git:20260902.20ec0a9 to git:20260906.f48bfce

+ The methodology below is unchanged by how it runs. Its execution is the workflow `plan-convergence-run-v2`, which holds the round loop inside its own script. `/plan-convergence` states the methodology. `/plan-convergence-run-v2` executes it.

+ The claim inventory and the round records live in the plan's state directory, `~/.claude/plans/<project>/<plan-name>/`, where `<project>` names the project and `<plan-name>` is the plan's filename with `.md` removed. Neither lives in a scratchpad.

+ The inventory is a field of each round's record, `records/round-<n>.json`: one row per checkable claim, each row carrying its number, its class, its claim, its site and its verified state. The record also carries the next round's inventory, the rows the next round audits.

+ The lead writes the round-0 seed, `records/round-0.json`, before a plan's first launch, creating `records/`. The seed carries the round-1 inventory, an empty target set and the launch marks. That seed is the lead's only inventory write. Every later round's inventory is written by the record builder, through the inventory module: it computes each row's verified state from the rows the seats returned verified, the rows the synthesizer returned and the class verdicts the synthesizer rendered, and it writes the next round's inventory into the record. The rows a round adds, changes or re-opens fall to the synthesizer, which returns them: an added or changed row for each claim its entries change, a recorded edit's entries among them, and a re-opened row for each row of this round's inventory whose claim it keeps and whose site falls within a marked entry's site.

+ Auditors check rows off. Every round's record reports coverage as verified rows over total rows.

+ 2. **Counts auditor.** Enumerate every numeric claim and ordinal. The candidates file seeds the enumeration: every numeral, number word and ordinal it lists is a numeric claim or a derived count to judge. Recompute each one. Flag every derived number for removal (drafting rule 2).

+ 3. **Code-citation auditor.** Re-verify every code citation whose surrounding text changed since its last verification. Use the previous round record's inventory to skip rows that are verified and unchanged.

+ 4. **Cross-consistency auditor.** Check every pair of sites that state related facts: design section against roster, plan against standing board calls. Flag restatements for conversion to references. The candidates file seeds the cross-plan sweep: every backticked path and every `~/.claude/plans/` name it lists is a cross-plan mention to judge. A passage discussing another plan's content is a defect on sight: plans are self-contained, and the fix is removal, not reconciliation.

+ 8. **Freshness pass.** Re-check the State section's volatile facts against the world. It reads the State section; the facts check file, which carries the existence and one-level listing of every `~/`- or `/`-rooted backticked path in that section, so it does not re-test those; the world, for every other State-section fact the launch marks do not cover; the previous round record, for its inventory rows and the launch marks; and the recorded-edits file, for the launch marks where it carries them, which stand in place of the previous record's. The launch marks are what it verifies the facts only the launching session can open against, never the world. It returns its findings, the rows it verified and its class verdict, and writes nothing. This seat carries its own row class, and dispatches alone, after the deterministic checks and ahead of the verify-new seat, the builder seat and the class-audit seats.

+ 9. **Builder seat.** Derive, from the plan alone, skeletons of the artifacts the plan commits a builder to author, and write them into the state directory as that round's derivation, `builder-derivation-round-<n>.md`, in place of any file of that name. Read the baseline file, `records/checks/round-<n>-baseline.json`, for the earlier derivation to compare against: baseline selection, the module `baseline.js`, names there the newest earlier derivation whose round record exists and names no failed builder seat, or none; the seat selects no baseline of its own. Where the file names a derivation, read it and report every difference from it that no plan change since it explains. It also reads the plan and the previous round record, for its inventory rows. It returns the derivation path, its findings each carrying its kind (block, guess or unexplained difference), the rows it verified and its class verdict. This seat carries its own row class, and dispatches in the opening barrier on its own row, because it writes its derivation.

+ Every class-audit seat reads the plan; the candidates file, `records/checks/round-<n>-candidates.json`; the previous round record, for its inventory rows, and the two round records before it where they exist, for the defects they record, so that no settled disposition is re-opened; the world, for the tree the ownership auditor and the executor walk and the files the code-citation auditor's citations name; and the standing board backup, for the board calls the counts auditor and the cross-consistency auditor check. Each returns its findings by site and one-line claim, the rows it verified by row number, its class verdict, and the enumeration the verdict rests on. None writes.

