chore: refresh kendex renders

.agents/skills/harness-ci/scripts/change-class

@@ -1280,24 +1280,9 @@ load_measurement() {
 # the measurement's render roots, or roots this script cannot load, keep the
 # inventory on the diff, where the list below refuses it. Any other change to
 # it, a changed entry or an entry for a path that stays, keeps it there too.
-names_only_roots_rendered() { # ROOTS
-  local root listed
-  [ "$1" != - ] || return 0
-  load_measurement || return 1
-  set -f
-  for root in ${1//,/ }; do
-    for listed in $BRANCH_GROWTH_RENDER_ROOTS; do
-      [ "$root" = "$listed" ] && continue 2
-    done
-    set +f
-    echo "inventory-kept: cause=root-not-rendered root=$root" >&2
-    return 1
-  done
-  set +f
-}
 case "$inventory_change" in
   names-only\ *\ roots=*)
-    if names_only_roots_rendered "${inventory_change##* roots=}"; then
+    if names_only_roots_rendered "${inventory_change##* roots=}" load_measurement; then
       changed="$(awk '$0 != ".kendex-generated.json"' <<<"$changed")" ||
         answer standard "cause=path-set-unreadable"
     fi ;;

.agents/skills/harness-ci/scripts/lib/change-class.sh

@@ -18,6 +18,26 @@
 # configuration. Candidacy permits proof setup; release comparison owns it.
 HARNESS_CI_REFRESH_CALLER=.github/workflows/kendex-refresh.yml
 
+# harness-only owns the names-only verdict. Its roots must also belong to
+# the caller's measurement roots before the inventory can leave the path set.
+# LOAD_ROOTS sets BRANCH_GROWTH_RENDER_ROOTS from the caller's trusted settings.
+names_only_roots_rendered() { # ROOTS LOAD_ROOTS [ARG...]
+  local roots="$1" root listed
+  shift
+  [ "$roots" != - ] || return 0
+  "$@" || return 1
+  set -f
+  for root in ${roots//,/ }; do
+    for listed in $BRANCH_GROWTH_RENDER_ROOTS; do
+      [ "$root" = "$listed" ] && continue 2
+    done
+    set +f
+    echo "inventory-kept: cause=root-not-rendered root=$root" >&2
+    return 1
+  done
+  set +f
+}
+
 change_class_path_match() { # PATH GLOBS
   local glob
   PATH_MATCH_HIT=""

