@azure-id/orc 1.9.2 → 2.1.0

package/templates/skills/orc-route/SKILL.md

@@ -1,14 +1,12 @@
 ---
 name: orc-route
 description: >
-  Plan-only lane router — you have a plan, this tells you which lane should build
-  it. Use for "/orc-route", "which lane for this plan?", "is this worth the full
-  orc run?". It reads the plan's own numbers (tasks, waves, files, top score,
-  risk) plus ORC's deterministic knowledge probes, then names ONE recommended
-  lane, the runners-up with the reason each lost, and any lane that is not
-  possible with the blocking condition named. It routes a PLAN and nothing else —
-  given a request in words it refuses and says why, because routing from a
-  sentence is guessing. Zero agents, user-invoked only, nothing is built.
+  Plan-only lane router — you have a plan, this tells you which lane should
+  build it. Use for "/orc-route", "which lane for this plan?", "is this worth
+  the full orc run?". It reads the plan's own numbers and ORC's knowledge
+  probes, then names ONE recommended lane, the runners-up with the reason each
+  lost, and any lane that is not possible. It routes a PLAN only, never a
+  request in words. Zero agents, nothing is built.
 ---
 
 # ORC-ROUTE
@@ -148,13 +146,11 @@ exactly one branch.
 
 ## Behavior trace (always on)
 
-`../_shared/phases/trace.md` (`core`, at run start; `orc lane phases` names
-the file and the layers). Lane token `route`, tier **Single-dispatch** —
-exactly ONE end-of-run packet, dispatched solo before `.current` is deleted.
-At run start write `log_dir/.current` = `run-route-<slug>-<DDMMYY>-<HHMMSS>.txt` AND
-`touch the trace file` of that name in the SAME step.
-Nothing else about the protocol is restated here; a phase that ends with
-`zero new trace lines is a protocol violation`.
+`../_shared/phases/trace.md` (`core`, at run start; `orc lane phases orc-route --json` →
+`trace_grammar` gives the verbs). Lane token `route`, tier
+**Single-dispatch**. At run start write `log_dir/.current` =
+`run-route-<slug>-<DDMMYY>-<HHMMSS>.txt` AND `touch the trace file` of that name
+in the SAME step. A phase that ends with `zero new trace lines is a protocol violation`.
 
 ## Rules this lane always keeps
 
@@ -163,33 +159,17 @@ Routes a plan, refuses anything else · zero agents, nothing dispatched · reuse
 only, never an ad-hoc `find` · reads no source file · never starts a lane the
 user did not accept · never edits config or any project file.
 
-## Config
-
-Resolve with `orc lane config orc-route --json` and obey `effective`. Never merge
-`.claude/orc.config.yaml` yourself, and never re-derive a precedence. Exit ≠ 0 →
-say so and use `../_shared/config-precedence.md`'s documented defaults, out
-loud. Nothing this lane reads is contested, gated or a stop, so it owes no
-preflight line and has no gate to honour.
-
-## Calls
-
-**ONE catalogue, and it is not you:** `orc lane calls orc-route --json` names every
-CLI call this lane makes, each with its exit-code contract, its cost, when to run
-it, and what an EMPTY answer means. Never invent a spelling, never re-word an
-exit code, and never re-derive a state word — the CLI's state words are the only
-state words, and **an exit code is an ANSWER wherever that contract says so, not
-a failure**. A call the answer does not name is a call this lane does not make.
-Exit ≠ 0 from the catalogue itself → say the CLI is unavailable and name the
-command you are about to run, out loud, before running it.
-
-## Rules — the anti-slop card (`../_shared/phases/rules.md`)
-
-`orc rules slice --lane orc-route --json` is the ONLY assembler; never build
-the card here. It rides under the house rules and above the task —
-**house rules > your project's rules > ORC's own packs** — and its `line` prints
-VERBATIM at preflight. Returns gain `rules_applied[]`, `rules_conflicts[]` (a gap,
-never a silent choice) and `rules_overridden[]`.
-## Waiting mid-run (`/orc-wait`)
-
-Canonical: `../_shared/wait.md`. **`a lane that waits without a hand-back` has broken this contract.**
-Checkpoint **none** · safe point **read-only, seconds long**. Nothing here to checkpoint, so all three modes behave identically — say so rather than asking. Never begin a wait between a dispatch and its validated return, or before the smoke gate has reported.
+## Lane contract (`../_shared/lane-contract.md` — read it ONLY when a call exits ≠ 0)
+
+- **Calls:** `orc lane calls orc-route --json` names every call and its exit codes.
+  **An exit code is an ANSWER where it says so, not a failure.** Make no other call.
+- **Config:** `orc lane config orc-route --json`. Obey `effective`. Never merge
+  `.claude/orc.config.yaml` yourself (`../_shared/config-precedence.md`). Nothing
+  here is contested, gated or a stop: no preflight line, no gate to honour.
+- **Rules:** `orc rules slice --lane orc-route --json` is the ONLY assembler
+  (`../_shared/phases/rules.md`). Its `line` prints VERBATIM at preflight.
+
+## Waiting mid-run (`/orc-wait`)
+
+Canonical: `../_shared/wait.md`. **`a lane that waits without a hand-back` has broken this contract.**
+Checkpoint **none** · safe point **read-only, seconds long**.

