git:20260710.9a8d7b2 to git:20260806.c4a645d

+ description: "Fix-through loop — invoke a new thing, fix bugs until it works."

+ | `--narrow` | Single smoke surface — one install, one command, one happy-path sequence. "Does it work?" | Tight. | Only when the surface explodes. |

+ | `--shakedown` | Comprehensive coverage matrix. Every tool/surface/path exercised once with realistic input. Requires a declared matrix (Gate 4). | Largest. | At budget halfway and on PM check-in pause. |

+ ## Gate 1 — Idempotent Re-Run

+ The target must be safely re-invocable across iterations. When the target mutates state such that a second invocation diverges from the first for non-bug reasons, fix idempotency first — this is empirical judgment about the target, not something an assembler reader can determine from an artifact. The fix is in-cone: idempotency is a property of the thing being dogfooded, not an external concern.

+ ## Gate 2 — Machine-Parseable Progress

+ The target must emit tagged stdout, exit codes, or a status file that the EM can diff iteration-to-iteration. Naked-stdout streams are forbidden — write a capture-and-classify wrapper as the first deliverable when the target doesn't already produce machine-parseable output. Whether the existing output actually parses cleanly is an empirical call the EM makes by trying it, not a static check.

+ ## Gate 3 — Framing Audit (Runs First, Every Invocation)

+ When the dogfood session is opened from a handoff or carries inherited scope language ("smoke verification only," "no scope expansion," "out of scope: refactor"), the EM surfaces the language to PM and forces a decision:

+ Hardcoded fix-through is the default. PM can override only with explicit reasoning. This gate runs as the first action of every `/dogfood` invocation, including autonomous runs. Skipping it is not permitted.

+ ## Gate 4 — Coverage Matrix Declared (`--shakedown` only)

+ **Without a declared matrix, `--shakedown` degrades to `--broad`**, and the EM surfaces the choice to PM before entering the loop. This gate exists because shakedown's value claim ("every surface exercised") is unfalsifiable without a prior declaration of what "every surface" means.

+ **Before entering the loop: if any of Gates 1-4 fails its precondition** (Gate 4 applies to `--shakedown` only), the first deliverable of the session is to satisfy it, then enter the loop below.

+ Invoke target → observe across every channel → classify each observation (Cone Classification, below) → act → write `pass-<N>-modes.json` → re-invoke → check for convergence, switch-gears, or PM stop.

+ Observation does not stop at exit code — read every channel:

+ Every observation must be explicitly classified before acting, logged in the flight recorder. This is the skill's actual purpose — deciding what's in-scope for a fix-through loop is a judgment call every time, not a lookup:

+ **In-cone — fix-now (default).** Mechanical fixes (validator gaps, missing fallbacks, false-success exits, off-by-one, missing flag handling, idempotency gaps, the skill/script/pipeline body itself) are in-scope by definition because the dogfood IS the test. The default question is "is there a real reason this isn't fix-now?" not "do I have permission to fix this?" In-cone fix surface includes production code; hooks, scripts, `bin/` helpers; the skill body / agent prompt / pipeline being dogfooded (yes — this is the whole point when dogfooding a new skill); and doctrine/wiki/CLAUDE.md the target depends on, when the smoke trips it.

+ **Out-of-cone — switch-gears.** The bug requires architectural rework that the plan author should re-do: a fix would reverse a load-bearing structural choice in the thing being dogfooded. Loop ends on PM confirm.

+ **Surface-and-skip.** Reserved for bugs requiring PM-level product decisions, externalities (PRs, signing, network), or genuinely-not-this-loop scope. The rare exception, not the conservative move. Required structured entry: `{ "category": "pm-product | externality | architectural-rework", "evidence": "<link-or-pointer-to-rationale>" }`, landing in `tasks/dogfood-<target>-<date>/surface-and-skip.md` — never `state/bug-backlog/` (that would blur the boundary with `/bug-blitz`, which works backlog, and undermine dogfood's does-not-file-remainder rule). Silent skips are forbidden.

+ **Skip-ratio threshold.** Skip-ratio over 40% of the session, or more than two consecutive skips without an interleaved fix-now, means the session has lost fix-through character — surface "is this dogfood the wrong shape?" to PM.

+ After each pass, write `tasks/dogfood-<target>-<date>/pass-<N>-modes.json` — a JSON list of `{component, error-class}` tuples, one per distinct failure mode observed:

+ { "component": "branch-cut helper", "error-class": "branch-cut-failure" },

+ Classifying a failure into a tuple is judgment; counting tuples and comparing them to the prior pass is not. `backlog-grind-assemble brief dogfood` reads the current `pass-<N>-modes.json`, against the prior pass where one exists, and returns the tuple count and a stuck flag (same tuples, unchanged, across passes) — that computed pair is the mechanical half of the Switch-Gears signal below; whether to act on it stays an EM proposal, PM confirm.

+ Parallel executors that each call `coordinator-safe-commit` produce concurrent-commit absorption and scope sweep — non-negotiable.

