feat(lib): implement FW-N1~FW-N4 items and pane snapshot guidelines

skills/tmux-agent-orchestrate-delegate-job/SKILL.md

@@ -349,6 +349,10 @@ has been verified (2026-06-21, 6-batch refactoring sprint):
 5. **Batch grouping** — group 2-3 FW items per batch when they touch different
    files (no file overlap). This amortises the dispatch overhead. Items touching
    the same file must be in separate batches to avoid conflicts.
+6. **Pane Snapshots & Truncation Prevention** — to prevent long agent responses from being scrolled out and truncated due to TUI viewport limitations, enforce the following snapshotting pattern:
+   - Immediately after dispatching a brief, capture the pre-brief pane buffer via `capture-pane -S -200`.
+   - During long execution, run a background loop taking incremental snapshots (e.g. every 30 seconds `>> /tmp/pane-snap.txt`).
+   - Immediately after job termination, capture the entire final pane state to ensure no terminal logs are lost.
 
 ## Verification Checklist
 

skills/tmux-agent-orchestrate-delegate-job/scripts/job_subscriber.py

@@ -85,7 +85,7 @@ class _Watcher:
         # --- production auth check: data.auth_token must match if expected ---
         expected_token = self.tokens.get(jid)
         if not mqtt_common.verify_hmac(payload, expected_token):
-            logger.warning("drop event for job %s: auth_token mismatch", jid)
+            logger.warning("drop event for job %s: HMAC verify failed", jid)
             return
         # Persistent audit log from the *subscriber's* vantage point: every event
         # that survives defensive parsing is recorded here, including ones a

skills/tmux-agent-orchestrate-delegate-job/scripts/publish_event.py

@@ -75,11 +75,9 @@ def build_payload(
         "detail": detail,
         "data": dict(data) if data else {},
     }
-    # Production: carry the per-job auth token so the subscriber can verify the
-    # publisher. The token is compared in plain text (bearer-token style) by the
-    # subscriber — NOT an HMAC. See SKILL.md "Auth token" and PLAN 8.2. The
-    # registry stores the per-job token in `auth_token`; only include it on the
-    # wire when set so the public broker (no auth) doesn't leak anything.
+    # Production: carry the per-job HMAC-SHA256 signature in `data.hmac_sig` so
+    # the subscriber can verify the publisher without exposing the secret token.
+    # The signature is calculated over the entire payload (with `data.hmac_sig` excluded).
     if auth_token:
         sign_payload = {k: v for k, v in payload.items() if k != "data"}
         sign_payload["data"] = {k: v for k, v in payload.get("data", {}).items() if k != "hmac_sig"}

skills/tmux-agent-orchestrate-monitor/SKILL.md

@@ -107,7 +107,7 @@ bash skills/tmux-agent-orchestrate-monitor/scripts/reconcile.sh --subscribe --id
 bash skills/tmux-agent-orchestrate-monitor/scripts/reconcile.sh --subscribe --idle-timeout 0
 ```
 
-Flags: `--once` (single pass), `--emit-diff` (print JSON), `--dry-run` (P1-E — no mutation), `--subscribe` (push-based MQTT subscription monitoring). `--subscribe` sub-flags: `--timeout N` (exit after N seconds of wall-clock; `0` = no limit, default), `--idle-timeout N` (exit after N seconds with no message; default `600`, `0` = never idle-out). On a broker connection failure (connect error **or** non-zero CONNACK), `--subscribe` falls back to a polling loop that re-runs `--once --emit-diff` every `RECONCILE_POLL_INTERVAL` (default 15) seconds until `--timeout`. Terminal-event YAML updates are written through `lib.sh::atomic_dump_yaml` (flock + schema-validate + `.bak`). There are **no** `--workspace` / `--agent` / `--comment-card` flags; the worker turns the emitted JSON `drifts[]` into `kanban_comment` calls itself.
+Flags: `--once` (single pass), `--emit-diff` (print JSON), `--dry-run` (P1-E — no mutation), `--subscribe` (push-based MQTT subscription monitoring). `--subscribe` sub-flags: `--timeout N` (exit after N seconds of wall-clock; `0` = no limit, default), `--idle-timeout N` (exit after N seconds with no message; default `3600`, `0` = never idle-out). On a broker connection failure (connect error **or** non-zero CONNACK), `--subscribe` falls back to a polling loop that re-runs `--once --emit-diff` every `RECONCILE_POLL_INTERVAL` (default 15) seconds until `--timeout`. Terminal-event YAML updates are written through `lib.sh::atomic_dump_yaml` (flock + schema-validate + `.bak`). There are **no** `--workspace` / `--agent` / `--comment-card` flags; the worker turns the emitted JSON `drifts[]` into `kanban_comment` calls itself.
 
 ## Drift classes (what the script handles)
 

skills/tmux-agent-orchestrate-monitor/scripts/reconcile.sh

@@ -22,10 +22,10 @@ ONCE=0
 EMIT_DIFF=0
 DRY_RUN=0
 SUBSCRIBE=0
-# --subscribe controls (review item 4): 0 = no overall timeout; idle default 600s
-# (raised from the old hardcoded 120s); idle 0 = never idle-out.
+# --subscribe controls (review item 4): 0 = no overall timeout; idle default 3600s
+# (raised from 600s to align with job timeout defaults); idle 0 = never idle-out.
 SUB_TIMEOUT=0
-SUB_IDLE_TIMEOUT=600
+SUB_IDLE_TIMEOUT=3600
 POLL_INTERVAL="${RECONCILE_POLL_INTERVAL:-15}"
 
 while [ $# -gt 0 ]; do
@@ -63,7 +63,7 @@ import os, sys, json, time, subprocess
 lib_sh = os.environ.get('LIB_SH', '')
 skills_dir = os.environ.get('SKILLS_DIR', '')
 timeout = int(os.environ.get('SUB_TIMEOUT', '0') or '0')          # 0 = no overall timeout
-idle_timeout = int(os.environ.get('SUB_IDLE_TIMEOUT', '600') or '0')  # 0 = no idle timeout
+idle_timeout = int(os.environ.get('SUB_IDLE_TIMEOUT', '3600') or '0')  # 0 = no idle timeout
 
 # Locate skills/tmux-agent-orchestrate-delegate-job/scripts to import mqtt_common — relative first, then
 # an upward walk from cwd. No hardcoded absolute path (review item 6).