Integrated team-move F candidate handoff (THR296seq135)

Founder-controlled teams move capability/preview/apply/show/recover now has
public service/CLI source. F proposes APPLY_AVAILABLE=True with actual native
apply AND recovery readiness gates; whole-feature independent acceptance and
manager guarded merge remain required. Skills/agents gain no execution or
ambient-bearer self-admission authority. Manage-agent retains team/role; transfers use the
separate admitted founder operation. Preview uses only the pure native planner,
not materializers/resets/reservations. Exact normalized client bytes/key are
privately fsynced before POST, including exact saved-file reuse/apply reads;
a complete prior failed-save file requires fresh descriptor/byte validation,
file fsync/close and containing-directory fsync/close. Partial/changed bytes
refuse without overwrite/new key; same-UID limitations remain. Preserve key on
transport loss and use same-key
show, never automatic second apply. HTTP202/CLI3 is in-flight, saved COMPLETE
readback/release alone permits apply200/CLI0; refusal/repair is1, parser2.
Show is read-only; recover explicitly binds SAME ID/revision and native prior
owner/process proof/CAS. Durable daemon tasks survive client disconnect; shutdown
reaps them before DB close without clearing holds. Diagnostic-org read/recovery
uses strict native owners, closes before positive normal attachment and clears
only after successful native map insertion. Native dedup redelivery follows.
Show/recover diagnostics distinguish strict saved bounded code/owner IDs and
original/latest recovery/publisher identities from current native census and
publisher owner observations. Diagnostic-only reads require no ordinary attachment
or preview; unavailable ownership stays unknown. Async failure/secondary close
or attachment facts are safe process-local observations, never durable evidence.
Resolve named dependencies before explicit SAME operation/target/revision recovery;
no automatic retry or TTL takeover. Both show GET forms declare202/CLI3 in-flight.
D staging/history/leases, C1-C3 uncertainty/EMPTY budgets and actual callbacks
remain. Earlier unavailable-E statements below describe historical checkpoints.
Current contract: docs/superpowers/specs/2026-10-14-online-team-move.md and
engineering-owned docs/runbooks/online-team-move.md. F candidate source,
independent acceptance/merge, separately authorized release loading and exact
Founder live operation are distinct. Shared bearer does not prove human presence. Behavior
UNEXECUTED, integration INCLUDING callback SKIPPED24342, units RETIRED; no new
cases/campaign, live operation, deployment or cleanup authority follows.

F native release preparation runs through OrgState.load: strict read-only move
discovery precedes naming preflight, generic compatibility writes, roster
validation, publication and producer admission. After complete native workflow
validation, the DB-owned install_team_move_schema transaction validates exact
existing layout/history/org identity, refuses held/unknown state, installs only
the literal ONE table if absent, and validates before COMMIT. Repeated compatible
attachment is idempotent. Generic Database/runtime-audit, capability/preview/show
and restricted diagnostic recovery never install or repair it. Source delivery
does not call it on production: separately authorized compatible release loading
through the supported launcher performs native preparation; Founder assembles
no files, SQL or offline manifest. Missing schema/owners are engineering release
dependencies. Even an empty installed table requires reader@3. An absent optional
layout remains compatible with generic/older readers; source rollback cannot
undo durable state or grant a downgrade.

F also freezes C2 thread retry initialization explicitly, including EMPTY
budgets. New initial/fallback/nudge phase initialization is distinct from a
frozen zero budget; deferral/reentry cannot replenish it. Old missing facts keep
their original history interpretation but refuse ambiguous new retry/reentry
with team_move_thread_retry_initialization_unknown; no history is backfilled.
Updated shell/Mac launchers require online-team-move@3 (reads old @1/@2), so
earlier supported parsers refuse before startup. Already-running old daemons,
obsolete launchers and unchecked old interpreters remain outside that guard.
All behavioral/installation/recovery/launcher observations remain UNEXECUTED.

