@azure-id/orc 1.9.2 → 2.0.2

package/templates/skills/_shared/return-validation.md

@@ -4,22 +4,20 @@ Canonical procedure for validating a spawned agent's return. Every ORC lane
 (full, mini, fast, wiki, diy) runs this on EVERY return; a malformed return is
 a failure (requeue/re-dispatch with reason — lane sets the retry cap).
 
+**Read the SECTION, not the file.** Every return: §1–§3. Then ONLY the § of
+each field the slice carried — §4 `pattern`, §5 `tdd_spec`, §5b wiki, §5b.1
+graph cards, §5c the rules card, §5d `repro`. §2b only for a foreign return. §0
+only before a re-dispatch. §6 only after a wave. §7 only on a repair loop. The §
+numbers are anchors: never renumber or rename a § heading.
+
 ## 0. Is the previous attempt still ALIVE? (v1.2.0) — BEFORE anything else
 
 > **`a lane that re-dispatches over a live attempt` has broken this contract.**
 
 **A Task error does not kill the agent behind it.** Claude Code's tool call can
 fail, time out, or be cut off mid-turn while the subagent it started keeps
-running — and keeps writing files. Every rule below this line ends in
-"re-dispatch", and every one of them silently assumed a failed call meant a dead
-agent. It does not.
-
-What that costs, measured: one graded `/orc-quick` entry put THREE
-`orc-executor-opus-5-low` agents on the SAME task — 50m19s, 115m22s and
-100m53s, **266 minutes of Opus 5.5 for one authorised dispatch**, all editing the
-same files, inside a 2h04m window. The second was dispatched 4m19s after the
-first, while the first was still working. The hook had recorded all three; no
-lane had ever read that record.
+running — and keeps writing files. Every rule below ends in "re-dispatch";
+none of them may assume that a failed call means a dead agent.
 
 ### The rule
 
@@ -49,8 +47,7 @@ A usage limit, an API error, a dropped connection or a `Ctrl+C` between a
 dispatch and its return says **nothing** about the agent. Treat it as §0 exit 2
 and ask. A lane that classifies an interruption as a failure re-dispatches into
 a live agent, gets interrupted again sooner because it is now paying twice, and
-the loop tightens on itself — which is exactly how the 266-minute entry
-happened.
+the loop tightens on itself.
 
 ### What refusing looks like
 
@@ -102,64 +99,14 @@ is on the wrong model.)
 