+ Every seat's brief of the opening barrier carries a defect-shape checklist mined from the plan's own round records. The lead is the actor that mines the shapes: read the round records for the shapes their marked entries keep taking, and name those shapes in the checklist, so each seat hunts by shape rather than by instance. The checklist lives in the v2 workflow's brief sources, the markdown files under `~/.claude/src/plan-methodology/plan-convergence-run-v2/`, in `brief-defect-shape-checklist.md`. After the cut-over, the lead refreshes it there, when the record shifts the mix and against the per-shape catch rate a seeded-defect calibration records on the board, then runs the `build` script of `~/.claude/package.json` (`pnpm --dir ~/.claude build`), which carries the refresh into `~/.claude/workflows/plan-convergence-run-v2.js`. The built workflow file is never edited by hand.

+ Verify-new coverage stays outside these row classes. The verify-new seat covers the round's target sites rather than inventory rows. It reads the plan and the previous round record, for the target set and for the marked entries with their claims, blocks and outcomes, against which it verifies the sites that record's application left; an entry whose blocks and outcome the record leaves absent, a converted record's among them, is verified against its claim alone. It returns its findings and one verdict per site, each under the site string the target set carries, and writes nothing.

+

+ `plan-convergence-run-v2` executes the round. Its stages, in run order:

+ 1. **The deterministic checks.** Four modules, each through a runner seat, as one parallel group: the facts check reads the plan's State section and the world and writes `records/checks/round-<n>-facts.json`; the pointer check reads the plan and writes `records/checks/round-<n>-pointers.json`, one entry per `§n`, `§n.m` or `Dn` pointer with whether it resolves; candidate generation reads the plan and writes `records/checks/round-<n>-candidates.json`; baseline selection reads the state directory's derivation files and round records and writes `records/checks/round-<n>-baseline.json`. Each runner returns the file's path.

+ 2. **The freshness pass.** One seat, alone, after the checks, on the reads and returns the Seats section states for it.

+ 3. **The opening barrier.** The verify-new seat, the builder seat and the seven class-audit seats, dispatched together after the freshness pass, each auditing the whole plan, on the reads and returns the Seats section states. The verify-new seat covers every site in the round's target set, the previous round record's next target set.

+ 4. **The synthesizer.** It reads the plan; every round record in `records/`, the complete history; the pointer check file, every unresolved pointer there being a finding; the recorded-edits file, where the lead wrote one; and the standing board backup and the repo CLAUDE.md. The seat returns of the freshness pass and the barrier reach it in its brief. It re-verifies the findings independently, consolidates them, tags nitpicks (wording taste, phrasing, or cosmetic rewrap alone, with no falsified claim, no contradiction, and no ownership or commitment change), and marks each surviving finding for application with byte-exact CURRENT and REPLACEMENT blocks, each entry carrying its id, site, one-line claim, tag, the blocking mark with its reason (Classification below) and the recorded-text mark. It carries the recorded-edits file's entries into its marked list exactly as recorded, merging an entry of its own that falls inside a recorded entry's CURRENT block into that entry, and drops every finding a recorded ruling settles. It closes every marked finding under its consequences: enumerate the sites that produce, consume, or reference the text the replacement changes, mark an induced edit for each such site the change breaks, and record for the rest that the change induces nothing at them. Its coverage report carries each seat's per-row returns and class-closure verdicts, the enumeration each class-audit seat's verdict rests on, the freshness pass's rows verified and the builder seat's derivation standing for their classes' enumerations, the builder seat's derivation path and its derivation findings by site and one-line claim, and the verify-new seat's per-site verdicts. It returns the synthesis file's path, the marked entries, the design calls (each with site, the one-line statement of what is undecided, options, lean and the reserved flag), the watch list, the coverage report with the verdict it renders per class, the inventory rows it added, changed or re-opened, and the rows held by a design change. It writes the synthesis file, `round-<n>-synthesis.md`, and the entries file, `records/round-<n>-entries.json`, both in place of any file of that name.