+ **`--narrow` (no fanout, single-committer):** the EM commits each fix directly on the daily branch (lessons.md:207; `docs/wiki/scoped-safety-commits.md § Current Doctrine`) via `backlog-grind-assemble apply dogfood`, which emits the `stage_and_commit` directive at `commit-per-item` granularity — one commit per fix, subject naming the fix, smoke evidence (the iteration's stdout/exit/probe transition that proves the fix landed) in the body. Smoke-evidence-in-commit is not optional.

+ **`--broad` and `--shakedown` (fanout-capable, autonomous):** executors and fix agents are edit-and-report only — no commit, no `coordinator-safe-commit` invocation of their own; helper invocation is forbidden in executor scope under these tiers. The EM serializes at wave gates via `apply dogfood` at `commit-per-wave` granularity — one commit per wave, gathered from DONE reports, subject naming the wave, smoke evidence in the body.

+ Fixes that span languages/files for one bug must ship as one unit; splitting parallelizes the executor at the cost of the semantic guarantee that one bug gets one coherent fix.

+ Switch-gears is a judgment call informed by mechanical signals, never automatic.

+ - **Failure-mode shift / stuck-detection (computed).** `backlog-grind-assemble brief dogfood` reports the tuple count for the latest pass and whether it repeats the prior pass unchanged (§ Per-Iteration Mode Artifact). Roughly 3-4 distinct tuples in one pass, or an unchanged tuple across two passes, means the loop has shifted from "verify a fix" to "discover more bugs," or is stuck.

+ - **Same seam, different bugs (judgment).** Three or more distinct failures attributable to the same architectural shape decision means the shape is the bug — this is an EM read of the failure pattern, not a count the engine can produce.

+ - **Skip-ratio threshold breached** (§ Cone Classification).

+ - **Fix would reverse a load-bearing structural choice** in the thing being dogfooded — an architectural-shape judgment, made by the EM against the specific target, every time.

+ EM proposes switch-gears with reasoning; PM confirms. On switch-gears the loop ends — the session output is the replan ask, not a converged thing.

+ Loop ends when ALL THREE hold:

+ - "Zero new bugs surfaced this pass" alone — convergence needs criterion 1 (clean happy-path) AND criterion 2 (clean in-cone iteration), not just one quiet pass. Flakes mask a single quiet pass.

+ | `surface-and-skip.md` | Structured skip entries with category + evidence |

+ Do NOT route surface-and-skip findings to `state/bug-backlog/`. If PM later decides an item belongs in the backlog, that is a deliberate hand-off, not automatic spillover.

+ - Gate 3 (Framing Audit) is hardcoded as the first action — cannot be skipped.

+ - Commit doctrine mirrors the tier-split (§ Commit Doctrine, above).

+ - Power-state cues ("late," "overnight," "tired") authorize urgency only — never hibernate or shutdown, never a destructive or externally-visible action outside what the fix itself requires.

+ | `/bug-blitz` | Works `state/bug-backlog/`. `/dogfood` does NOT file remainder there — if `/dogfood` exits via switch-gears, the output is a replan, not a backlog dump. |

+ | `/learn-lessons` | Surfaced doctrine drift is filed to `state/lessons/` for `/learn-lessons` triage — out-of-loop, by design. |

+ ## Final Summary

+ **Report by exception.** Two lines always; everything else appears only when it is *not* clean. This is still an EM→PM reply and still owes the ≤200-word budget — a fixed block of all-clean status lines spends that budget on facts the PM can read off the commit or the flight-recorder, then gets measured as verbosity. Print what needs a reader, not what needs a checkbox.

+

+ **Target:** <target> (tier: --narrow/--broad/--shakedown)

+ **Verdict:** <converged: thing works | switch-gears: replan ask | stopped: open observation was X>

+ ```

+ Then append a line **only** if its condition holds:

+ | Line | Include only when |

+ |---|---|

+ | `**Bugs fixed this session:**` | F ≥ 1 — count plus a one-line characterization of what shipped |

+ | `**Surface-and-skip:**` | S ≥ 1 — count plus a one-line characterization |

+ **Negative-spec — these are gone, do not restore them.** `Outcome` is dropped — `Verdict` already states converged/switch-gears/stopped, so a separate Outcome line was a redundant restatement of the same fact. `Passes run` is dropped — a raw iteration count with no PM decision attached; the count is already in the flight-recorder's `pass-<N>.log`/`pass-<N>-modes.json` trail. `Tier` is dropped as its own line — folded into the `Target` line instead, since it's the invocation parameter the PM already declared, not new information. Per-fix commit SHAs and per-item surface-and-skip evidence pointers are dropped from both retained lines — the Stop hook's D2 detector fires on ≥2 file:line citations or absolute paths in an EM→PM reply independently of length, on the doctrine that verification detail belongs in the commit message and the artifact, not the reply; per-fix smoke evidence lives in the commit body (§ Commit Doctrine), and per-item category/evidence lives in `surface-and-skip.md`, which the field label already points to. A future reader must not re-add SHA lists or evidence pointers "for completeness" — that completeness belongs to the commit and the flight-recorder, not the PM reply.