--status <text>] [--deps <a,b>] [--runtime codex|claude]
+//        board.mjs <orchDir> push-check <writer> --head <sha>
 //        board.mjs <orchDir> deliver <item> --to <a,b> [--kind ruling|checkpoint|note] [--reference <file>] [--head <sha>]
 //        board.mjs <orchDir> told <item> <recipient>
 //        board.mjs <orchDir> duty <duty> --owner <writer or helper>
+//        board.mjs <orchDir> question <writer> --text <the question and its default> | answered <writer>
 //        board.mjs <orchDir> status [--pushed <name>=<sha>]... [--threads <name>=<n>]...
 //
 // `writer` adds or updates a writer's row (owner, PR, head, status,
@@ -27,17 +29,34 @@
 // owner was stopped with no replacement. `status` prints `UNOWNED-DUTY <duty>
 // owner <who> <why>` when the owner is neither a board writer nor a running
 // helper in helpers.json, and helpers.mjs refuses to stop an owner.
+// Each duty in `REQUIRED_DUTIES` (config.env, space-separated; default
+// `green-watch` and `status-sweep` once the work dir watches PRs in prs.txt)
+// must have one:
+// `status` prints `MISSING-DUTY <duty>` until it does. Merged program PRs once
+// broke main's post-merge batch with nobody following it.
 // A Codex writer (`--runtime codex`) whose head has not moved for 30 minutes
 // while its PR has unresolved human review threads (`--threads`, or read with
 // `gh api graphql` for rows with a PR and repo) prints `SLOW <writer> ...`:
 // hand it to a Claude writer. One spent 35 minutes on nine threads without a push.
-// Both count toward the exit status.
+// A writer declares the head it calls push-ready (`writer <name> --ready
+// <sha>`); `push-check` exits 1 unless the head you are about to push for it
+// is that one. The orchestrator once pushed a writer's committed head while the
+// writer was still fixing two regressions in it, and auto-merge took it.
+// A writer records each question it sends you (`question`); `status` prints
+// `QUESTION-UNANSWERED <writer> <m>m: <text>` once one waited 15 minutes, until
+// `answered`. A writer once held its PR six hours on an unanswered question.
+// All of these count toward the exit status, as does `WATCHER-MISSING(<why>)` when the
+// work dir watches sessions or PRs (sessions.txt or prs.txt) and its watcher is
+// not running: a watcher left unarmed overnight let writers' questions sit
+// unanswered for 7 hours.
 
 import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { parseArgs } from "node:util";
+import { watcherState } from "../../codex-fleet-monitor/scripts/watcher.mjs";
+import { readThreads } from "../../vibe/scripts/pr-threads.mjs";
 
 const STATE = "board.json";
 const PAGE = "board.md";
@@ -45,6 +64,7 @@ const KINDS = new Set(["ruling", "checkpoint", "note"]);
 const LOG_LINES = 50;
 const RUNTIMES = new Set(["codex", "claude"]);
 const SLOW_MINUTES = 30;
+const QUESTION_MINUTES = 15;
 const BOTS = new RegExp(process.env.BOT_LOGIN_REGEX || "vercel|codex|github-actions|copilot|bot", "i");
 
 /** Rows whose recorded head differs from the pushed head; a row with no known pushed head is not judged. */
@@ -71,6 +91,25 @@ export function unownedDuties(board, helpers) {
   });
 }
 
+/** Writers whose recorded question has waited QUESTION_MINUTES or more. */
+export function unansweredQuestions(board, now) {
+  return Object.entries(board.questions)
+    .map(([writer, { text, at }]) => ({ writer, text, minutes: Math.floor((now - Date.parse(at)) / 60_000) }))
+    .filter((entry) => entry.minutes >= QUESTION_MINUTES);
+}
+
+/** Required duties with no owner recorded. */
+export function missingDuties(board, required) {
+  return required.filter((duty) => !board.duties[duty]);
+}
+
+function requiredDuties(orchDir) {
+  const file = path.join(orchDir, "config.env");
+  const configured = existsSync(file) ? /^REQUIRED_DUTIES=["']?([^"'\n]*)["']?\s*$/m.exec(readFileSync(file, "utf8"))?.[1] : undefined;
+  if (configured !== undefined) return configured.split(/\s+/).filter(Boolean);
+  return existsSync(path.join(orchDir, "prs.txt")) ? ["green-watch", "status-sweep"] : [];
+}
+
 /** Every recipient of every delivery not yet told. */
 export function untold(board) {
   return Object.entries(board.deliveries).flatMap(([item, delivery]) =>
@@ -80,15 +119,15 @@ export function untold(board) {
 /** The page writers read. */
 export function render(board) {
   const rows = Object.entries(board.writers).map(([name, row]) =>
-    `| ${name} | ${row.pr ? `${row.repo ?? ""}#${row.pr}` : ""} | ${row.head ?? ""} | ${row.status ?? ""} | ${(row.deps ?? []).join(", ")} | ${row.updatedAt} |`);
+    `| ${name} | ${row.pr ? `${row.repo ?? ""}#${row.pr}` : ""} | ${row.head ?? ""} | ${row.ready ?? ""} | ${row.status ?? ""} | ${(row.deps ?? []).join(", ")} | ${row.updatedAt} |`);
   const open = untold(board).map(({ item, recipient, delivery }) =>
     `- ${item} (${delivery.kind}) for ${recipient}${delivery.reference ? `: ${delivery.reference}` : ""}${delivery.head ? ` at ${delivery.head}` : ""}`);
   const duties = Object.entries(board.duties).map(([duty, { owner, at }]) => `- ${duty}: ${owner} (since ${at})`);
   return [
     "# Fleet board",
     "",
-    "| Writer | PR | Head | Status | Depends on | Updated |",
-    "|---|---|---|---|---|---|",
+    "| Writer | PR | Head | Ready | Status | Depends on | Updated |",
+    "|---|---|---|---|---|---|---|",
     ...rows,
     "",
     "## Standing duties",
@@ -109,7 +148,7 @@ export function render(board) {
 function read(orchDir) {
   const file = path.join(orchDir, STATE);
   const board = existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : {};
-  return { writers: board.writers ?? {}, deliveries: board.deliveries ?? {}, duties: board.duties ?? {}, log: board.log ?? [] };
+  return { writers: board.writers ?? {}, deliveries: board.deliveries ?? {}, duties: board.duties ?? {}, questions: board.questions ?? {}, log: board.log ?? [] };
 }
 
 function write(orchDir, board, line, at) {
@@ -135,19 +174,10 @@ function ghHead(row) {
   }
 }
 
-const THREADS_QUERY = "query($o:String!,$n:String!,$p:Int!){repository(owner:$o,name:$n){pullRequest(number:$p){reviewThreads(first:100){nodes{isResolved comments(first:1){nodes{author{login}}}}}}}}";
-
 /** Unresolved review threads a human opened, or null when gh cannot answer. */
 function ghThreads(row) {
-  const [owner, name] = row.repo.split("/");
-  try {
-    const out = execFileSync(process.env.BOARD_GH || "gh", ["api", "graphql", "-f", `query=${THREADS_QUERY}`, "-F", `o=${owner}`, "-F", `n=${name}`, "-F", `p=${row.pr}`],
-      { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 30_000 });
-    const nodes = JSON.parse(out)?.data?.repository?.pullRequest?.reviewThreads?.nodes ?? [];
-    return nodes.filter((node) => !node.isResolved && !BOTS.test(node.comments?.nodes?.[0]?.author?.login ?? "bot")).length;
-  } catch {
-    return null;
-  }
+  const threads = readThreads(row.repo, row.pr, process.env.BOARD_GH || "gh");
+  return threads === null ? null : threads.filter((thread) => !thread.resolved && !BOTS.test(thread.opener ?? "bot")).length;
 }
 
 function pairs(texts, flag) {
@@ -196,11 +226,11 @@ function main(argv) {
       pr: { type: "string" }, repo: { type: "string" }, head: { type: "string" }, status: { type: "string" }, deps: { type: "string" },
       to: { type: "string" }, kind: { type: "string" }, reference: { type: "string" },
       pushed: { type: "string", multiple: true }, threads: { type: "string", multiple: true }, now: { type: "string" },
-      runtime: { type: "string" }, owner: { type: "string" },
+      runtime: { type: "string" }, owner: { type: "string" }, text: { type: "string" }, ready: { type: "string" },
     },
   });
-  if (!orchDir || !["writer", "deliver", "told", "duty", "status"].includes(action)) {
-    throw new Error("Usage: board.mjs <orchDir> writer|deliver|told|duty|status ...");
+  if (!orchDir || !["writer", "deliver", "told", "duty", "question", "answered", "push-check", "status"].includes(action)) {
+    throw new Error("Usage: board.mjs <orchDir> writer|deliver|told|duty|question|answered|push-check|status ...");
   }
   const board = read(orchDir);
   const now = values.now ? Date.parse(values.now) : Date.now();
@@ -216,13 +246,45 @@ function main(argv) {
     }
     const duties = unownedDuties(board, readHelpers(orchDir));
     for (const entry of duties) process.stdout.write(`UNOWNED-DUTY ${entry.duty} owner ${entry.owner} ${entry.why}\n`);
-    process.stdout.write(`board: ${Object.keys(board.writers).length} writers, ${stale.length} stale, ${open.length} untold, ${slow.length} slow, ${duties.length} unowned duties\n`);
-    return stale.length + open.length + slow.length + duties.length === 0 ? 0 : 1;
+    const missing = missingDuties(board, requiredDuties(orchDir));
+    for (const duty of missing) process.stdout.write(`MISSING-DUTY ${duty}: give it an owner with board.mjs <orchDir> duty ${duty} --owner <writer or helper>\n`);
+    const asked = unansweredQuestions(board, now);
+    for (const entry of asked) process.stdout.write(`QUESTION-UNANSWERED ${entry.writer} ${entry.minutes}m: ${entry.text.slice(0, 160)}\n`);
+    const watched = ["sessions.txt", "prs.txt"].some((file) => existsSync(path.join(orchDir, file)));
+    const watcher = watched ? watcherState(orchDir, now) : { ok: true };
+    if (!watcher.ok) process.stdout.write(`WATCHER-MISSING ${watcher.line.replace("watcher MISSING", "")}: re-arm watch.sh now (run_in_background)\n`);
+    process.stdout.write(`board: ${Object.keys(board.writers).length} writers, ${stale.length} stale, ${open.length} untold, ${slow.length} slow, ${duties.length + missing.length} unowned duties, ${asked.length} unanswered${watcher.ok ? "" : ", watcher missing"}\n`);
+    return stale.length + open.length + slow.length + duties.length + missing.length + asked.length + (watcher.ok ? 0 : 1) === 0 ? 0 : 1;
   }
   const [name, recipient] = positionals;
   if (!name) {
     throw new Error(`${action} needs a name.`);
   }
+  if (action === "push-check") {
+    const ready = board.writers[name]?.ready;
+    if (!values.head) {
+      throw new Error("push-check needs --head <the sha you would push>.");
+    }
+    if (!ready || !(ready.startsWith(values.head) || values.head.startsWith(ready)) || Math.min(ready.length, values.head.length) < 7) {
+      process.stdout.write(`NOT-READY ${name} head ${values.head}, declared ready ${ready ?? "none"}: ask the writer for its push-ready head and wait for it; never push a head it has not called ready\n`);
+      return 1;
+    }
+    process.stdout.write(`READY ${name} ${values.head}\n`);
+    return 0;
+  }
+  if (action === "question") {
+    if (!values.text?.trim()) {
+      throw new Error("question needs --text <the question and the default you proceed on>.");
+    }
+    board.questions[name] = { text: values.text.trim(), at };
+    write(orchDir, board, `${name} asked: ${values.text.trim().slice(0, 80)}`, at);
+    return 0;
+  }
+  if (action === "answered") {
+    delete board.questions[name];
+    write(orchDir, board, `${name} answered`, at);
+    return 0;
+  }
   if (action === "duty") {
     if (!values.owner) {
       throw new Error("duty needs --owner <writer or helper>; a standing duty is never left without one.");
@@ -236,7 +298,7 @@ function main(argv) {
       throw new Error("--runtime must be codex or claude.");
     }
     const row = board.writers[name] ?? {};
-    const update = Object.fromEntries(Object.entries({ pr: values.pr, repo: values.repo, head: values.head, status: values.status, runtime: values.runtime })
+    const update = Object.fromEntries(Object.entries({ pr: values.pr, repo: values.repo, head: values.head, ready: values.ready, status: values.status, runtime: values.runtime })
       .filter(([, value]) => value !== undefined));
     const moved = values.head !== undefined && values.head !== row.head;
     board.writers[name] = { ...row, ...update, ...(values.deps === undefined ? {} : { deps: list(values.deps) }), ...(moved ? { headAt: at } : {}), updatedAt: at };
diff --git a/plugins/vibe/skills/fleet-orchestrator/scripts/board.test.mjs b/plugins/vibe/skills/fleet-orchestrator/scripts/board.test.mjs
index 3940526e..2cab7b40 100644
--- a/plugins/vibe/skills/fleet-orchestrator/scripts/board.test.mjs
+++ b/plugins/vibe/skills/fleet-orchestrator/scripts/board.test.mjs
@@ -27,7 +27,7 @@ test('a writer row whose head is behind the pushed head is stale until the write
   assert.equal(run([dir, 'writer', 'w1', '--head', 'bbb', '--status', 'QA ready']).status, 0);
   assert.equal(run([dir, 'status', '--pushed', 'w1=bbb']).status, 0);
   const page = readFileSync(path.join(dir, 'board.md'), 'utf8');
-  assert.match(page, /^\| w1 \| #101 \| bbb \| QA ready \| w2 \| /m, 'the update keeps the PR and dependencies');
+  assert.match(page, /^\| w1 \| #101 \| bbb \|  \| QA ready \| w2 \| /m, 'the update keeps the PR and dependencies');
   assert.match(page, /w1: head bbb, status QA ready/);
 });
 
@@ -122,3 +122,62 @@ test('unresolved human threads are read with gh for a Codex row with a PR and re
   const slow = run([dir, 'status', '--now', '2026-10-21T13:00:00Z'], { BOARD_GH: gh });
   assert.match(slow.stdout, /^SLOW w1 no push for 60m with 2 unresolved human threads; hand it to a Claude writer$/m);
 });
+
+test('a work dir that watches sessions or PRs fails status while its watcher is missing (7 quiet hours overnight)', (t) => {
+  const dir = tempDir(t);
+  assert.equal(run([dir, 'status']).status, 0, 'no watch list, no watcher expected');
+  writeFileSync(path.join(dir, 'prs.txt'), 'acme/app 7\n');
+  assert.equal(run([dir, 'duty', 'green-watch', '--owner', 'w1']).status, 0);
+  assert.equal(run([dir, 'duty', 'status-sweep', '--owner', 'w1']).status, 0);
+  assert.equal(run([dir, 'writer', 'w1']).status, 0);
+  const missing = run([dir, 'status', '--now', '2026-10-22T06:00:00Z']);
+  assert.equal(missing.status, 1);
+  assert.match(missing.stdout, /^WATCHER-MISSING \(no watcher\.json\): re-arm watch\.sh now/m);
+  writeFileSync(path.join(dir, 'watcher.json'), JSON.stringify({ pid: process.pid, startedAt: '2026-10-22T05:50:00Z', lastTickAt: '2026-10-22T05:59:00Z', intervalSeconds: 120 }));
+  const armed = run([dir, 'status', '--now', '2026-10-22T06:00:00Z']);
+  assert.equal(armed.status, 0, armed.stdout);
+  writeFileSync(path.join(dir, 'watcher.json'), JSON.stringify({ pid: process.pid, startedAt: '2026-10-22T05:50:00Z', lastTickAt: '2026-10-22T05:59:00Z', intervalSeconds: 120, exitedAt: '2026-10-22T05:59:00Z' }));
+  assert.match(run([dir, 'status', '--now', '2026-10-22T13:00:00Z']).stdout, /^WATCHER-MISSING \(exited 421m ago\)/m);
+});
+
+test('a writer question waiting 15 minutes is QUESTION-UNANSWERED until answered (#9118)', (t) => {
+  const dir = tempDir(t);
+  assert.equal(run([dir, 'question', 'w1', '--text', 'Sort by rank or updated? If no answer by 09:04Z: rank', '--now', '2026-10-22T08:34:00Z']).status, 0);
+  assert.equal(run([dir, 'status', '--now', '2026-10-22T08:48:00Z']).status, 0, 'fourteen minutes is not yet late');
+  const late = run([dir, 'status', '--now', '2026-10-22T08:49:00Z']);
+  assert.equal(late.status, 1);
+  assert.match(late.stdout, /^QUESTION-UNANSWERED w1 15m: Sort by rank or updated\?/m);
+  assert.equal(run([dir, 'answered', 'w1', '--now', '2026-10-22T08:50:00Z']).status, 0);
+  assert.equal(run([dir, 'status', '--now', '2026-10-22T13:00:00Z']).status, 0);
+  assert.equal(run([dir, 'question', 'w1']).status, 2);
+});
+
+test('a watched program needs a green-watch owner; REQUIRED_DUTIES names others', (t) => {
+  const dir = tempDir(t);
+  writeFileSync(path.join(dir, 'prs.txt'), 'acme/app 7\n');
+  writeFileSync(path.join(dir, 'watcher.json'), JSON.stringify({ pid: process.pid, startedAt: '2026-10-22T05:50:00Z', lastTickAt: '2026-10-22T05:59:00Z', intervalSeconds: 120 }));
+  const now = ['--now', '2026-10-22T06:00:00Z'];
+  const bare = run([dir, 'status', ...now]);
+  assert.equal(bare.status, 1);
+  assert.match(bare.stdout, /^MISSING-DUTY green-watch: give it an owner/m);
+  assert.equal(run([dir, 'writer', 'keeper']).status, 0);
+  assert.equal(run([dir, 'duty', 'green-watch', '--owner', 'keeper']).status, 0);
+  assert.match(run([dir, 'status', ...now]).stdout, /^MISSING-DUTY status-sweep/m, 'the status sweep is a standing duty too');
+  assert.equal(run([dir, 'duty', 'status-sweep', '--owner', 'keeper']).status, 0);
+  assert.equal(run([dir, 'status', ...now]).status, 0);
+  writeFileSync(path.join(dir, 'config.env'), 'REQUIRED_DUTIES="green-watch pr-shepherd"\n');
+  assert.match(run([dir, 'status', ...now]).stdout, /^MISSING-DUTY pr-shepherd/m);
+});
+
+test('a head is pushed for a writer only when the writer declared it ready (a partial commit was pushed)', (t) => {
+  const dir = tempDir(t);
+  assert.equal(run([dir, 'writer', 'w1', '--head', 'a77421d8fa00']).status, 0);
+  const none = run([dir, 'push-check', 'w1', '--head', 'a77421d8fa00']);
+  assert.equal(none.status, 1);
+  assert.match(none.stdout, /^NOT-READY w1 head a77421d8fa00, declared ready none/);
+  assert.equal(run([dir, 'writer', 'w1', '--ready', '5ec6633da7ff']).status, 0);
+  assert.equal(run([dir, 'push-check', 'w1', '--head', 'a77421d8fa00']).status, 1, 'the committed head is not the ready one');
+  assert.equal(run([dir, 'push-check', 'w1', '--head', '5ec6633da7']).status, 0);
+  assert.equal(run([dir, 'push-check', 'w1', '--head', '5ec']).status, 1, 'a short prefix proves nothing');
+  assert.match(readFileSync(path.join(dir, 'board.md'), 'utf8'), /\| w1 \|  \| a77421d8fa00 \| 5ec6633da7ff \|/);
+});
diff --git a/plugins/vibe/skills/fleet-orchestrator/scripts/codex-session.mjs b/plugins/vibe/skills/fleet-orchestrator/scripts/codex-session.mjs
index ed69745e..75a7c551 100644
--- a/plugins/vibe/skills/fleet-orchestrator/scripts/codex-session.mjs
+++ b/plugins/vibe/skills/fleet-orchestrator/scripts/codex-session.mjs
@@ -4,6 +4,8 @@
 //   node codex-session.mjs last  <stateDir> <name> [--count <n>]
 // `turn` starts a thread bound to --cwd when <stateDir>/<name>.json does not exist (a new session also needs
 // --model, --effort and a prompt that starts with `$vibe`, since every writer is a vibe session), otherwise resumes the thread it names, then starts a turn with the prompt file's text. `steer` adds the prompt to the active turn.
+// A prompt that hands over another writer's work (a `Done:` line) also needs a `Re-verify:` line: takeover
+// writers found a half-fixed thread, six broken tests and a 10 s per insert trigger behind "done" claims.
 // `last` prints the thread's status line and its last <n> agent messages (default 1).
 // The state file is the one codex-fleet-monitor reads for a `local|remote <name>` session line.
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
@@ -23,6 +25,8 @@ const SANDBOX_POLICIES = {
 const NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 const EFFORT_PATTERN = /^[A-Za-z][A-Za-z0-9_-]{0,31}$/;
 const VIBE_PROMPT = /^\s*\$vibe\b/;
+const DONE_CLAIMS = /^\s*Done:/m;
+const REVERIFY = /^\s*Re-verify:\s*\S/m;
 
 export function parseCli(argv) {
   const { values, positionals } = parseArgs({
@@ -186,6 +190,9 @@ export async function run(client, options) {
   if (options.command === 'turn' && !saved && !VIBE_PROMPT.test(prompt)) {
     throw new Error(`a new session's prompt must start with $vibe; ${options.promptFile} does not`);
   }
+  if (DONE_CLAIMS.test(prompt) && !REVERIFY.test(prompt)) {
+    throw new Error(`${options.promptFile} hands over "Done:" claims with no "Re-verify:" line; the writer re-verifies each with a test or a measurement before building on it`);
+  }
   const promptFile = resolve(options.promptFile);
   let state;
   if (options.command === 'turn') state = await startTurn(client, nextState(saved, options), prompt, promptFile);
diff --git a/plugins/vibe/skills/fleet-orchestrator/scripts/codex-session.test.mjs b/plugins/vibe/skills/fleet-orchestrator/scripts/codex-session.test.mjs
index 8d9fe8f4..e3449859 100644
--- a/plugins/vibe/skills/fleet-orchestrator/scripts/codex-session.test.mjs
+++ b/plugins/vibe/skills/fleet-orchestrator/scripts/codex-session.test.mjs
@@ -174,3 +174,14 @@ test('a new session refuses a prompt that does not start with $vibe; a saved one
   saveState(dir, 'w1', { threadId: 'T1', cwd: '/wt', effort: 'high', turns: [] });
   assert.equal(await run(client, parseCli(['turn', dir, 'w1', '--prompt-file', plain])), 'w1 turn T1 U1');
 });
+
+test('a prompt carrying another writer\'s Done: claims needs a Re-verify: line (takeover claims)', async () => {
+  const { dir } = workDir();
+  const handover = join(dir, 'resume.md');
+  writeFileSync(handover, '$vibe resume the vibe session for ISS-1.\nDone: threads fixed, migration ready\nLeft: QA\n');
+  const client = stubClient({ 'thread/start': { thread: { id: 'T1' } }, 'turn/start': { turn: { id: 'U1' } } });
+  await assert.rejects(run(client, parseCli(['turn', dir, 'w1', '--prompt-file', handover, '--cwd', '/wt', '--model', 'm', '--effort', 'high'])), /no "Re-verify:" line/);
+  assert.deepEqual(client.calls, []);
+  writeFileSync(handover, '$vibe resume the vibe session for ISS-1.\nDone: threads fixed, migration ready\nRe-verify: each Done claim with a test or a measurement before building on it\nLeft: QA\n');
+  assert.equal(await run(client, parseCli(['turn', dir, 'w1', '--prompt-file', handover, '--cwd', '/wt', '--model', 'm', '--effort', 'high'])), 'w1 turn T1 U1');
+});
diff --git a/plugins/vibe/skills/fleet-orchestrator/scripts/fleet.sh b/plugins/vibe/skills/fleet-orchestrator/scripts/fleet.sh
index 128a7e88..3d8d391d 100755
--- a/plugins/vibe/skills/fleet-orchestrator/scripts/fleet.sh
+++ b/plugins/vibe/skills/fleet-orchestrator/scripts/fleet.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 # Usage: fleet.sh <orchDir> <local|remote> session <turn|steer|last> <name> [codex-session.mjs options]
 #        fleet.sh <orchDir> <local|remote> slot <lockName> <owner> <dir> <command...>
+# A heavy slot first runs load-check.sh on that machine and refuses (exit 4) when its load per core is over MAX_LOAD_PER_CORE.
 # Settings come from <orchDir>/config.env (references/setup.md); without the REMOTE_* keys only `local` works.
 # `remote` copies the scripts it needs, and a session's prompt file (with its <prompt>.evidence/ folder), to <REMOTE_STATE_DIR>/.fleet-orchestrator/
 # on REMOTE_HOST over ssh and runs them there in REMOTE_SHELL.
@@ -27,7 +28,7 @@ case "$where" in
   *) usage ;;
 esac
 