 ## 2b. A FOREIGN return — the SUBSTITUTION check (v0.50.0)
 
-A foreign worker (`orc extra dispatch`, `_shared/extra-dispatch.md`) is not a
-Claude subagent. It has no injected system-prompt model-id line, so **it cannot
-carry `actual_model`** — and §2 must not be faked for it. A foreign return that
-claimed an `actual_model` would be claiming evidence that does not exist.
-
-It carries instead, and every one of these is quoted from the wire rather than
-assumed:
-
-- `engine` (`api` | `claude-shim` | `cli`), `provider`, `profile`
-- `model_requested` — what the route row asked for
-- **`model_reported`** — the `model` field the endpoint echoed back
-- `usage` — the four token kinds, never blended, **or `null`**
-
-**`model_reported != model_requested` is ⛔ SUBSTITUTION**, surfaced to the user
-exactly as ⛔ DOWNGRADE is today and never silently accepted. It is the only
-defence against an aggregator quietly serving something else. `unknown` is a
-valid, honest value and is reported as `unknown` — **never as a match**.
-
-**A clean model check is not a clean answer.** An aggregator's *provider-level*
-fallback is on by default and it PRESERVES the model id, so the substitution
-check reads clean while the code went to a different company. Engine `api`
-records the response's `provider` echo and reports **⚠ REROUTE**; the other two
-engines cannot see it at all, and their `served_by_note` says so. An absent
-measurement is never a pass.
-
-**`usage: null` is not four zeros.** A worker that reported no token counts
-(engine `cli` frequently) returns `null` plus a note. `{0,0,0,0}` would tell
-`/orc-budget` the run was free. Engine `api`'s `cache_write: 0` is the opposite
-case — a real measurement — so the two must never be normalised together.
-
-**The fence is per-engine, and the return says which one it had.** Engine `api`
-ENFORCES `declared_files`; engines `claude-shim` and `cli` ASK. A return
-carrying `fence: {declared_files: false}` means the list was an instruction, not
-a rule — treat §6 below as the only real check, and say so to the user rather
-than reporting a constraint that was never applied.
-
-**A RESUMED foreign dispatch owes three more fields** (v0.54.0). The dispatch
-return sets `resume_expected: true`, so the obligation is never inferred:
-
-- **`resume_state`** — `continued` · `restarted` · `no-op`. Absent on a slice
-  with no `resumed_from` is correct; **absent on a resume slice is MALFORMED.**
-  A return claiming `restarted` while `preexisting[]` was non-empty is a
-  FINDING, not a failure — it is how `/orc-retro` learns which providers ignore
-  a resume preamble, so surface it rather than treating it as a bad return.
-- **`preexisting_read[]`** — which pre-existing files the worker actually
-  opened. Quoted like `wiki_used`: **what it did, never what the dispatcher
-  assumed.** An EMPTY list on a resume whose `preexisting[]` was not empty is an
-  honest and informative return — it says the worker ignored the preamble — and
-  it must be surfaced, never dropped.
-- **`journal_fidelity`** — relayed from the dispatch return (`per-turn` |
-  `streamed-opaque`), so a validator never reports `streamed-opaque` evidence as
-  if it had per-turn tool attribution.
-
-Everything else in this file applies to a foreign return unchanged: the
-honest-status rules, the pattern attestation, the TDD attestation, the wiki
-attestation, and above all **§6, the worktree delta** — which is engine-blind
-because it reads the worktree rather than the return, and is therefore what
-makes a foreign executor safe at all.
+Read this § only when `extra_enabled` and the return came from `orc extra
+dispatch`. A foreign worker has no system-prompt model-id line, so **it cannot
+carry `actual_model`** — never fake §2 for it. **`model_reported !=
+model_requested` is ⛔ SUBSTITUTION**, surfaced exactly as ⛔ DOWNGRADE. A
+RESUMED foreign dispatch also owes `resume_state`, `preexisting_read[]` and
+`journal_fidelity`. The full check — the wire fields, ⚠ REROUTE, `usage: null`,
+the per-engine fence and the resume fields — is `extra-dispatch.md`
+§The return contract delta. Every other § of this file applies unchanged.
 
