git:20261007.5542fc3 to git:20261010.19eae11

+ Run a PM-approved plan end-to-end without stopping for permission between tasks. Invoking `/execute-plan` on a plan IS the PM's authorizing act; frontmatter

+ `execution_authorized_at` records that act; it is no precondition. **It also

+ chunk or offer to halt a fired run at that chunk's wave. A chunk gate the invocation does

+ NOT satisfy names another act — a cross-repo commit (per-session assent, obtained at

+ that dispatch) or an external-facing action. No chain into branch disposition (the PM-gated `/merging-to-main`). Rationale: wiki.

+ per-chunk dispatches — parallel where gates allow, serial where not, default vehicle a background Workflow. A serial chain is N fresh

+ row has written, at every size. The EM never hand-dispatches a reviewer afterward. Tripwire: `CODE-REVIEW-IS-A-STAGE-OF-THE-EXECUTE-WORKFLOW`. **A chunk that

+ tests (scoped paths), never trusts an executor's pass claim**; "PASS (by inspection)" is not verification. A

+ gate env, not a bare `python3`. **A chunk that ships a new helper/hook/injector is not done on

+ green tests alone**; a mechanism with no caller never counts as shipped. That check gates

+ Phase 3's mark-complete and is re-checked in Phase 4 before the stamp (`coordinator/docs/wiki/reviewer-pipeline/review-integration-doctrine.md`

+ Phase boundaries are not stop boundaries: ship Phase N green, dispatch N+1.

+ **Dispatch authorization — invoking this skill IS the request.** The dispatches named below are constitutive steps of this skill, not a separate thing to get cleared: invoking a skill requests the actions that skill performs. A harness line permitting dispatch "unless the user requested it" is therefore **satisfied here, not overridden** — no precedence claim is needed and none is made. Re-asking spends the very context the dispatch exists to protect. The rule attaches to skill entry and dissolves no PM-authored gate: keyword-gated skills gate entry, and every gate a skill names for itself still binds — per-session cross-repo-commit assent, ask-before-external-action, and any other this skill's own body names. Tripwire: `UNATTRIBUTED-HARNESS-LINE-IS-NOT-PM`.

+ Firing the Phase 1.5/1.6 background Workflow is one of those dispatches.

+ `gates.execution_stamp_match`, the check this step needs (no `stamp-check` verb exists). Minting first erases the staleness signal. FRESH, STALE-bookkeeping, or a business-fail of

+ "carries no `execution_authorized_sha`" (nothing to compare yet) → proceed **without re-stamping**. STALE-substantive surfaces the delta and STOPS. A body changed since

+ review (`coordinator:review`) — never re-mint over it; once re-reviewed,

+ prefix the call with `MSYS_NO_PATHCONV=1` (or use PowerShell): MSYS rewrites `/execute-plan`. Under `/autonomous`, skip the brief and mint as a delegated run (2a) before the claim, never `--typed-command` (a keystroke the PM never made). A body changed before any mint recovers, after plan review, via `restamp --authorized-by-delegation <d> --delegation-source <ref>`.

+ **`mise_prepped_*` is a different axis; neither substitutes for the quartet.** This step writes only the quartet. Tripwire: `A-HANDOFF-AN-EM-RETYPES-IS-NOT-A-SEAM`.

+ unchanged: the `--utterance` ask, using the PM's execution words.

+ **Chained.** Only an opt-in `emit-wave-fire --chain` fire (headless, warns) hands a pm/ceo

+ plan to the chain driver, which executes and commits it with the same stamp; the EM invokes

+ /execute-plan there only to resume a halted chain. Every other run is in-session. Contract:

+ `coordinator/docs/wiki/em-operating-model/sizing-to-commit-chain-contract.md`.

+ 3. **Remaining-context gate** (skip under `/autonomous`): read this session's remaining-context

+ reading (the statusline's context-window percentage; the engine cannot see it) before committing to same-session

+ execution. A fresh (picked-up) session is the default; LOW remaining context is the narrow carve-out. Detail: wiki.