+ 5. **The design-call adjudication.** Spawned only when the synthesizer's return carries a design call. The adjudicator rebuilds the lead's context from the durable record: it reads the plan, every round record in `records/`, the standing board backup, the repo CLAUDE.md, the round's synthesis, the round's entries file and the recorded-edits file, for the lead's rulings. It applies each call's lean unless that record contradicts it, a recorded ruling outranking a lean every time. It returns one ruling per call, `ruled`, `unadjudicated` or `reserved`, and no block: a `ruled` call's blocks reach the plan through its write of the entries file, which it composes as the round's entries after adjudication (every entry at a site a ruling settles with no edit removed, every entry whose CURRENT block lies inside one of its blocks' CURRENT blocks replaced by that block, its blocks added with the adjudicator's id prefix and the recorded-text mark set, every other entry unchanged). A call in the human's reserved set, and any call the adjudicator leaves unadjudicated, skips the replacement review, the anchor check and the application; the record builder, the verdict engine and the narrator still run, and the run ends on the verdict `reserved decision` or `design call` for the lead.

+ 6. **The replacement review.** One seat per pass, spawned only when a marked entry carries no recorded-text mark. It reads the plan and the entries file, and reads each unmarked entry's REPLACEMENT as it will read in place, against the whole plan, for the defects a fix introduces: a contradiction with a sibling passage, an incomplete enumeration, a stale or dangling pointer, a second home for a fact, a broken producer-consumer pair, a wrong claim. It recomposes what it rejects, keeping the CURRENT block unchanged, and the cycle reviews the recomposed text again; where a pass's rejected ids repeat the rejected ids of an earlier pass of the cycle, it withholds them instead. It returns the ids by review outcome (accepted, recomposed or withheld), a recomposed id carrying its objection, and writes the entries file with each entry's outcome and, where recomposed, the recomposed REPLACEMENT. The cycle ends on a pass that recomposes nothing. A withheld entry is neither tested nor applied and stands as a defect for the next round.

+ 7. **The anchor check.** A module through a runner. It reads the plan and the entries file, counts each accepted or recorded entry's CURRENT block's occurrences in the plan and tests it for disjointness from every other such entry's, and writes `records/checks/round-<n>-anchors.json`, one entry per id with pass or fail; its runner returns the file's path. It takes the place v1's pre-verify held.

+ 8. **The applier.** Spawned on every round that reaches it. It reads the plan, the entries file and the anchor check file, and applies the entries the anchor check passed, one `Edit` call per entry, CURRENT to REPLACEMENT byte for byte. It returns nothing but its seat and round: a hook records every `Edit` call to the edit-provenance log, and that log, not the applier's report, is the round's applied and failed record. An anchor that does not match is a reported failure, never improvised around. No post-verify runs; the record builder settles each entry's outcome from the log.

+ 9. **The record builder.** A module through a runner. It reads the run's `journal.jsonl` and, for a seat that returned null, the first line of that seat's transcript; the three hook logs; the meter log; the round's anchor check file and entries file; the previous round record; and the recorded-edits file, for the launch marks. It writes the round record, `records/round-<n>.json`, and returns its path.

+ 10. **The verdict engine.** A module through a runner. It reads the round record and the previous three round records where they exist, writes the verdict file, `records/round-<n>-verdict.json`, and returns its path and the kind it carries.

+ 11. **The status narrator.** It reads the round record, the verdict file and `STATUS.md`, and writes `STATUS.md`, one section per round record, newest first, in plain sentences. It writes no ledger, no target set and no inventory: those live in the record.

+ - No real finding of that class survives that seat's own audit. A nitpick (wording taste, phrasing, or cosmetic rewrap alone, with no falsified claim, no contradiction, and no ownership or commitment change) leaves the class closed, and a completion, a real defect with no blocking mark, leaves it closed the same way.

+ The synthesizer renders the verdict the record carries per class: it re-renders a seat's open verdict as closed where every finding holding it open is one it routed to the watch list or one it marked for application as a completion, and leaves it open where a finding holding it open carries the blocking mark, is neither marked nor routed, or rests on an incomplete enumeration.