 ## 3. Honest-status rules (executor returns)
 

package/templates/skills/_shared/review-slice.md

@@ -0,0 +1,79 @@
+# The review slice — the ONE shape every lane uses
+
+> **On demand.** Read this file ONLY when a review dispatch is about to be built
+> (`/orc` Phase 5 and its composed DIY layer, `orc-review-verify/core.md`, the
+> `/orc-quick` review offer, the `/orc-mini` risk-high option, the `/orc-pr-driver`
+> per-layer gate, `/orc-ultra` gate 3). One slice, so a review in quick is the
+> same review as in `/orc`. The procedure and the return live in the agent file
+> (`.claude/agents/orc-reviewer-opus-5-med.md`), never here.
+
+Slice fields: changed_files[] · diff_ranges[] · acceptance_criteria[] · constraints[] · code_pattern · invariants[] · validation_gate[] · fe_rules[] · security_checklist[] · graph_changes · tool_findings[] · gotcha_card · rules_card · previous_findings[] · mode
+
+## §1 R1 — the free check (before ANY review dispatch)
+
+The free check always runs before the paid one. On the changed files only:
+
+1. Run the project's OWN lint and type check. Take the commands from
+   `wiki-meta.json` `commands`; else the `package.json` scripts named `lint` /
+   `typecheck`; else the `pyproject` / `Makefile` targets of those names; else
+   `sonar-scanner` when the project already has it. **Never invent a command.
+   Never install tooling.** No command found → `tool_findings[]` is empty; say so
+   in one line.
+2. Run `orc rules lint --diff` (free, zero tokens).
+3. Keep only the output lines that land on a changed file → `tool_findings[]`
+   (`{tool, location, message}`). **The reviewer must not re-report them.**
+
+`/orc-ultra` gate 3 reuses this step (it does not run a second copy); a fix wave
+that changed files re-runs it first.
+
+## §2 The fields
+
+| Field | Source |
+|---|---|
+| `changed_files[]`, `diff_ranges[]` | git — `diff_ranges` are the changed line ranges per file (R2) |
+| `acceptance_criteria[]`, `constraints[]` | the plan / the quick entry |
+| `code_pattern`, `invariants[]`, `validation_gate[]` | the pattern cache (or null / empty) |
+| `fe_rules[]`, `security_checklist[]` | FE diffs / `mode: security` only, else empty |
+| `graph_changes` | `orc graph changes --if-enabled --json` — **keeps its rows: no `--brief` here** |
+| `tool_findings[]` | §1 |
+| `gotcha_card` | `orc gotcha card --files <changed csv> --lane <lane> --json` → `text` |
+| `rules_card` | `orc rules slice --lane <lane> --json` → `text` (a lane with no rules → null) |
+| `previous_findings[]` | the checkpoint, on a re-review ONLY (R9), each with its outcome |
+| `mode` | `review` · `disprove` · `security` |
+
+- **`graph_changes`** (`code-graph.md` §7): the symbols THIS diff's hunks overlap,
+  each with its callers, its tests and a risk word that carries its own reason.
+  The reviewer is handed `symbols[].caller_files` and reads them.
+It replaces a whole-file `orc graph impact` here: a file card reports every symbol in
+a touched file, and a symbol nobody edited is not a finding. An unchanged caller of
+a changed signature is a finding candidate, anchored like any other.
+- **`gotcha_card` is ALWAYS built** when anything matches — no switch removes it
+  (`gotcha_card_budget` is only its size). Exit 1 (no match) → null, the normal
+  case. Its header counts what the budget dropped; never cut it silently.
+  The session hook ALSO hands it to every `orc-reviewer-*`, `orc-verifier-*` and
+  `orc-judge-*` at `SubagentStart` (v2.0.2), so a slice that forgot it still has it.
+  Before the card, run `orc gotcha sync --json` (it is due at most once per
+  `gotcha_sync_hours`); exit 2 (a CLI that has no `sync`) or any failure → go on.
+- **`mode: disprove`** carries only the P0/P1 findings to test and their files.
+
+## §3 After the return — the after-filter (R10)
+
+The reviewer reports EVERY finding. Then, before the ladder acts:
+
+1. Pipe the findings to `orc gotcha filter --findings - --json`. It drops P2/P3
+   that a `suppress` gotcha names, folds P3 above 5 into `+N similar`, and applies
+   the category noise budget. **It never removes a P0 or P1.** Keep its `kept`;
+   list its `removed[]` (each with the `by` id) in the run summary — a count is
+   not consent.
+2. `pre_existing: true` findings (on a line outside `diff_ranges`) go to their own
+   bucket. They never gate.
+3. A P0/P1 with no `scenario`, or with `confidence: low`, becomes P2.
+4. Findings that share a `group` are ONE fix: the P0 fix, the P1 ask and the P2
+   batch are made per group (R7).
+
+5. At review close, record one observation per finding and emit the
+   `FINDING-OUTCOME` line — `gotchas.md` §10 "Review close" (`/orc` Phase 7,
+   `/orc-mini` after its risk option, `/orc-quick` after the review offer).
+
+**Superpowers path** (DE-13): after the Superpowers review skill returns, run
+this §3 on its findings too, outcomes included — never a second reviewer dispatch.

