Fix bidirectional RF-001A coordination

docs/handoff/RX_AGENT_PROTOCOL.md

@@ -10,7 +10,7 @@ The reverse result channel uses the separate origin/rx-node branch. The RX lapto
 
 docs/handoff/NEXT_RX_TASK.md starts with these plain key-value fields:
 
-    TASK_ID = RF001A_OTA_CAPTURE_002
+    TASK_ID = RF001A_OTA_CAPTURE_003
     TASK_TITLE = Start coordinated RF-001A common-clock OTA capture
     SOURCE_BRANCH = video-development
     EXPECTED_HEAD = <full 40-character base commit hash>
@@ -69,7 +69,7 @@ After the task actually finishes, mark the local ID complete:
 
 The coordinated RF-001A result is a strict JSON object. Unknown or missing keys are rejected. READY requires:
 
-- task_id = RF001A_OTA_CAPTURE_002;
+- task_id = RF001A_OTA_CAPTURE_003;
 - state = RX_READY_FOR_TX;
 - rx_ready_for_tx, process_alive, file_growing and common_clock_verified all true;
 - a positive capture_pid;
@@ -105,12 +105,12 @@ The publisher checks:
 6. origin/rx-node already exists;
 7. the JSON schema is valid.
 
-It clones only the existing result branch into a temporary directory, writes exactly:
+It checks the branch with git fetch and git ls-remote through the real origin configured in the main checkout. It creates a temporary worktree from that repository and writes exactly:
 
     docs/handoff/results/RX_RESULT.json
     docs/handoff/results/RX_RESULT.md
 
-It checks the staged path set, commits, and pushes HEAD to origin/rx-node. It never switches the source checkout. It rejects any additional staged path and enforces a 64 KiB limit per result file.
+It checks the staged path set, commits, pushes HEAD:rx-node, and confirms that git ls-remote returns the new commit. It then removes the temporary worktree. It never switches the source checkout. It rejects any additional staged path and enforces a 64 KiB limit per result file.
 
 Raw IQ, video, waveform files, large logs, secrets and machine-local state remain outside Git. A missing result branch or failed push is reported and never authorizes TX.
 
@@ -118,9 +118,9 @@ Raw IQ, video, waveform files, large logs, secrets and machine-local state remai
 
 tools/tx_agent_watcher.py polls origin/rx-node every 5 seconds by default. It does not call an LLM or open SDR hardware.
 
-For a new valid READY result it checks task ID, state, live-process flags, common clock, publication age, planned duration and remaining capture time. It then requests the exact phrase AUTHORIZE RF TX.
+For RF_HANDOFF_CHANNEL_TEST_001 the watcher records synthetic READY and COMPLETE states without requesting RED approval. For a new valid production READY result it checks task ID, source HEAD, current result branch commit, state, live-process flags, common clock, publication age, planned duration and remaining capture time. It then requests the exact phrase AUTHORIZE RF TX.
 
-After the phrase, it fetches rx-node again and repeats the checks. A changed result, stale publication or fewer than 10 seconds remaining blocks authorization.
+After the phrase, it fetches rx-node again and repeats every check. A changed result or commit, stale publication or fewer than 10 seconds remaining blocks authorization.
 
 A successful gate writes one local authorization record under .local/tx_authorizations/. The record has rf_tx_started = false and rf_tx = 0. The separately controlled TX executor must re-fetch and compare the result commit and digest immediately before opening hardware.
 
@@ -135,6 +135,8 @@ Duplicate result digests are not shown repeatedly.
 - Neither watcher starts RF TX.
 - The TX executor remains a separate RED-controlled action.
 
-## Dry-run contract
+## Model-free channel and dry-run contracts
 
-The fake coordination tests use a temporary local bare Git repository and branch named rx-node. They publish a fake READY result, detect it, require the exact RED phrase and invoke a fake TX action that writes RF TX = 0. They do not fetch the real remote, access SDR hardware, run hackrf_transfer, create the production rx-node branch or transmit RF.
+The preflight channel command publishes synthetic READY and COMPLETE results with TASK_ID RF_HANDOFF_CHANNEL_TEST_001 through the real origin. The MAIN watcher must observe both without a RED prompt, and COMPLETE must be the final remote state. It does not access SDR hardware or run hackrf_transfer.
+
+Automated coordination tests use a temporary local bare Git repository and branch named rx-node. They cover worktree publication, READY, COMPLETE, push failure and watcher reception without accessing the real remote or SDR hardware and without transmitting RF.