[TiantianFlow]

Closes #69.

What changes

• Room replies (1). foil post --re wakes only the seats that wrote a waking post in that thread and the seats its text names as @name. A new post still wakes every other alive seat. A decline, and a hand-written file without contract: room/v1, do not join a thread. No hard cap.
• Rotation (2, 6). The pair list now rotates on a per-role count of spawns in the fleet, stored in the registry's new rotation record with the lists it counts for. A killed or archived seat still counts, every lead respawn takes the next entry, and an edited list (mapping or fleet overrides) starts again at its first entry. Resume does not advance it. The viewer's Rotation line marks the entry the next seat takes.
• Model ids (7). Spawn and roster add/update print one warning line when a model is not in that harness's models, naming the ids it lists, and still launch or write it (there is no --force flag in the fixed command surface).
• Reply to the operator (8). The lead, and only the lead, can foil send user. That mail lands in board/mail/user/ and nudges nothing. Outside the fleet, foil mail list lists that mailbox. The operator skill reads it at each check-in. --name user is refused.
• Privacy and worktree guard (5). Each seat's git runs Foil's hooks, set through GIT_CONFIG_COUNT/KEY/VALUE in the seat's environment only. Nothing is written to the repository, its config, or its hooks (F7). In the project's repository, pre-commit refuses a commit outside the seat's worktree and staged lines that add a home directory path, the hostname, a non-noreply git email, or a token. pre-push scans each pushed commit that is on no remote (at most 200 per ref). Every client hook name passes through to the repository's own hook, found without Foil's variables. Other repositories a seat creates or tests get pass-through only.
• Handoff (3). Skills only: a seat near a full context writes board/handoffs/<name>.md and mails the lead, which kills it and spawns a new seat from the file. The lead writes board/handoffs/lead.md and sends user, and the operator replaces the lead. Foil does not read context use.
• Not done. Usage- or quota-aware rotation and per-harness usage display stay out of scope (requirements section 11, see auto detect plan usage and load balance #31). Item 4 was handled by Global settings (#66) #68.

docs/requirements.md (F3, F14, F21, F23, F30, F33, F38 info texts, new F40, sections 6, 7, 8, 11), the three skills, both READMEs, docs/architecture.md, and CHANGELOG.md are updated.

Verification

• pytest -m "not e2e_live" without tests/test_view_browser.py: 563 passed. The browser tests were not run here because this container's Playwright Chromium build does not match the locked version. CI runs them.
• ruff check . is clean.
• New tests cover reply wakes and mentions, declines and hand-written files, rotation (lead respawn, edited list, killed seats), the model warning, the user mailbox and its authority, and the hooks against real git: refusals, chaining (including from a seat that spawned a seat), another repository, and false positives such as risk-assessment-... and a Signed-off-by trailer.
• Not verified: a live-harness run, and an install from the branch into a fresh tool directory.
• Three independent review rounds covered the code, privacy, and publish safety. The last round found nothing worth fixing. One known low item remains: two spawns of the same role at the same moment can read the same rotation count.

---

Generated by Claude Code