.agents/skills/orch/references/communication-modes.md

@@ -188,7 +188,7 @@ In flight: [EACH TRACKER ID WITH ONE NEXT ACTION]
 [CURRENT SESSION'S OPEN PROGRESS ONLY: ONE LINE PER ACTION WITH ITS TIME, OPERATION, OBSERVED RESULT AND DECISION REASON; EXCLUDE RULINGS AND FILING HISTORY (FLEET LOG), AND VERIFYING READINGS (THEIR TRACKER ITEMS)]
 ```
 
-The handoff is a current snapshot. Prepare the complete body below Start here in a separate ignored scratch file. At Stop and succession, write it with `oversee-succeed --write-only --handoff-body [BODY]` under [oversee.md § 5](../workflows/oversee.md#5-stop). Add `--handoff [PATH]` when the fleet uses another destination. Require a successful write before completing preparation, attempting plain succession, claiming a current installed snapshot or recording it for manual recovery. A failed write stops preparation; report its cause. The writer replaces the complete snapshot and supplies its current fleet generation and UTC write time. It refuses the installed handoff as body input, links to it and any body with a Start here line. The body is replaceable session scratch with no archive role. The caller keeps ownership of it. The successor and recovery read only the installed handoff.
+The handoff is a current snapshot. Prepare the complete body below Start here in a separate ignored scratch file. At Stop and succession, write it with `oversee-succeed --write-only --handoff-body [BODY]` under [oversee.md § 5](../workflows/oversee.md#5-stop). Add `--handoff [PATH]` when the fleet uses another destination. Require a successful write before completing preparation, attempting plain succession, claiming a current installed snapshot or recording it for manual recovery. A failed write stops preparation; report its cause. The writer replaces the complete snapshot and supplies its current fleet generation and UTC write time. It refuses the installed handoff as body input, links to it and any body with a Start here line. In the body's Progress log, it refuses labeled rulings, filing history and Verifying readings with the first matching line number and record home; `oversee-succeed --help` names the refusal. It checks labeled forms only; paraphrases pass. A bare Verifying state stays legal. The body is replaceable session scratch with no archive role. The caller keeps ownership of it. The successor and recovery read only the installed handoff.
 
 For live self-succession, `oversee-succeed` refuses `handoff-stale` when the Start here generation is absent or differs from the fleet record; it does not judge the time. Plain succession never rewrites retained content. Dead and walled recovery use the existing handoff plus bounded live records, even when the handoff is stale or absent: their callers cannot write a live snapshot. At succession, promote open progress into the sections above and cut the log. Keep no archive copy: commits, the tracker, mailboxes and Slack hold history.
 

.agents/skills/orch/references/narrow-change.conf

@@ -156,7 +156,7 @@ path .github/allowed_models.txt
 # reach this file for the wider `small` class, and micro.md § Escape
 # condition 3 takes them too: every `path` line here escapes the micro tier,
 # except one a `superseded` line names, as the header states. The inventory
-# exception is stated in ../../harness-ci/scripts/change-class beside
+# exception is stated in ../../harness-ci/scripts/lib/change-class.sh beside
 # names_only_roots_rendered.
 path .kendex-lock.json
 path .kendex-generated.json

.agents/skills/orch/references/oversee-events.md

@@ -82,7 +82,7 @@ To wake a lane below is to send it the directive and wake it per `oversee-lanes.
 - `parked-closed [ITEM] pr=[N] repo=[OWNER/REPO]` → the dependency PR closed without merging. The watch reports it once. Resolve the hold or resume the lane through the same Recovery relaunch route.
 - `lane-exited` → the window is alive but the harness under it is gone (the lane's closing lines follow the event and say why; `payload-noise-only lines=N` in their place means the lane deleted its own worktree and the shell has drawn nothing since). A lane stopped by a harness session limit ("You've hit your session limit · resets 9:50am") is not dead: resume it under another auth lane (`lanes pick --harness [HARNESS] --model [MODEL]` for the model the replacement will run, then [lane-directive.md § Recovery relaunch](lane-directive.md#recovery-relaunch)), or wait for the shown reset and use Recovery relaunch on the original account. The relaunch carries its own continuation line, except on a hosted codex lane, which resumes without one and takes it by Pane paste ([lane-directive.md § Recovery relaunch](lane-directive.md#recovery-relaunch)). A lane that reported `handoff` on an earlier run is relaunched per that event, not resumed or nudged. Any other exit is the `window-gone` rule below.
 - `overseer-dead`, `overseer-walled`, `overseer-reserve`, `overseer-context-unmeasured`, `overseer-context-stale`, `overseer-mark` → the overseer's own session: [overseer-session-events.md](overseer-session-events.md).
-- `handoff` → the item's lane recorded its handoff and exited: relaunch it per § Judgement rules, Hand off a lane; the record follows the event line.
+- `handoff` → the item's lane recorded its handoff and exited: relaunch it per § Judgement rules, Hand off a lane; the record follows the event line. When `cause` is `model-switched`, pin the recorded `model` in the recovery launch flags. A native remote lane dispatches its predecessor stop through the launch identity owner. Report `stop_failure` cause and process identity when that field stands on the handoff. The existing controller recovery route rechecks the stop before relaunch. A handoff alone does not confirm that its predecessor stopped.
 - `lane-closed` → the watch ran `lane-close` under the [Lane close contract](lane-reach.md#lane-close). Record the line below in the fleet log, the provider's `kept=PATH`, `kept=none` for no archive, or `closed=absent item=ITEM` for a host that no longer held the item and ran no archive pass ([lane-host.md](../schemas/lane-host.md) `close`).
 - `lane-close-refused` → `lane-close` relayed exit 3 from the provider and the sandbox stays. Surface the `path=` line that follows to the user; its value is the checkout the close stopped on, never the path that stopped it. Render-only drift is saved as a binary patch under the hosted clone's `tmp`, restored, and refreshed before close, and the provider refuses on any of several conditions. An untraced change in the checkout is the common one; a saved patch that does not carry a path the close was about to restore or remove is another. Several of them leave every changed path inside the generated inventory, so a hunt for an untraced path can find none. Inspect the directory and never force the close.