-ship=(codex-fleet-monitor/scripts/liveness.mjs fleet-orchestrator/scripts/codex-session.mjs fleet-orchestrator/scripts/slot-lock.sh fleet-orchestrator/scripts/request-visual.mjs)
+ship=(codex-fleet-monitor/scripts/liveness.mjs fleet-orchestrator/scripts/codex-session.mjs fleet-orchestrator/scripts/slot-lock.sh fleet-orchestrator/scripts/load-check.sh fleet-orchestrator/scripts/request-visual.mjs)
 extra=()
 
 # Runs a shell command line on REMOTE_HOST after unpacking the shipped scripts (and `extra`) into remote_dir.
@@ -86,16 +87,20 @@ session() {
 
 slot() {
   [ $# -ge 4 ] || usage
-  local name=$1 owner=$2 dir=$3 slots=1
+  local name=$1 owner=$2 dir=$3 slots=1 check=
   shift 3
   if [ "$name" = heavy ]; then
     if [ "$where" = local ]; then slots=${HEAVY_SLOTS:-1}; else slots=${REMOTE_HEAVY_SLOTS:-1}; fi
+    check=1
   fi
   if [ "$where" = local ]; then
     cd "$dir"
+    if [ -n "$check" ]; then MAX_LOAD_PER_CORE=${MAX_LOAD_PER_CORE:-1.5} bash "$here/load-check.sh"; fi
     exec bash "$here/slot-lock.sh" --slots "$slots" "$name" "$owner" "$@"
   fi
-  run_remote "cd $(printf %q "$dir") && $(printf '%q ' bash "$remote_dir/fleet-orchestrator/scripts/slot-lock.sh" --slots "$slots" "$name" "$owner" "$@")"
+  local gate=
+  if [ -n "$check" ]; then gate="MAX_LOAD_PER_CORE=$(printf %q "${REMOTE_MAX_LOAD_PER_CORE:-${MAX_LOAD_PER_CORE:-1.5}}") FLEET_FORCE_HERE=$(printf %q "${FLEET_FORCE_HERE:-}") bash $(printf %q "$remote_dir/fleet-orchestrator/scripts/load-check.sh") && "; fi
+  run_remote "cd $(printf %q "$dir") && $gate$(printf '%q ' bash "$remote_dir/fleet-orchestrator/scripts/slot-lock.sh" --slots "$slots" "$name" "$owner" "$@")"
 }
 
 case "$action" in
diff --git a/plugins/vibe/skills/fleet-orchestrator/scripts/fleet.test.mjs b/plugins/vibe/skills/fleet-orchestrator/scripts/fleet.test.mjs
index fb30d922..c99ebc6d 100644
--- a/plugins/vibe/skills/fleet-orchestrator/scripts/fleet.test.mjs
+++ b/plugins/vibe/skills/fleet-orchestrator/scripts/fleet.test.mjs
@@ -30,7 +30,7 @@ function fixture(config) {
   writeFileSync(prompt, 'Start.\n');
   const run = (args, env = {}) => spawnSync('bash', [FLEET, orch, ...args], {
     encoding: 'utf8',
-    env: { ...process.env, PATH: `${bin}:${process.env.PATH}`, SLOT_LOCK_DIR: join(root, 'locks'), ...env },
+    env: { ...process.env, PATH: `${bin}:${process.env.PATH}`, SLOT_LOCK_DIR: join(root, 'locks'), FLEET_LOAD: '0 8', ...env },
   });
   const argv = (result) => result.stdout.split('\n').filter((l) => l.startsWith('arg:')).map((l) => l.slice(4));
   return { root, orch, prompt, run, argv };
@@ -67,7 +67,7 @@ test('a remote session ships the scripts and prompt file and runs in the remote
     join(shipped, 'fleet-orchestrator/scripts/codex-session.mjs'), 'turn', join(f.root, 'remote', 'sessions'), 'w1',
     '--prompt-file', join(shipped, 'w1-01-start.md'), '--cwd', '/remote wt', '--effort', 'high',
   ]);
-  for (const file of ['codex-fleet-monitor/scripts/liveness.mjs', 'fleet-orchestrator/scripts/codex-session.mjs', 'fleet-orchestrator/scripts/slot-lock.sh', 'fleet-orchestrator/scripts/request-visual.mjs']) {
+  for (const file of ['codex-fleet-monitor/scripts/liveness.mjs', 'fleet-orchestrator/scripts/codex-session.mjs', 'fleet-orchestrator/scripts/slot-lock.sh', 'fleet-orchestrator/scripts/load-check.sh', 'fleet-orchestrator/scripts/request-visual.mjs']) {
     assert.ok(existsSync(join(shipped, file)), file);
   }
   assert.equal(readFileSync(join(shipped, 'w1-01-start.md'), 'utf8'), 'Start.\n');
@@ -116,3 +116,14 @@ test('rejects unknown machines and actions with usage', TIMEOUT, () => {
     assert.match(result.stderr, /Usage: fleet\.sh/);
   }
 });
+
+test('a heavy slot refuses a machine whose load per core is over the limit and names the other machine', TIMEOUT, () => {
+  const f = fixture('HEAVY_SLOTS=2\n');
+  const busy = f.run(['local', 'slot', 'heavy', 'w1 tests', f.root, 'echo', 'ran'], { FLEET_LOAD: '34 18' });
+  assert.equal(busy.status, 4);
+  assert.equal(busy.stdout, '');
+  assert.match(busy.stderr, /load 34 on 18 cores is over 1\.5 per core.*run this heavy check on the other machine/);
+  assert.equal(f.run(['local', 'slot', 'heavy', 'w1 tests', f.root, 'echo', 'ran'], { FLEET_LOAD: '20 18' }).stdout, 'ran\n');
+  assert.equal(f.run(['local', 'slot', 'heavy', 'w1 tests', f.root, 'echo', 'ran'], { FLEET_LOAD: '34 18', FLEET_FORCE_HERE: '1' }).stdout, 'ran\n');
+  assert.equal(f.run(['local', 'slot', 'shared', 'w1 shared', f.root, 'echo', 'ran'], { FLEET_LOAD: '34 18' }).stdout, 'ran\n', 'only heavy slots are load-checked');
+});
diff --git a/plugins/vibe/skills/fleet-orchestrator/scripts/green-watch.mjs b/plugins/vibe/skills/fleet-orchestrator/scripts/green-watch.mjs
new file mode 100644
index 00000000..0b5ce9a4
--- /dev/null
+++ b/plugins/vibe/skills/fleet-orchestrator/scripts/green-watch.mjs
@@ -0,0 +1,84 @@
+#!/usr/bin/env node
+// The green-watch duty's report. A watcher that listed main's batch runs once,
+// when it started, never saw a push-triggered batch that began later, so an
+// accessibility red from a program PR went unreported. Every call re-lists
+// the runs for main from the code host, and every lane (job) of every run whose
+// commit contains a program PR's merge commit is reported.
+//
+// Usage: green-watch.mjs --repo <owner/repo> --worktree <a clone with main fetched> --program <merge sha>[,<merge sha>...] [--branch main]
+//
+// Prints `RED <workflow> #<run> <sha> <job>` for each failed lane,
+// `PENDING <workflow> #<run> <sha> <job>` for each unfinished one, `NO-RUN <sha>`
+// when no run exists yet for the branch head, then `green-watch: <runs> runs,
+// <red> red, <pending> pending`; exits 1 on any RED or NO-RUN and 2 when gh or
+// git cannot answer. `GREEN_WATCH_GH` overrides the gh binary.
+
+import { execFileSync } from "node:child_process";
+import { pathToFileURL } from "node:url";
+import { parseArgs } from "node:util";
+
+const FAILED = new Set(["failure", "cancelled", "timed_out", "action_required", "startup_failure"]);
+
+/** The report lines for runs whose commit contains a program PR, read fresh each time. */
+export function greenReport({ runs, jobsOf, head, includesProgram }) {
+  const watched = runs.filter((run) => includesProgram(run.headSha));
+  const lines = [];
+  let red = 0;
+  let pending = 0;
+  for (const run of watched) {
+    for (const job of jobsOf(run.databaseId)) {
+      const where = `${run.workflowName ?? run.name} #${run.databaseId} ${String(run.headSha).slice(0, 10)} ${job.name}`;
+      if (job.status !== "completed") {
+        pending += 1;
+        lines.push(`PENDING ${where}`);
+      } else if (FAILED.has(job.conclusion)) {
+        red += 1;
+        lines.push(`RED ${where}`);
+      }
+    }
+  }
+  const noRun = runs.some((run) => run.headSha === head) ? [] : [`NO-RUN ${head}`];
+  return { lines: [...lines, ...noRun, `green-watch: ${watched.length} runs, ${red} red, ${pending} pending`], ok: red === 0 && noRun.length === 0 };
+}
+
+function gh(args) {
+  return JSON.parse(execFileSync(process.env.GREEN_WATCH_GH || "gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 60_000 }));
+}
+
+function isAncestor(worktree, ancestor, sha) {
+  try {
+    execFileSync("git", ["-C", worktree, "merge-base", "--is-ancestor", ancestor, sha], { stdio: "ignore" });
+    return true;
+  } catch (error) {
+    if (error.status === 1) return false;
+    throw new Error(`git cannot compare ${ancestor} with ${sha}; fetch the branch into ${worktree} first`);
+  }
+}
+
+function main(argv) {
+  const { values } = parseArgs({ args: argv, options: { repo: { type: "string" }, worktree: { type: "string" }, program: { type: "string" }, branch: { type: "string" } } });
+  const program = (values.program ?? "").split(",").map((sha) => sha.trim()).filter(Boolean);
+  if (!values.repo || !values.worktree || program.length === 0) {
+    throw new Error("Usage: green-watch.mjs --repo <owner/repo> --worktree <clone> --program <merge sha>[,...] [--branch main]");
+  }
+  const branch = values.branch ?? "main";
+  const runs = gh(["run", "list", "-R", values.repo, "--branch", branch, "--limit", "100", "--json", "databaseId,headSha,status,conclusion,name,workflowName,event,createdAt"]);
+  const head = gh(["api", `repos/${values.repo}/commits/${branch}`]).sha;
+  const { lines, ok } = greenReport({
+    runs,
+    head,
+    jobsOf: (id) => gh(["run", "view", String(id), "-R", values.repo, "--json", "jobs"]).jobs ?? [],
+    includesProgram: (sha) => program.some((merge) => isAncestor(values.worktree, merge, sha)),
+  });
+  process.stdout.write(`${lines.join("\n")}\n`);
+  return ok ? 0 : 1;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    process.exit(main(process.argv.slice(2)));
+  } catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exit(2);
+  }
+}
diff --git a/plugins/vibe/skills/fleet-orchestrator/scripts/green-watch.test.mjs b/plugins/vibe/skills/fleet-orchestrator/scripts/green-watch.test.mjs
new file mode 100644
index 00000000..0598dd54
--- /dev/null
+++ b/plugins/vibe/skills/fleet-orchestrator/scripts/green-watch.test.mjs
@@ -0,0 +1,53 @@
+import assert from 'node:assert/strict';
+import { execFileSync, spawnSync } from 'node:child_process';
+import { chmodSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { test } from 'node:test';
+import { fileURLToPath } from 'node:url';
+import { greenReport } from './green-watch.mjs';
+
+const SCRIPT = fileURLToPath(new URL('./green-watch.mjs', import.meta.url));
+const run = (id, headSha, name = 'ci-batch', createdAt = '2026-10-22T10:00:00Z') => ({ databaseId: id, headSha, name, workflowName: name, createdAt });
+const job = (name, conclusion, status = 'completed') => ({ name, conclusion, status });
+
+test('every call reports every lane of every run containing a program PR, including a batch that started later', () => {
+  const jobs = { 1: [job('unit', 'success'), job('e2e', 'success')], 2: [job('lint', 'success'), job('a11y', 'failure')], 3: [job('unit', 'failure')] };
+  const includesProgram = (sha) => sha !== 'before';
+  const first = greenReport({ runs: [run(1, 'merge1')], head: 'merge1', jobsOf: (id) => jobs[id], includesProgram });
+  assert.deepEqual(first, { lines: ['green-watch: 1 runs, 0 red, 0 pending'], ok: true });
+  const later = [run(1, 'merge1'), run(2, 'head2', 'ci-push', '2026-10-22T11:00:00Z'), run(3, 'before')];
+  const second = greenReport({ runs: later, head: 'head2', jobsOf: (id) => jobs[id], includesProgram });
+  assert.deepEqual(second.lines, ['RED ci-push #2 head2 a11y', 'green-watch: 2 runs, 1 red, 0 pending']);
+  assert.equal(second.ok, false, 'a red lane in a later push-triggered batch is reported');
+  const noRun = greenReport({ runs: later, head: 'head3', jobsOf: (id) => jobs[id], includesProgram });
+  assert.match(noRun.lines.join('\n'), /^NO-RUN head3$/m);
+  const pending = greenReport({ runs: [run(4, 'head4')], head: 'head4', jobsOf: () => [job('e2e', null, 'in_progress')], includesProgram });
+  assert.deepEqual(pending, { lines: ['PENDING ci-batch #4 head4 e2e', 'green-watch: 1 runs, 0 red, 1 pending'], ok: true });
+});
+
+test('the command re-lists runs through gh on every call and reads ancestry from git', (t) => {
+  const dir = mkdtempSync(path.join(os.tmpdir(), 'green-watch-'));
+  t.after(() => rmSync(dir, { recursive: true, force: true }));
+  const repo = path.join(dir, 'repo');
+  const git = (...args) => execFileSync('git', ['-C', repo, ...args], { encoding: 'utf8', env: { ...process.env, GIT_AUTHOR_NAME: 't', GIT_AUTHOR_EMAIL: 't', GIT_COMMITTER_NAME: 't', GIT_COMMITTER_EMAIL: 't' } }).trim();
+  execFileSync('git', ['init', '--quiet', '--initial-branch=main', repo]);
+  git('commit', '--quiet', '--allow-empty', '-m', 'before');
+  const before = git('rev-parse', 'HEAD');
+  git('commit', '--quiet', '--allow-empty', '-m', 'program PR');
+  const merge = git('rev-parse', 'HEAD');
+  git('commit', '--quiet', '--allow-empty', '-m', 'later push');
+  const head = git('rev-parse', 'HEAD');
+  writeFileSync(path.join(dir, 'runs.json'), JSON.stringify([run(1, before), run(2, merge)]));
+  writeFileSync(path.join(dir, 'gh'), `#!/bin/sh\ncase "$1 $2" in\n  "run list") cat "${dir}/runs.json" ;;\n  "run view") if [ "$3" = 3 ]; then echo '{"jobs":[{"name":"a11y","status":"completed","conclusion":"failure"}]}'; else echo '{"jobs":[{"name":"unit","status":"completed","conclusion":"success"}]}'; fi ;;\n  "api repos/o/r/commits/main") echo '{"sha":"${head}"}' ;;\nesac\n`);
+  chmodSync(path.join(dir, 'gh'), 0o755);
+  const call = () => spawnSync(process.execPath, [SCRIPT, '--repo', 'o/r', '--worktree', repo, '--program', merge], { encoding: 'utf8', env: { ...process.env, GREEN_WATCH_GH: path.join(dir, 'gh') } });
+  const early = call();
+  assert.equal(early.status, 1);
+  assert.match(early.stdout, new RegExp(`^NO-RUN ${head}$`, 'm'));
+  assert.match(early.stdout, /green-watch: 1 runs, 0 red/, 'the run before the program PR is not watched');
+  writeFileSync(path.join(dir, 'runs.json'), JSON.stringify([run(1, before), run(2, merge), run(3, head, 'ci-push')]));
+  const late = call();
+  assert.equal(late.status, 1);
+  assert.match(late.stdout, /^RED ci-push #3 \S+ a11y$/m);
+});
diff --git a/plugins/vibe/skills/fleet-orchestrator/scripts/load-check.sh b/plugins/vibe/skills/fleet-orchestrator/scripts/load-check.sh
new file mode 100644
index 00000000..161ee90d
--- /dev/null
+++ b/plugins/vibe/skills/fleet-orchestrator/scripts/load-check.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Usage: load-check.sh. Exits 0 when this machine can take a heavy run, 4 when its load per core is over
+# MAX_LOAD_PER_CORE (default 1.5), naming the load so the run goes to the less loaded machine. A fixed
+# machine choice once drove one laptop past twice its core count while the other sat idle.
+# FLEET_FORCE_HERE=1 runs it here anyway; FLEET_LOAD="<load1> <cores>" stands in for the reading.
+set -euo pipefail
+reading=${FLEET_LOAD:-}
+if [ -z "$reading" ]; then
+  if [ -r /proc/loadavg ]; then load=$(cut -d' ' -f1 /proc/loadavg); else load=$(sysctl -n vm.loadavg | awk '{print $2}'); fi
+  reading="$load $(getconf _NPROCESSORS_ONLN)"
+fi
+read -r load cores <<<"$reading"
+max=${MAX_LOAD_PER_CORE:-1.5}
+if awk -v l="$load" -v c="$cores" -v m="$max" 'BEGIN { exit !(c > 0 && l / c > m) }'; then
+  if [ "${FLEET_FORCE_HERE:-}" = 1 ]; then
+    echo "load-check: load $load on $cores cores is over $max per core; running here because FLEET_FORCE_HERE=1" >&2
+    exit 0
+  fi
+  echo "load-check: load $load on $cores cores is over $max per core on $(hostname); run this heavy check on the other machine (fleet.sh <orchDir> local|remote slot heavy ...), or set FLEET_FORCE_HERE=1" >&2
+  exit 4
+fi
diff --git a/plugins/vibe/skills/fleet-orchestrator/scripts/qa-plan-check.mjs b/plugins/vibe/skills/fleet-orchestrator/scripts/qa-plan-check.mjs
index c38d91f0..bf9160fe 100644
--- a/plugins/vibe/skills/fleet-orchestrator/scripts/qa-plan-check.mjs
+++ b/plugins/vibe/skills/fleet-orchestrator/scripts/qa-plan-check.mjs
@@ -6,7 +6,7 @@
 // technology, a flow an agent cannot drive (real sign-in, OS dialogs,
 // hardware, a third-party screen), or a product call no reference settles.
 //
-// Usage: qa-plan-check.mjs --plan <QA record>
+// Usage: qa-plan-check.mjs --plan <QA record> [--criteria <ticket body> [--prd <PRD body>]]
 //
 // Reads each `### <ID>: <title>` checkpoint and its `- Routing:` line (the
 // guided-manual-qa record). A routing that starts with AGENT_VERIFIED or
@@ -14,10 +14,15 @@
 // must give a reason from the list above. Prints `HUMAN <id>: <reason>` for
 // each accepted one and `REFUSED <id>: <why>` for each refused one, then
 // `human checkpoints: <n>, refused: <n>`; exits 1 when any is refused.
+// With --criteria, every rollout, flag and rollback requirement of the ticket
+// and its PRD (handoff's rollout-gate.mjs) must be a checkpoint the plan cites
+// by its ID; it prints `MISSING-ROLLOUT <id>: <text>` otherwise. A PRD's
+// rollout gate was once skipped and no QA step checked it.
 
 import { readFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 import { parseArgs } from "node:util";
+import { rolloutRequirements } from "../../handoff/scripts/rollout-gate.mjs";
 
 const CHECKPOINT = /^###\s+([A-Za-z0-9_-]+):/;
 const ROUTING = /^-\s*Routing[^:]*:\s*(.*)$/;
@@ -42,6 +47,11 @@ export function checkpoints(text) {
   return found;
 }
 
+/** Rollout requirements no checkpoint in `plan` cites by ID. */
+export function missingRolloutCheckpoints(plan, ticket, prd = "") {
+  return rolloutRequirements(ticket, prd).filter(({ id }) => !new RegExp(`\\b${id}\\b`).test(plan));
+}
+
 /** The verdict for one checkpoint: agent, human (with its reason) or refused (with why). */
 export function verdict({ routing }) {
   if (routing === null || routing === "") {
@@ -60,13 +70,17 @@ export function verdict({ routing }) {
 }
 
 function main(argv) {
-  const { values } = parseArgs({ args: argv, options: { plan: { type: "string" } } });
+  const { values } = parseArgs({ args: argv, options: { plan: { type: "string" }, criteria: { type: "string" }, prd: { type: "string" } } });
   if (!values.plan) {
     throw new Error("Usage: qa-plan-check.mjs --plan <QA record>");
   }
   let human = 0;
   let refused = 0;
-  for (const checkpoint of checkpoints(readFileSync(values.plan, "utf8"))) {
+  const plan = readFileSync(values.plan, "utf8");
+  const missing = values.criteria ? missingRolloutCheckpoints(plan, readFileSync(values.criteria, "utf8"), values.prd ? readFileSync(values.prd, "utf8") : "") : [];
+  for (const requirement of missing) process.stdout.write(`MISSING-ROLLOUT ${requirement.id}: ${requirement.text.slice(0, 120)}\n`);
+  refused += missing.length;
+  for (const checkpoint of checkpoints(plan)) {
     const result = verdict(checkpoint);
     if (result.kind === "human") {
       human += 1;
diff --git a/plugins/vibe/skills/fleet-orchestrator/scripts/qa-plan-check.test.mjs b/plugins/vibe/skills/fleet-orchestrator/scripts/qa-plan-check.test.mjs
index 4bfbd893..e1c5218b 100644
--- a/plugins/vibe/skills/fleet-orchestrator/scripts/qa-plan-check.test.mjs
+++ b/plugins/vibe/skills/fleet-orchestrator/scripts/qa-plan-check.test.mjs
@@ -5,7 +5,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { test } from 'node:test';
 import { fileURLToPath } from 'node:url';
-import { checkpoints, verdict } from './qa-plan-check.mjs';
+import { missingRolloutCheckpoints, checkpoints, verdict } from './qa-plan-check.mjs';
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const record = (sections) => sections.map(([id, routing]) => `### ${id}: title\n\n- Risk / requirement: AC-1\n${routing === null ? '' : `- Routing (\`AGENT_VERIFIED\` with its evidence, or the reason this checkpoint needs a human): ${routing}\n`}- Expected: x\n`).join('\n');
@@ -48,3 +48,11 @@ test('the command exits 1 on a refused checkpoint and 0 for a plan with zero hum
   assert.equal(clean.status, 0);
   assert.equal(clean.stdout, 'human checkpoints: 0, refused: 0\n');
 });
+
+test('every rollout, flag and rollback requirement is a cited QA checkpoint (a skipped PRD rollout gate)', () => {
+  const ticket = '- Acceptance criteria:\n  - [ ] The new list renders behind the closed-by-default flag\n  - [ ] The legacy list stays as the rollback path\n  - [ ] Rows sort by updated time\n';
+  const prd = '## Rollout\n\n- Staged cohort rollout with stop conditions\n';
+  const plan = '### Q1: Flag off shows the legacy list\n- Criterion: AC-1\n- Routing: AGENT_VERIFIED\n';
+  assert.deepEqual(missingRolloutCheckpoints(plan, ticket, prd).map(({ id }) => id), ['AC-2', 'PRD-1']);
+  assert.deepEqual(missingRolloutCheckpoints(`${plan}### Q2: Rollback\n- Criterion: AC-2\n### Q3: Cohorts\n- Criterion: PRD-1\n`, ticket, prd), []);
+});
diff --git a/plugins/vibe/skills/fleet-orchestrator/scripts/status-audit.mjs b/plugins/vibe/skills/fleet-orchestrator/scripts/status-audit.mjs
index 273c629f..4a25494d 100644
--- a/plugins/vibe/skills/fleet-orchestrator/scripts/status-audit.mjs
+++ b/plugins/vibe/skills/fleet-orchestrator/scripts/status-audit.mjs
@@ -8,26 +8,63 @@
 //
 // snapshot.json, gathered from the ticket tool and the code host:
 //   {"prds": [{"slug", "children": [{"slug", "status", "writer": <name or null>,
-//     "pullRequests": [{"url", "state": "MERGED" | "OPEN" | "CLOSED"}]}]}],
+//     "pullRequests": [{"url", "state": "MERGED" | "OPEN" | "CLOSED"}],
+//     "body": "<the ticket's latest text>", "plans": [{"slug", "status"}],
+//     "absorbedBy": {"slug", "status"} (the umbrella ticket that absorbed it)}]}],
 //    "outOfScope": [{"slug", "reason": "<who ruled it out, and where>"}]}
 // For each child: a merged pull request means DONE; an open pull request or an
 // assigned writer means IN_PROGRESS or IN_REVIEW; not DONE or CANCELED with
-// neither means UNOWNED. Prints `MISMATCH <slug> <status>, expected <status>
-// (<evidence>)`, `UNOWNED <slug> <status>` and `OUT-OF-SCOPE <slug>: <reason>`
-// lines, then `status audit: <n> children, <m> mismatched, <u> unowned`; exits
-// 1 until every mismatch is fixed or ruled out of scope with a reason.
+// neither means UNOWNED. A merged pull request is not DONE on its own: a child
+// that is DONE or has one merged needs its `body`, and every acceptance
+// criterion in it checked, followed up or excluded by a human (executed-check
+// --kind ticket); about sixty children were swept to DONE minutes after their
+// merges with criteria unchecked. Prints `MISMATCH <slug> <status>, expected
+// <status> (<evidence>)`, `UNOWNED <slug> <status>`, `UNREAD <slug> <status>`,
+// `UNCHECKED <slug> <status>: <criteria>` and `OUT-OF-SCOPE <slug>: <reason>`
+// lines, then `status audit: <n> children, <m> mismatched, <u> unowned,
+// <c> unchecked, <s> unscoped`; exits 1 until every finding is fixed or ruled
+// out of scope by a reason that names the child or its PRD (`UNSCOPED`
+// otherwise: rollout tickets were once closed on a ruling about another surface).
+// It is also the program's status sweep, run at every merge and every status
+// report (the board's `status-sweep` duty): `PLAN-OPEN <slug>: <plan> <status>`
+// for a DONE ticket whose plan is not EXECUTED, and `ABSORBED-OPEN <slug>
+// <status>: absorbed by <umbrella> DONE` for a child still open after the
+// umbrella that absorbed it closed; close those children in the same step as
+// the umbrella, with its merge as evidence. Plans stayed open behind DONE
+// tickets and absorbed children stayed IN_PROGRESS until the operator noticed.
 
