docs(protocol): operating protocol + Charles preferences

Language policy tiers (Go/PHP/C/Java only for our code; Rust tools OK;
python avoid-but-OK in supply chain; node last-resort with consult),
dev-in-docker rule, availability-tracking prohibition.

PREFS-reachableceo.md

@@ -0,0 +1,18 @@
+- Call him reachableceo or Charles. NEVER "the founder" (his words: creepy).
+# Founder preferences (durable)
+- Terse replies (<=5 lines unless detail requested); cite file paths, never restate task/report text.
+- Careful/safe ops on ALL work (founder, 2026-08-28): scripts that mutate
+  anything get preflight checks before mutation, a stated plan, and verify
+  steps after. Idempotent where possible. Confirm gate when interactive.
+- reachableceo has passwordless sudo for ROOT target only; run-as-other-user
+  must route via `sudo runuser -u <user> -- ...` (sudo -u prompts password).
+- Vertical homes are 700; cross-user path tests must run via sudo.
+- Host is Debian 13 (verified 2026-08-28). Never assume distro/paths/commands - verify.
+- Founder wants reachableceo PMO/work stack next (for sudo + Bitwarden work), after crossfeed body of work.
+
+## Availability (2026-08-28 evening)
+- Charles says when he steps away; do NOT track/schedule around his time.
+  No availability windows, no "before you leave" framing, no time-based asks.
+
+## Docs standard (2026-08-28)
+All project docs must be informative, well-formatted, beautiful, and useful. README standard: front matter + Status line, verified quickstart, mermaid architecture, reference tables (CLI/config/routing), honest status table, no dead links. Doc rot found = fix or file follow-up, never leave stale.

PROTOCOL.md

@@ -0,0 +1,71 @@
+# reachableceo .coordinate — PMO/Work scratch channel
+
+Local scratch under $HOME: not git-tracked, not durable. Durable artifacts
+(tickets/code/docs/decisions) go to the systems of record the founder
+attaches to this stack; until then they stay in ~/.coordinate.
+
+Layout:
+- inbox-work/  PMO writes TASK-<yyyymmdd>-<HHMM>-<slug>.md (CANCEL- to drop).
+- inbox-pmo/   Work writes REPORT-*.md, QUESTION-*.md, BLOCKED-*.md.
+- archive/     handled items; prune >30 days.
+- BOARD.md     roster + standing state.  log.md  append-only journal
+               (date -Is | WHO | what).  prompts/  intros.  logs/ worker output.
+
+TASK fields: Objective / Context / Constraints / Deliverables / Priority.
+
+Turn-start checklist (both agents, every turn): read BOARD.md, scan your
+inbox AND /home/_crossfeed/inbox/rceo/, tail log.md, read peer
+/home/_crossfeed/{bod,cco,coo,cto}/STATUS.md (ambient awareness only; asks
+with teeth go via founder or systems of record, never STATUS files). End
+of active turn: publish STATUS.md to /home/_crossfeed/founder/ (Focus /
+Last / Blockers / Needs).
+
+Rules:
+- PMO plans, prioritizes, writes TASKs, reports to the founder on drop-in.
+- FOUNDER GATE: PMO never dispatches without explicit founder approval of
+  that TASK. Draft -> present -> founder says go -> dispatch. Every time.
+- Work executes in priority order; one turn = do work, file REPORT, archive
+  the TASK. Never self-assign scope (QUESTION instead).
+- Empty inbox when pinged: say so, stop. No watchers/polling loops.
+- No sudo for agents; root needs go BLOCKED -> PMO -> founder.
+- Never kill or attach to the other agent's screen.
+
+Comms with Charles (standing): spoonfeed ONE item per turn; end every reply
+with the rolling HUD (terse table, mirror of ~/.coordinate/HUD.md, kept
+current every active turn; `hud` alias). Long-form goes to ~/.coordinate/
+files; chat gets pointers + short extracts. Never call him "founder" —
+reachableceo or Charles. Root-run scripts staged as scripts/root-*.sh.
+
+Wrapper (auto-relaunch): screens run ~/.coordinate/scripts/pmo-loop.sh
+[pmo|work]; quitting crush relaunches it (60s backoff on short runs).
+Controls: touch ~/.coordinate/RELAUNCH-FRESH[-WORK] before quitting for a
+clean next session (no intro injected — founder feeds INTRO manually);
+pin via ~/.coordinate/[WORK-]SESSION-ID (pins take precedence); default
+--continue. Screen names canonical: RCEO-PMO / RCEO-Work.
+
+Dispatch (headless; never screen-stuff task text; ping success-gated):
+  screen -dmS work-turn bash -c 'crush run --quiet --session <WORK_TURN_SID> \
+    "$(cat ~/.coordinate/inbox-work/TASK-*.md)" > ~/.coordinate/logs/work-turn.log 2>&1 \
+    && screen -S RCEO-PMO -X stuff "Work turn done OK - read inbox-pmo.\r" \
+    || screen -S RCEO-PMO -X stuff "Work turn FAILED - read log.\r"'
+First dispatch (or after a kill orphans the lineage): omit --session, then
+capture id via `crush session list --json` into BOARD.md.
+
+screen -X stuff is DOORBELL-ONLY (short fixed lines to an idle screen): a
+stuffed line can answer an open dialog; a dead pty eats it silently.
+Founder contract: founder observes Work read-only; founder writes in PMO;
+Work turns come only from PMO dispatch.
+
+## Dev environment rule (2026-08-28 evening, Charles)
+- ALL DEV IN DOCKER: no dev toolchains on the host. Builds/tests/hacking run
+  in digest-pinned builder containers with repos bind-mounted. docker pull
+  pre-authorized without asking.
+
+## Language policy (Charles, 2026-08-29)
+TOOLING WE WRITE: Go, PHP, C, Java ONLY (no python/node/rust in our code).
+SUPPLY CHAIN: third-party prebuilt binaries are fine as tools (incl. Rust
+like typst, Haskell like pandoc) — digest-pinned docker images, never
+vendored source we maintain. TIERING (Charles, 2026-08-29): Rust tools OK;
+python AVOID but acceptable in supply chain; NODE = LAST RESORT ONLY and
+CONSULT CHARLES BEFORE adopting any node-based tool. WORKERS: any TASK
+proposing a node dependency stops and asks via REPORT instead.