package/templates/skills/_shared/smoke-gate.md

@@ -1,28 +1,46 @@
-# Smoke gate (read-only build + test ship gate)
-
-Canonical procedure for the smoke gate run by orc-mini (Phase M) and orc-fast
-(Phase F3). The gate is the orchestrator's INDEPENDENT check — the executor's
-`evidence` is a claim; your run is the verification (when they disagree, say
-so). Running build+test is read-only and is NOT implementation: you still
-never write code.
-
-## Procedure
-
-1. Discover the commands: prefer the wiki manifest's `commands` block when it
-   exists (recorded at scan time — don't rediscover tooling); otherwise detect
-   the stack's build + test runner once and say which you chose.
-2. Run build, then the fast test suite, once each.
-3. Verdict (emit the `VERDICT pass|fail` trace line):
-   - **GREEN** → proceed to the lane's next step (test-ask / ship).
-   - **RED** → **never offer commit/ship.** Surface the failure verbatim, then
-     ONE repair round: re-dispatch the SAME executor with the failing output
-     as `failure_reason`, and re-run this gate. A second RED → STOP and
-     surface; the lane names its escalation options (mini: stop; fast:
-     escalate to orc-mini / switch to full `/orc` / stop).
-   - **No runnable build/test** (docs-only repo) → say so explicitly; the
-     gate is N/A — never silently skip it.
-
-## What it is not
-
-Smoke, not verification: no findings classification, no criteria matrix, no
-severity ladder. A run that needs that depth belongs in the full lane.
+# Smoke gate (read-only build + test ship gate)
+
+Canonical procedure for the smoke gate run by orc-mini (Phase M) and orc-fast
+(Phase F3). The gate is the orchestrator's INDEPENDENT check — the executor's
+`evidence` is a claim; your run is the verification (when they disagree, say
+so). Running build+test is read-only and is NOT implementation: you still
+never write code.
+
+## Procedure
+
+1. Discover the commands: prefer the wiki manifest's `commands` block when it
+   exists (recorded at scan time — don't rediscover tooling); otherwise detect
+   the stack's build + test runner once and say which you chose.
+2. Run build, then the fast test suite, once each.
+3. Verdict (emit the `VERDICT pass|fail` trace line):
+   - **GREEN** → proceed to the lane's next step (test-ask / ship).
+   - **RED** → **never offer commit/ship.** Run the flaky check first
+     (§Flaky). Still red → surface the failure verbatim, then
+     ONE repair round: re-dispatch the SAME executor with the failing output
+     as `failure_reason`, and re-run this gate. A second RED → STOP and
+     surface; the lane names its escalation options (mini: stop; fast:
+     escalate to orc-mini / switch to full `/orc` / stop).
+   - **No runnable build/test** (docs-only repo) → say so explicitly; the
+     gate is N/A — never silently skip it.
+
+## Flaky — before any repair round
+
+**Everywhere a test runs** (this gate, `/orc-quick` §3.2, `/orc` verify's TDD
+gate, every repair loop): a RED test run gets ONE identical re-run of ONLY the
+failing tests, before any repair. Save both outputs, then ask the CLI — never
+judge it yourself:
+
+`orc ci flaky --first <log> --rerun <log> [--rerun-exit <n>] --json`
+
+- `--first` alone names the failing tests to re-run (`tests_failed[]`).
+- Exit 0 = **FLAKY**: every failing test passed on the re-run. Emit its
+  `gate_line` (`GATE flaky :: <tests>`), report the tests, and do NOT start a
+  repair round. A flaky run is not red and does not use a round.
+- Exit 1 = red (a test failed again, did not run, or the re-run exited ≠ 0) →
+  the repair round as usual. Exit 3 = no test name in the log → red.
+- One re-run only. Never re-run until green.
+
+## What it is not
+
+Smoke, not verification: no findings classification, no criteria matrix, no
+severity ladder. A run that needs that depth belongs in the full lane.

package/templates/skills/context-combiner/SKILL.md

@@ -1,20 +1,10 @@
 ---
 name: context-combiner
 description: >
-  Combines 2+ RELATED, already-confirmed ORC analyses (from orc-analyze) into
-  ONE merged, deduped, conflict-resolved requirement context before build. Use
-  when the user analyzed multiple related documents within the same scope and
-  chose "pass to context-combiner" at orc-analyze's Phase F. Verifies the source
-  analyses actually overlap (shared files/requirements/scope) and challenges the
-  user if they look unrelated; pools ALL source requirements into one table and
-  reconciles them (exact/semantic duplicates, partial overlaps split — never
-  collapsed, conflicts, ordering) one issue at a time; proves NOTHING WAS LOST
-  via a source coverage matrix and a 100% coverage gate before handoff;
-  spot-checks inherited evidence and marks stale anchors; writes
-  combined-report.md + combined-requirement-spec.md, which reuse the
-  requirement-spec schema, so the planner/build pipeline is unchanged. Full
-  lane only. The orchestrator DISPATCHES this to a subagent — it never
-  combines itself, and the combiner never spawns subagents.
+  Internal to /orc: merges 2+ RELATED, confirmed orc-analyze analyses into ONE
+  deduped, conflict-resolved requirement context. Dispatched when the user picks
+  "pass to context-combiner" at orc-analyze's Phase F.
+disable-model-invocation: true
 ---
 