 import { readFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 import { parseArgs } from "node:util";
+import { ticketProblems } from "../../handoff/scripts/executed-check.mjs";
+import { rulingNamesScope } from "../../handoff/scripts/rulings-check.mjs";
 
 const ACTIVE = ["IN_PROGRESS", "IN_REVIEW"];
 const FINISHED = new Set(["DONE", "CANCELED"]);
+const PLAN_CLOSED = new Set(["EXECUTED", "OBSOLETE"]);
+
+/** Plan and absorption drift for one child: its plans behind a DONE ticket, or an absorbed child left open. */
+export function sweepFindings(child) {
+  const findings = [];
+  if (child?.status === "DONE") {
+    for (const plan of Array.isArray(child.plans) ? child.plans : []) {
+      if (!PLAN_CLOSED.has(plan?.status)) findings.push({ kind: "PLAN-OPEN", plan: plan?.slug ?? "?", planStatus: plan?.status ?? "missing" });
+    }
+  }
+  if (child?.absorbedBy?.status === "DONE" && !FINISHED.has(child.status)) {
+    findings.push({ kind: "ABSORBED-OPEN", umbrella: child.absorbedBy.slug ?? "?" });
+  }
+  return findings;
+}
 
 /** What the evidence says one child's status should be, or null when it agrees. */
-export function childFinding(child) {
+export function childFinding(child, prdSlug) {
   const pulls = Array.isArray(child?.pullRequests) ? child.pullRequests : [];
   const merged = pulls.find((pull) => pull?.state === "MERGED");
+  if (merged || child?.status === "DONE") {
+    const criteria = criteriaFinding(child, prdSlug);
+    if (criteria) return criteria;
+  }
   if (merged) {
     return child.status === "DONE" ? null : { kind: "MISMATCH", expected: "DONE", evidence: `${merged.url ?? "a pull request"} merged` };
   }
@@ -42,18 +79,31 @@ export function childFinding(child) {
   return FINISHED.has(child?.status) ? null : { kind: "UNOWNED" };
 }
 
+/** A DONE or merged child whose body was not read, or whose criteria are not all checked. */
+function criteriaFinding(child, prdSlug) {
+  if (typeof child?.body !== "string" || child.body.trim() === "") {
+    return { kind: "UNREAD" };
+  }
+  const unchecked = ticketProblems(child.body, [child.slug, prdSlug].filter(Boolean));
+  return unchecked.length === 0 ? null : { kind: "UNCHECKED", criteria: unchecked.map((problem) => problem.split(" ")[0]).join(", ") };
+}
+
 /** Every child that disagrees with its evidence, and every one ruled out of scope. */
 export function auditStatuses(snapshot) {
   const ruled = new Map((Array.isArray(snapshot?.outOfScope) ? snapshot.outOfScope : [])
     .filter((entry) => typeof entry?.slug === "string" && typeof entry.reason === "string" && entry.reason.trim() !== "")
     .map((entry) => [entry.slug, entry.reason.trim()]));
-  const children = (Array.isArray(snapshot?.prds) ? snapshot.prds : []).flatMap((prd) => (Array.isArray(prd?.children) ? prd.children : []));
+  const children = (Array.isArray(snapshot?.prds) ? snapshot.prds : [])
+    .flatMap((prd) => (Array.isArray(prd?.children) ? prd.children : []).map((child) => ({ child, prdSlug: prd?.slug })));
   const findings = [];
   const outOfScope = [];
-  for (const child of children) {
-    const finding = childFinding(child);
+  for (const { child, prdSlug } of children) {
+    findings.push(...sweepFindings(child).map((found) => ({ slug: child.slug, status: child.status, ...found })));
+    const finding = childFinding(child, prdSlug);
     if (!finding) continue;
-    if (ruled.has(child.slug)) outOfScope.push({ slug: child.slug, reason: ruled.get(child.slug) });
+    const reason = ruled.get(child.slug);
+    if (reason && rulingNamesScope(reason, [child.slug, prdSlug])) outOfScope.push({ slug: child.slug, reason });
+    else if (reason) findings.push({ slug: child.slug, status: child.status, kind: "UNSCOPED", reason });
     else findings.push({ slug: child.slug, status: child.status, ...finding });
   }
   return { children: children.length, findings, outOfScope };
@@ -65,14 +115,19 @@ function main(argv) {
     throw new Error("Usage: status-audit.mjs --snapshot <snapshot.json>");
   }
   const { children, findings, outOfScope } = auditStatuses(JSON.parse(readFileSync(values.snapshot, "utf8")));
-  for (const finding of findings) {
-    process.stdout.write(finding.kind === "UNOWNED"
-      ? `UNOWNED ${finding.slug} ${finding.status}\n`
-      : `MISMATCH ${finding.slug} ${finding.status}, expected ${finding.expected} (${finding.evidence})\n`);
-  }
+  const lines = {
+    UNOWNED: (finding) => `UNOWNED ${finding.slug} ${finding.status}`,
+    "PLAN-OPEN": (finding) => `PLAN-OPEN ${finding.slug}: ${finding.plan} is ${finding.planStatus}; a DONE ticket's plan is EXECUTED`,
+    "ABSORBED-OPEN": (finding) => `ABSORBED-OPEN ${finding.slug} ${finding.status}: absorbed by ${finding.umbrella}, which is DONE; close it in the same step with that merge as evidence`,
+    UNSCOPED: (finding) => `UNSCOPED ${finding.slug} ${finding.status}: the out-of-scope ruling "${finding.reason.slice(0, 120)}" names neither the ticket nor its PRD`,
+    UNREAD: (finding) => `UNREAD ${finding.slug} ${finding.status}: no ticket body in the snapshot; read it so its acceptance criteria are checked`,
+    UNCHECKED: (finding) => `UNCHECKED ${finding.slug} ${finding.status}: ${finding.criteria}; check each against the merged code, or name its follow-up or human exclusion, before DONE (executed-check.mjs --kind ticket)`,
+    MISMATCH: (finding) => `MISMATCH ${finding.slug} ${finding.status}, expected ${finding.expected} (${finding.evidence})`,
+  };
+  for (const finding of findings) process.stdout.write(`${lines[finding.kind](finding)}\n`);
   for (const entry of outOfScope) process.stdout.write(`OUT-OF-SCOPE ${entry.slug}: ${entry.reason}\n`);
-  const mismatched = findings.filter((finding) => finding.kind === "MISMATCH").length;
-  process.stdout.write(`status audit: ${children} children, ${mismatched} mismatched, ${findings.length - mismatched} unowned\n`);
+  const count = (kind) => findings.filter((finding) => finding.kind === kind).length;
+  process.stdout.write(`status audit: ${children} children, ${count("MISMATCH")} mismatched, ${count("UNOWNED")} unowned, ${count("UNREAD") + count("UNCHECKED")} unchecked, ${count("UNSCOPED")} unscoped, ${count("PLAN-OPEN")} open plans, ${count("ABSORBED-OPEN")} absorbed open\n`);
   return findings.length === 0 ? 0 : 1;
 }
 
diff --git a/plugins/vibe/skills/fleet-orchestrator/scripts/status-audit.test.mjs b/plugins/vibe/skills/fleet-orchestrator/scripts/status-audit.test.mjs
index b43308d5..d7f9c767 100644
--- a/plugins/vibe/skills/fleet-orchestrator/scripts/status-audit.test.mjs
+++ b/plugins/vibe/skills/fleet-orchestrator/scripts/status-audit.test.mjs
@@ -5,15 +5,16 @@ import os from 'node:os';
 import path from 'node:path';
 import { test } from 'node:test';
 import { fileURLToPath } from 'node:url';
-import { auditStatuses, childFinding } from './status-audit.mjs';
+import { auditStatuses, childFinding, sweepFindings } from './status-audit.mjs';
 
 const SCRIPT = fileURLToPath(new URL('./status-audit.mjs', import.meta.url));
 const merged = { url: 'https://example.test/pull/1', state: 'MERGED' };
 const open = { url: 'https://example.test/pull/2', state: 'OPEN' };
+const body = '- Acceptance criteria:\n  - [x] Rows reorder\n  - [ ] Keyboard reorder; Follow-up: ABC-1\n';
 
 test('a merged pull request means DONE, an open one or a writer means in progress or review, and neither means unowned', () => {
-  assert.deepEqual(childFinding({ slug: 'a', status: 'IN_REVIEW', pullRequests: [merged] }), { kind: 'MISMATCH', expected: 'DONE', evidence: 'https://example.test/pull/1 merged' });
-  assert.equal(childFinding({ slug: 'a', status: 'DONE', pullRequests: [merged, open] }), null);
+  assert.deepEqual(childFinding({ slug: 'a', status: 'IN_REVIEW', pullRequests: [merged], body }), { kind: 'MISMATCH', expected: 'DONE', evidence: 'https://example.test/pull/1 merged' });
+  assert.equal(childFinding({ slug: 'a', status: 'DONE', pullRequests: [merged, open], body }), null);
   assert.deepEqual(childFinding({ slug: 'b', status: 'BACKLOG', pullRequests: [open] }), { kind: 'MISMATCH', expected: 'IN_PROGRESS or IN_REVIEW', evidence: 'https://example.test/pull/2 open' });
   assert.deepEqual(childFinding({ slug: 'c', status: 'BACKLOG', writer: 'w2', pullRequests: [] }), { kind: 'MISMATCH', expected: 'IN_PROGRESS or IN_REVIEW', evidence: 'writer w2 assigned' });
   assert.equal(childFinding({ slug: 'd', status: 'IN_PROGRESS', writer: 'w2' }), null);
@@ -24,12 +25,12 @@ test('a merged pull request means DONE, an open one or a writer means in progres
 
 test('a mismatch ruled out of scope with a reason no longer fails; one without a reason still does', () => {
   const snapshot = {
-    prds: [{ slug: 'P1', children: [{ slug: 'a', status: 'IN_REVIEW', pullRequests: [merged] }, { slug: 'f', status: 'BACKLOG' }] }],
-    outOfScope: [{ slug: 'f', reason: 'operator, 2026-10-21: parked for next sprint' }, { slug: 'a', reason: ' ' }],
+    prds: [{ slug: 'P1', children: [{ slug: 'a', status: 'IN_REVIEW', pullRequests: [merged], body }, { slug: 'f', status: 'BACKLOG' }] }],
+    outOfScope: [{ slug: 'f', reason: 'operator, 2026-10-21: P1 child parked for next sprint' }, { slug: 'a', reason: ' ' }],
   };
   const result = auditStatuses(snapshot);
   assert.deepEqual(result.findings.map((finding) => finding.slug), ['a']);
-  assert.deepEqual(result.outOfScope, [{ slug: 'f', reason: 'operator, 2026-10-21: parked for next sprint' }]);
+  assert.deepEqual(result.outOfScope, [{ slug: 'f', reason: 'operator, 2026-10-21: P1 child parked for next sprint' }]);
 });
 
 test('the command prints each finding and exits 1 until the statuses match', (t) => {
@@ -37,8 +38,10 @@ test('the command prints each finding and exits 1 until the statuses match', (t)
   t.after(() => rmSync(dir, { recursive: true, force: true }));
   const file = path.join(dir, 'snapshot.json');
   writeFileSync(file, JSON.stringify({ prds: [{ slug: 'P1', children: [
-    { slug: 'a', status: 'IN_REVIEW', pullRequests: [merged] },
+    { slug: 'a', status: 'IN_REVIEW', pullRequests: [merged], body },
     { slug: 'c', status: 'BACKLOG', writer: 'w2' },
+    { slug: 'd', status: 'DONE', pullRequests: [merged], body: body.replace('[x] Rows', '[ ] Rows') },
+    { slug: 'e', status: 'DONE' },
     { slug: 'f', status: 'BACKLOG' },
   ] }] }));
   const failing = spawnSync(process.execPath, [SCRIPT, '--snapshot', file], { encoding: 'utf8' });
@@ -46,12 +49,53 @@ test('the command prints each finding and exits 1 until the statuses match', (t)
   assert.equal(failing.stdout, [
     'MISMATCH a IN_REVIEW, expected DONE (https://example.test/pull/1 merged)',
     'MISMATCH c BACKLOG, expected IN_PROGRESS or IN_REVIEW (writer w2 assigned)',
+    'UNCHECKED d DONE: AC-1; check each against the merged code, or name its follow-up or human exclusion, before DONE (executed-check.mjs --kind ticket)',
+    'UNREAD e DONE: no ticket body in the snapshot; read it so its acceptance criteria are checked',
     'UNOWNED f BACKLOG',
-    'status audit: 3 children, 2 mismatched, 1 unowned',
+    'status audit: 5 children, 2 mismatched, 1 unowned, 2 unchecked, 0 unscoped, 0 open plans, 0 absorbed open',
     '',
   ].join('\n'));
-  writeFileSync(file, JSON.stringify({ prds: [{ slug: 'P1', children: [{ slug: 'a', status: 'DONE', pullRequests: [merged] }] }] }));
+  writeFileSync(file, JSON.stringify({ prds: [{ slug: 'P1', children: [{ slug: 'a', status: 'DONE', pullRequests: [merged], body }] }] }));
   const clean = spawnSync(process.execPath, [SCRIPT, '--snapshot', file], { encoding: 'utf8' });
   assert.equal(clean.status, 0);
-  assert.equal(clean.stdout, 'status audit: 1 children, 0 mismatched, 0 unowned\n');
+  assert.equal(clean.stdout, 'status audit: 1 children, 0 mismatched, 0 unowned, 0 unchecked, 0 unscoped, 0 open plans, 0 absorbed open\n');
+});
+
+test('a merged or DONE child needs its body read and every criterion checked before DONE (bulk DONE sweep)', () => {
+  const unchecked = body.replace('[x] Rows', '[ ] Rows');
+  assert.deepEqual(childFinding({ slug: 'a', status: 'IN_REVIEW', pullRequests: [merged] }), { kind: 'UNREAD' });
+  assert.deepEqual(childFinding({ slug: 'a', status: 'IN_REVIEW', pullRequests: [merged], body: unchecked }), { kind: 'UNCHECKED', criteria: 'AC-1' });
+  assert.deepEqual(childFinding({ slug: 'a', status: 'DONE', body: unchecked }), { kind: 'UNCHECKED', criteria: 'AC-1' });
+  assert.equal(childFinding({ slug: 'a', status: 'DONE', body }), null);
+  assert.equal(childFinding({ slug: 'g', status: 'CANCELED' }), null);
+});
+
+test('a child ruled out of scope by a ruling about another surface is UNSCOPED (a skipped PRD rollout gate)', () => {
+  const snapshot = {
+    prds: [{ slug: 'PRD-7', children: [{ slug: 'ISS-8', status: 'BACKLOG' }, { slug: 'ISS-9', status: 'BACKLOG' }] }],
+    outOfScope: [
+      { slug: 'ISS-8', reason: 'operator, 2026-10-21: the Desktop Labs toggle is retired' },
+      { slug: 'ISS-9', reason: 'operator, 2026-10-22: PRD-7 ships ungated, extending the Sessions ruling' },
+    ],
+  };
+  const result = auditStatuses(snapshot);
+  assert.deepEqual(result.findings.map((finding) => [finding.slug, finding.kind]), [['ISS-8', 'UNSCOPED']]);
+  assert.deepEqual(result.outOfScope.map((entry) => entry.slug), ['ISS-9']);
+});
+
+test('the status sweep flags plans left open behind DONE tickets and absorbed children left open (a PRD whose plans stayed open)', () => {
+  const body = '- Acceptance criteria:\n  - [x] Rows reorder\n';
+  const snapshot = { prds: [{ slug: 'PRD-8', children: [
+    { slug: 'ISS-1', status: 'DONE', body, pullRequests: [merged], plans: [{ slug: 'PLN-1', status: 'APPROVED' }, { slug: 'PLN-2', status: 'EXECUTED' }] },
+    { slug: 'ISS-2', status: 'DONE', body, pullRequests: [merged], plans: [{ slug: 'PLN-3', status: 'EXECUTED' }] },
+    { slug: 'ISS-3', status: 'IN_PROGRESS', writer: 'w1', absorbedBy: { slug: 'ISS-2', status: 'DONE' } },
+    { slug: 'ISS-4', status: 'DONE', body: '- Acceptance criteria:\n  - [ ] Keyboard reorder\n', pullRequests: [merged] },
+  ] }] };
+  const { findings } = auditStatuses(snapshot);
+  assert.deepEqual(findings.map((finding) => [finding.slug, finding.kind]), [
+    ['ISS-1', 'PLAN-OPEN'],
+    ['ISS-3', 'ABSORBED-OPEN'],
+    ['ISS-4', 'UNCHECKED'],
+  ]);
+  assert.deepEqual(sweepFindings({ status: 'IN_PROGRESS', plans: [{ slug: 'PLN-1', status: 'DRAFT' }] }), [], 'a plan may stay open while its ticket is');
 });
diff --git a/plugins/vibe/skills/handoff/SKILL.md b/plugins/vibe/skills/handoff/SKILL.md
index 290da60e..ebec24ea 100644
--- a/plugins/vibe/skills/handoff/SKILL.md
+++ b/plugins/vibe/skills/handoff/SKILL.md
@@ -923,10 +923,18 @@ the MET/PARTIAL/MISSED audit, and
 must pass (every criterion MET, and every criterion x surface x input x flag
 cell evidenced, flag-off cells by a diff against the base or a ruling).
 `node scripts/rulings-check.mjs --ticket <body> --record <QA record> --plan <each linked PLN's get-document JSON> --plan-body <its latest text>`
-must pass too: every ruling made during the work is on the ticket with the
+must pass too, and so must
+`node scripts/rollout-gate.mjs --worktree "<wt>" --ticket <body> --slug <ticket> --prd <PRD body> --prd-slug <PRD>`
+(each flag, rollback or rollout requirement recorded as `Rollout: <id>:` with
+its code at HEAD or a human ruling that names the ticket or PRD). In the rulings check, every ruling made during the work is on the ticket with the
 criteria it amends, and a plan no human approved excludes nothing without
 citing a ticket AC, PRD or operator ruling. From then on the pull request is shepherded:
 `node ../vibe/scripts/shepherd.mjs --pr <n> --repo <owner/repo>` polls it
 every two minutes and stops on a conflict (merge main at once in final-merge
-mode, push, run it again), failed checks (the SAME writer fixes them), a
-merge or a close.
+mode, push, run it again), failed checks (the SAME writer fixes them), an
+unresolved round-one review thread the writer has not answered last (armed
+auto-merge is not done), a later-round thread (pass `--round-one-fixed-at`
+once round one is pushed; triage it into the one follow-up ticket with
+`../vibe/scripts/review-followup.mjs`, reply with its link or why it is
+invalid, and resolve it with `review-threads.mjs`, round `later`), a merge or
+a close.
diff --git a/plugins/vibe/skills/handoff/scripts/criteria-audit.mjs b/plugins/vibe/skills/handoff/scripts/criteria-audit.mjs
index c2a29888..87ed410d 100644
--- a/plugins/vibe/skills/handoff/scripts/criteria-audit.mjs
+++ b/plugins/vibe/skills/handoff/scripts/criteria-audit.mjs
@@ -27,7 +27,10 @@ import { pathToFileURL } from "node:url";
 import { parseArgs } from "node:util";
 
 const CRITERIA_START = /^\s*-\s*Acceptance criteria:\s*$/;
-const CHECKBOX = /^\s+-\s*\[[ xX]\]\s*(\S.*)$/;
+const CRITERIA_HEADING = /^(#{1,6})\s+Acceptance criteria\b/i;
+const HEADING = /^(#{1,6})\s/;
+const CHECKBOX = /^\s+-\s*\[([ xX])\]\s*(\S.*)$/;
+const TOP_CHECKBOX = /^\s*[-*]\s*\[([ xX])\]\s*(\S.*)$/;
 const AUDIT_ROW = /^\|\s*(AC-\d+)\s*\|\s*(MET|PARTIAL|MISSED)\s*\|\s*(.*?)\s*\|\s*$/gm;
 const AUDIT_HEAD = /^Head:\s*([0-9a-f]{7,40})\s*$/m;
 const FLAG_OFF_EVIDENCE = /^(?:no behavior change:|ruling:)\s*\S/;
@@ -35,16 +38,33 @@ const ANY_INPUT_EVIDENCE = /^not input-driven:\s*\S/;
 