+ 4. Resolve EM-resolvable concerns at EM altitude. A

+ in-prose deferral of an EM-resolvable decision; open questions gating whether

+ downstream chunks can be authored; an unbuilt external prerequisite with no landed commit/date;

+ a chunk with an irreversible external side effect (send, publish, mail, third-party call) naming no skip-if-already-delivered marker. Tripwire:

+ unpopulated wave-map. A row's `external_gate` entries declare the external prerequisite: `blocks: execution` uncleared bounces;

+ `blocks: ac-closure` does not — proceed, telling the PM at dispatch the terminal state is `approved`, not `implemented`.

+ Catalog: wiki.

+ baton needs every blocker **coded**, not just planned. Read it, never derive it:

+ `verdict.open` plus the blockers holding it shut. Shut → stop; a written, waiting plan is the correct state. Tripwire: `A-PLANNING-GATE-IS-NOT-AN-EXECUTION-GATE`.

+ Claim the plan (`session-claim-cli claim-plan <slug> --for-execution`) before any gate-graph work;

+ a live peer holding it means reconcile with them first, never race. A live holder that has

+ formally handed off (relinquishment evidence, not liveness) → `take_over_claim`,

+ fail-loud without evidence; never retry `claim-plan` bare. **`--for-execution` is

+ mandatory**: it flips the plan to `status: executing`, and this step is its only caller fleet-wide. (`coordinator-tripwires/plan-status-ladder.md`.)

+ After the claim, run `plan-completeness generate "$ARGUMENTS"` (the BASELINE SNAPSHOT, diffed in Phase 4).

+ **Plan prose does not pick the vehicle.** A sentence forbidding fan-out or prescribing

+ EM-sequenced chunk-at-a-time execution is overridden: the vehicle follows from the classification

+ below (default a background Workflow); note the override in one line, do not ask. Only a prohibition

+ **Read each chunk pair's `gate_kind` off the `dispatch.emit` wave map — never classify by hand.** Running a pair together:

+ - **Output/contract consumption** → concurrent if A's interface is pinned up front

+ (verify at merge); else predecessor-wave.

+ - **Epistemic/premise** (A decides whether B's chunks should exist) → A ships alone first; B isn't drafted until A's verdict lands.

+ An uncleared `external_gate` `blocks: execution` row is unschedulable in any wave; its owner

+ session must be live and its `memo:` sent (`A-EXTERNAL-OWNER-IS-LIVE-AND-ITS-MEMO-IS-SENT`).

+ confirm a `## Tasks` row names every AC row, and fix an uncovered AC in the plan before dispatching.

+ must name test fixture defs and call sites (`execute-plan-residue.md` § Signature/param-removal).

+ **A chunk whose deliverable is a static gate or sweep predicate** carries a brief sorting every

+ case into PROVE-BAD, PROVE-GOOD or CANNOT-DECIDE, flagging only PROVE-BAD; a first run of two dozen hits or more gets a hand-read sample before any fix wave. Tripwire:

+ **Invoke `dispatch.emit` — never derive the wave shape by hand.** It

+ reads the spine's `writes:`/`depends_on` and emits the ready-to-fire Workflow, each row's

+ `gate_kind`, `write_files`, `agentType` resolved, non-dispatchable rows filtered.

+ `NoWritesDeclaredError` means an unpopulated spine — fix the plan, never hand-derive. Write

+ the emitted script to `<plan-basename>.workflow.mjs` next to the plan. Emitted scripts and `.emitted.json` receipts are ephemeral: gitignored, never committed, pruned by `/distill`.

+ **Emit and dispatch are ONE action.** In an interactive

+ `${CLAUDE_PLUGIN_ROOT}/snippets/resolve-coordinator-bin.md`, PowerShell included). Before firing, register review targets (EM-only; reviewers apply findings only to them):

+ session, using the `fire with: Workflow(...)` line the emitter prints on stderr.

+ completion receipt, and the chunk's commit. A row shipped since the emit makes the

+ carries a skip-if-delivered check keyed on that effect's receipt (wiki `execute-plan-residue.md` § Fire-time freshness). Tripwire: `A-ROW-IS-RECHECKED-AT-FIRE-NOT-AT-EMIT`.

