TRI CLAW from today's stalls: claw_reds for sandboxed agents, auto-reseal stale PRs, boundary-overlap and epic-close guards, local preflight, service health #11382

Owner, 2026-10-20: TRI CLAW is already built -- improve it from the orchestrator's experience of this day. Each item below is a real stall measured today, the existing claw spec it extends (DRY), and the change. Parent: #11340; the golden chain under the App is #11360.

Boundary

• specs/claw/red_origin.t27
• specs/claw/merge_judge.t27
• specs/claw/push_gate.t27
• specs/claw/github_surface.t27
• specs/t27mcp/check_hints.t27

User Scenarios

• Given an agent in a sandbox with no working gh (TLS x509 -26276 hit 3 subagents today), when it calls the TRI CLAW MCP tool claw_reds <pr>, then it gets, per failing check: OURS or INHERITED (red_origin.t27 against master's last runs), the last 40 log lines, and the one-line fix hint (check_hints.t27) -- no personal token, the App reads it.
• Given a waiting PR whose only red is a stale seal (27 of 32 waiting PRs today), when merge_judge sees it, then TRI CLAW re-saves the seal on the merged tree with the pinned t27c and pushes one commit (the golden REGEN rule, tri golden land: re-save stale seals on the carried tree (REGEN) -- 27 of 32 waiting PRs refused only for a stale seal #11361), instead of leaving it red forever.
• Given a new issue, when its Boundary shares a file with an open P0/P1 issue (6 swarm issues all named glass_window.t27 and the Queen ran them one by one), then TRI CLAW comments the overlap and suggests a path :: fn region or a split.
• Given a commit or PR body says Closes #N and #N is an epic (happened twice today), when push_gate runs, then it refuses and proposes the sub-issue.
• Given a branch before its first push, when tri claw preflight runs locally, then it reports what CI would fail: foreign-line budget (40/file, 80/PR), home paths in seals (/Users/), stale seals, duplicate-body growth, absurd widths -- the six reds of T27 OS tools: registries, tri golden (own git), skills (Closes #11358) #11359 today, all knowable before the push.
• Given a service TRI CLAW depends on (the Queen on Railway), when its platform refuses deploys (trial expired today, invisible for hours), then the claw health row turns red on the dashboard.

Requirements

• FR-001: every decision above is a tested fn in the named spec; hosts stay argv glue.
• FR-002: the App mints per-job tokens with the surface's scope only (github_surface.t27); agents never need a personal token.
• FR-003: claw_reds, claw_preflight are MCP tools generated from their specs (t27mcp/tool_schema.t27).

Success Criteria

• claw_reds 11359 from a sandboxed agent lists the six checks with the same OURS/INHERITED verdict a human reached today; a stale-seal-only PR turns green by a claw commit; t27c test green on the touched specs.