 /** The ticket's acceptance criteria as AC-n ids with their text. */
 export function ticketCriteria(ticket) {
+  return criteriaStates(ticket).map(({ id, text }) => ({ id, text }));
+}
+
+/**
+ * The acceptance criteria with whether each box is checked: the template's
+ * `- Acceptance criteria:` list, or the checkboxes under an `Acceptance
+ * criteria` heading up to the next heading of the same or a higher level.
+ */
+export function criteriaStates(ticket) {
   const criteria = [];
+  const push = (match) => criteria.push({ id: `AC-${criteria.length + 1}`, text: match[2], checked: match[1] !== " " });
   let inList = false;
+  let headingLevel = 0;
   for (const line of ticket.split("\n")) {
+    const heading = HEADING.exec(line);
+    if (heading) {
+      inList = false;
+      headingLevel = CRITERIA_HEADING.test(line) ? heading[1].length : headingLevel && heading[1].length > headingLevel ? headingLevel : 0;
+      continue;
+    }
     if (CRITERIA_START.test(line)) {
       inList = true;
       continue;
     }
-    const item = CHECKBOX.exec(line);
-    if (inList && item) {
-      criteria.push({ id: `AC-${criteria.length + 1}`, text: item[1] });
+    const item = inList ? CHECKBOX.exec(line) : headingLevel ? TOP_CHECKBOX.exec(line) : null;
+    if (item) {
+      push(item);
     } else if (inList && line.trim() !== "" && !/^\s{4,}\S/.test(line)) {
       inList = false;
     }
diff --git a/plugins/vibe/skills/handoff/scripts/diff-rules.mjs b/plugins/vibe/skills/handoff/scripts/diff-rules.mjs
index 171e4385..525914b7 100644
--- a/plugins/vibe/skills/handoff/scripts/diff-rules.mjs
+++ b/plugins/vibe/skills/handoff/scripts/diff-rules.mjs
@@ -8,11 +8,13 @@
 import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
+import { migrationId, migrationProblems } from "../../vibe/scripts/migration-publish.mjs";
 import { git } from "../../vibe/scripts/session-record.mjs";
 import { E2E_ROOT_PATHSPECS, isTestFile } from "../../vibe/scripts/test-files.mjs";
 import { pathGateTests } from "./path-gates.mjs";
 import { checkComparators, checkUnusedExports } from "./review-gap-rules.mjs";
 import { sharedComponentTests } from "./shared-consumers.mjs";
+import { checkSpecChanges } from "./spec-rules.mjs";
 import { routeSpecs } from "./route-specs.mjs";
 import { escapeRegExp, IMPORT_SPECIFIER, resolveImport, SOURCE_FILE } from "./source-imports.mjs";
 import { checkStorybookRules, storybookRuleTests } from "./storybook-rules.mjs";
@@ -131,6 +133,10 @@ export function evaluateDiff(files, changeLog, repo) {
   const live = files.filter((file) => file.status !== "D");
 
   checkMigrations(live, repo, logged, add, requiredChecks);
+  const newMigrations = live.filter((file) => file.status === "A" && migrationId(file.path)).map((file) => ({ path: file.path, sql: repo.head(file.path) ?? "" }));
+  for (const problem of migrationProblems(newMigrations, changeLog, (file) => repo.headFiles.includes(file) || repo.head(file) !== null)) {
+    add("migration-test", problem.slice(0, problem.indexOf(":")), 1, problem.slice(problem.indexOf(":") + 2), "add the test (and the measured scale test for per-row work) and record it; vibe-environment-worker runs migration-publish.mjs before every push");
+  }
   const shared = live.filter((file) => file.status === "M" && SHARED_PATH.test(file.path) && !logged("Shared path:", file.path));
   const importers = shared.length ? repo.importerCounts(shared.map((file) => file.path)) : new Map();
   for (const file of shared.filter((entry) => (importers.get(entry.path) ?? 0) >= 2)) {
@@ -154,6 +160,7 @@ export function evaluateDiff(files, changeLog, repo) {
   checkLostStoryIds(files, repo, add);
   checkCopyProvenance(live, files, repo, logged, add);
   checkCapabilityRemovals(live, files, repo, logged, add);
+  checkSpecChanges(files, changeLog, add);
   checkRestoredRemovalsDeepening(live, files, repo, changeLog, add);
   checkComparators(live, repo, logged, add, changeLog);
   checkUnusedExports(live, repo, logged, add);
diff --git a/plugins/vibe/skills/handoff/scripts/diff-rules.test.mjs b/plugins/vibe/skills/handoff/scripts/diff-rules.test.mjs
index 41ea0228..0012d897 100644
--- a/plugins/vibe/skills/handoff/scripts/diff-rules.test.mjs
+++ b/plugins/vibe/skills/handoff/scripts/diff-rules.test.mjs
@@ -63,12 +63,26 @@ test("migrations: an existing table needs its recorded precedent, a full-table b
     "ALTER TABLE \"y\" ADD CONSTRAINT \"y_fk\" FOREIGN KEY (\"a\") REFERENCES \"z\"(\"id\") ON UPDATE CASCADE;",
   ].join("\n");
   const bare = run(t, { head: { [file]: sql } });
-  assert.deepEqual(bare.found, [["migration-precedent", file], ["migration-precedent", file], ["migration-backfill", file]]);
+  assert.deepEqual(bare.found, [["migration-precedent", file], ["migration-precedent", file], ["migration-backfill", file], ["migration-test", file]]);
   assert.deepEqual(bare.requiredChecks.map((check) => check.command), ["pnpm check:destructive-migrations", "pnpm check:migration-immutability"]);
-  const logged = run(t, { head: { [file]: sql }, changeLog: "Migration precedent: artifact_links: a, b, c\nMigration precedent: y: d, e, f\n" });
+  const test = "packages/database/__tests__/link-kind.test.ts";
+  const logged = run(t, { head: { [file]: sql, [test]: "test();\n" }, changeLog: `Migration precedent: artifact_links: a, b, c\nMigration precedent: y: d, e, f\nMigration test: 20261021000000_link_kind: ${test}\n` });
   assert.deepEqual(logged.found, []);
 });
 
+test("a new migration needs a recorded test before it is pushed, and a trigger a measured scale test (preview CI, 726-F1)", (t) => {
+  const file = "packages/database/prisma/migrations/20261022000000_projection/migration.sql";
+  const sql = "CREATE FUNCTION refresh_projection() RETURNS trigger AS $$ BEGIN RETURN NEW; END $$ LANGUAGE plpgsql;\nCREATE TRIGGER t AFTER INSERT ON \"fresh\" FOR EACH ROW EXECUTE FUNCTION refresh_projection();\nCREATE TABLE \"fresh\" (id int);\n";
+  const test = "packages/database/__tests__/projection.test.ts";
+  const tested = `Migration test: 20261022000000_projection: ${test}\n`;
+  const rules = (options) => run(t, options).blocking.filter((finding) => finding.rule === "migration-test").map((finding) => finding.problem);
+  assert.equal(rules({ head: { [file]: sql } }).length, 2, "no test and no scale test");
+  assert.match(rules({ head: { [file]: sql }, changeLog: tested }).join(), /recorded migration test .* is not a test file at HEAD/);
+  assert.match(rules({ head: { [file]: sql, [test]: "t\n" }, changeLog: tested }).join(), /no `Scale test/);
+  assert.match(rules({ head: { [file]: sql, [test]: "t\n" }, changeLog: `${tested}Scale test: 20261022000000_projection: ${test}: fast\n` }).join(), /needs a test file at HEAD and a measurement/);
+  assert.deepEqual(rules({ head: { [file]: sql, [test]: "t\n" }, changeLog: `${tested}Scale test: 20261022000000_projection: ${test}: 100,000 rows, 2.1 ms per insert\n` }), []);
+});
+
 test("backend writes: uncaptured artifact fields, errors after a transaction write, and unscoped link deletes block", (t) => {
   const write = "await tx.artifact.updateMany({\n  where: { id: { in: ids } },\n  data: { projectId: target },\n});\n";
   const partial = "export const run = () => withDb.tx(async (tx) => {\n  await tx.artifactLink.create({ data });\n  if (cycle) {\n    return Result.err(Status.Conflict);\n  }\n});\n";
@@ -101,8 +115,8 @@ test("a new Desktop sync lane needs the shared give-up, the shared backoff, a Su
   const bare = run(t, { head: { [lane]: "export const delay = (attempt) => 1000 * 2 ** attempt;\n", ...table } });
   assert.equal(bare.found.filter(([rule]) => rule === "desktop-sync-lane").length, 4);
   const done = run(t, {
-    head: { [lane]: "import { LaneGiveUpStampDefect } from \"../../shared/lane-give-up.js\";\nexport const delay = (n) => exponentialBackoffMs(n + 1);\n", ...table },
-    changeLog: "Synchronizing-susan: no findings\nEngineering needed (forbidden path): apps/desktop/src/main/sync/AGENTS.md; why: roster\n",
+    head: { [lane]: "import { LaneGiveUpStampDefect } from \"../../shared/lane-give-up.js\";\nexport const delay = (n) => exponentialBackoffMs(n + 1);\n", ...table, "apps/desktop/test/placement.test.ts": "test();\n" },
+    changeLog: "Synchronizing-susan: no findings\nEngineering needed (forbidden path): apps/desktop/src/main/sync/AGENTS.md; why: roster\nMigration test: 20261021000000_placement: apps/desktop/test/placement.test.ts\n",
   });
   assert.deepEqual(done.found, []);
 });
@@ -478,3 +492,17 @@ test("a shared component's change requires every host's suites, in both flag sta
   const single = run(t, { base, head: { "packages/ui/only.tsx": "export const Only = 2;\n" }, commit: true });
   assert.deepEqual(single.requiredTests, [], "a component one host imports is not shared");
 });
+
+test("a change to a spec the base has needs a dated human source; a new spec or a test named .spec. does not (#8963)", (t) => {
+  const spec = "apps/prototypes/projects/project-hierarchy-spec.ts";
+  const base = { [spec]: "/**\n * Reject cycles and moves beyond four levels by withholding the drop target.\n */\nexport {};\n", "e2e/board.spec.ts": "test();\n" };
+  const head = { [spec]: base[spec].replace("Reject cycles and moves beyond four levels", "Reject cycles; four levels is display-only"), "e2e/board.spec.ts": "test(1);\n", "docs/prd/new-thing.md": "# New\n" };
+  const found = run(t, { base, head }).found.filter(([rule]) => rule === "spec-change");
+  assert.deepEqual(found, [["spec-change", spec]]);
+  const plan = `Spec change: ${spec}: the session plan PLN-1\n`;
+  assert.equal(run(t, { base, head, changeLog: plan }).found.filter(([rule]) => rule === "spec-change").length, 1, "a plan is not a human source");
+  const ruled = `Spec change: ${spec}: Pat Example, 2026-10-21, ISS-6560 comment\n`;
+  assert.deepEqual(run(t, { base, head, changeLog: ruled }).found.filter(([rule]) => rule === "spec-change"), []);
+  const prd = run(t, { base: { "docs/prds/board.md": "- Reject deep moves\n" }, head: { "docs/prds/board.md": null } }).found.filter(([rule]) => rule === "spec-change");
+  assert.deepEqual(prd, [["spec-change", "docs/prds/board.md"]], "deleting a spec is a change");
+});
diff --git a/plugins/vibe/skills/handoff/scripts/executed-check.mjs b/plugins/vibe/skills/handoff/scripts/executed-check.mjs
index 0b20ff36..3cbbc537 100644
--- a/plugins/vibe/skills/handoff/scripts/executed-check.mjs
+++ b/plugins/vibe/skills/handoff/scripts/executed-check.mjs
@@ -6,24 +6,35 @@
 // someone else can visual-QA the work in production.
 // A PRD is also executed only when every child it PRODUCES is DONE or
 // CANCELED: a PRD was once marked EXECUTED with four children still open.
-// Prints one JSON object; exits 0 when the document may be marked EXECUTED and
-// 1 otherwise. Changes nothing.
+// A ticket (`--kind ticket`) is DONE only when every acceptance criterion box
+// is checked, or the unchecked one names `Follow-up: <slug>` (the ticket that
+// carries it) or `Excluded: <human name or operator ruling>, <YYYY-MM-DD>`
+// in a ruling that names the ticket (`--slug`) or its PRD (`--prd`):
+// about sixty children were once swept to DONE with their criteria unchecked,
+// minutes after a merge.
+// Prints one JSON object; exits 0 when the document may be marked EXECUTED (a
+// ticket DONE) and 1 otherwise. Changes nothing.
 //
 // Usage: executed-check.mjs --kind plan --file <document body .md> --last-merge <iso time of the last merged pull request>
 //        executed-check.mjs --kind prd --file <...> --last-merge <...> --children <children.json>
+//        executed-check.mjs --kind ticket --file <ticket body .md, read just now> --slug <ticket slug> [--prd <PRD slug>]
 // children.json: the PRODUCES children read just now, `[{"slug", "status"}]`.
 
 import { readFileSync } from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { parseArgs } from "node:util";
+import { criteriaStates } from "./criteria-audit.mjs";
+import { rulingNamesScope } from "./rulings-check.mjs";
 
 export const SECTION = "Production visual QA";
 const HEADING = /^##\s+(.+?)\s*$/;
 const CHECKED = /^\s*(?:[-*]\s+)?Checked:\s*(\S+)/m;
 const FLAG_ROW = /^\s*(?:[-*]\s+`[^`]+`|\|\s*`[^`]+`\s*\|)/m;
 const NO_FLAGS = /^\s*(?:[-*]\s+)?No flags:\s*\S/m;
-const KINDS = new Set(["plan", "prd"]);
+const KINDS = new Set(["plan", "prd", "ticket"]);
+const FOLLOW_UP = /\bFollow-up:\s*[A-Z][A-Z0-9]+-\d+/;
+const EXCLUDED = /\bExcluded:\s*(?:operator ruling|[A-Z][\w'.-]+(?:\s+[A-Z][\w'.-]+)+),\s*\d{4}-\d{2}-\d{2}/;
 const FINISHED = new Set(["DONE", "CANCELED"]);
 
 /** Problems with a PRD's children: each one not DONE or CANCELED. */
@@ -36,6 +47,18 @@ export function childProblems(children) {
     .map((child) => `child ${child?.slug ?? "?"} is ${child?.status ?? "missing a status"}; a PRD is executed only when every PRODUCES child is DONE or CANCELED`);
 }
 
+/** Problems that keep a ticket from DONE: no criteria read, or an unchecked one with no follow-up or human exclusion. */
+export function ticketProblems(body, scope = []) {
+  const criteria = criteriaStates(body);
+  if (criteria.length === 0) {
+    return ["no acceptance criteria checkboxes found; read the ticket body just now (its latest version) and pass it with --file"];
+  }
+  const excluded = (text) => EXCLUDED.test(text) && (scope.length === 0 || rulingNamesScope(text.slice(text.search(EXCLUDED)), scope));
+  return criteria
+    .filter((criterion) => !criterion.checked && !FOLLOW_UP.test(criterion.text) && !excluded(criterion.text))
+    .map((criterion) => `${criterion.id} is unchecked: "${criterion.text.slice(0, 120)}"; check it against the merged code, or name \`Follow-up: <slug>\` or \`Excluded: <human name or operator ruling>, <YYYY-MM-DD>\` on it${scope.length ? `, in a ruling that names ${scope.join(" or ")}` : ""}`);
+}
+
 /** Problems that keep `body` from being marked EXECUTED after a merge at `lastMerge`. */
 export function executedProblems(body, lastMerge) {
   const lines = body.split("\n");
@@ -62,17 +85,20 @@ export function executedProblems(body, lastMerge) {
 }
 
 function main() {
-  const { values } = parseArgs({ options: { kind: { type: "string" }, file: { type: "string" }, "last-merge": { type: "string" }, children: { type: "string" } } });
-  const error = !KINDS.has(values.kind) ? "--kind plan or --kind prd is required."
-    : !values.file || !values["last-merge"] ? "--file and --last-merge are required."
+  const { values } = parseArgs({ options: { kind: { type: "string" }, file: { type: "string" }, "last-merge": { type: "string" }, children: { type: "string" }, slug: { type: "string" }, prd: { type: "string" } } });
+  const error = !KINDS.has(values.kind) ? "--kind plan, --kind prd or --kind ticket is required."
+    : !values.file ? "--file is required."
+    : values.kind !== "ticket" && !values["last-merge"] ? "--last-merge is required."
+    : values.kind === "ticket" && !values.slug ? "--kind ticket needs --slug <ticket slug> (and --prd <PRD slug> when it has one)."
     : values.kind === "prd" && !values.children ? "--kind prd needs --children <file> with its PRODUCES children read just now."
     : null;
   if (error) {
     process.stdout.write(`${JSON.stringify({ ok: false, error })}\n`);
     process.exit(1);
   }
-  const problems = [
-    ...executedProblems(readFileSync(path.resolve(values.file), "utf8"), values["last-merge"]),
+  const body = readFileSync(path.resolve(values.file), "utf8");
+  const problems = values.kind === "ticket" ? ticketProblems(body, [values.slug, values.prd].filter(Boolean)) : [
+    ...executedProblems(body, values["last-merge"]),
     ...(values.kind === "prd" ? childProblems(JSON.parse(readFileSync(path.resolve(values.children), "utf8"))) : []),
   ];
   process.stdout.write(`${JSON.stringify({ ok: problems.length === 0, problems }, null, 2)}\n`);
diff --git a/plugins/vibe/skills/handoff/scripts/executed-check.test.mjs b/plugins/vibe/skills/handoff/scripts/executed-check.test.mjs
index 8c9106c7..3fc2151a 100644
--- a/plugins/vibe/skills/handoff/scripts/executed-check.test.mjs
+++ b/plugins/vibe/skills/handoff/scripts/executed-check.test.mjs
@@ -3,7 +3,7 @@ import { writeFileSync } from "node:fs";
 import path from "node:path";
 import test from "node:test";
 import { fileURLToPath } from "node:url";
-import { childProblems, executedProblems } from "./executed-check.mjs";
+import { childProblems, executedProblems, ticketProblems } from "./executed-check.mjs";
 import { makeHome, runNode } from "../../vibe/scripts/test-fixtures.mjs";
 
 const SCRIPT = path.join(path.dirname(fileURLToPath(import.meta.url)), "executed-check.mjs");
@@ -58,9 +58,50 @@ test("a PRD is executed only when every PRODUCES child is DONE or CANCELED", (t)
   writeFileSync(done, JSON.stringify([{ slug: "A-1", status: "DONE" }]));
   const args = ["--kind", "prd", "--file", prd, "--last-merge", MERGED];
   assert.match(runNode(SCRIPT, args, home.home).json.error, /--kind prd needs --children/);
-  assert.match(runNode(SCRIPT, ["--file", prd, "--last-merge", MERGED], home.home).json.error, /--kind plan or --kind prd is required/);
+  assert.match(runNode(SCRIPT, ["--file", prd, "--last-merge", MERGED], home.home).json.error, /--kind plan, --kind prd or --kind ticket is required/);
   const refused = runNode(SCRIPT, [...args, "--children", open], home.home);
   assert.equal(refused.status, 1);
   assert.deepEqual(refused.json.problems, ["child A-3 is IN_PROGRESS; a PRD is executed only when every PRODUCES child is DONE or CANCELED"]);
   assert.equal(runNode(SCRIPT, [...args, "--children", done], home.home).status, 0);
 });
+
+const TICKET = [
+  "## Scope and acceptance criteria",
+  "",
+  "- Scope: board rows",
+  "- Acceptance criteria:",
+  "  - [x] Rows reorder by drag",
+  "  - [ ] Moves beyond four levels are refused",
+  "  - [ ] Keyboard reorder; Follow-up: ISS-12001",
+  "  - [ ] Touch reorder; Excluded: Pat Example, 2026-10-21, ISS-12001 comment",
+  "",
+  "## Environment",
+].join("\n");
+
+test("a ticket is DONE only when every acceptance criterion is checked, followed up or excluded by a human (bulk DONE sweep)", (t) => {
+  assert.deepEqual(ticketProblems(TICKET), [
+    "AC-2 is unchecked: \"Moves beyond four levels are refused\"; check it against the merged code, or name `Follow-up: <slug>` or `Excluded: <human name or operator ruling>, <YYYY-MM-DD>` on it",
+  ]);
+  assert.deepEqual(ticketProblems(TICKET.replace("- [ ] Moves", "- [x] Moves")), []);
+  assert.match(ticketProblems(TICKET.replace("Excluded: Pat Example, 2026-10-21", "Excluded: the plan")).join(), /AC-4 is unchecked/, "a plan is not a human exclusion");
+  assert.match(ticketProblems("# Bug\n\nIt breaks.\n").join(), /no acceptance criteria checkboxes/);
+  const heading = "## Acceptance Criteria\n\n- [x] One\n- [ ] Two\n\n## Notes\n- [ ] not a criterion\n";
+  assert.deepEqual(ticketProblems(heading).map((problem) => problem.slice(0, 16)), ["AC-2 is unchecke"]);
+  const home = makeHome("vibe-executed-check-");
+  t.after(home.cleanup);
+  const file = path.join(home.root, "ticket.md");
+  writeFileSync(file, TICKET);
+  assert.match(runNode(SCRIPT, ["--kind", "ticket", "--file", file], home.home).json.error, /--kind ticket needs --slug/);
+  const refused = runNode(SCRIPT, ["--kind", "ticket", "--file", file, "--slug", "ISS-12001"], home.home);
+  assert.equal(refused.status, 1);
+  assert.equal(refused.json.problems.length, 1);
+  writeFileSync(file, TICKET.replace("- [ ] Moves", "- [x] Moves"));
+  assert.equal(runNode(SCRIPT, ["--kind", "ticket", "--file", file, "--slug", "ISS-77", "--prd", "PRD-5"], home.home).status, 1, "the exclusion names neither this ticket nor its PRD");
+  assert.equal(runNode(SCRIPT, ["--kind", "ticket", "--file", file, "--slug", "ISS-12001"], home.home).status, 0);
+});
+
+test("an exclusion closes a ticket only in a ruling that names the ticket or its PRD (PRD-729 rollout tickets)", () => {
+  const body = "- Acceptance criteria:\n  - [ ] Roll out to cohorts with stop conditions; Excluded: Pat Example, 2026-10-21, ruling on the Desktop Labs toggle\n";
+  assert.equal(ticketProblems(body, ["ISS-9538", "PRD-729"]).length, 1, "a ruling about another surface");
+  assert.deepEqual(ticketProblems(body.replace("ruling on the Desktop Labs toggle", "ruling on PRD-729 rollout"), ["ISS-9538", "PRD-729"]), []);
+});
diff --git a/plugins/vibe/skills/handoff/scripts/handoff-inventory.test.mjs b/plugins/vibe/skills/handoff/scripts/handoff-inventory.test.mjs
index 2b1f9437..c09be6e1 100644
--- a/plugins/vibe/skills/handoff/scripts/handoff-inventory.test.mjs
+++ b/plugins/vibe/skills/handoff/scripts/handoff-inventory.test.mjs
@@ -359,12 +359,13 @@ test("frontend-only work reports no backend change", (t) => {
 });
 
 test("backend work is allowed and reported for the full checks", (t) => {
-  const { home, worktree } = setup(t, "backend");
+  const { home, worktree } = setup(t, "backend", { "packages/database/__tests__/migrations.test.ts": "test();\n" });
   write(worktree, "apps/app/page.tsx", "export const page = 2;\n");
   write(worktree, "apps/api/app/tags/route.ts", "export const GET = 1;\n");
   write(worktree, "packages/api/src/types/tag.ts", "type Tag = string;\n");
   write(worktree, "packages/database/prisma/migrations/1_tags/migration.sql", "select 1;\n");
   write(worktree, "apps/desktop/src/main/tags.ts", "const tags = 1;\n");
+  writeFileSync(path.join(git(worktree, ["rev-parse", "--absolute-git-dir"], home), "vibe-changes.md"), "Migration test: 1_tags: packages/database/__tests__/migrations.test.ts\n");
 
   const result = runNode(INVENTORY, ["--worktree", worktree], home);
   assert.equal(result.status, 0, JSON.stringify(result.json));
diff --git a/plugins/vibe/skills/handoff/scripts/review-threads.mjs b/plugins/vibe/skills/handoff/scripts/review-threads.mjs
index 063ef631..471efab8 100644
--- a/plugins/vibe/skills/handoff/scripts/review-threads.mjs
+++ b/plugins/vibe/skills/handoff/scripts/review-threads.mjs
@@ -8,12 +8,18 @@
 // their reply and stay open. A flag-gated fix names the test or missing-tests
 // entry pinning flag-off behavior to main. Every unresolved thread read from
 // the pull request needs a result. Any problem resolves nothing.
+// One review round per pull request (operator ruling, 2026-10-22): a thread
+// raised after the round-one fixes were pushed (`"round": "later"`) is never
+// fixed in it; its result is `followup` (`followupUrl`, the pull request's one
+// follow-up ticket, from review-followup.mjs) or `invalid` (`reason`), and it
+// is resolved after that reply, so it never blocks the merge.
 //
 // Usage:
 //   review-threads.mjs resolve --results <results.json> --threads <threads.json> [--gh <gh CLI>]
 //
 // results.json: {"writer": "<writer id>", "threads": [{"threadId", "commentId",
 //   "result": "fixed"|"partial"|"reason", "fixingCommit", "remaining", "reason",
+//   "round": "later" with "result": "followup"|"invalid" and "followupUrl" or "reason",
 //   "verification": {"by", "verdict": "verified"|"not-verified", "evidence"},
 //   "flagGated", "flagOffEqualsMain": "test:<path>"|"missing-test:<entry>"}]}
 // threads.json: the environment worker's `reviewThreads: read` list.
@@ -46,7 +52,7 @@ export function checkThreads(results, unresolved) {
     }
     const found = problemsFor(thread, writer);
     problems.push(...found.map((problem) => `${id}: ${problem}`));
-    if (!found.length) (thread.result === "fixed" ? resolve : replyOnly).push(id);
+    if (!found.length) (thread.result === "fixed" || thread.round === "later" ? resolve : replyOnly).push(id);
   }
   const answered = new Set(threads.map((thread) => thread?.threadId));
   for (const thread of unresolved) {
@@ -71,6 +77,11 @@ export function resolveThreads(results, unresolved, gh = "gh") {
 }
 