+ **The review bar.** Convergence rounds evaluate the core loop of the plan under convergence: what its machinery does when it runs, and what a builder must author for the artifacts it commits. A finding whose only subject is detail outside that loop goes on the watch list the plan's own live test owns, recorded in the round record's watch list by site and one-line claim, held out of the marked-for-application list and out of the round's counts. A design call whose only subject is such detail is recorded on that list the same way, its one-line statement of what the round left undecided standing in place of a claim, and it reaches no adjudicator and no exit. A finding that changes what the core loop does, or what a builder must author for the plan's committed artifacts, or that falsifies a claim, stays a real defect wherever it sits. An unsure classification resolves to real defect. Every class-closure verdict is evaluated against the findings this bar leaves on the marked path, and a class held open only by watch-list items closes with that note.

+

+ ## Classification

+

+ A plan's design is its decision register, the stage table's roles, the ownership rows, the waves and the transition table: which pieces exist, what a piece is for, what it hands to another piece, who builds it, in what order, and how the run decides. Everything else is a completion: contract detail, a world fact, a pointer, wording.

+

+ The synthesizer answers one question to set the blocking mark on an entry: is this entry a real defect that changes the plan's design? Where it is, the mark is set. Where the entry is a completion, the mark is unset. Beside the mark the synthesizer writes the mark's reason, its one line naming what the entry changes. Every writer of an entry sets the mark on its own entries and on no other's; the adjudicator on its blocks, the lead on its recorded entries.

+

+ The done rule, as the verdict engine's converged test reads it: the design stopped changing, shown by two records in a row carrying no marked entry with the blocking mark, the closing round's record and the record before it. A completion is applied as found and holds the run open no further; its rows are verified by the application, the synthesizer having checked the text the entry replaces and the reviewer the text it lands. A row is held unverified only by a design-tagged entry at its site, an entry carrying the blocking mark, whatever a seat returned for the row; the record builder sends such a row to the next round's audit. This is Chance's ruling of 2026-09-05 on the board.

+

+ A plateau verdict ends no run. The verdict engine records it, the verdict file naming the three rounds compared, and the run opens the next round as it does on a `round continues` verdict, or ends after the narrator when the round is `endRound`. The response is one structural fix, drafted between runs.

+ The compared rounds' recorded defects, read from their round records, select the fix's form. When those defects name a shared home, the fix is a structural fix of that home. When they name no shared home, the fix is a sequential walk of every section those defects name, against one fixed checklist, rewriting each shape that generated them.

+ Drafting the fix is the lead's option between runs: the lead launches the workflow `plan-stall-sweep-run-v2`, which lands beside `plan-convergence-run-v2`, on the rounds the verdict file names, and records the blocks its return carries in the recorded-edits file of the round it relaunches at, `records/round-<n>-recorded.json`, on that file's lead-edit terms below. That round's machinery applies the blocks and re-audits them. This section states the response. `/plan-stall-sweep-run-v2` drafts the fix.

+ ## Round records

+ The round records are the files under `records/` in the state directory, one per round, `records/round-<n>.json`. The record builder writes one at every round, a halted round's among them. Beside each sits the verdict file, `records/round-<n>-verdict.json`, and the round's check files under `records/checks/`. The lead's own writes sit there too: the round-0 seed before the first round, and the recorded-edits file, `records/round-<n>-recorded.json`, for a round that needs one. The launch marks travel with the records: the round-0 seed carries them before a plan's first round, and at every later launch the lead re-reads the facts they cover and records the marks in the launch round's recorded-edits file, which stand in place of the previous record's. A v1 plan's `ledger.md`, `ledger-archive.md` and `ledger-archive-index.md` stay as history; no v2 stage reads or writes them, and the converted round records carry what a v2 stage needs from them.

+ The record builder, through the record, is every round's writer of the next round's target set, a halted round's among them: for a round halted before the applier ran, this round's own target set unchanged; otherwise every marked entry's site, whatever its outcome, and every site of this round's target set the verify-new seat's verdicts left uncovered. No previous round's actor opens a section, and no lead list feeds the verify-new seat.

+

+ - The round number, the launch marks, and the last stage reached.