+ place (its `<script>.emitted.json` digest differs): `--restamp`, not re-emit. Tripwire:

+ **No hand-dispatch fallback.** If the dispatch refuses — the `Workflow` call, or on the

+ `ConcurrencyCapExceededError`, `ChildSpawnFailedError`) — report it and stop; hand-dispatching with the Agent tool is never the recovery; a concurrency-cap refusal means wait. The emit refuses with

+ `DirtyWriteSetError` when a path in the dispatchable rows' `writes:` is dirty or untracked — commit or reconcile it with its owner and re-emit; never edit `writes:` to dodge it. Tripwire: A-DIRTY-PATH-IN-THE-WAVE-WRITE-SET-REFUSES-THE-EMIT.

+ **A sixth state: returned `incomplete`, nothing halted.** Not a resume. Run `dispatch.terminal_commit`, then `emit-dispatch-workflow --plan <plan> --only-incomplete <task-output>` and fire; never hand-dispatch. A row partial only on a break outside its files is re-graded by `terminal_commit` (`regraded`); any other is re-verified (`--reverify-delivery <run-record>`, fire, `reverify-delivery record --run-record <that same run-record>`, never the `.emitted.json`). Hand-committing its files refuses the stamp.

+ Wave shape comes from the file-write graph, never the plan's section structure; one dispatch

+ per chunk, never bundled. Taxonomy and checks: wiki.

+ **No checkpoint prompt; scripted gates still hold.** The workflow never pauses to ask; a `phase()`'s deterministic gate MAY halt the run (`return { halted: ... }`, wiki:

+ **One emit per plan — a partial re-run resumes, never re-emits.** The emitted script carries

+ (`dispatch.terminal_commit`, below) follows the return. On a halt (a BLOCKed executor, review-wave BLOCKED/FAIL, or rebuild verdict) recover with `Workflow({scriptPath, resumeFromRunId: <run>})`

+ in the same session; resume alone re-halts (the refusal verdict is cached). **Edit the

+ closed rows); re-emit only when the spine changed. Tripwire:

+ **Watch with `Monitor`, never hand-polling:** the run's `journal.jsonl` (completion, phase-boundary, failure, every terminal state).

+ review wave runs inside the workflow; nothing commits mid-run. The run's driver commits — the EM for an in-session run, the chain driver for a chained one. The driver runs `coordinator-invoke dispatch.terminal_commit` with `script_path` and

+ it. Still `executing`: read the reason and treat the run as Phase-5-halted. That commit writes one

+ completion receipt per baton; the EM reads it, never writes it ([`completion-receipts.md`](../../docs/wiki/release-and-distribution/completion-receipts.md)).

+ TaskCreate: one task per plan phase/major task, BENEATH the stage rows the sizing lobby

+ opened (`skills/sizing/SKILL.md` § 4b); its session-goal task is already `in_progress`.

+ Without the lobby: open the recorder here, session goal plus phases, `in_progress` at once.

+ A plan in another repo than the session's anchor → pass

+ `coordinator-tasks-mirror --repo-root <plan's repo>`; bare, the repo-identity gate refuses as a MISMATCH.

+ Execute every task in sequence without stopping to ask. Per task: write-ahead (mark

+ `In progress` on disk + TaskUpdate `in_progress`) → execute (follow the plan, fix routine errors)

+ → **reachability gate** (new entry point? confirm a production call site: caller-grep or traced entry, never an import smoke-check; the terminal judge re-checks via `review.reachability`, wiki `judge-reachability-check`) → mark complete (on disk + TaskUpdate `completed`) → proceed

+ immediately, across phase boundaries, same session, same flight recorder.

+ Mid-dispatch decisions are the EM's — pick, record a one-line rationale, continue; only the

+ Phase 5 list escalates. A residual (a missed site, a fix wider than the AC) needs a closed exit: dispatch it, add a spine row for the Phase 4 harvest, `coordinator-queue-append --schema

+ bug-backlog|debt-backlog|improvement-queue`, or take it to the PM; a reason with no queue id, row, or commit is not routed.