 # CONTEXT-COMBINER
@@ -80,11 +70,9 @@ it were a single analysis — with PROOF that no source requirement was lost.
 
 ## Phases
 
-`orc lane phases context-combiner --json` is this lane's pipeline: the ordered list, where
-each phase lives, and how much of it to read. **The CLI owns the order** — never
-derive it from the headings below, and never renumber or rename one without the
-manifest, because a `read: section` pointer names a HEADING and a renamed heading
-is a pointer into nothing.
+`orc lane phases context-combiner --json` is this lane's pipeline. **The CLI owns the order**:
+never derive it from the headings below, and never rename or renumber one
+without the manifest (`../_shared/lane-contract.md` §Phases).
 
 ## Phase A — Load sources
 Read every source `requirement-spec.md` (2+) the orchestrator hands you, plus
@@ -194,29 +182,12 @@ withheld until the open conflict is resolved and coverage is complete.
 ## No mini variant
 Full lane only. `orc-analyze-mini` / `orc-mini` do not use the combiner.
 
-## Config
+## Lane contract (`../_shared/lane-contract.md` — read it ONLY when a call exits ≠ 0)
 
-Resolve with `orc lane config context-combiner --json` and obey `effective`. Never merge
-`.claude/orc.config.yaml` yourself, and never re-derive a precedence. Exit ≠ 0 →
-say so and use `../_shared/config-precedence.md`'s documented defaults, out
-loud. Nothing this lane reads is contested, gated or a stop, so it owes no
-preflight line and has no gate to honour.
-
-## Calls
-
-**ONE catalogue, and it is not you:** `orc lane calls context-combiner --json` names every
-CLI call this lane makes, each with its exit-code contract, its cost, when to run
-it, and what an EMPTY answer means. Never invent a spelling, never re-word an
-exit code, and never re-derive a state word — the CLI's state words are the only
-state words, and **an exit code is an ANSWER wherever that contract says so, not
-a failure**. A call the answer does not name is a call this lane does not make.
-Exit ≠ 0 from the catalogue itself → say the CLI is unavailable and name the
-command you are about to run, out loud, before running it.
-
-## Rules — the anti-slop card (`../_shared/phases/rules.md`)
-
-`orc rules slice --lane context-combiner --json` is the ONLY assembler; never build
-the card here. It rides under the house rules and above the task —
-**house rules > your project's rules > ORC's own packs** — and its `line` prints
-VERBATIM at preflight. Returns gain `rules_applied[]`, `rules_conflicts[]` (a gap,
-never a silent choice) and `rules_overridden[]`.
+- **Calls:** `orc lane calls context-combiner --json` names every call and its exit codes.
+  **An exit code is an ANSWER where it says so, not a failure.** Make no other call.
+- **Config:** `orc lane config context-combiner --json`. Obey `effective`. Never merge
+  `.claude/orc.config.yaml` yourself (`../_shared/config-precedence.md`). Nothing
+  here is contested, gated or a stop: no preflight line, no gate to honour.
+- **Rules:** `orc rules slice --lane context-combiner --json` is the ONLY assembler
+  (`../_shared/phases/rules.md`). Its `line` prints VERBATIM at preflight.

package/templates/skills/orc/SKILL.md

@@ -3,12 +3,10 @@ name: orc
 description: >
   Use when orchestrating a multi-task build through a full pipeline: intake →
   planning → scored parallel execution → review → verify → ship. Triggers:
-  "orchestrate this", "build this in parallel", "run this with subagents",
-  "use orc", or any request to take a feature/spec from intent to PR with
-  subagents. Routes planning to Superpowers, OpenSpec, or its own planner;
-  schedules conflict-free waves; scores each task to pick the cheapest capable
-  model; checkpoints eagerly; survives compaction and fresh-session resume.
-  Stack-agnostic.
+  "orchestrate this", "build this in parallel", "run this with subagents", "use
+  orc", or any request to take a feature/spec from intent to PR with subagents.
+  Scores each task to pick the cheapest capable model, and survives compaction
+  and fresh-session resume. Stack-agnostic.
 ---
 
 # ORC (orchestrator spine)
@@ -81,7 +79,7 @@ trigger points; emit `GATE` trace lines.
 
 ## Dispatch via named agents (not prose)
 
-**`orc run inflight` before ANY re-dispatch** (0 clear · 1 in-flight · 2 unknown).
+**`orc run inflight` before ANY re-dispatch.**
 A Task error does not kill the agent behind it, and exit 2 REFUSES by default —
 `a lane that re-dispatches over a live attempt` has broken the contract. Canonical: `_shared/return-validation.md` §0.
 