 function problemsFor(thread, writer) {
+  if (thread.round === "later") {
+    if (thread.result === "followup") return /^https:\/\/\S+$/.test(thread.followupUrl ?? "") ? [] : ["a later-round finding replies with its follow-up ticket's link (followupUrl)"];
+    if (thread.result === "invalid") return text(thread.reason) ? [] : ["an invalid later-round finding carries its reason"];
+    return ["a later-round thread is never fixed in this pull request; its result is followup (the one follow-up ticket) or invalid"];
+  }
   if (!["fixed", "partial", "reason"].includes(thread.result)) return [`result must be fixed, partial or reason, not ${JSON.stringify(thread.result)}`];
   const problems = [];
   if (thread.result === "partial" && !text(thread.remaining)) problems.push("a partial fix names what remains");
diff --git a/plugins/vibe/skills/handoff/scripts/review-threads.test.mjs b/plugins/vibe/skills/handoff/scripts/review-threads.test.mjs
index fbc8ce2a..b9b43d98 100644
--- a/plugins/vibe/skills/handoff/scripts/review-threads.test.mjs
+++ b/plugins/vibe/skills/handoff/scripts/review-threads.test.mjs
@@ -75,3 +75,13 @@ test("the writer's own word, an unverified verdict, a short SHA or a missing res
   assert.equal(checkThreads({ writer: WRITER, threads: [fixed("T1", { flagGated: true,
     flagOffEqualsMain: "missing-test:R12 flag off matches main" })] }, []).ok, true);
 });
+
+test("a later-round thread is answered with the follow-up ticket's link, or why it is invalid, and resolved; never fixed here", () => {
+  const later = (extra) => ({ threadId: "T9", commentId: 9, round: "later", ...extra });
+  const unresolved = [{ threadId: "T9" }];
+  const followup = checkThreads({ writer: "w", threads: [later({ result: "followup", followupUrl: "https://app.example.test/issues/ISS-2" })] }, unresolved);
+  assert.deepEqual([followup.ok, followup.resolve, followup.replyOnly], [true, ["T9"], []]);
+  assert.deepEqual(checkThreads({ writer: "w", threads: [later({ result: "invalid", reason: "already covered by AC-3" })] }, unresolved).resolve, ["T9"]);
+  assert.match(checkThreads({ writer: "w", threads: [later({ result: "followup" })] }, unresolved).problems.join(), /follow-up ticket's link/);
+  assert.match(checkThreads({ writer: "w", threads: [later({ result: "fixed", fixingCommit: "a".repeat(40) })] }, unresolved).problems.join(), /never fixed in this pull request/);
+});
diff --git a/plugins/vibe/skills/handoff/scripts/rollout-gate.mjs b/plugins/vibe/skills/handoff/scripts/rollout-gate.mjs
new file mode 100644
index 00000000..b588b3a4
--- /dev/null
+++ b/plugins/vibe/skills/handoff/scripts/rollout-gate.mjs
@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+// A PRD's rollout gate is part of its scope. One PRD required a closed-by-default
+// flag, the legacy list kept as a rollback path until parity, and a staged
+// cohort rollout; a pull request deleted the legacy list and shipped the new
+// surface to everyone, and agents then closed the rollout tickets citing a
+// ruling about a different surface.
+//
+// Every rollout requirement (a ticket acceptance criterion, or a PRD checkbox or
+// bullet under a rollout or rollback heading, that names a flag, a rollback or
+// legacy path, a cohort or a staged rollout) needs a change log line:
+//   Rollout: <AC-n | PRD-n>: <file>:<line>                                 (the code that does it, at HEAD)
+//   Rollout: <AC-n | PRD-n>: ruling <human name or operator ruling>, <YYYY-MM-DD>, <where>
+// A flag requirement's line reads a flag; a ruling names the ticket or PRD it
+// is applied to (a ruling about another surface does not cover this one).
+//
+// Usage: rollout-gate.mjs --worktree <path> --ticket <ticket body .md> --slug <ticket slug> [--prd <PRD body .md> --prd-slug <slug>] [--change-log <file>]
+// Prints {"ok","requirements","problems"}; exits 1 on any problem. Changes nothing.
+
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { parseArgs } from "node:util";
+import { git } from "../../vibe/scripts/session-record.mjs";
+import { criteriaStates } from "./criteria-audit.mjs";
+import { rulingNamesScope } from "./rulings-check.mjs";
+import { escapeRegExp } from "./source-imports.mjs";
+
+export const ROLLOUT = /\b(?:feature (?:flag|switch)|flag(?:-gated|ged)?|closed[- ]by[- ]default|default[- ]off|rollback|roll back|legacy|cohort|staged rollout|rollout|kill switch|percentage rollout)\b/i;
+const FLAG = /\b(?:feature (?:flag|switch)|flag|closed[- ]by[- ]default|default[- ]off|kill switch)\b/i;
+const FLAG_READ = /flag/i;
+const ROLLOUT_HEADING = /^#{1,6}\s+.*\b(?:rollout|rollback|release plan|launch plan|feature flags?)\b/i;
+const HEADING = /^(#{1,6})\s/;
+const BULLET = /^\s*[-*]\s+(?:\[[ xX]\]\s*)?(\S.*)$/;
+const RULING = /^ruling\s+(?:operator ruling|[A-Z][\w'.-]+(?:\s+[A-Z][\w'.-]+)+),\s*\d{4}-\d{2}-\d{2},\s*\S/;
+const CODE = /^(\S+?):(\d+)\s*$/;
+
+/** The rollout requirements in a ticket body (AC-n) and a PRD body (PRD-n). */
+export function rolloutRequirements(ticket, prd = "") {
+  const fromTicket = criteriaStates(ticket).filter((criterion) => ROLLOUT.test(criterion.text)).map(({ id, text }) => ({ id, text }));
+  const fromPrd = [];
+  let level = 0;
+  let count = 0;
+  for (const line of prd.split("\n")) {
+    const heading = HEADING.exec(line);
+    if (heading) {
+      level = ROLLOUT_HEADING.test(line) ? heading[1].length : level && heading[1].length > level ? level : 0;
+      continue;
+    }
+    const bullet = BULLET.exec(line);
+    if (bullet && (level || (/^\s*[-*]\s+\[[ xX]\]/.test(line) && ROLLOUT.test(bullet[1])))) {
+      count += 1;
+      if (ROLLOUT.test(bullet[1]) || level) fromPrd.push({ id: `PRD-${count}`, text: bullet[1] });
+    }
+  }
+  return [...fromTicket, ...fromPrd];
+}
+
+/** Problems for each requirement without code at HEAD or a ruling scoped to this ticket or PRD. */
+export function rolloutProblems(requirements, changeLog, { lineAt }, scope) {
+  const problems = [];
+  for (const requirement of requirements) {
+    const match = new RegExp(String.raw`^\s*(?:[-*]\s+)?Rollout:\s*${escapeRegExp(requirement.id)}:\s*(.+?)\s*$`, "m").exec(changeLog);
+    const label = `${requirement.id} "${requirement.text.slice(0, 100)}"`;
+    if (!match) {
+      problems.push(`${label} has no \`Rollout: ${requirement.id}: <file>:<line>\` or scoped ruling; build it, or cite a human ruling that names ${scope.join(" or ")}`);
+      continue;
+    }
+    const evidence = match[1];
+    if (/^ruling\b/i.test(evidence)) {
+      if (!RULING.test(evidence)) problems.push(`${label}: a ruling needs a human name or operator ruling, a date and where it was said`);
+      else if (!rulingNamesScope(evidence, scope)) problems.push(`${label}: the ruling names neither ${scope.join(" nor ")}; a ruling about another ticket or surface does not cover this one`);
+      continue;
+    }
+    const code = CODE.exec(evidence);
+    const text = code ? lineAt(code[1], Number(code[2])) : null;
+    if (text === null) problems.push(`${label}: ${evidence} is not a line at HEAD; a deleted or missing path does not keep a rollout or rollback requirement`);
+    else if (FLAG.test(requirement.text) && !FLAG_READ.test(text)) problems.push(`${label}: ${evidence} reads no flag`);
+  }
+  return problems;
+}
+
+function main(argv) {
+  const { values } = parseArgs({ args: argv, options: {
+    worktree: { type: "string" }, ticket: { type: "string" }, slug: { type: "string" }, prd: { type: "string" }, "prd-slug": { type: "string" }, "change-log": { type: "string" },
+  } });
+  if (!values.worktree || !values.ticket || !values.slug || (values.prd && !values["prd-slug"])) {
+    throw new Error("Usage: rollout-gate.mjs --worktree <path> --ticket <body> --slug <ticket slug> [--prd <body> --prd-slug <slug>] [--change-log <file>]");
+  }
+  const worktree = path.resolve(values.worktree);
+  const logFile = values["change-log"] ?? path.join(git(worktree, ["rev-parse", "--absolute-git-dir"]), "vibe-changes.md");
+  const requirements = rolloutRequirements(readFileSync(values.ticket, "utf8"), values.prd ? readFileSync(values.prd, "utf8") : "");
+  const lineAt = (file, line) => {
+    const full = path.join(worktree, file);
+    if (!full.startsWith(`${worktree}${path.sep}`) || !existsSync(full)) return null;
+    return readFileSync(full, "utf8").split("\n")[line - 1] ?? null;
+  };
+  const problems = rolloutProblems(requirements, existsSync(logFile) ? readFileSync(logFile, "utf8") : "", { lineAt }, [values.slug, values["prd-slug"]].filter(Boolean));
+  process.stdout.write(`${JSON.stringify({ ok: problems.length === 0, requirements: requirements.map(({ id }) => id), problems }, null, 2)}\n`);
+  return problems.length === 0 ? 0 : 1;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    process.exit(main(process.argv.slice(2)));
+  } catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exit(2);
+  }
+}
diff --git a/plugins/vibe/skills/handoff/scripts/rollout-gate.test.mjs b/plugins/vibe/skills/handoff/scripts/rollout-gate.test.mjs
new file mode 100644
index 00000000..58a685fc
--- /dev/null
+++ b/plugins/vibe/skills/handoff/scripts/rollout-gate.test.mjs
@@ -0,0 +1,72 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdirSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+import { rolloutProblems, rolloutRequirements } from "./rollout-gate.mjs";
+import { criteriaChangeProblems, rulingNamesScope } from "./rulings-check.mjs";
+import { git, makeHome, runNode } from "../../vibe/scripts/test-fixtures.mjs";
+
+const SCRIPT = path.join(path.dirname(fileURLToPath(import.meta.url)), "rollout-gate.mjs");
+// Shaped like PRD-729: a closed-by-default flag, the legacy list kept as a rollback path, and a staged rollout.
+const TICKET = [
+  "- Acceptance criteria:",
+  "  - [ ] Branches v2 renders behind the closed-by-default flag branches-v2",
+  "  - [ ] The legacy Branches list stays as the rollback path until parity",
+  "  - [ ] Rows sort by updated time",
+  "",
+].join("\n");
+const PRD = ["# PRD", "", "## Rollout", "", "- Staged cohort rollout with stop conditions", "", "## Problem", "", "- Slow lists", ""].join("\n");
+
+test("rollout, flag and rollback requirements come from the ticket criteria and the PRD's rollout section", () => {
+  assert.deepEqual(rolloutRequirements(TICKET, PRD).map(({ id }) => id), ["AC-1", "AC-2", "PRD-1"]);
+  assert.deepEqual(rolloutRequirements("- Acceptance criteria:\n  - [ ] Rows sort by updated time\n"), []);
+});
+
+test("each rollout requirement needs code at HEAD that does it, or a human ruling naming this ticket or PRD (PRD-729)", () => {
+  const head = { "packages/app/branches/list.tsx": ["export const List = () => {", "  const on = useFeatureFlag(BRANCHES_V2);", "  return on ? <V2 /> : <Legacy />;", "};"] };
+  const lineAt = (file, line) => head[file]?.[line - 1] ?? null;
+  const requirements = rolloutRequirements(TICKET, PRD);
+  const scope = ["ISS-9394", "PRD-729"];
+  const problems = (log) => rolloutProblems(requirements, log, { lineAt }, scope);
+  assert.equal(problems("").length, 3, "the shipped-ungated diff: nothing recorded");
+  const done = [
+    "Rollout: AC-1: packages/app/branches/list.tsx:2",
+    "Rollout: AC-2: packages/app/branches/list.tsx:3",
+    "Rollout: PRD-1: ruling Pat Example, 2026-10-22, PRD-729 thread: ship to everyone at once",
+  ].join("\n");
+  assert.deepEqual(problems(done), []);
+  assert.match(problems(done.replace("list.tsx:2", "list.tsx:4")).join(), /reads no flag/, "a flag requirement cites a flag read");
+  assert.match(problems(done.replace("AC-2: packages/app/branches/list.tsx:3", "AC-2: packages/app/branches/legacy-list.tsx:1")).join(), /not a line at HEAD/, "a deleted legacy list keeps nothing");
+  assert.match(problems(done.replace("PRD-729 thread", "Desktop Labs toggle thread")).join(), /names neither ISS-9394 nor PRD-729/, "a ruling about another surface");
+  assert.match(problems(done.replace("Pat Example", "the plan")).join(), /human name or operator ruling/);
+});
+
+test("a cited ruling covers a ticket only when it names the ticket or its PRD", () => {
+  assert.equal(rulingNamesScope("Ruling (operator): PRD-729 ships ungated", ["ISS-9538", "PRD-729"]), true);
+  assert.equal(rulingNamesScope("Ruling (operator): the Desktop Labs toggle is gone", ["ISS-9538", "PRD-729"]), false);
+  assert.equal(rulingNamesScope("ISS-95380 only", ["ISS-9538"]), false);
+  assert.deepEqual(criteriaChangeProblems(TICKET, TICKET), []);
+});
+
+test("the command reads the session change log and fails a diff that shipped ungated", (t) => {
+  const { root, home, cleanup } = makeHome("vibe-rollout-gate-");
+  t.after(cleanup);
+  const worktree = path.join(root, "wt");
+  git(root, ["init", "--quiet", "--initial-branch=main", worktree], home);
+  mkdirSync(path.join(worktree, "packages/app/branches"), { recursive: true });
+  writeFileSync(path.join(worktree, "packages/app/branches/list.tsx"), "export const List = () => {\n  const on = useFeatureFlag(BRANCHES_V2);\n  return on ? <V2 /> : <Legacy />;\n};\n");
+  const ticket = path.join(root, "ticket.md");
+  const prd = path.join(root, "prd.md");
+  writeFileSync(ticket, TICKET);
+  writeFileSync(prd, PRD);
+  const args = ["--worktree", worktree, "--ticket", ticket, "--slug", "ISS-9394", "--prd", prd, "--prd-slug", "PRD-729"];
+  const refused = runNode(SCRIPT, args, home);
+  assert.equal(refused.status, 1);
+  assert.equal(refused.json.problems.length, 3);
+  writeFileSync(path.join(git(worktree, ["rev-parse", "--absolute-git-dir"], home), "vibe-changes.md"), "Rollout: AC-1: packages/app/branches/list.tsx:2\nRollout: AC-2: packages/app/branches/list.tsx:3\nRollout: PRD-1: ruling operator ruling, 2026-10-22, PRD-729 thread\n");
+  assert.equal(runNode(SCRIPT, args, home).status, 0);
+  const usage = spawnSync(process.execPath, [SCRIPT, "--worktree", worktree, "--ticket", ticket], { encoding: "utf8" });
+  assert.equal(usage.status, 2, "the ticket slug is required, so a ruling can be scoped");
+});
diff --git a/plugins/vibe/skills/handoff/scripts/rulings-check.mjs b/plugins/vibe/skills/handoff/scripts/rulings-check.mjs
index b2d9df65..7ca558a1 100644
--- a/plugins/vibe/skills/handoff/scripts/rulings-check.mjs
+++ b/plugins/vibe/skills/handoff/scripts/rulings-check.mjs
@@ -4,16 +4,21 @@
 // threads, so a later audit against the written criteria reported deliberate
 // changes as misses.
 //
-// Usage: rulings-check.mjs --ticket <ticket body .md> --record <QA record or resume log> [--record <file>]...
+// Usage: rulings-check.mjs --ticket <ticket body .md> --record <QA record or resume log> [--record <file>]... [--criteria-before <earlier body>]
 //        rulings-check.mjs --program <rulings.md> --record <orchestrator transcript or QA record> [--record <file>]...
 //        rulings-check.mjs --plan <get-document JSON of a PLN> [--plan-body <its latest version text>] [--plan ...]
+//        rulings-check.mjs --ruling <file with the cited ruling's words> --scope <ticket slug>[,<PRD slug>]
 //
 // A ruling in a record is a line `Ruling <anything>: <decision>` (the resume
 // log's `- Ruling (operator): ...`, or the same line in a QA record). The
 // ticket's Scope and acceptance criteria section carries each one as
 // `- Ruling <date> (<who>): "<decision>"; amends: <criteria, or none>`. Prints
 // {"ok","problems"} and exits 1 when a record's ruling is missing from the
-// ticket or a ticket ruling names no amended criteria.
+// ticket or a ticket ruling names no amended criteria. With
+// `--criteria-before`, every acceptance criterion of the earlier ticket body
+// that the ticket no longer carries word for word needs a ticket ruling that
+// amends it by its earlier id: an agent once reworded a human's "reject moves
+// beyond four levels" to "display-only" to match its code.
 //
 // A plan with no human approver (`approverId` null; vibe sets a PLN's status
 // but never its approver) is not a ruling, so each exclusion in it must cite
@@ -26,10 +31,15 @@
 // session-plan.mjs renders. A writer once skipped
 // two tickets on an uncited Out-of-scope line of a plan vibe itself had set to
 // APPROVED, against a direct instruction to build them.
+//
+// A ruling cited to close, narrow or skip a ticket covers it only when the
+// ruling names that ticket or its PRD (`--ruling` with `--scope`): rollout
+// tickets were once closed DONE on a ruling about a different surface.
 
 import { readFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 import { parseArgs } from "node:util";
+import { criteriaStates } from "./criteria-audit.mjs";
 
 const RECORD_RULING = /^\s*[-*]?\s*Ruling\b[^:\n]*:\s*(.+?)\s*$/gm;
 const TICKET_RULING = /^\s*[-*]\s*Ruling\b[^:\n]*:\s*(.+?)\s*$/gm;
@@ -115,6 +125,21 @@ export function rulingProblems(ticket, records) {
   return problems;
 }
 
+/** Criteria of `before` reworded or dropped in `ticket` that no ticket ruling amends by id. */
+export function criteriaChangeProblems(before, ticket) {
+  const now = new Set(criteriaStates(ticket).map((criterion) => normalize(criterion.text)));
+  const amended = new Set([...ticket.matchAll(TICKET_RULING)]
+    .flatMap((match) => AMENDS.exec(match[1])?.[1].match(/\bAC-\d+\b/g) ?? []));
+  return criteriaStates(before)
+    .filter((criterion) => !now.has(normalize(criterion.text)) && !amended.has(criterion.id))
+    .map((criterion) => `${criterion.id} "${criterion.text.slice(0, 120)}" was reworded or dropped with no ticket ruling amending ${criterion.id}; restore it, or add - Ruling <date> (<who>): "<decision>"; amends: ${criterion.id} from a human source`);
+}
+
+/** Whether a ruling's words name one of the slugs it is applied to. */
+export function rulingNamesScope(text, slugs) {
+  return slugs.filter(Boolean).some((slug) => new RegExp(`(?:^|[^A-Za-z0-9-])${slug.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![0-9])`, "i").test(text));
+}
+
 /** Problems with the program-wide ruling index and the records it reconciles. */
 export function programRulingProblems(program, records) {
   const entries = [...program.matchAll(PROGRAM_RULING)].map((match) => match[4]);
@@ -134,18 +159,28 @@ export function programRulingProblems(program, records) {
 function main(argv) {
   const { values } = parseArgs({ args: argv, options: {
     ticket: { type: "string" }, program: { type: "string" }, record: { type: "string", multiple: true },
-    plan: { type: "string", multiple: true }, "plan-body": { type: "string", multiple: true },
+    plan: { type: "string", multiple: true }, "plan-body": { type: "string", multiple: true }, "criteria-before": { type: "string" },
+    ruling: { type: "string" }, scope: { type: "string" },
   } });
+  if (values.ruling || values.scope) {
+    if (!values.ruling || !values.scope) throw new Error("--ruling <file> and --scope <ticket slug>[,<PRD slug>] go together");
+    const slugs = values.scope.split(",").map((slug) => slug.trim()).filter(Boolean);
+    const problems = rulingNamesScope(readFileSync(values.ruling, "utf8"), slugs) ? [] : [`the ruling names neither ${slugs.join(" nor ")}; a ruling about another ticket or surface does not cover this one`];
+    process.stdout.write(`${JSON.stringify({ ok: problems.length === 0, problems }, null, 2)}\n`);
+    return problems.length === 0 ? 0 : 1;
+  }
   const plans = values.plan ?? [];
   const bodies = values["plan-body"] ?? [];
   const rulingMode = Boolean(values.ticket || values.program);
-  if ((rulingMode && (!values.record?.length || (values.ticket && values.program))) || (!rulingMode && plans.length === 0) || bodies.length > plans.length) {
-    throw new Error("Usage: rulings-check.mjs (--ticket <ticket body .md> | --program <rulings.md>) --record <file>... | --plan <get-document JSON> [--plan-body <text>]...");
+  const before = values["criteria-before"];
+  if ((before && !values.ticket) || (rulingMode && ((!values.record?.length && !before) || (values.ticket && values.program))) || (!rulingMode && plans.length === 0) || bodies.length > plans.length) {
+    throw new Error("Usage: rulings-check.mjs (--ticket <ticket body .md> [--criteria-before <earlier body>] | --program <rulings.md>) --record <file>... | --plan <get-document JSON> [--plan-body <text>]...");
   }
   const records = (values.record ?? []).map((file) => readFileSync(file, "utf8"));
   const problems = [];
   if (values.program) problems.push(...programRulingProblems(readFileSync(values.program, "utf8"), records));
   else if (values.ticket) problems.push(...rulingProblems(readFileSync(values.ticket, "utf8"), records));
+  if (before) problems.push(...criteriaChangeProblems(readFileSync(before, "utf8"), readFileSync(values.ticket, "utf8")));
   plans.forEach((file, index) => {
     const doc = JSON.parse(readFileSync(file, "utf8"));
     problems.push(...planProblems(doc, bodies[index] === undefined ? undefined : readFileSync(bodies[index], "utf8")));
diff --git a/plugins/vibe/skills/handoff/scripts/rulings-check.test.mjs b/plugins/vibe/skills/handoff/scripts/rulings-check.test.mjs
index 45141b38..b5790968 100644
--- a/plugins/vibe/skills/handoff/scripts/rulings-check.test.mjs
+++ b/plugins/vibe/skills/handoff/scripts/rulings-check.test.mjs
@@ -5,7 +5,7 @@ import os from "node:os";
 import path from "node:path";
 import test from "node:test";
 import { fileURLToPath } from "node:url";
-import { planProblems, programRulingProblems, recordRulings, rulingProblems, uncitedExclusions } from "./rulings-check.mjs";
+import { planProblems, programRulingProblems, recordRulings, rulingProblems, uncitedExclusions, criteriaChangeProblems } from "./rulings-check.mjs";
 
 const SCRIPT = fileURLToPath(new URL("./rulings-check.mjs", import.meta.url));
 