+ - Each seat the round spawned before the record builder, with its journal key, agent id and outcome; the failed seats and failed modules among them; and each seat's findings by site and claim, rows verified, class verdict, and, for a class-audit seat, its enumeration; the verify-new seat's per-site verdicts; the builder seat's derivation path and its findings by kind.

+ - The marked entries as the entries file carries them, the adjudicator's blocks among them: id, site, one-line claim, tag (real defect, nitpick taken or induced edit), the blocking mark and its reason, the CURRENT and REPLACEMENT blocks, the recorded-text mark, the review outcome, and the outcome the record builder computes from the edit-provenance log: applied, failed, or unattempted, a withheld entry among the unattempted.

+ - The design calls, each with its statement, options, lean and reserved flag, and the ruling the adjudicator returned: `ruled`, `unadjudicated` or `reserved`.

+ - The watch list, by site and one-line claim, held out of the round's counts.

+ - The coverage report, with each class's verdict as the synthesizer renders it, closed or open.

+ - Each seat's usage and span from the usage log, its read lines from the read log, and its meter readings at its span's start and end; and the round's closing meter reading.

+ - The claim inventory with each row's verified state and the count of verified rows over total rows; the next round's target set and inventory; and the highest row number any record of the plan has assigned.

+ A halted round's record carries no field of a stage the round never reached. The round's verdict and the exit kind live in the verdict file beside it: the kind the verdict engine returns, every other kind the record also satisfies, and, for a plateau, the rounds compared.

+ **Lead-recorded edits.** Between runs, the lead writes a recorded-edits file for a round on these occasions: a correction, a purely additive edit, a ruling it settles or records as the human's decision for a reserved call, the blocks the stall sweep drafts after a plateau verdict, or the launch marks of a launch after the plan's first round. The file has three parts, each present only where the lead wrote it: entries, in the entries file's shape, each carrying an id with the lead's prefix, its site, a one-line claim, its tag, the blocking mark with its reason, byte-exact CURRENT and REPLACEMENT blocks, and the recorded-text mark set; rulings, one per design call the lead settles or records the human's decision for, each naming the call's site and either the ids of the entries it takes or that it takes no edit; and the launch marks. The relaunched round's synthesizer carries every recorded entry into its marked list and the entries file exactly as recorded, merges an entry of its own that falls inside a recorded entry's CURRENT block into that entry, and drops every finding a recorded ruling settles; the adjudicator reads the rulings as rulings that outrank a lean. Recorded text skips the replacement review. A recorded entry's site reaches the next round's target set through the record, so the lead puts no site in any list.

+ The synthesizer and the adjudicator read every round record in `records/`, the complete history; the audit seats read the previous round record and, for the defects they record, the two before it.

+

+ The verdict engine approves, returning `converged`, when every condition holds on the closing round's record and the record before it:

+ 1. Every claim is verified: every row of the closing record's claim inventory carries the verified state, and its next-round inventory holds no row outside that inventory.

+ 2. Every class audit is closed on the closing record's coverage report, as the synthesizer renders it.

+ 3. The builder seat's class is rendered closed on the closing record's coverage report and on the previous record's too, the previous record carrying the builder seat's return. The counting is the lead's ruling of 2026-09-04 on the board: a guess whose disposition is an item of the record's watch list counts as no guess, and the derivation is clean where every guess it returns is so disposed or fixed; a block, or a difference from the baseline derivation no plan change explains, holds the class open.

+ 4. The previous record's marked entries every one without the blocking mark, and the closing round nitpick-only: every marked entry tagged nitpick taken, induced edit, or real defect with no blocking mark, and no blocker below.

+ The nitpick-only condition counts as a nitpick a real defect that carries no blocking mark, a completion on the Classification section's question. Apply such a defect as found. It holds the run open no further.

+ A round is never nitpick-only while its record carries a marked entry tagged real defect with the blocking mark, a failed entry, an unattempted entry (a withheld entry among them), a failed seat or a failed module (a failed key the record leaves unattributed among them), a design call the adjudicator ruled in flight, or a site of the round's target set the verify-new seat's verdicts leave uncovered.