Historical task attribution is separate from current launch eligibility. The
complete parent/child/revisit/chain/fanout/workflow closure retains task team keys,
recorded participants and permanent IDs, including retired actors authenticated
by the existing strict naming owner or native INTEGER task/result/SID attribution.
It never resolves settled history through today's manager or requires re-enrollment.
Unknown identity/graph facts remain actionable census blockers without discarding
collected inventory; dependent sessions/jobs/recovery callbacks/workflows remain
joined even for terminal tasks. New execution still requires a current executable
owner. No historical record, team, callback or binding is rewritten.

The SAME INTEGER thread invocation/agent/SID preparation owner spans native
materialization, integrity, repository refresh and launch-spec/cache preparation,
including helper-internal omissions and caught failures. Such uncertainty appends
the existing sticky failed_cleanup fact BEFORE ordinary failure settlement;
backend preparation/cleanup and native workspace/cache failures retain ownership.
Later success/callback/terminal state cannot erase it. Serializer, audit COMMIT,
strict history reader, restart/reentry and census preserve that fact, independently
of frozen EMPTY/nonempty retries. Ordinary stale-claim/agent/breaker or missing
launch-seam refusals before effects retain their native no-effect disposition;
returned failure alone never proves compensation. No new schema/journal/backfill
or generic producer identity is introduced. All behavior remains UNEXECUTED.

Ordinary tasks carry their SAME native TaskInvocation/task/agent/runtime SID
through materialization, integrity (including retries), package omissions,
repository refresh, attachment writes/cleanup, task scratch and builtin/custom
cache/workspace setup. Safe deferred ownership becomes durably prepared before
preparation resumes; this never clears existing uncertainty.
Preparation failure sets the existing local reservation cleanup flag BEFORE the
fallible strict Pause save/COMMIT, then retains execution_unknown/unknown in
the admitted journal. Terminal/callback/quiescent later attempts and safe unrelated
worktree cleanup cannot clear it. Settlement persists that fact before release;
failed saves retain local ownership and original plus persistence errors.
Restart treats unclosed task prepared entries as unknown, including terminal
rows and prepared recovery/retry owners; absence of first launch is no proof of
preparation cleanup. Unknown deferred entries cannot authorize a fresh launch.
Native pre-effect source/artifact validation, repo-scan and missing launch-seam refusals
retain their no-effect disposition. Existing retry/recovery IDs, frozen budgets,
INTEGER callbacks and authority-v2 are preserved. No new field/journal, history
backfill, compensation or clearance writer is introduced. Behavior UNEXECUTED.

D private operation and startup holds (THR296seq135)

The corrected reader is online-team-move@3 (also reads old @1/@2 records); supported
launchers pass --reader-guarded-start=online-team-move@3 and reject earlier D
readers. Per-org open/identity/SQLite errors remain diagnostic-only and survive
startup/switch readback. Restricted recovery preserves the original error on
close failure; standalone close failures retain native classification and holds.
Recovery reconciles only pre-recorded operation staging
intent/acquired identity/terminal disposition in existing audits. Unknown acquired
identity or cleanup stays held even after owner-finished; no glob deletion or
legacy evidence adoption is allowed. Native discovery and publication capture
run outside durable profile/publication mutation leases, with revision/epoch/CAS
revalidation before mutation and at final release. This grants no skill execution,
cleanup, activation, live operation or behavioral-proof authority.

Global/rebind/claim/retry/synchronization profile writers retain diagnostic roots
and refuse without diagnostic filesystem/DB acquisition while leased, even with
EMPTY dependencies.
Adapter removal reports the retained EMPTY-dependency diagnostic refusal as
HTTP409 with detail.code; its bounded ProfileCoordinatorError translation
preserves unrelated exceptions and native removal/audit/compensation.
Native startup/attachment performs positive inspection
outside leases. Matching attachment revalidates its actual already-open DB owner
in the short segment; only successful attachment clears its diagnostic. Other
roots, failed attachment, current holds and malformed history stay held. D's
own-operation/native-identity exception also checks EMPTY dependencies. Public
recovery/reattachment is source-wired by E and gated on actual native owners by F; no skill authority is granted.