 - `lane-close` refusing `stop-failed` or `exit-timeout` → the idle lane's harness did not end by signal, and the window and record stay. `stop-failed` names the failed step as `cause=`: `cause=timeout` is a harness that ignored its signal, which on a hosted lane arrives as `cause=provider` with the provider's own lines above the refusal, `cause=identity-unread` is a local record naming no launch identity over a pane with no harness process under it, `cause=identity-stale` one naming a harness that has exited, or whose `pid=` a later process holds, over a pane with none under it either, and `cause=process-read-failed` a process read under the pane, or the process table read at the identity the stop signals by, that failed. `target=wake` is the turn a wake started, stopped by the record's `wake` before the record reads done or stopped. A hosted stop by `lane-host-ssh` refusing `stop-identity-invalid` is a clone whose `.git/lane-host-pid` holds no pid and start: remove that file and close again, which stops the lane by its worktree. `cause=provider status=4` under `--keep-sandbox` is a hosted item whose worktree its own close-out removed, under a stop that finds the harness by that directory: the stop has no directory to find the harness by, and only a full close, which prints `stop-skipped cause=worktree-removed`, closes it: its host close ends the harness where the provider's `close` ends the sandbox, and otherwise the window kill hangs up the lane's ssh session. That reading needs the provider's `stop-worktree-removed item=[ITEM]` line above the refusal; `cause=provider status=4` without it is the provider's own `4`, such as a sandbox it stopped, whose line above names it: start the sandbox, then close again. `exit-timeout` on a local lane names `identity=`, the identity the stop signalled by: `recorded`, the record's `launch`, or `pane`, read off the pane because the record named none or a stale one. `processes=0` there is a harness that identity named which exited before its signal, or under `recorded` no process named for the harness at or below the recorded pid. `processes=` above 0 means that many harness processes were signalled and confirmed exited, yet the pane still does not read exited: inspect what the pane now runs. Report the refusal lines to the user. Never type into the pane to end the harness instead.

.agents/skills/orch/schemas/workflow-state.md

@@ -185,7 +185,9 @@ The same locked update appends one `fleet_log` entry with `kind` `model-switched
 
 The lane recovery dispatcher marks the switch row's `recovery` as `starting` before launch, `replaced` after success, or `failed` after failure. A later launch's mismatch also proves a pending `starting` replacement reached a live harness. The dispatcher counts successful replacements since this item's last `model-recovery-reset` row. [lanes help](../scripts/lanes) defines `ORCH_MODEL_RECOVERY_LIMIT` and its default. A refusal adds one `model-recovery-limit` row with `recoveries`, `limit` and the keyed refusal in `text`. The first Stop of the bound replacement resets the count when that launch has no mismatch. It writes `model_check.outcome` as `passed` with `session_id`, `launch_identity` and `at`, and appends one `model-recovery-reset` row. Repeated Stops retain that check. A Stop from a stale session cannot reset the current launch.
 
-A lane that cannot read its fleet launch record stores the unavailable reading under `model_checks[session_id]` in its existing item workflow state. The hook uses the state writer's lock when that item state needs initialization. Repeated events retain the first unavailable reading and deliver no second notice. The session continues with its model identity unjudged.
+A native remote lane with no local fleet record reads its launch model from the separate JSON launch record owned by `lane-marker` (`--launch-path`). Its `identity_file` names the predecessor record written by the SSH launch prefix. The hook verifies that the callback descends from that live predecessor. It stores the model check under `model_checks[session_id]` in the item's existing workflow state. A mismatch preserves the durable handoff, adds `cause:"model-switched"` and the recorded `model`, then dispatches the existing stop owner for the verified native predecessor. A failed stop stores `handoff.stop_failure` with `cause`, the affected `pid` (null when the failure names no process), the predecessor `launch` identity, `exit`, and `at`. The detached child also writes a keyed failure to the existing recovery log. A new model handoff clears the prior stop failure. A dispatch failure reaches the callback as unavailable context. The controller reads the handoff over the existing host transport, reports a stop failure, and rechecks the existing stop before relaunching with the recorded model pinned. No fleet watcher runs on the lane's host.
+
+A lane without readable launch evidence stores the unavailable reading under `model_checks[session_id]` in its existing item workflow state. The hook uses the state writer's lock when that item state needs initialization. Repeated events for the same launch retain the reading and deliver no second notice. The session continues with its model identity unjudged.
 
 `workflow-state-oversee.json`, under the key `oversee`, is the fleet's record, at the one address every launch passes `open-terminal --state-dir` and the watch reads as `--state` ([oversee.md § 3 Lane record](../workflows/oversee.md#3-launch)). `open-terminal` creates it on the first launch of a tmux fleet; the other surfaces create it as oversee.md § 3 Lane record directs. It carries the fields above unused and these:
 

.agents/skills/orch/scripts/item-tier

@@ -195,6 +195,10 @@ if [ -n "$base" ]; then
     consider micro branch-paths
     while IFS= read -r -d '' path; do
       change_class_path "$path" launch
+      if [ "$path" = .kendex-generated.json ] && [[ "$CHANGE_CLASS_PATH_CAUSE" = excluded-path\ * ]] &&
+        change_class_inventory_rendered "$base" "$head" "$repo" "$scratch/inventory-err"; then
+        continue
+      fi
       [ -z "$CHANGE_CLASS_PATH" ] || consider "$CHANGE_CLASS_PATH" "$CHANGE_CLASS_PATH_CAUSE"
     done <"$range_paths"
   fi

.agents/skills/orch/scripts/lane-host-ssh

@@ -801,7 +801,8 @@ if [ ! -x "$marker" ]; then
   printf 'the host clone predates the launch record writer; refresh it to a build carrying that script\\n' >&2
   exit 1
 fi
-exec "$marker" "$2" "$3"''', row["clone"], path, args.item)
+exec "$marker" --launch-record "$4" "$2" "$3"''', row["clone"], path, args.item,
+           json.dumps({"identity_file": row["clone"] + IDENTITY_FILE}))
     pi_root = f"\tpi-root={remote_account}" if args.harness == "pi" else ""
     lifecycle_output(row, f"ssh-target={row['target']}\tpath={path}\tremote-prefix={prefix}{pi_root}\n".encode())