@@ -100,59 +98,35 @@ resolves to its Opus 5.5 agent, FORCING over everything below — `_shared/opus5
 Caveat: a subagent's model can't exceed the MAIN session's tier — run the main
 session on Opus or the Opus pins silently fall back (the original "wrong model" bug).
 
-## Config (read at run start)
-
-**ONE resolver, and it is not you:** `orc lane config orc --json`. Obey
-`effective`, print every line in `announce[]` VERBATIM at preflight, and honour
-`stops[]` before wave 1. Never re-derive a value, a precedence or an inertness
-from `.claude/orc.config.yaml` — a key this lane does not read is not in the
-answer, and a key another key shadows comes back already marked. Exit ≠ 0 → say
-the CLI is unavailable and fall back to `../_shared/config-precedence.md`'s
-documented defaults, out loud. Priorities and families:
-`../_shared/config-precedence.md`.
-
-## Rules — the anti-slop card (`../_shared/phases/rules.md`)
-
-`orc rules slice --lane orc --json` is the ONLY assembler; never build
-the card here. It rides under the house rules and above the task —
-**house rules > your project's rules > ORC's own packs** — and its `line` prints
-VERBATIM at preflight. Returns gain `rules_applied[]`, `rules_conflicts[]` (a gap,
-never a silent choice) and `rules_overridden[]`.
-## Calls
-
-**ONE catalogue, and it is not you:** `orc lane calls orc --json` names every
-CLI call this lane makes, each with its exit-code contract, its cost, when to run
-it, and what an EMPTY answer means. Never invent a spelling, never re-word an
-exit code, and never re-derive a state word — the CLI's state words are the only
-state words, and **an exit code is an ANSWER wherever that contract says so, not
-a failure**. A call the answer does not name is a call this lane does not make.
-Exit ≠ 0 from the catalogue itself → say the CLI is unavailable and name the
-command you are about to run, out loud, before running it.
+## Lane contract (`../_shared/lane-contract.md` — read it ONLY when a call exits ≠ 0)
+
+- **Calls:** `orc lane calls orc --json` names every call and its exit codes.
+  **An exit code is an ANSWER where it says so, not a failure.** Make no other call.
+- **Config:** `orc lane config orc --json`. Obey `effective`, print every line
+  in `announce[]` VERBATIM at preflight, and honour `stops[]` before wave 1.
+  Never merge `.claude/orc.config.yaml` yourself (`../_shared/config-precedence.md`).
+- **Rules:** `orc rules slice --lane orc --json` is the ONLY assembler
+  (`../_shared/phases/rules.md`). Its `line` prints VERBATIM at preflight.
 