D supplies private canonical/context/reset/profile/publication/recovery source.
E supplies public API/CLI source; F proposes reviewed source enablement with
separate actual apply/recovery readiness gates;
no skill or agent may invoke the private owner or use ambient bearer credentials
to self-admit a move. Manage-agent still cannot transfer teams. New startup
schema-owner discovery precedes compatibility writers and partial membership;
unknown/unresolved state keeps that org diagnostic-only and its durable holds.
Only admitted bounded same-operation recovery can reconcile exact owned images
and native owner evidence; no timeout, missing tracker or source rollback releases
it. Updated launchers require the guarded reader protocol; old running daemons
and arbitrary direct old interpreters remain outside that protection. Source
and static checks do not prove behavior. No activation/restart/live move, new
tests/campaign, callback fabrication or cleanup authority follows. Earlier C3
checkpoint text below records that slice only; current D disposition is in
docs/superpowers/specs/2026-10-14-online-team-move.md. SAME13 observations stay;
behavior/recovery UNEXECUTED, integration INCLUDING callback SKIPPED24342,
Python units RETIRED. Native permission/execution enforcement is unchanged.

dream

Native C3 preparation failure or ordinary process return never proves file,
package or process cleanup. Unknown ownership remains in retained audit census.
New retry budgets explicitly freeze even an empty schedule; missing legacy facts
cannot authorize replenishment/reentry. Schedule runtime SID is pinned through
real preparation/spec/execution and is distinct from provider resume identity.
Custom-skill authority validates before reservations; only explicit native
validation/rollback/temporary-cleanup evidence can settle a refused writer.
No history deletion, automatic recovery, apply or execution authority follows.

During an online team-move hold, the native scheduler/runner retains due or pending work without consuming its occurrence. Running work is a blocker. Let the real dream owner revalidate and issue its genuine callback; never create a replacement occurrence, fake completion or reset a window. Source behavior remains UNEXECUTED and apply is unavailable.

This is a private reflection invocation. It is not a task, thread, or thread.

Procedure

1. Review the dream prompt and the recent window it provides.
2. Identify durable private lessons for your own future work.
3. Identify possible org-wide KB candidates, but do not write KB entries directly.
4. If founder attention is needed, prepare a short founder-visible thread body.
5. Write KB candidate bodies to temporary markdown files.
6. Write a JSON payload to /tmp/dream-result-<DREAM-ID>.json.
7. Complete with a single-line callback:

happyranch dreams complete --org <slug> --dream-id <DREAM-ID> --from-file /tmp/dream-result-<DREAM-ID>.json

Payload Shape

{
  "summary": "private markdown summary",
  "learnings": [
    {
      "slug": "short-id",
      "title": "Durable private lesson",
      "topic": "workflow",
      "body": "..."
    }
  ],
  "kb_candidates": [
    {
      "slug": "candidate-slug",
      "title": "Possible org-wide rule",
      "topic": "operations",
      "rationale": "Why this may belong in KB",
      "body_path": "/tmp/dream-kb-candidate-slug.md"
    }
  ],
  "founder_thread": {
    "needed": true,
    "subject": "Nightly reflection: agent_name",
    "body_markdown": "Short founder-visible summary with candidates/actions"
  }
}

Rules

• Keep the full dream private unless founder_thread.needed is true.
• Do not write KB entries directly. Dreams produce KB candidates for founder review.
• Do not dispatch tasks or other agents from a dream.
• Do not call happyranch report-completion.
• Use body_path for KB candidate bodies so the JSON payload stays small.

C3 writer disposition follows the actual authority/profile interval through
native naming reconciliation and explicit leading validation. Stale rename or
prompt CAS may settle only after successful native rollback/reconciliation;
unfenced status alone proves nothing. Caught reconciliation/publication/clone
failure, cancellation and partial effects retain unknown ownership. Skill scratch
cleanup requires no-follow lstat ENOENT; surviving entries, inspection errors and
prior uncertainty stay unknown. Cleanup causes are retained; existing unknown
history is never cleared. These are source accounting rules, not behavioral
verification or new execution/activation authority.