@@ -105,3 +105,15 @@ test("the command fails on a PLN-2212-shaped plan and passes once it is marked a
   writeFileSync(body, `${MARKER}\n\n- Out-of-scope: ISS-9381 per ISS-9381 AC-2 (operator ruling 2026-10-21)\n`);
   assert.equal(spawnSync(process.execPath, [SCRIPT, "--plan", doc, "--plan-body", body], { encoding: "utf8" }).status, 0);
 });
+
+test("a reworded or dropped acceptance criterion needs a ticket ruling amending it by id (#8963, ISS-6560)", () => {
+  const before = "- Acceptance criteria:\n  - [ ] Drag reorders rows\n  - [ ] Reject moves beyond four levels\n";
+  const reworded = "- Acceptance criteria:\n  - [ ] Drag reorders rows\n  - [ ] Four levels is a display-only cap\n";
+  assert.deepEqual(criteriaChangeProblems(before, before), []);
+  assert.match(criteriaChangeProblems(before, reworded).join(), /^AC-2 "Reject moves beyond four levels" was reworded or dropped/);
+  assert.equal(criteriaChangeProblems(before, reworded).length, 1, "the unchanged criterion passes");
+  const ruled = `${reworded}- Ruling 2026-10-21 (Pat Example): "depth is display-only"; amends: AC-2\n`;
+  assert.deepEqual(criteriaChangeProblems(before, ruled), []);
+  assert.equal(criteriaChangeProblems(before, ruled.replace("amends: AC-2", "amends: AC-1")).length, 1, "a ruling amending another criterion does not cover it");
+  assert.equal(criteriaChangeProblems(before, "- Acceptance criteria:\n  - [ ] Drag reorders rows\n").length, 1, "a dropped criterion is a change");
+});
diff --git a/plugins/vibe/skills/handoff/scripts/spec-rules.mjs b/plugins/vibe/skills/handoff/scripts/spec-rules.mjs
new file mode 100644
index 00000000..b2313ef4
--- /dev/null
+++ b/plugins/vibe/skills/handoff/scripts/spec-rules.mjs
@@ -0,0 +1,36 @@
+// A spec a human wrote is never the session's to move. An agent session once
+// reworded a prototype spec's "reject ... moves beyond four levels" to
+// "display-only" so it agreed with the code, though a written rule already
+// forbade editing a spec to match an implementation; a self-approved plan and a
+// ticket then repeated the new wording.
+//
+// A spec is a `*-spec.<ts|tsx|js|jsx|md|mdx>` file (a `.spec.` file is a
+// test), or a Markdown file under a `prd`, `prds`, `spec` or `specs`
+// directory. Any change to one the base already has needs the human source in
+// the change log:
+//   Spec change: <path>: <human name or operator ruling>, <YYYY-MM-DD>, <where>
+// The session's own ticket, plan or change log is not a source.
+
+import { escapeRegExp } from "./source-imports.mjs";
+
+const SPEC_FILE = /(?:^|\/)[^/]+-spec\.(?:[cm]?[jt]sx?|mdx?)$|(?:^|\/)(?:prds?|specs?)\/(?:[^/]+\/)*[^/]+\.mdx?$/i;
+
+/** Whether `file` is a spec under the rule above. */
+export function isSpecFile(file) {
+  return SPEC_FILE.test(file);
+}
+
+/** Blocks each change to an existing spec that records no dated human source. */
+export function checkSpecChanges(files, changeLog, add) {
+  for (const file of files.filter((entry) => entry.status !== "A" && isSpecFile(entry.oldPath ?? entry.path))) {
+    if (file.added.length === 0 && file.removed.length === 0 && file.status !== "D") {
+      continue;
+    }
+    const where = file.oldPath ?? file.path;
+    const recorded = new RegExp(String.raw`^\s*(?:[-*]\s+)?Spec change:\s*${escapeRegExp(where)}:\s*(?:operator ruling|[A-Z][\w'.-]+(?:\s+[A-Z][\w'.-]+)+),\s*\d{4}-\d{2}-\d{2},\s*\S`, "m");
+    if (!recorded.test(changeLog)) {
+      const line = file.removed[0]?.line ?? file.added[0]?.line ?? 1;
+      add("spec-change", where, line, "changes a spec the base already has with no recorded human source; a spec that disagrees with the code is a finding to report, never one to edit", `restore the spec, or record \`Spec change: ${where}: <human name or operator ruling>, <YYYY-MM-DD>, <where they said it>\`; the session's own ticket, plan or change log is not a source`);
+    }
+  }
+}
diff --git a/plugins/vibe/skills/vibe/SKILL.md b/plugins/vibe/skills/vibe/SKILL.md
index dd13000e..5f2b0034 100644
--- a/plugins/vibe/skills/vibe/SKILL.md
+++ b/plugins/vibe/skills/vibe/SKILL.md
@@ -410,7 +410,11 @@ Only after the person chose resume, run `node scripts/vibe-sessions.mjs list`
   - the fixes are pushed to the same branch (never forced);
   - the pull request body is refreshed from the session record;
   - each review thread is answered with the fixing commit and resolved once
-    fixed.
+    fixed, in round one. One review round per pull request: a thread raised
+    after the round-one fixes are pushed is never fixed in it; a valid one
+    becomes a criterion on the pull request's one follow-up ticket
+    (`scripts/review-followup.mjs`), and the thread gets that ticket's link
+    (or why it is invalid) and is resolved, so it never blocks the merge.
 
 Before offering anything, for each `handed-off` session whose
 `livePlanStatus` is `APPROVED`, dispatch `vibe-ticket-worker` in plan mode
@@ -840,7 +844,12 @@ except the startup version question, which runs once per conversation
 (section 1, "Plugin version"):
 
 1. Before asking, run `node scripts/session-questions.mjs ask --key <topic>
-   --question "<exact words>" [--worktree "<wt>"]`. For a product question,
+   --question "<exact words>" --default "<what you do without an answer>"
+   --deadline-minutes <n> [--worktree "<wt>"]` and end the message with the
+   `ifNoAnswer` line it returns (at most 30 minutes); past it, go ahead on
+   the default and say so. A question never holds a pull request: ship what
+   is done, arm auto-merge and put the answer-dependent part in a follow-up.
+   For a product question,
    also pass `--product --code-evidence "<file:line>"`; the command refuses it
    without the required code/data-model check. It also refuses a request for
    permission to do in-scope work (a test repair, a main merge, a push, a fix):
@@ -890,9 +899,10 @@ that waited, and one deploy after the last of them carries them all. A
    script leaves out the session's `localFixes` and files that never belong
    in a commit, and the repository's commit hook runs. `committed: false`
    means nothing changed; continue. A commit reporting `pushDue: true`
-   (`scripts/push-cadence.mjs`) has work that waited 90 minutes unpushed:
+   (`scripts/push-cadence.mjs`) has work that waited 45 minutes unpushed:
    publish this tested checkpoint now, send later review findings as
-   follow-up commits, and add no new scope to an unpushed checkpoint. `"ok":false` means the hook refused:
+   follow-up commits, add no new scope to an unpushed checkpoint, and never
+   hold a push for optional evidence (screenshots, extra e2e, full lanes). `"ok":false` means the hook refused:
    resume the SAME persistent writer in fix mode with the error, then commit
    again. An existing test or fixture the change broke is repaired there
    (`references/guardrails.md`, "Repair, don't author"). When the writer
diff --git a/plugins/vibe/skills/vibe/references/guardrails.md b/plugins/vibe/skills/vibe/references/guardrails.md
index d48be329..6828b4e3 100644
--- a/plugins/vibe/skills/vibe/references/guardrails.md
+++ b/plugins/vibe/skills/vibe/references/guardrails.md
@@ -39,8 +39,11 @@ Codex and Claude Code, and this section is its one canonical statement:
 
 These rules bind every worker in both harnesses.
 
-- Stop only a pid or process group this session recorded and still owns.
-  Never `pkill`, `killall` or `kill` by name or pattern; report what you did not start.
+- Stop only a pid this session recorded and still owns: record each process
+  you start with `node <plugin root>/hooks/kill-guard.mjs own <pid>`.
+  Never `pkill`, `killall` or `kill` by name or pattern; in Claude Code that
+  hook refuses them and a `kill` of a pid of 1 or lower or an unrecorded pid.
+  Report what you did not start.
 - Records, writer state, briefs, monitor config and reports a later step
   reads live in the session's Git metadata, `.claude/worktrees/` or
   `~/.codex/vibe/`, never `/tmp` or the system temp folder.
@@ -111,9 +114,12 @@ Backend, built by that same writer using canonical backend guidance, each under
   canonical place for them.
 - `packages/database/**`: Prisma schema changes with a generated migration
   (`packages/database/AGENTS.md`); never edit a migration that has landed on
-  main; never apply a migration to a shared database from this Mac (the API's
-  Vercel build applies it to the session's own data on redeploy); every new
-  model gets a seed coverage file and seed data in the vibe seed.
+  main; never apply a migration to a shared database from this Mac; every new
+  model gets a seed coverage file and seed data in the vibe seed. Pushing a
+  migration publishes it to shared preview schemas, so record the test that
+  runs it as `Migration test:` (an existing one that applies every migration
+  counts; for per-row work a measured `Scale test:` too) first;
+  `scripts/migration-publish.mjs` refuses the push without them.
 - `apps/desktop/src/main/**` and `apps/desktop/prisma/**`, when the change is a
   Desktop feature (`apps/desktop/AGENTS.md`; gateway operations stay in
   `apps/desktop/src/server/operations/`).
diff --git a/plugins/vibe/skills/vibe/scripts/commit-worktree.mjs b/plugins/vibe/skills/vibe/scripts/commit-worktree.mjs
index 6936839e..e960538f 100644
--- a/plugins/vibe/skills/vibe/scripts/commit-worktree.mjs
+++ b/plugins/vibe/skills/vibe/scripts/commit-worktree.mjs
@@ -99,7 +99,7 @@ function commitWorktree() {
   return { committed: true, commit: git(worktree, ["rev-parse", "HEAD"]), subject, merge: merging, files, excluded, ...pushCadence(worktree, [...excluded, ...localFixes]) };
 }
 
-// A tested checkpoint is pushed at least every 90 minutes (`push-cadence.mjs`); the commit never fails on it.
+// A tested checkpoint is pushed at least every 45 minutes (`push-cadence.mjs`); the commit never fails on it.
 function pushCadence(worktree, ignore) {
   try {
     const { minutes, due } = unpushedAge(worktree, { ignore });
diff --git a/plugins/vibe/skills/vibe/scripts/migration-publish.mjs b/plugins/vibe/skills/vibe/scripts/migration-publish.mjs
new file mode 100644
index 00000000..4657f91a
--- /dev/null
+++ b/plugins/vibe/skills/vibe/scripts/migration-publish.mjs
@@ -0,0 +1,91 @@
+#!/usr/bin/env node
+// Pushing a migration publishes it. A vibe branch push once ran preview CI
+// that applied an unreviewed migration to two shared preview schemas, and the
+// later fix needed a cleanup run; a takeover writer found another migration's
+// trigger had moved quadratic cost onto every insert (10 s per insert), which
+// its handoff had called done. So before the first push, each new migration
+// needs a test that runs it, and one that adds a trigger, a function or
+// per-row work needs a measured scale test, both recorded in the change log:
+//   Migration test: <migration id>: <test file>
+//   Scale test: <migration id>: <test file>: <n> rows, <time per write or total>
+// The test file must exist at HEAD; an existing test that applies every
+// migration counts, since a vibe session writes no tests unless asked for a
+// pull request. The migration id is its folder name
+// (`migrations/<id>/migration.sql`) or its file name without `.sql`.
+//
+// Usage: migration-publish.mjs --worktree <path> --since <the last pushed commit, or the session's base commit> [--change-log <file>]
+// Prints {"ok","migrations","problems"}; exits 1 on any problem. Changes nothing.
+
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { parseArgs } from "node:util";
+import { escapeRegExp } from "../../handoff/scripts/source-imports.mjs";
+import { git } from "./session-record.mjs";
+import { isTestFile } from "./test-files.mjs";
+
+const MIGRATION = /(?:^|\/)migrations\/(?:([^/]+)\/[^/]+|([^/]+))\.sql$/;
+const PER_ROW_WORK = /\bCREATE\s+(?:OR\s+REPLACE\s+)?(?:CONSTRAINT\s+)?(?:TRIGGER|FUNCTION|PROCEDURE)\b|\bFOR\s+EACH\s+ROW\b/i;
+const MEASUREMENT = /\d[\d,_]*\s*(?:k\s*)?rows?\b.*\d+(?:\.\d+)?\s*(?:ms|s|seconds?|milliseconds?)\b/i;
+
+/** The migration id of a SQL file under a `migrations` directory, or null. */
+export function migrationId(file) {
+  const match = MIGRATION.exec(file);
+  if (!match) return null;
+  return match[1] ?? match[2];
+}
+
+/**
+ * Problems with the new migrations in `added` (`{path, sql}` each) against the
+ * change log; `exists(file)` says whether a recorded test file is at HEAD.
+ */
+export function migrationProblems(added, changeLog, exists) {
+  const problems = [];
+  for (const { path: file, sql } of added) {
+    const id = migrationId(file);
+    const recorded = (label) => {
+      const match = new RegExp(String.raw`^\s*(?:[-*]\s+)?${label}:\s*${escapeRegExp(id)}:\s*(\S+?)(?::\s*(.*))?\s*$`, "m").exec(changeLog);
+      return match ? { test: match[1], rest: match[2] ?? "" } : null;
+    };
+    const test = recorded("Migration test");
+    if (!test) {
+      problems.push(`${file}: no \`Migration test: ${id}: <test file>\`; pushing applies it to shared preview schemas, so a test that runs it comes first`);
+    } else if (!isTestFile(test.test) || !exists(test.test)) {
+      problems.push(`${file}: the recorded migration test ${test.test} is not a test file at HEAD`);
+    }
+    if (PER_ROW_WORK.test(sql)) {
+      const scale = recorded("Scale test");
+      if (!scale) {
+        problems.push(`${file}: adds a trigger, function or per-row work with no \`Scale test: ${id}: <test file>: <n> rows, <time>\`; measure it at production scale before the first push`);
+      } else if (!isTestFile(scale.test) || !exists(scale.test) || !MEASUREMENT.test(scale.rest)) {
+        problems.push(`${file}: the scale test line needs a test file at HEAD and a measurement (<n> rows, <time>), got "${scale.test}: ${scale.rest}"`);
+      }
+    }
+  }
+  return problems;
+}
+
+function main(argv) {
+  const { values } = parseArgs({ args: argv, options: { worktree: { type: "string" }, since: { type: "string" }, "change-log": { type: "string" } } });
+  if (!values.worktree || !values.since) {
+    throw new Error("Usage: migration-publish.mjs --worktree <path> --since <commit> [--change-log <file>]");
+  }
+  const worktree = path.resolve(values.worktree);
+  const files = git(worktree, ["diff", "--name-only", "--diff-filter=A", `${values.since}..HEAD`]).split("\n").filter((file) => migrationId(file));
+  const added = files.map((file) => ({ path: file, sql: git(worktree, ["show", `HEAD:${file}`]) }));
+  const logFile = values["change-log"] ?? path.join(git(worktree, ["rev-parse", "--absolute-git-dir"]), "vibe-changes.md");
+  const changeLog = existsSync(logFile) ? readFileSync(logFile, "utf8") : "";
+  const tracked = new Set(git(worktree, ["ls-tree", "-r", "--name-only", "HEAD"]).split("\n"));
+  const problems = migrationProblems(added, changeLog, (file) => tracked.has(file));
+  process.stdout.write(`${JSON.stringify({ ok: problems.length === 0, migrations: files, problems }, null, 2)}\n`);
+  return problems.length === 0 ? 0 : 1;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    process.exit(main(process.argv.slice(2)));
+  } catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exit(2);
+  }
+}
diff --git a/plugins/vibe/skills/vibe/scripts/migration-publish.test.mjs b/plugins/vibe/skills/vibe/scripts/migration-publish.test.mjs
new file mode 100644
index 00000000..0b4f62b7
--- /dev/null
+++ b/plugins/vibe/skills/vibe/scripts/migration-publish.test.mjs
@@ -0,0 +1,62 @@
+import assert from "node:assert/strict";
+import { mkdirSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+import { migrationId, migrationProblems } from "./migration-publish.mjs";
+import { git, makeHome, runNode } from "./test-fixtures.mjs";
+
+const SCRIPT = path.join(path.dirname(fileURLToPath(import.meta.url)), "migration-publish.mjs");
+const FOLDER = "packages/database/prisma/migrations/20261022000000_projection/migration.sql";
+const TRIGGER = "CREATE OR REPLACE FUNCTION refresh() RETURNS trigger AS $$ BEGIN RETURN NEW; END $$ LANGUAGE plpgsql;\nCREATE TRIGGER t AFTER INSERT ON a FOR EACH ROW EXECUTE FUNCTION refresh();\n";
+
+test("migration ids come from the folder or the file name", () => {
+  assert.equal(migrationId(FOLDER), "20261022000000_projection");
+  assert.equal(migrationId("db/migrations/0042_add_index.sql"), "0042_add_index");
+  assert.equal(migrationId("apps/api/lib/migrations.ts"), null);
+  assert.equal(migrationId("docs/notes.sql"), null);
+});
+
+test("a new migration needs a test, and per-row work a measured scale test, before it is pushed", () => {
+  const exists = (file) => file === "packages/database/__tests__/projection.test.ts";
+  const plain = [{ path: FOLDER, sql: "CREATE INDEX i ON a(b);\n" }];
+  assert.match(migrationProblems(plain, "", exists).join(), /no `Migration test: 20261022000000_projection/);
+  const tested = "Migration test: 20261022000000_projection: packages/database/__tests__/projection.test.ts\n";
+  assert.deepEqual(migrationProblems(plain, tested, exists), []);
+  assert.match(migrationProblems(plain, tested.replace("projection.test.ts", "missing.test.ts"), exists).join(), /not a test file at HEAD/);
+  const trigger = [{ path: FOLDER, sql: TRIGGER }];
+  assert.match(migrationProblems(trigger, tested, exists).join(), /trigger, function or per-row work/);
+  const unmeasured = `${tested}Scale test: 20261022000000_projection: packages/database/__tests__/projection.test.ts: looks fine\n`;
+  assert.match(migrationProblems(trigger, unmeasured, exists).join(), /needs a test file at HEAD and a measurement/);
+  const measured = `${tested}Scale test: 20261022000000_projection: packages/database/__tests__/projection.test.ts: 100k rows, 2.1 ms per insert\n`;
+  assert.deepEqual(migrationProblems(trigger, measured, exists), []);
+});
+
+test("the command reads only migrations added since the last push and the session change log", (t) => {
+  const home = makeHome("vibe-migration-publish-");
+  t.after(home.cleanup);
+  const checkout = path.join(home.root, "wt");
+  git(home.root, ["init", "--quiet", "--initial-branch=main", checkout], home.home);
+  const put = (file, text) => {
+    mkdirSync(path.dirname(path.join(checkout, file)), { recursive: true });
+    writeFileSync(path.join(checkout, file), text);
+  };
+  put("packages/database/prisma/migrations/20261001000000_old/migration.sql", "CREATE TABLE a (b int);\n");
+  git(checkout, ["add", "-A"], home.home);
+  git(checkout, ["commit", "--quiet", "-m", "base"], home.home);
+  const since = git(checkout, ["rev-parse", "HEAD"], home.home);
+  put(FOLDER, TRIGGER);
+  git(checkout, ["add", "-A"], home.home);
+  git(checkout, ["commit", "--quiet", "-m", "session"], home.home);
+  const refused = runNode(SCRIPT, ["--worktree", checkout, "--since", since], home.home);
+  assert.equal(refused.status, 1);
+  assert.deepEqual(refused.json.migrations, [FOLDER]);
+  assert.equal(refused.json.problems.length, 2);
+  put("packages/database/__tests__/projection.test.ts", "test();\n");
+  git(checkout, ["add", "-A"], home.home);
+  git(checkout, ["commit", "--quiet", "-m", "test"], home.home);
+  const log = path.join(git(checkout, ["rev-parse", "--absolute-git-dir"], home.home), "vibe-changes.md");
+  writeFileSync(log, "Migration test: 20261022000000_projection: packages/database/__tests__/projection.test.ts\nScale test: 20261022000000_projection: packages/database/__tests__/projection.test.ts: 100,000 rows, 2 ms per insert\n");
+  const passed = runNode(SCRIPT, ["--worktree", checkout, "--since", since], home.home);
+  assert.equal(passed.status, 0, JSON.stringify(passed.json));
+});
diff --git a/plugins/vibe/skills/vibe/scripts/pr-threads.mjs b/plugins/vibe/skills/vibe/scripts/pr-threads.mjs
new file mode 100644
index 00000000..25ed0b19
--- /dev/null
+++ b/plugins/vibe/skills/vibe/scripts/pr-threads.mjs
@@ -0,0 +1,27 @@
+// Reads a pull request's review threads through `gh api graphql`, for the
+// fleet board (unresolved human threads on a slow writer) and the writer's
+// shepherd (an unresolved thread waiting on the writer is round-one work or
+// a later-round thread to triage).
+
+import { execFileSync } from "node:child_process";
+
+const QUERY = "query($o:String!,$n:String!,$p:Int!){repository(owner:$o,name:$n){pullRequest(number:$p){reviewThreads(first:100){nodes{isResolved comments(first:1){nodes{author{login} createdAt}} latest:comments(last:1){nodes{author{login}}}}}}}}";
+
+/** Each thread as `{ resolved, opener, lastAuthor, createdAt }`, or null when gh cannot answer. */
+export function readThreads(repo, pr, gh = "gh") {
+  const [owner, name] = repo.split("/");
+  try {
+    const out = execFileSync(gh, ["api", "graphql", "-f", `query=${QUERY}`, "-F", `o=${owner}`, "-F", `n=${name}`, "-F", `p=${pr}`],
+      { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 30_000 });
+    const nodes = JSON.parse(out)?.data?.repository?.pullRequest?.reviewThreads?.nodes;
+    if (!Array.isArray(nodes)) return null;
+    return nodes.map((node) => ({
+      resolved: node?.isResolved === true,
+      opener: node?.comments?.nodes?.[0]?.author?.login ?? null,
+      lastAuthor: node?.latest?.nodes?.[0]?.author?.login ?? node?.comments?.nodes?.[0]?.author?.login ?? null,
+      createdAt: node?.comments?.nodes?.[0]?.createdAt ?? null,
+    }));
+  } catch {
+    return null;
+  }
+}
diff --git a/plugins/vibe/skills/vibe/scripts/push-cadence.mjs b/plugins/vibe/skills/vibe/scripts/push-cadence.mjs
index 4963f19f..fcecd1bf 100644
--- a/plugins/vibe/skills/vibe/scripts/push-cadence.mjs
+++ b/plugins/vibe/skills/vibe/scripts/push-cadence.mjs
@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 // How long a worktree's work has waited unpushed. A writer kept a validated
 // checkpoint unpushed for hours while each review pass added scope, so QA
-// could not start; a tested checkpoint is pushed at least every 90 minutes of
-// active work, and review findings after that go out as follow-up commits.
+// could not start; a tested checkpoint is pushed at least every 45 minutes of
+// active work (operator ruling, 2026-10-22: an open PR once went six hours
+// with no push), and review findings after that go out as follow-up commits.
 //
-// Usage: push-cadence.mjs --worktree <path> [--limit-minutes <n, default 90>] [--now <iso>]
+// Usage: push-cadence.mjs --worktree <path> [--limit-minutes <n, default 45>] [--now <iso>]
 //
 // The age is measured from the oldest work not on the remote: the committer
 // time of the oldest commit missing from the upstream (or from origin/<branch>,
@@ -19,7 +20,7 @@ import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { parseArgs } from "node:util";
 
-export const DEFAULT_LIMIT_MINUTES = 90;
+export const DEFAULT_LIMIT_MINUTES = 45;
 