 ## Behavior trace (PERMANENT — always on, no config toggle)
 
-Follow `../_shared/phases/trace.md` (ALWAYS load it at run start). The
-`orc-trace.js` hook writes the `SPAWN`/`RETURN`/`PHASE-EDGE` skeleton
-deterministically; the rich narrative is **dispatched, never remembered** — every
-`emit <VERB>` step below means RECORD that event, with its REAL timestamp, into
-the current **phase packet**; you never append a trace line yourself. Run start:
-create `log_dir`, write `log_dir/.current` = `run-orc-<slug>-<DDMMYY>-<HHMMSS>.txt`
-AND `touch the trace file` of that name in the SAME step; store `trace_path`.
+Follow `../_shared/phases/trace.md` (ALWAYS load it at run start; pairing rule,
+packet shape and run end are there). Lane token `orc`, tier **Build lanes**. The
+`orc-trace.js` hook writes the `SPAWN`/`RETURN`/`PHASE-EDGE` skeleton; the
+narrative is **dispatched, never remembered** — every `emit <VERB>` step below
+means RECORD that event, with its REAL timestamp, into the current **phase packet**. Run start: create `log_dir`, write `log_dir/.current`
+= `run-orc-<slug>-<DDMMYY>-<HHMMSS>.txt` AND `touch the trace file` of that name
+in the SAME step; store `trace_path`.
 **Under `ultra_mode` the lane segment is `ultra`, not `orc`** (`run-ultra-<slug>-…`)
 — the filename IS the per-lane data, so an ultra run named `orc` is counted as a
 plain `/orc` run forever, hiding the costliest lane in every usage report.
-**Phase close = dispatch `orc-trace-writer-haiku-4-5`** with that packet
-(`phase`, `events[]`, and `decisions` — the WHY: scoring rationale, the user's
-answers VERBATIM, what you rejected; `run_meta` on the FIRST packet only).
-**Pairing rule:** issue phase N's writer dispatch in the SAME tool block as phase
-N+1's first dispatch (a phase with no next dispatch sends it solo, before its
-user-facing output); the first packet is solo + synchronous — it repairs a
-hook-bootstrapped filename. `DISPATCH`/`VERIFY` models are derived from the agent
-NAME and checked against each return's `actual_model`/`actual_effort` — surface
-any ⛔ DOWNGRADE to the user, not just into the packet. A phase ending with
-`zero new trace lines is a protocol violation` — build and dispatch its packet
-NOW, with the events' real stamps. Run end (Phase 8 or abort): the `FINISH`
-packet goes out and RETURNS, then delete `log_dir/.current`.
+**Phase close = `orc trace write --packet -`** (exit ≠ 0 → `orc-trace-writer-haiku-4-5`).
+The first packet is solo — it repairs a hook-bootstrap filename.
+`DISPATCH`/`VERIFY` models are derived from the agent NAME and checked against
+each return's `actual_model`/`actual_effort` — surface any ⛔ DOWNGRADE to the
+user, not just into the packet. A phase ending with
+`zero new trace lines is a protocol violation` — build and write its packet
+NOW, with the events' real stamps.
 
 ## Extra — a band that executes OFF Claude (config `extra_enabled`, default false)
 
@@ -175,7 +149,7 @@ review/verify re-check the invariants + `validation_gate[]` lines. Load
 ## Ultra lane (`/orc-ultra`)
 
 `/orc-ultra` sets `ultra_mode: true` RUN-SCOPED (never persisted): full pipeline
-+ Opus 4.8 max Advisor (Phase U0) + three judge gates + forced overrides (deep
++ Opus 5.5 xhigh Advisor (Phase U0) + three judge gates + forced overrides (deep
 analyze, pattern/testgen/security on, executor tier floor); never on plain
 `/orc` or orc-mini. Load `references/ultra-mode.md` at Phase 0 when ultra_mode;
 orc-advisor / orc-judge load at their dispatch points.
@@ -214,10 +188,9 @@ them; they are never dispatched as subagents).
 
 ## Phases
 
-`orc lane phases orc --json` **is** the pipeline — the CLI owns the list and
-its order, and this table is the human index of it. Never derive the order
-from these filenames; a second idea of the pipeline is the drift the manifest
-exists to prevent.
+`orc lane phases orc --json` **is** the pipeline; this table is only its human
+index. **The CLI owns the order**: never derive it from these filenames
+(`../_shared/lane-contract.md` §Phases).
 
 **Read a row when its phase fires, not on activation.** Every row is
 `on-phase` — this spine deliberately carries no `always` phase pointer. **Read
@@ -228,8 +201,7 @@ each row.
 
 W13 gave those ten a second reader (`orc-diy`), so they moved to
 `_shared/phases/`. Intake and Integration have one consumer each and stay home
-— a file with one consumer stays home. W14 (`orc-mini`/`orc-fast`) is what adds
-a `trim` layer beside the `full` one.
+— a file with one consumer stays home.
 
 | # | Phase | File | Read | Trace |
 |---|-------|------|------|-------|
@@ -252,4 +224,4 @@ their config key is resolved by `orc lane config orc --json`, never read raw.
 ## Waiting mid-run (`/orc-wait`)
 
 Canonical: `../_shared/wait.md`. **`a lane that waits without a hand-back` has broken this contract.**
-Checkpoint **full** · safe point **wave or phase edge**. `soft` FORCES that checkpoint and does NOT stop if the write fails; `hard` skips it and can lose an in-flight return. Never begin a wait between a dispatch and its validated return, or before the smoke gate has reported.
+Checkpoint **full** · safe point **wave or phase edge**.