+ `chunk-commits <plan-path> <chunk-id>` (`ceremony.chunk_commits`) scopes to the plan's add-commit range (`<add-sha>..HEAD`) AND its `Checkpoint-Plan:` trailer, filtering on the commit SUBJECT (never

+ per plan). A `no_join_candidates`-shaped result does not prove the chunks didn't ship. Rationale: wiki residue § Phase 4 Leg 1.

+ 2. **Leg 2 — the Workflow's own script**, persisted and resumable via

+ `resumeFromRunId` (Phase 1).

+ 3. **Leg 3 — the Task-list flight recorder** (Phase 2), which persists through compaction.

+ **The `## Tasks` spine is the only row family close-out reads.** The falsifier delta on

+ `prime_exit_criterion` — its verdict, not a row's ticked-or-open state — discharges the plan. Tripwire: `AN-UNTICKED-AC-CELL-CARRIES-NO-INFORMATION`.

+ `pm_approved: true`) is a ratification claim the harvest selects on; this step never stamps it

+ (closing a row mid-execution is a scope decision for the PM).

+ **Commit sequence, two commits, never one (the resolve step writes the plan, not a third commit):**

+ `snippets/scoped-commit-route.md`; never hand-add it.

+ 2. Resolve each landed row's `disposition_ref`, the only thing close-out counts:

+ chunk SHA means unresolved rows: resolve and re-run, never rewrite shared history. Record the

+ `exit_criterion_met.prose`, beside the baseline's rollup line. A `CONTRADICTION: ` line

+ output is `fail`); the gate refuses the

+ stamp unless it is `pass`. `exit_criterion_met.prose` ties it to the prime criterion.

+ 3.5. **Promote the falsifier, when it promotes.** An executable, deterministic falsifier graduates into the repo's test suite: `promotion: promoted` plus `promoted_to: <test path>`, or `partial`

+ `sizing_object.estimate.tshirt` (never an S-lane spec-dispatch) AND every wave-map chunk

+ landed without an executor BLOCKing — dispatch one reader that receives only the prime exit criterion statement and `HEAD`, and answers one question: does HEAD

+ do this? A roster's judge stage (`coordinator:exit-criterion-judge`) is this reader; no second. **THE DENIAL LIST IS THE MECHANISM AND MUST BE EXPLICIT IN THE DISPATCH:**

+ 3.7. **Reachability re-check, before the stamp.** The judge's `reachability` block (`review.reachability`, wiki `judge-reachability-check`) is the re-check; unreachable is its not_met. No block (op absent, error): caller-grep at `HEAD`. Unconfirmed → Phase-5-halted, no stamp.

+ (incl. a `refused` from `terminal_commit`) — no stamp-able review, no build/test record,

+ `foreign_claims[]` — is Phase-5-halted: report, skip step 4. Tripwire:

+ 4. `close-out-and-stamp "$ARGUMENTS"` stamps `status: implemented` and commits the plan path

+ **Offer, stamp-aware.** Whether step 4 stamped `implemented` decides it.

+ resolve-and-resume, `/handoff`, or commit-and-stop. Never auto-invoke these or `coordinator:finishing-a-development-branch`.

+ **A cross-repo leg names its failing conjunct, not its repo** (*undeclared*, *unaddressed*, *unanswered*), per `coordinator/snippets/cross-repo-block-exchange.md`. Tripwire:

+ Default: complete the plan. Stop only for: **external trust surface change**

+ (disk state changed since drafting, making the plan structurally wrong — bounce to

+ `/plan`); **scope explosion** (≥3× anticipated size, no 5-15min-chunk decomposition for the

+ remainder — route back to `/plan`); **unauthorized irreversible action required**

+ would ship something not authorized** (approved on premise X; execution reveals it also does Y, not a mechanical consequence of X).

+ **Usage-limit advisory** (a pause, no PM emergency): dispatch nothing new, let in-flight agents

+ Default upstream entry is `/handoff` + `/pickup`; enrichment has happened upstream.

+ `/review-code` stays an optional ad-hoc pass; the plan's review is the fired workflow's (Phase 1.5/1.6).