 /** Minutes since the oldest unpushed work in `worktree`, and whether a push is due. */
 export function unpushedAge(worktree, { now = Date.now(), limitMinutes = DEFAULT_LIMIT_MINUTES, ignore = [] } = {}) {
diff --git a/plugins/vibe/skills/vibe/scripts/push-cadence.test.mjs b/plugins/vibe/skills/vibe/scripts/push-cadence.test.mjs
index e69a0544..1161f8c1 100644
--- a/plugins/vibe/skills/vibe/scripts/push-cadence.test.mjs
+++ b/plugins/vibe/skills/vibe/scripts/push-cadence.test.mjs
@@ -45,19 +45,19 @@ test("nothing unpushed is never due", (t) => {
   assert.deepEqual(unpushedAge(work, { now: minutes(500) }), { minutes: 0, due: false, since: null, reason: "nothing unpushed" });
 });
 
-test("the oldest unpushed commit sets the age, and 90 minutes makes the push due", (t) => {
+test("the oldest unpushed commit sets the age, and 45 minutes makes the push due", (t) => {
   const { work, commit } = repos(t);
   commit("b.txt", minutes(10));
-  commit("c.txt", minutes(60));
-  const early = unpushedAge(work, { now: minutes(80) });
-  assert.equal(early.minutes, 70);
+  commit("c.txt", minutes(30));
+  const early = unpushedAge(work, { now: minutes(54) });
+  assert.equal(early.minutes, 44);
   assert.equal(early.due, false);
   assert.match(early.reason, /2 unpushed commit/);
-  const late = unpushedAge(work, { now: minutes(100) });
-  assert.equal(late.minutes, 90);
+  const late = unpushedAge(work, { now: minutes(55) });
+  assert.equal(late.minutes, 45);
   assert.equal(late.due, true);
   assert.equal(late.since, new Date(minutes(10)).toISOString());
-  assert.equal(unpushedAge(work, { now: minutes(100), limitMinutes: 120 }).due, false);
+  assert.equal(unpushedAge(work, { now: minutes(55), limitMinutes: 120 }).due, false);
 });
 
 test("an uncommitted file counts by its modification time, and ignored paths do not", (t) => {
diff --git a/plugins/vibe/skills/vibe/scripts/review-followup.mjs b/plugins/vibe/skills/vibe/scripts/review-followup.mjs
new file mode 100644
index 00000000..4c8c6f7b
--- /dev/null
+++ b/plugins/vibe/skills/vibe/scripts/review-followup.mjs
@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+// One review round per pull request (operator ruling, 2026-10-22). A valid
+// finding from a thread raised after the round-one fixes were pushed is never
+// fixed in the pull request: it becomes an acceptance criterion on exactly one
+// follow-up ticket for that pull request. Later rounds append criteria to the
+// same ticket (a new document version), never a second ticket; each thread is
+// then answered with the ticket's link (or why it is invalid) and resolved.
+//
+// Usage:
+//   review-followup.mjs plan   --worktree <path> --pr <n> --pr-ticket <slug> --findings <findings.json> [--found <search.json>]
+//   review-followup.mjs record --worktree <path> --pr <n> --slug <ticket slug>
+//
+// findings.json: [{"thread": "<thread url or id>", "finding": "<one checkable line>"}], the valid ones only.
+// search.json: the documents a search for the plan's title returned, `[{"slug", "title"}]`, used before the
+// first `record`. `plan` prints {"action": "create"|"append", "slug"?, "title", "criteria": [...]};
+// `record` saves the created ticket's slug in the session's git dir and refuses a second, different one.
+// Changes no ticket; the ticket worker or the orchestrator makes the write.
+
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { parseArgs } from "node:util";
+import { git } from "./session-record.mjs";
+
+const RECORD = "vibe-review-followups.json";
+
+/** The follow-up ticket's title for a pull request. */
+export function followupTitle(prTicket, pr) {
+  return `${prTicket}: follow-ups from #${pr} review`;
+}
+
+/** Create the one follow-up ticket, or append to the one already recorded or found by its title. */
+export function planFollowup({ recorded, found = [], pr, prTicket, findings }) {
+  const title = followupTitle(prTicket, pr);
+  const criteria = findings.map((entry) => {
+    if (typeof entry?.finding !== "string" || !entry.finding.trim() || typeof entry.thread !== "string" || !entry.thread.trim()) {
+      throw new Error("each finding needs a thread and a one-line finding");
+    }
+    return `- [ ] ${entry.finding.trim()} (review thread: ${entry.thread.trim()})`;
+  });
+  if (criteria.length === 0) {
+    throw new Error("no valid findings: reply to each thread with why it is not valid and resolve it; no ticket is needed");
+  }
+  if (recorded) {
+    return { action: "append", slug: recorded, title, criteria };
+  }
+  const matches = found.filter((doc) => doc?.title === title);
+  if (matches.length > 1) {
+    throw new Error(`${matches.map((doc) => doc.slug).join(", ")} all carry the title "${title}"; keep one, cancel the others, then record it`);
+  }
+  return matches.length === 1 ? { action: "append", slug: matches[0].slug, title, criteria } : { action: "create", title, criteria };
+}
+
+function recordFile(worktree) {
+  return path.join(git(worktree, ["rev-parse", "--absolute-git-dir"]), RECORD);
+}
+
+function readRecords(worktree) {
+  const file = recordFile(worktree);
+  return existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : {};
+}
+
+function main(argv) {
+  const [command, ...rest] = argv;
+  const { values } = parseArgs({ args: rest, options: {
+    worktree: { type: "string" }, pr: { type: "string" }, "pr-ticket": { type: "string" }, findings: { type: "string" }, found: { type: "string" }, slug: { type: "string" },
+  } });
+  if (!values.worktree || !/^\d+$/.test(values.pr ?? "")) {
+    throw new Error("--worktree and --pr <number> are required");
+  }
+  const records = readRecords(values.worktree);
+  if (command === "plan") {
+    if (!values["pr-ticket"] || !values.findings) throw new Error("plan needs --pr-ticket and --findings");
+    return planFollowup({
+      recorded: records[values.pr]?.slug,
+      found: values.found ? JSON.parse(readFileSync(values.found, "utf8")) : [],
+      pr: values.pr,
+      prTicket: values["pr-ticket"],
+      findings: JSON.parse(readFileSync(values.findings, "utf8")),
+    });
+  }
+  if (command === "record") {
+    if (!values.slug) throw new Error("record needs --slug");
+    const existing = records[values.pr]?.slug;
+    if (existing && existing !== values.slug) {
+      throw new Error(`#${values.pr} already has its follow-up ticket ${existing}; append to it, never create a second`);
+    }
+    records[values.pr] = { slug: values.slug, at: records[values.pr]?.at ?? new Date().toISOString() };
+    writeFileSync(recordFile(values.worktree), `${JSON.stringify(records, null, 2)}\n`);
+    return { recorded: values.slug };
+  }
+  throw new Error("Usage: review-followup.mjs plan|record ...");
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    process.stdout.write(`${JSON.stringify({ ok: true, ...main(process.argv.slice(2)) }, null, 2)}\n`);
+  } catch (error) {
+    process.stdout.write(`${JSON.stringify({ ok: false, error: error instanceof Error ? error.message : String(error) })}\n`);
+    process.exit(1);
+  }
+}
diff --git a/plugins/vibe/skills/vibe/scripts/review-followup.test.mjs b/plugins/vibe/skills/vibe/scripts/review-followup.test.mjs
new file mode 100644
index 00000000..42ea8e47
--- /dev/null
+++ b/plugins/vibe/skills/vibe/scripts/review-followup.test.mjs
@@ -0,0 +1,43 @@
+import assert from "node:assert/strict";
+import { writeFileSync } from "node:fs";
+import path from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+import { followupTitle, planFollowup } from "./review-followup.mjs";
+import { git, makeHome, runNode } from "./test-fixtures.mjs";
+
+const SCRIPT = path.join(path.dirname(fileURLToPath(import.meta.url)), "review-followup.mjs");
+const ROUND_TWO = [{ thread: "https://example.test/o/r/pull/9118#discussion_r1", finding: "Sort ties by id" }];
+const ROUND_THREE = [{ thread: "https://example.test/o/r/pull/9118#discussion_r7", finding: "Keep focus after a move" }];
+
+test("later rounds append to the pull request's one follow-up ticket, found by title or recorded", () => {
+  const title = followupTitle("ISS-1", 9118);
+  assert.equal(title, "ISS-1: follow-ups from #9118 review");
+  assert.deepEqual(planFollowup({ pr: 9118, prTicket: "ISS-1", findings: ROUND_TWO }), {
+    action: "create", title, criteria: ["- [ ] Sort ties by id (review thread: https://example.test/o/r/pull/9118#discussion_r1)"],
+  });
+  assert.equal(planFollowup({ recorded: "ISS-2", pr: 9118, prTicket: "ISS-1", findings: ROUND_THREE }).action, "append");
+  assert.deepEqual(planFollowup({ found: [{ slug: "ISS-2", title }, { slug: "ISS-3", title: "other" }], pr: 9118, prTicket: "ISS-1", findings: ROUND_THREE }).slug, "ISS-2");
+  assert.throws(() => planFollowup({ found: [{ slug: "ISS-2", title }, { slug: "ISS-4", title }], pr: 9118, prTicket: "ISS-1", findings: ROUND_THREE }), /keep one/);
+  assert.throws(() => planFollowup({ pr: 9118, prTicket: "ISS-1", findings: [] }), /no valid findings/);
+});
+
+test("a second later round reuses the recorded ticket and a second ticket is refused", (t) => {
+  const { root, home, cleanup } = makeHome("vibe-review-followup-");
+  t.after(cleanup);
+  const worktree = path.join(root, "wt");
+  git(root, ["init", "--quiet", "--initial-branch=main", worktree], home);
+  const findings = path.join(root, "findings.json");
+  writeFileSync(findings, JSON.stringify(ROUND_TWO));
+  const plan = (...extra) => runNode(SCRIPT, ["plan", "--worktree", worktree, "--pr", "9118", "--pr-ticket", "ISS-1", "--findings", findings, ...extra], home);
+  assert.equal(plan().json.action, "create");
+  assert.equal(runNode(SCRIPT, ["record", "--worktree", worktree, "--pr", "9118", "--slug", "ISS-2"], home).status, 0);
+  writeFileSync(findings, JSON.stringify(ROUND_THREE));
+  const third = plan();
+  assert.equal(third.json.action, "append");
+  assert.equal(third.json.slug, "ISS-2");
+  const second = runNode(SCRIPT, ["record", "--worktree", worktree, "--pr", "9118", "--slug", "ISS-5"], home);
+  assert.equal(second.status, 1);
+  assert.match(second.json.error, /already has its follow-up ticket ISS-2; append to it/);
+  assert.equal(runNode(SCRIPT, ["record", "--worktree", worktree, "--pr", "9118", "--slug", "ISS-2"], home).status, 0, "recording the same ticket again is harmless");
+});
diff --git a/plugins/vibe/skills/vibe/scripts/session-questions.mjs b/plugins/vibe/skills/vibe/scripts/session-questions.mjs
index 2ac3bbd2..50909766 100644
--- a/plugins/vibe/skills/vibe/scripts/session-questions.mjs
+++ b/plugins/vibe/skills/vibe/scripts/session-questions.mjs
@@ -7,7 +7,8 @@
 //
 // Usage:
 //   session-questions.mjs reset                                   (start of a new session)
-//   session-questions.mjs ask    --key <key> --question <text> [--product --code-evidence <file:line>] [--worktree <path>]
+//   session-questions.mjs ask    --key <key> --question <text> --default <what you do without an answer> --deadline-minutes <n>
+//                                [--product --code-evidence <file:line>] [--worktree <path>]
 //   session-questions.mjs answer --key <key> --answer <text>   [--worktree <path>]
 //   session-questions.mjs list   [--worktree <path>]
 //
@@ -24,6 +25,16 @@
 // writer once sat idle for an hour "pending authorization" to repair tests.
 // Only a flag key, a product question, dropping or narrowing scope, a
 // destructive action or a credential waits for the person.
+// Every other question carries `--default` and `--deadline-minutes`, and `ask`
+// returns `ifNoAnswer`, the line `If no answer by <ISO time>: <default>` that
+// ends the message asking it; with no answer by then the writer proceeds on
+// the default and says so, and codex-fleet-monitor's recovery pass resumes an
+// idle Codex writer with it. Writers' questions once sat unanswered for seven
+// hours overnight while their writers waited on stated defaults. The deadline
+// is at most 30 minutes, and a question never holds a pull request: the
+// writer ships what is done, arms auto-merge and puts the answer-dependent
+// part in a follow-up (operator ruling, 2026-10-22), so `ask` refuses one
+// that says it holds a merge, a push or the PR.
 // Every command prints one JSON object; errors print {"ok":false,"error":...}.
 
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
@@ -37,25 +48,41 @@ const KEY_PATTERN = /^[a-z0-9]+(?:[-:][a-z0-9]+)*$/;
 const MAX_TEXT = 4000;
 const ASKS_LEAVE = /\b(?:may|can|shall|should) i\b|\b(?:ok|okay|fine) (?:for me )?to\b|\bpermission\b|\bauthori[sz](?:e|ation)\b|\bapprov(?:e|al)\b|\bgo-?ahead\b/i;
 const IN_SCOPE_WORK = /\b(?:tests?|fixtures?|specs?|snapshots?|merge (?:main|the base)|main merge|rebase|push|commit|rerun|re-run|lint|typecheck|fix(?:es)?|repair)\b/i;
-const HUMAN_ONLY = /\b(?:flags?|feature flag|credentials?|password|token|sign(?:ed)?[ -]?in|log ?in|delete|discard|destroy|drop|force|wording|copy|product|skip|narrow|defer|exclude|descope|obsolete|out of scope)\b/i;
+const HUMAN_ONLY = /\b(?:flags?|feature flag|switch(?:es)?|toggles?|credentials?|password|token|sign(?:ed)?[ -]?in|log ?in|delete|discard|destroy|drop|force|wording|copy|say|says|label|product|skip|narrow|defer|exclude|descope|obsolete|out of scope)\b/i;
+const WAITS_FOR_PERSON = /\b(?:flags?|feature flag|switch(?:es)?|toggles?|credentials?|password|token|sign(?:ed)?[ -]?in|log ?in|delete|discard|destroy|drop|force|wording|copy|say|says|label|skip|narrow|defer|exclude|descope|obsolete|out of scope)\b/i;
+const MAX_DEADLINE_MINUTES = 30;
+const HOLDS_PR = /\b(?:hold(?:s|ing)?|block(?:s|ing)?|paus(?:e|es|ing)|park(?:ed|ing)?)\b[^.?!\n]{0,40}\b(?:auto-?merge|merge|pr|pull request|push)\b|\b(?:auto-?merge|merge|pr|pull request|push)\b[^.?!\n]{0,20}\b(?:on hold|held|until you answer|pending your answer)\b/i;
 
 /** In-scope engineering work asked as permission; it never waits for the person. */
 export function asksLeaveForInScopeWork(question) {
   return ASKS_LEAVE.test(question) && IN_SCOPE_WORK.test(question) && !HUMAN_ONLY.test(question);
 }
 
+/** A flag, copy, destructive, credential or scope-narrowing question: no default is ever applied without the person. */
+export function waitsForPerson(question) {
+  return WAITS_FOR_PERSON.test(question);
+}
+
+/** The line that ends a question message: what happens, and when, if nobody answers. */
+export function ifNoAnswerLine(deadlineAt, fallback) {
+  return `If no answer by ${deadlineAt}: ${fallback}`;
+}
+
 /** Where questions asked before the session exists are kept. */
 export function startupFile(home = os.homedir()) {
   return path.join(home, ".codex", "vibe", "startup-questions.json");
 }
 
 /** Records a question once; a repeated key returns the existing entry instead. */
-export function askQuestion(questions, { key, question, product = false, codeEvidence, now = new Date().toISOString() }) {
+export function askQuestion(questions, { key, question, product = false, codeEvidence, fallback, deadlineMinutes, now = new Date().toISOString() }) {
   requireKey(key);
   requireText("--question", question);
   if (asksLeaveForInScopeWork(question)) {
     throw new Error("in-scope work never waits for authorization: repairing tests the change broke, a main merge, a push, a rerun or an in-scope fix goes ahead now and is reported afterwards; only a flag key, a product question, dropping or narrowing scope, a destructive action or a credential waits");
   }
+  if (HOLDS_PR.test(question)) {
+    throw new Error("a question never holds a pull request: ship what is done, arm auto-merge, put the part that depends on the answer in a follow-up, and ask without holding anything");
+  }
   if (product && !/^\S.*:\d+(?:-\d+)?$/.test(codeEvidence ?? "")) {
     throw new Error("a product question needs --code-evidence <file:line> proving the code and data model were checked first");
   }
@@ -63,7 +90,17 @@ export function askQuestion(questions, { key, question, product = false, codeEvi
   if (existing) {
     return { questions, result: { ask: false, ...existing } };
   }
-  const entry = { key, question, ...(product ? { product: true, codeEvidence } : {}), askedAt: now, answer: null, answeredAt: null };
+  const waits = waitsForPerson(question);
+  const minutes = Number(deadlineMinutes);
+  if (!waits && (!fallback?.trim() || !Number.isInteger(minutes) || minutes < 1 || minutes > MAX_DEADLINE_MINUTES)) {
+    throw new Error(`a question carries --default <what you do without an answer> and --deadline-minutes <1 to ${MAX_DEADLINE_MINUTES}>; only a flag, copy, destructive, credential or scope-narrowing question waits for the person with no deadline`);
+  }
+  const deadlineAt = waits ? null : new Date(Date.parse(now) + minutes * 60_000).toISOString();
+  const entry = {
+    key, question, ...(product ? { product: true, codeEvidence } : {}),
+    ...(waits ? { waitsForPerson: true } : { default: fallback.trim(), deadlineAt, ifNoAnswer: ifNoAnswerLine(deadlineAt, fallback.trim()) }),
+    askedAt: now, answer: null, answeredAt: null,
+  };
   return { questions: [...questions, entry], result: { ask: true, ...entry } };
 }
 
@@ -157,6 +194,8 @@ function run(argv, home = os.homedir()) {
       answer: { type: "string" },
       product: { type: "boolean" },
       "code-evidence": { type: "string" },
+      default: { type: "string" },
+      "deadline-minutes": { type: "string" },
     },
   });
   const worktree = values.worktree;
@@ -170,6 +209,7 @@ function run(argv, home = os.homedir()) {
     case "ask": {
       const { questions, result } = askQuestion(load(worktree, home), {
         key: values.key, question: values.question, product: values.product, codeEvidence: values["code-evidence"],
+        fallback: values.default, deadlineMinutes: values["deadline-minutes"],
       });
       if (result.ask) {
         store(worktree, home, questions);
diff --git a/plugins/vibe/skills/vibe/scripts/session-questions.test.mjs b/plugins/vibe/skills/vibe/scripts/session-questions.test.mjs
index 2f4858e2..6b6108ac 100644
--- a/plugins/vibe/skills/vibe/scripts/session-questions.test.mjs
+++ b/plugins/vibe/skills/vibe/scripts/session-questions.test.mjs
@@ -3,7 +3,7 @@ import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import test from "node:test";
 import { fileURLToPath } from "node:url";
-import { askQuestion, asksLeaveForInScopeWork } from "./session-questions.mjs";
+import { askQuestion, asksLeaveForInScopeWork, waitsForPerson } from "./session-questions.mjs";
 import { makeCheckout, makeHome, mainSyncRecipeFiles, runNode } from "./test-fixtures.mjs";
 
 const DIR = path.dirname(fileURLToPath(import.meta.url));
@@ -65,9 +65,10 @@ test("questions asked before the session exists move onto the new session and su
 
 test("reset clears only the questions kept before a session exists", (t) => {
   const { home } = setup(t);
-  questions(home, ["ask", "--key", "sample-data", "--question", "Start with example data?"]);
+  const sample = ["ask", "--key", "sample-data", "--question", "Start with example data?", "--default", "start with example data", "--deadline-minutes", "30"];
+  questions(home, sample);
   assert.equal(questions(home, ["reset"]).json.ok, true);
-  assert.equal(questions(home, ["ask", "--key", "sample-data", "--question", "Start with example data?"]).json.ask, true);
+  assert.equal(questions(home, sample).json.ask, true);
   const refused = questions(home, ["reset", "--worktree", home]);
   assert.equal(refused.status, 1);
 });
@@ -76,14 +77,15 @@ test("an answer needs a recorded question and keys stay plain identifiers", () =
   assert.throws(() => askQuestion([], { key: "Page Wording", question: WORDING }), /--key/);
   assert.throws(() => askQuestion([], { key: "page-wording", question: " " }), /--question/);
   const { questions: recorded } = askQuestion([], { key: "page-wording", question: WORDING, now: "2026-10-15T00:00:00.000Z" });
-  assert.deepEqual(recorded, [{ key: "page-wording", question: WORDING, askedAt: "2026-10-15T00:00:00.000Z",
+  assert.deepEqual(recorded, [{ key: "page-wording", question: WORDING, waitsForPerson: true, askedAt: "2026-10-15T00:00:00.000Z",
     answer: null, answeredAt: null }]);
 });
 
 test("a product question is refused until it cites the code or data model checked first", () => {
-  assert.throws(() => askQuestion([], { key: "bulk-owner", question: "Can owners change in bulk?", product: true }), /--code-evidence/);
+  const fallback = { fallback: "allow it, as the schema does", deadlineMinutes: "30" };
+  assert.throws(() => askQuestion([], { key: "bulk-owner", question: "Can owners change in bulk?", product: true, ...fallback }), /--code-evidence/);
   const { questions } = askQuestion([], {
-    key: "bulk-owner", question: "Can owners change in bulk?", product: true, codeEvidence: "packages/branches/schema.ts:42",
+    key: "bulk-owner", question: "Can owners change in bulk?", product: true, codeEvidence: "packages/branches/schema.ts:42", ...fallback,
   });
   assert.equal(questions[0].product, true);
   assert.equal(questions[0].codeEvidence, "packages/branches/schema.ts:42");
@@ -118,3 +120,37 @@ test("permission to do in-scope engineering work is refused; flags, product call
   for (const question of waits) assert.equal(asksLeaveForInScopeWork(question), false, question);
   assert.equal(askQuestion([], { key: "flag-key", question: waits[0] }).result.ask, true);
 });
+
+test("a question carries a default and a deadline, except flag, copy, destructive, credential and scope questions (7 quiet hours)", (t) => {
+  const sort = "Sort the board by rank or by updated time?";
+  assert.equal(waitsForPerson(sort), false);
+  assert.throws(() => askQuestion([], { key: "board-sort", question: sort }), /--default .* --deadline-minutes/);
+  assert.throws(() => askQuestion([], { key: "board-sort", question: sort, fallback: "rank", deadlineMinutes: "0" }), /--deadline-minutes/);
+  assert.throws(() => askQuestion([], { key: "board-sort", question: sort, fallback: "rank", deadlineMinutes: "31" }), /--deadline-minutes <1 to 30>/, "a default applies within 30 minutes");
+  const { result } = askQuestion([], { key: "board-sort", question: sort, fallback: "sort by rank, as the shipped list does", deadlineMinutes: "30", now: "2026-10-22T05:45:00.000Z" });
+  assert.equal(result.deadlineAt, "2026-10-22T06:15:00.000Z");
+  assert.equal(result.ifNoAnswer, "If no answer by 2026-10-22T06:15:00.000Z: sort by rank, as the shipped list does");
+  for (const question of ["May I add the new feature flag key for this screen?", "Add the new feature switch `branches-list-v2`?", "Which wording should the empty state use?", "Should I delete the old branch?", "Should I skip the two tickets?"]) {
+    assert.equal(waitsForPerson(question), true, question);
+    const waiting = askQuestion([], { key: "waits", question }).result;
+    assert.equal(waiting.waitsForPerson, true);
+    assert.equal(waiting.ifNoAnswer, undefined, "no default is applied without the person");
+  }
+  const { home } = setup(t);
+  const cli = questions(home, ["ask", "--key", "board-sort", "--question", sort, "--default", "rank", "--deadline-minutes", "20"]);
+  assert.equal(cli.json.ok, true);
+  assert.match(cli.json.ifNoAnswer, /^If no answer by \S+Z: rank$/);
+  assert.equal(questions(home, ["ask", "--key", "other", "--question", sort]).status, 1);
+});
+
+test("a question never holds a pull request (#9118)", () => {
+  const fallback = { fallback: "rank", deadlineMinutes: "30" };
+  for (const question of [
+    "Sort by rank or updated? Holding auto-merge on #9118 pending your answer.",
+    "Rank or updated? I'm keeping the PR on hold until you answer.",
+    "Rank or updated? We should hold the PR until you pick the sort.",
+  ]) {
+    assert.throws(() => askQuestion([], { key: "board-sort", question, ...fallback }), /never holds a pull request/, question);
+  }
+  assert.equal(askQuestion([], { key: "board-sort", question: "Sort by rank or updated? The PR ships with rank; the other order is a follow-up.", ...fallback }).result.ask, true);
+});
diff --git a/plugins/vibe/skills/vibe/scripts/shepherd.mjs b/plugins/vibe/skills/vibe/scripts/shepherd.mjs
index 9bf8b875..70230c48 100644
--- a/plugins/vibe/skills/vibe/scripts/shepherd.mjs
+++ b/plugins/vibe/skills/vibe/scripts/shepherd.mjs
@@ -3,9 +3,17 @@
 // once final-merge mode is set): it polls the pull request every two minutes
 // and stops at the first thing it must act on, so a conflict with main is
 // merged at once instead of waiting for someone to notice it. A pull request
-// that went conflicting once sat for hours with nobody watching it.
+// that went conflicting once sat for hours with nobody watching it. Armed
+// auto-merge is not the end: two approved pull requests once sat blocked for
+// hours on new threads while their writers waited for the merge.
+// One review round per pull request (operator ruling, 2026-10-22): a thread
+// opened before the round-one fixes were pushed (`--round-one-fixed-at`) is
+// fixed here; a later one is triaged, never fixed here and never a merge
+// blocker: a valid finding joins the pull request's one follow-up ticket
+// (review-followup.mjs), the thread gets a reply with that ticket's link or
+// why it is invalid, and is resolved.
 //
-// Usage: shepherd.mjs --pr <number> --repo <owner/repo> [--interval-seconds 120] [--max-polls <n>]
+// Usage: shepherd.mjs --pr <number> --repo <owner/repo> [--round-one-fixed-at <iso time of the round-one fix push>] [--interval-seconds 120] [--max-polls <n>]
 //
 // Prints one JSON object when it stops:
 //   {"event":"merged"}                         exit 0
@@ -13,17 +21,22 @@
 //   {"event":"waiting","polls":n}              exit 3  (--max-polls reached)
 //   {"event":"conflict","head":sha}            exit 10 (merge main now in final-merge mode, push, run shepherd again)
 //   {"event":"checks-failed","failed":[...]}   exit 11 (fix on the branch, push, run shepherd again)
+//   {"event":"threads","unresolved":n}         exit 13 (round one: fix or answer each thread, then run shepherd again)
+//   {"event":"later-threads","unresolved":n}   exit 14 (triage each into the follow-up ticket, reply, resolve, run again)
 //   {"event":"unreadable","error":...}         exit 12 (three reads in a row failed)
 // `gh` is read from PATH; a single failed read is retried on the next poll.
+// Threads whose latest comment is the writer's (`gh api user`) wait on the
+// reviewer and do not stop the shepherd.
 
