Sync agent state from PC at 2026-05-19 12:32:00

docs/MULTI_AGENT_CURSOR_PLAYBOOK.md

@@ -19,6 +19,30 @@ Recommended windows:
 - VPS control-plane window: VPS executor/verifier roles.
 - Dedicated terminals: PC and VPS sync scripts. Do not let normal chat agents own these long-running terminals.
 
+## Multi-Window Role Confirmation
+
+When several Cursor windows are open, every window should make its role visible before work starts:
+
+- Put the active role at the top of the working context or first message, such as `Role: ORCHESTRATOR`, `Role: VPS_VERIFIER`, or `Role: PC_EXECUTOR`.
+- Before sending an execution or authorization prompt, check the visible workspace path and the relevant `handoff/*.md` file.
+- Prompts that authorize token use, `node run`, `approve`, service changes, Docker/Nginx changes, firewall changes, or other mutation must echo the intended role and workspace in the first sentence.
+- If the target role and current window role do not match, do not reinterpret the prompt. Stop and ask the user to resend it to the correct window.
+- Verifier windows must not accept ORCHESTRATOR or EXECUTOR work, even if the requested content looks reasonable.
+- ORCHESTRATOR must adopt or correct any cross-role control-plane edits before executors act on them.
+
+Example safe authorization phrasing:
+
+```text
+Target role: PC_EXECUTOR in D:\openclaw-control-plane.
+Authorize only T9 foreground node run under docs/G2_RUNBOOK.md.
+```
+
+Unsafe phrasing:
+
+```text
+Go ahead with G2.
+```
+
 ## Role Boundaries
 
 - ORCHESTRATOR owns requirements, task split, dependency state, and acceptance gates.
@@ -43,6 +67,7 @@ Git is the durable source of truth. It is not a real-time message bus. Upgrade l
 - Do not store secrets in files, evidence, commits, or chat.
 - Do not enter mutation stages while sync health is blocked.
 - Require rollback notes before persistent service, routing, firewall, Docker, or environment changes.
+- Treat role mismatch as a safety blocker for execution or authorization prompts.
 
 ## User Experience Rule
 

docs/ROLE_MISDIRECTION_RECOVERY.md

@@ -0,0 +1,44 @@
+# Role Misdirection Recovery
+
+Use this procedure when a prompt intended for one role is sent to another Cursor window or agent role.
+
+## Immediate Stop
+
+- Stop the receiving role from acting outside its assigned scope.
+- Do not reinterpret the prompt for the current role.
+- Do not run execution, approval, service, network, Nginx, Docker, firewall, or token-handling commands.
+- Do not continue mutation-stage work from any role until ORCHESTRATOR reviews the incident.
+
+## Audit
+
+- Identify the intended role, actual receiving role, workspace path, and time window.
+- Review modified files and recent evidence.
+- Check whether any secrets were written to files, logs, commits, or chat.
+- Check whether any PC/VPS commands, approvals, service changes, Nginx/Docker changes, website changes, or firewall/network changes were executed.
+- Check `sync-state/heartbeat-*.json` and `sync-state/error-*.md` for sync health.
+
+## Correction
+
+- CORRECTION records findings in `handoff/CORRECTION.md` and blocks dependent tasks if needed.
+- ORCHESTRATOR reviews cross-role edits and either adopts or corrects them.
+- `USER_STATUS.md` must show a paused state and a single safe next action.
+- Executor handoffs must explicitly say whether their tasks are blocked or allowed.
+- Task files must not be left in `ready` when role ownership or authorization is uncertain.
+
+## Resume Criteria
+
+Work may resume only when:
+
+- ORCHESTRATOR records the corrected active state.
+- Any affected task status is reconciled.
+- No secret leak or unsafe mutation remains unresolved.
+- Sync health is not blocked.
+- Any execution or authorization work receives fresh explicit user authorization targeted to the correct role and workspace.
+
+## Prevention Checklist
+
+- Each Cursor window starts with a visible role marker.
+- Before sending an execution prompt, the user and agent verify role, workspace, and handoff.
+- Authorization prompts echo the target role and exact allowed action.
+- Verifier roles refuse executor/orchestrator work.
+- Execution agents refuse work outside their assigned task file.

docs/SESSION_FREEZE_PROTOCOL.md

@@ -10,6 +10,7 @@ Freeze before:
 - A role finishes a phase or hands work to another role.
 - The user reports confusion or asks for a status reset.
 - A significant incident occurs, such as sync failure, credential friction, or a blocked safety gate.
+- A role-misdirection incident occurs or a prompt may have been sent to the wrong Cursor window.
 
 ## Required Freeze Outputs
 
@@ -48,3 +49,13 @@ You are resuming the OpenClaw COACH/ORCHESTRATOR workflow.
 Read USER_STATUS.md, AGENT_BOARD.md, relevant handoff files, sync-state/README.md, and knowledge/LESSONS_LEARNED.md.
 Do not start mutation work unless USER_STATUS.md and AGENT_BOARD.md both allow it.
 ```
+
+## Role-Misdirection Freeze
+
+If a prompt was sent to the wrong role or wrong Cursor window:
+
+- Stop execution immediately.
+- Update `USER_STATUS.md` with a paused status and one safe next action.
+- Record the incident in the active role handoff and, if needed, `handoff/CORRECTION.md`.
+- Follow `docs/ROLE_MISDIRECTION_RECOVERY.md`.
+- Do not resume mutation or authorization work until ORCHESTRATOR has adopted or corrected the affected control-plane files.

knowledge/LESSONS_LEARNED.md

@@ -12,3 +12,12 @@ Reusable lessons from this OpenClaw multi-agent Cursor workflow.
 - COACH and ORCHESTRATOR should remain separate roles: ORCHESTRATOR manages tasks; COACH manages usability, method, and knowledge capture.
 - Sync scripts are infrastructure and should not be owned by normal chat agents. They should remain in dedicated terminals for now and later become managed services after safety gates allow persistence.
 - Session freeze is mandatory for long-running work. Handoff files and lessons are more reliable than chat memory.
+
+## 2026-05-19
+
+- Multi-window Cursor work needs visible role confirmation. A prompt intended for ORCHESTRATOR can land in a VPS_VERIFIER window and produce plausible but out-of-scope control-plane edits.
+- Role mismatch should be treated as a safety blocker for execution or authorization. Pause tasks first, then let ORCHESTRATOR adopt or correct affected files.
+- Authorization should name the target role, workspace, task, and exact allowed action. Short prompts like "go ahead" are unsafe when several role windows are open.
+- Verifier roles should refuse ORCHESTRATOR/EXECUTOR work even when the requested edit is reasonable.
+- Recovery should check for five facts before resuming: cross-role file edits, secret leakage, live PC/VPS commands, frozen website mutation, and sync health.
+- Keep `docs/ROLE_MISDIRECTION_RECOVERY.md` and `.cursor/rules/role-confirmation.mdc` as reusable guardrails for future multi-agent sessions.

sync-state/heartbeat-pc.json

@@ -1,9 +1,9 @@
 {
     "host":  "pc",
-    "time":  "2026-05-19T12:30:56+08:00",
+    "time":  "2026-05-19T12:31:59+08:00",
     "branch":  "main",
-    "head":  "31622d5",
-    "status":  "clean",
+    "head":  "d8b2521",
+    "status":  "dirty",
     "intervalSeconds":  30,
     "heartbeatEverySeconds":  60
 }