Autopilot worker lifecycle and recovery

Headless Claude workers receive a per-process --settings {"disableAllHooks":true} override. This prevents user/project/plugin session hooks from performing vault maintenance or delaying worker exit. Authentication, repository instructions, model selection, permission flags, and the explicit MCP assignment remain in place. Managed hooks remain subject to administrator policy. This setting does not change the driving interactive session or its settings files.

Do not replace this with --bare: the installed Claude CLI documents that bare mode skips OAuth/keychain authentication and requires API-key authentication. See the Claude hook reference.

For reviewers, a complete verdict file containing a boolean passed and a nonempty reason or finding starts a 60-second exit grace period. If the child still has not exited, the wrapper reaps its process tree and reads the verdict through the existing PASS/FAIL handling. Missing, partial, empty, or unexplained verdicts do not trigger early cleanup. A verdict disappearing resets the grace. This cleanup is distinct from a no-progress timeout and is logged explicitly. The vendor's terminal stream result starts the same grace for every role, even when no verdict-file callback is supplied. Cleanup preserves the captured output; it does not turn an absent or failing review verdict into a PASS.

A managed implementation lane encountering mixed-dirty or unsafe-gald3r keeps its candidate for up to five minutes before creating a worktree or spawning a model. The five-minute recovery budget is shared by the headless parallel batch, starting at its first refusal; it does not restart for each candidate. Every five seconds it reruns the same housekeeping gate. Cleaning or committing the blocking files can therefore release it while reviewers are still running. Operator stop ends the wait; persistent dirt still refuses dispatch. Conflict and configuration-fault gates remain immediate refusals. Diagnostics include offending paths and reasons. This does not authorize staging unrelated files: dashboard/configuration edits should live outside the active controller checkout, or be committed by their owner.

The default alignment check no longer treats a title's backticked symbol appearing in source or documentation as evidence of completion. A request to fix or remove an existing symbol is still work. Existing confirmed-merged checks, explicit contradiction markers, and injected behavioral-evidence checks retain their own contracts. Legacy symbol-match cache entries are not reused. This change does not reopen or close records previously moved to review; independent review owns them.

An elapsed duration alone is not a hung-worker signal. Distinguish startup, substantive vendor output, verdict creation, and process exit. Wrapper heartbeat bytes and historical gate-refusal counts do not prove current worker progress or current blockage.