 import { execFileSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
 import { parseArgs } from "node:util";
+import { readThreads } from "./pr-threads.mjs";
 
 const FIELDS = "state,mergeable,headRefOid,statusCheckRollup";
 const FAILED = new Set(["FAILURE", "CANCELLED", "TIMED_OUT", "ACTION_REQUIRED", "ERROR", "STARTUP_FAILURE"]);
 const MAX_READ_FAILURES = 3;
-export const EXIT = { merged: 0, closed: 2, waiting: 3, conflict: 10, "checks-failed": 11, unreadable: 12 };
+export const EXIT = { merged: 0, closed: 2, waiting: 3, conflict: 10, "checks-failed": 11, unreadable: 12, threads: 13, "later-threads": 14 };
 
 /** What one pull request read asks the writer to do, or null to keep waiting. */
 export function shepherdEvent(pr) {
@@ -33,15 +46,17 @@ export function shepherdEvent(pr) {
   const failed = (pr.statusCheckRollup ?? [])
     .filter((check) => FAILED.has(check.conclusion ?? check.state))
     .map((check) => check.name ?? check.context);
-  return failed.length > 0 ? { event: "checks-failed", head: pr.headRefOid, failed } : null;
+  if (failed.length > 0) return { event: "checks-failed", head: pr.headRefOid, failed };
+  if (pr.waitingThreads > 0) return { event: "threads", head: pr.headRefOid, unresolved: pr.waitingThreads };
+  return pr.laterThreads > 0 ? { event: "later-threads", head: pr.headRefOid, unresolved: pr.laterThreads } : null;
 }
 
 /** Polls until an event; resolves with it. */
-export async function shepherd({ pr, repo, intervalSeconds = 120, maxPolls = Infinity, read = readPr }) {
+export async function shepherd({ pr, repo, intervalSeconds = 120, maxPolls = Infinity, roundOneFixedAt = null, read = readPr }) {
   let failures = 0;
   for (let polls = 1; ; polls++) {
     try {
-      const event = shepherdEvent(read(pr, repo));
+      const event = shepherdEvent(read(pr, repo, roundOneFixedAt));
       failures = 0;
       if (event) return event;
     } catch (error) {
@@ -55,15 +70,31 @@ export async function shepherd({ pr, repo, intervalSeconds = 120, maxPolls = Inf
   }
 }
 
-function readPr(pr, repo) {
-  return JSON.parse(execFileSync("gh", ["pr", "view", String(pr), "--repo", repo, "--json", FIELDS], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }));
+let writerLogin;
+
+/** Unresolved threads the writer did not answer last, split at the round-one fix push (all round one before it). */
+export function splitThreads(threads, writer, roundOneFixedAt) {
+  const cutoff = roundOneFixedAt ? Date.parse(roundOneFixedAt) : Number.POSITIVE_INFINITY;
+  const waiting = threads.filter((thread) => !thread.resolved && thread.lastAuthor !== writer);
+  const later = waiting.filter((thread) => Date.parse(thread.createdAt ?? "") >= cutoff);
+  return { waitingThreads: waiting.length - later.length, laterThreads: later.length };
+}
+
+function readPr(pr, repo, roundOneFixedAt) {
+  const view = JSON.parse(execFileSync("gh", ["pr", "view", String(pr), "--repo", repo, "--json", FIELDS], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }));
+  writerLogin ??= execFileSync("gh", ["api", "user", "-q", ".login"], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+  const threads = readThreads(repo, pr);
+  if (threads === null) {
+    throw new Error("gh could not read the review threads");
+  }
+  return { ...view, ...splitThreads(threads, writerLogin, roundOneFixedAt) };
 }
 
 async function main() {
   const { values } = parseArgs({
-    options: { pr: { type: "string" }, repo: { type: "string" }, "interval-seconds": { type: "string" }, "max-polls": { type: "string" } },
+    options: { pr: { type: "string" }, repo: { type: "string" }, "interval-seconds": { type: "string" }, "max-polls": { type: "string" }, "round-one-fixed-at": { type: "string" } },
   });
-  if (!/^\d+$/.test(values.pr ?? "") || !/^[\w.-]+\/[\w.-]+$/.test(values.repo ?? "")) {
+  if (!/^\d+$/.test(values.pr ?? "") || !/^[\w.-]+\/[\w.-]+$/.test(values.repo ?? "") || (values["round-one-fixed-at"] !== undefined && !Number.isFinite(Date.parse(values["round-one-fixed-at"])))) {
     process.stdout.write(`${JSON.stringify({ event: "usage", error: "--pr <number> and --repo <owner/repo> are required" })}\n`);
     process.exit(64);
   }
@@ -73,6 +104,7 @@ async function main() {
     repo: values.repo,
     intervalSeconds: Number.isFinite(interval) && interval >= 0 ? interval : 120,
     maxPolls: values["max-polls"] ? Math.max(1, Number(values["max-polls"])) : Infinity,
+    roundOneFixedAt: values["round-one-fixed-at"] ?? null,
   });
   process.stdout.write(`${JSON.stringify(result)}\n`);
   process.exit(EXIT[result.event]);
diff --git a/plugins/vibe/skills/vibe/scripts/shepherd.test.mjs b/plugins/vibe/skills/vibe/scripts/shepherd.test.mjs
index a8257c08..b4e9bf4d 100644
--- a/plugins/vibe/skills/vibe/scripts/shepherd.test.mjs
+++ b/plugins/vibe/skills/vibe/scripts/shepherd.test.mjs
@@ -5,7 +5,7 @@ import os from "node:os";
 import path from "node:path";
 import test from "node:test";
 import { fileURLToPath } from "node:url";
-import { EXIT, shepherd, shepherdEvent } from "./shepherd.mjs";
+import { EXIT, shepherd, shepherdEvent, splitThreads } from "./shepherd.mjs";
 
 const SCRIPT = path.join(path.dirname(fileURLToPath(import.meta.url)), "shepherd.mjs");
 const OPEN = { state: "OPEN", mergeable: "MERGEABLE", headRefOid: "abc", statusCheckRollup: [{ name: "lint", conclusion: "SUCCESS" }, { name: "e2e", conclusion: null, status: "IN_PROGRESS" }] };
@@ -20,6 +20,8 @@ test("each pull request state maps to the action the writer takes", () => {
     { event: "checks-failed", head: "abc", failed: ["lint", "deploy"] }
   );
   assert.equal(shepherdEvent({ ...OPEN, mergeable: "UNKNOWN" }), null, "unknown mergeability keeps waiting");
+  assert.deepEqual(shepherdEvent({ ...OPEN, waitingThreads: 2 }), { event: "threads", head: "abc", unresolved: 2 });
+  assert.deepEqual(shepherdEvent({ ...OPEN, state: "MERGED", waitingThreads: 2 }), { event: "merged" });
 });
 
 test("it keeps polling until a conflict appears, and a single failed read is retried", async () => {
@@ -37,11 +39,46 @@ test("the command reads the pull request through gh and exits with the event's c
   const dir = mkdtempSync(path.join(os.tmpdir(), "vibe-shepherd-"));
   t.after(() => rmSync(dir, { recursive: true, force: true }));
   writeFileSync(path.join(dir, "pr.json"), JSON.stringify({ ...OPEN, mergeable: "CONFLICTING" }));
-  writeFileSync(path.join(dir, "gh"), `#!/bin/sh\nprintf '%s\\n' "$@" > "${dir}/args.txt"\ncat "${dir}/pr.json"\n`);
+  writeFileSync(path.join(dir, "threads.json"), JSON.stringify({ data: { repository: { pullRequest: { reviewThreads: { nodes: [] } } } } }));
+  writeFileSync(path.join(dir, "gh"), `#!/bin/sh\nprintf '%s\\n' "$@" > "${dir}/args.txt"\ncase "$1 $2" in\n  "api user") echo writer ;;\n  "api graphql") cat "${dir}/threads.json" ;;\n  *) cat "${dir}/pr.json" ;;\nesac\n`);
   chmodSync(path.join(dir, "gh"), 0o755);
   const env = { ...process.env, PATH: `${dir}:${process.env.PATH}` };
-  const result = spawnSync(process.execPath, [SCRIPT, "--pr", "42", "--repo", "o/r", "--interval-seconds", "0"], { encoding: "utf8", env });
+  const shepherdRun = () => spawnSync(process.execPath, [SCRIPT, "--pr", "42", "--repo", "o/r", "--interval-seconds", "0", "--max-polls", "1"], { encoding: "utf8", env });
+  const result = shepherdRun();
   assert.equal(result.status, EXIT.conflict);
   assert.deepEqual(JSON.parse(result.stdout), { event: "conflict", head: "abc" });
   assert.equal(spawnSync(process.execPath, [SCRIPT, "--pr", "x"], { encoding: "utf8" }).status, 64);
+
+  // An approved pull request with auto-merge armed and a new reviewer thread is work, not waiting.
+  writeFileSync(path.join(dir, "pr.json"), JSON.stringify({ ...OPEN, reviewDecision: "APPROVED" }));
+  const thread = (login, latest, createdAt = "2026-10-22T08:00:00Z") => ({ isResolved: false, comments: { nodes: [{ author: { login }, createdAt }] }, latest: { nodes: [{ author: { login: latest } }] } });
+  writeFileSync(path.join(dir, "threads.json"), JSON.stringify({ data: { repository: { pullRequest: { reviewThreads: { nodes: [
+    thread("reviewer", "reviewer"),
+    thread("reviewer", "writer"),
+    { ...thread("reviewer", "reviewer"), isResolved: true },
+  ] } } } } }));
+  const threads = shepherdRun();
+  assert.equal(threads.status, EXIT.threads);
+  assert.deepEqual(JSON.parse(threads.stdout), { event: "threads", head: "abc", unresolved: 1 });
+  writeFileSync(path.join(dir, "threads.json"), JSON.stringify({ data: { repository: { pullRequest: { reviewThreads: { nodes: [thread("reviewer", "writer")] } } } } }));
+  assert.equal(shepherdRun().status, EXIT.waiting, "a thread the writer answered last waits on the reviewer");
+
+  // One review round: a thread opened after the round-one fix push is triaged, never round-one work.
+  writeFileSync(path.join(dir, "threads.json"), JSON.stringify({ data: { repository: { pullRequest: { reviewThreads: { nodes: [
+    thread("review-bot", "review-bot", "2026-10-22T10:30:00Z"),
+  ] } } } } }));
+  const roundTwo = spawnSync(process.execPath, [SCRIPT, "--pr", "42", "--repo", "o/r", "--interval-seconds", "0", "--max-polls", "1", "--round-one-fixed-at", "2026-10-22T10:00:00Z"], { encoding: "utf8", env });
+  assert.equal(roundTwo.status, EXIT["later-threads"]);
+  assert.deepEqual(JSON.parse(roundTwo.stdout), { event: "later-threads", head: "abc", unresolved: 1 });
+  assert.equal(shepherdRun().status, EXIT.threads, "without a round-one fix push every thread is round one");
+});
+
+test("a second-round thread is never blocking work; round-one threads still are (single review round)", () => {
+  const at = (createdAt, lastAuthor = "reviewer", resolved = false) => ({ resolved, lastAuthor, createdAt });
+  const threads = [at("2026-10-22T09:00:00Z"), at("2026-10-22T10:05:00Z"), at("2026-10-22T11:00:00Z"), at("2026-10-22T11:30:00Z", "writer"), at("2026-10-22T12:00:00Z", "reviewer", true)];
+  assert.deepEqual(splitThreads(threads, "writer", "2026-10-22T10:00:00Z"), { waitingThreads: 1, laterThreads: 2 });
+  assert.deepEqual(splitThreads(threads, "writer", null), { waitingThreads: 3, laterThreads: 0 });
+  const laterOnly = shepherdEvent({ ...OPEN, ...splitThreads(threads.slice(1), "writer", "2026-10-22T10:00:00Z") });
+  assert.equal(laterOnly.event, "later-threads");
+  assert.notEqual(EXIT[laterOnly.event], EXIT.threads);
 });
diff --git a/plugins/vibe/tools/python/test_vibe_1074_lessons_contract.py b/plugins/vibe/tools/python/test_vibe_1074_lessons_contract.py
index 8ffc7be1..a4d0cbd5 100644
--- a/plugins/vibe/tools/python/test_vibe_1074_lessons_contract.py
+++ b/plugins/vibe/tools/python/test_vibe_1074_lessons_contract.py
@@ -49,7 +49,7 @@ def test_push_cadence_and_shepherding_are_wired() -> None:
     assert "pushDue" in (VIBE / "scripts" / "commit-worktree.mjs").read_text()
     assert "`pushDue: true`" in _text(VIBE / "SKILL.md")
     assert "shepherd.mjs --pr <n> --repo <owner/repo>" in _text(HANDOFF / "SKILL.md")
-    assert "every 90 minutes" in _text(FLEET / "SKILL.md")
+    assert "every 45 minutes" in _text(FLEET / "SKILL.md"), "operator ruling 2026-10-22 moved the cadence from 90 to 45 minutes"
 
 
 def test_migration_order_compose_projects_precedent_and_path_gates_are_wired() -> None:
diff --git a/plugins/vibe/tools/python/test_vibe_1076_lessons_contract.py b/plugins/vibe/tools/python/test_vibe_1076_lessons_contract.py
new file mode 100644
index 00000000..511e501a
--- /dev/null
+++ b/plugins/vibe/tools/python/test_vibe_1076_lessons_contract.py
@@ -0,0 +1,125 @@
+"""Contract coverage for the vibe 1.0.76 lessons release: each new check is wired where its mistake happens."""
+
+from pathlib import Path
+
+from vibe_contract_text import flat
+
+
+PLUGIN = Path(__file__).resolve().parents[2]
+AGENTS = PLUGIN / "agents"
+SKILLS = PLUGIN / "skills"
+VIBE = SKILLS / "vibe"
+HANDOFF = SKILLS / "handoff"
+FLEET = SKILLS / "fleet-orchestrator"
+MONITOR = SKILLS / "codex-fleet-monitor"
+
+
+def _text(path: Path) -> str:
+    return flat(path.read_text())
+
+
+def test_questions_carry_a_default_and_the_fleet_keeps_a_heartbeat() -> None:
+    assert "--default" in _text(VIBE / "SKILL.md") and "--deadline-minutes" in _text(VIBE / "SKILL.md")
+    fleet = _text(FLEET / "SKILL.md")
+    for wired in ("`HEARTBEAT`", "`WATCHER-MISSING`", "recurring schedule", "resumes an idle Codex writer on its default"):
+        assert wired in fleet, wired
+    assert "If no answer by" in _text(FLEET / "references" / "templates.md")
+    monitor = _text(MONITOR / "SKILL.md")
+    for wired in ("HEARTBEAT_SECONDS", "proceeded-on-default", "If no answer by <ISO time>: <default>"):
+        assert wired in monitor, wired
+    assert "HEARTBEAT" in (MONITOR / "scripts" / "watch.sh").read_text()
+    assert "seq 1 200" not in (MONITOR / "scripts" / "watch.sh").read_text(), "a 6.7 hour watcher is not a heartbeat"
+
+
+def test_takeovers_reverify_done_claims() -> None:
+    templates = _text(FLEET / "references" / "templates.md")
+    assert "Re-verify: each Done claim with a test or a measurement" in templates
+    assert 'Re-verify every "done" claim' in templates
+    assert "REVERIFY" in (FLEET / "scripts" / "codex-session.mjs").read_text()
+
+
+def test_a_migration_is_tested_before_its_first_push() -> None:
+    environment = _text(AGENTS / "vibe-environment-worker.md")
+    assert "migration-publish.mjs --worktree" in environment
+    guardrails = _text(VIBE / "references" / "guardrails.md")
+    assert "Pushing a migration publishes it" in guardrails and "`Scale test:`" in guardrails
+    assert "migrationProblems" in (HANDOFF / "scripts" / "diff-rules.mjs").read_text(), "handoff runs the same check"
+
+
+def test_a_spec_or_criterion_changes_only_with_a_human_source() -> None:
+    assert "checkSpecChanges" in (HANDOFF / "scripts" / "diff-rules.mjs").read_text()
+    assert "--criteria-before" in _text(AGENTS / "vibe-ticket-worker.md")
+    assert "`spec-change`" in _text(AGENTS / "vibe-guardrails-reviewer.md")
+
+
+def test_every_path_that_sets_a_ticket_done_checks_its_criteria_first() -> None:
+    for path in (
+        AGENTS / "vibe-ticket-worker.md",
+        SKILLS / "cl-execute" / "references" / "monitoring-merge-completion.md",
+        SKILLS / "cl-sweep" / "references" / "open-pr-lifecycle.md",
+    ):
+        assert "executed-check.mjs --kind ticket" in _text(path), path.name
+    fleet = _text(FLEET / "SKILL.md")
+    assert "`UNCHECKED`" in fleet and "A merge alone never makes a ticket DONE" in fleet
+
+
+def test_the_shepherd_stops_on_review_threads() -> None:
+    assert "an unresolved round-one review thread the writer has not answered last" in _text(HANDOFF / "SKILL.md")
+    assert '"threads"' in (VIBE / "scripts" / "shepherd.mjs").read_text()
+
+
+def test_claude_sessions_run_the_kill_guard_on_every_bash_command() -> None:
+    import json
+
+    hooks = json.loads((PLUGIN / "hooks" / "hooks.json").read_text())["hooks"]["PreToolUse"]
+    assert any(entry.get("matcher") == "Bash" and any("kill-guard.mjs" in hook["command"] for hook in entry["hooks"]) for entry in hooks)
+    assert "kill-guard.mjs own <pid>" in _text(VIBE / "references" / "guardrails.md")
+
+
+def test_stale_prs_and_unanswered_questions_are_flagged_and_answered() -> None:
+    assert "STALE-PR" in (MONITOR / "scripts" / "snapshot.sh").read_text()
+    assert "QUESTION-UNANSWERED" in (MONITOR / "scripts" / "classify.sh").read_text()
+    monitor = _text(MONITOR / "SKILL.md")
+    for wired in ("STALE-PR(...)", "QUESTION-UNANSWERED(15m+)", "STALE_PR_SECONDS", "QUESTION_SECONDS"):
+        assert wired in monitor, wired
+    fleet = _text(FLEET / "SKILL.md")
+    assert "On `STALE-PR`" in fleet and "ask the owning writer for an ETA, unblock it, or reassign it" in fleet
+    assert "every 45 minutes" in fleet and "never hold one for optional evidence" in fleet
+    assert "A question never holds a pull request" in _text(VIBE / "SKILL.md")
+    assert "board.mjs <orchDir> question" in _text(FLEET / "references" / "templates.md")
+
+
+def test_one_review_round_with_one_follow_up_ticket() -> None:
+    for path in (VIBE / "SKILL.md", HANDOFF / "SKILL.md", FLEET / "SKILL.md"):
+        assert "review-followup.mjs" in _text(path), path.name
+    assert "--round-one-fixed-at" in _text(HANDOFF / "SKILL.md")
+    assert "follow-ups from #<PR> review" in _text(FLEET / "SKILL.md")
+
+
+def test_program_practices_and_rollout_gate_are_wired() -> None:
+    fleet = _text(FLEET / "SKILL.md")
+    for wired in ("## Program practices", "`MISSING-DUTY`", "MAX_LOAD_PER_CORE", "REPO_MEMORY_CMD", "Deadline mode", "Runtime choice"):
+        assert wired in fleet, wired
+    assert "--criteria <ticket body>" in fleet and "--scope <ticket>,<PRD>" in fleet
+    assert "rollout-gate.mjs --worktree" in _text(HANDOFF / "SKILL.md")
+    assert "load-check.sh" in (FLEET / "scripts" / "fleet.sh").read_text()
+
+
+def test_the_requirements_worker_never_reads_public_help_material() -> None:
+    import re
+
+    worker = (AGENTS / "vibe-requirements-worker.md").read_text()
+    sentences = re.split(r"(?<=[.!?])\s+", flat(worker))
+    public = re.compile(r"help cent(?:er|re)|public documentation|release notes|web search", re.IGNORECASE)
+    offenders = [sentence for sentence in sentences if public.search(sentence) and not re.search(r"\bnever\b|\bnot\b", sentence, re.IGNORECASE)]
+    assert offenders == [], offenders
+    assert "NEEDS_PERSON" in flat(worker) and "signed-in browser" in flat(worker)
+
+
+def test_ready_heads_green_watch_claude_usage_and_status_sweep_are_wired() -> None:
+    fleet = _text(FLEET / "SKILL.md")
+    for wired in ("push-check <writer> --head <sha>", "green-watch.mjs --repo", "claude -p \"/usage\"", "`status-sweep` duty", "`PLAN-OPEN`", "`ABSORBED-OPEN`"):
+        assert wired in fleet, wired
+    assert "the monitor cannot read Claude usage" not in fleet
+    assert "claude-usage.mjs" in (MONITOR / "scripts" / "snapshot.sh").read_text()
+    assert "--ready <sha>" in _text(FLEET / "references" / "templates.md")