package/templates/skills/orc-test/SKILL.md

@@ -4,12 +4,9 @@ description: >
   Run the test against the real running system, and report only what was
   observed. Use for "/orc-test", "test my API end to end", "run the endpoints
   from happy path to security", "test this against staging", "e2e the login
-  flow". It brings the local system up (and STOPS and hands back if it will
-  not come up), finds the surface, digs the repo for the flow from the first
-  request into the target endpoint, expands the case matrix from happy path to
-  edge to abuse to security, RUNS every case, and writes the evidence and the
-  report into orc/orc-test/<slug>/. It never edits the system it is testing,
-  never commits, and never reports a result it did not observe.
+  flow". It brings the system up, expands the cases from happy path to security,
+  RUNS every case, and writes the evidence and the report into
+  orc/orc-test/<slug>/. It never edits the system it tests and never commits.
 ---
 
 # `/orc-test` — the lane that RUNS the test
@@ -172,26 +169,15 @@ Canonical contract: `../_shared/live-target.md`. Read it before phase T1.
   and offer: re-run a tier · widen the surface · `/orc-pact` the invariant this
   run proved · `/orc-challenge` the report. Never proceed on your own.
 
-## Config
+## Lane contract (`../_shared/lane-contract.md` — read it ONLY when a call exits ≠ 0)
 
-**ONE resolver, and it is not you:** `orc lane config orc-test --json`. Obey
-`effective`, print every line in `announce[]` VERBATIM at preflight, and honour
-`stops[]` before the first case runs. Never re-derive a value, a precedence or
-an inertness from `.claude/orc.config.yaml` — a key this lane does not read is
-not in the answer, and a key another key shadows comes back already marked.
-Exit ≠ 0 → say the CLI is unavailable and fall back to
-`../_shared/config-precedence.md`'s documented defaults, out loud. Priorities
-and families: `../_shared/config-precedence.md`.
-
-## Calls
-
-**ONE catalogue, and it is not you:** `orc lane calls orc-test --json` names
-every CLI call this lane makes, each with its exit-code contract, its cost, when
-to run it, and what an EMPTY answer means. Never invent a spelling, never
-re-word an exit code, and never re-derive a state word — the CLI's state words
-are the only state words, and **an exit code is an ANSWER wherever that contract
-says so, not a failure**. A call the answer does not name is a call this lane
-does not make.
+- **Calls:** `orc lane calls orc-test --json` names every call and its exit codes.
+  **An exit code is an ANSWER where it says so, not a failure.** Make no other call.
+- **Config:** `orc lane config orc-test --json`. Obey `effective`, print every line
+  in `announce[]` VERBATIM at preflight, and honour `stops[]` before the first case runs.
+  Never merge `.claude/orc.config.yaml` yourself (`../_shared/config-precedence.md`).
+- **Rules:** `orc rules slice --lane orc-test --json` is the ONLY assembler
+  (`../_shared/phases/rules.md`). Its `line` prints VERBATIM at preflight.
 
 ## Sending work off Claude (`orc extra`)
 
@@ -223,18 +209,11 @@ behind the disk. Keep the `Where it stands:` line at column 0.
 
 ## Trace
 
-Tier **Iterative** — one packet per completed cycle. Narration is DISPATCHED,
-never remembered: build the PHASE PACKET and dispatch
-`orc-trace-writer-haiku-4-5`. Canonical: `../_shared/phases/trace.md`.
-
-## Rules — the anti-slop card (`../_shared/phases/rules.md`)
-
-`orc rules slice --lane orc-test --json` is the ONLY assembler; never build
-the card here. It rides under the house rules and above the task —
-**house rules > your project's rules > ORC's own packs** — and its `line` prints
-VERBATIM at preflight. Returns gain `rules_applied[]`, `rules_conflicts[]` (a gap,
-never a silent choice) and `rules_overridden[]`.
+Tier **Iterative** — one packet per completed cycle. Pipe the PHASE PACKET to
+`orc trace write --packet -` (exit ≠ 0 → `orc-trace-writer-haiku-4-5`).
+Canonical: `../_shared/phases/trace.md`.
+
 ## Waiting mid-run (`/orc-wait`)
 
 Canonical: `../_shared/wait.md`. **`a lane that waits without a hand-back` has broken this contract.**
-Checkpoint **cycle** · safe point **case boundary**. `soft` FORCES that checkpoint and does NOT stop if the write fails; `hard` skips it and can lose an in-flight return. Never begin a wait mid-request — a long `orc test run` is the first ORC operation that takes minutes with no model in it, and the safe point is BETWEEN cases.
+Checkpoint **cycle** · safe point **case boundary**. Never begin a wait mid-request — a long `orc test run` is the first ORC operation that takes minutes with no model in it, and the safe point is BETWEEN cases.

package/templates/skills/orc-verify/SKILL.md

@@ -64,13 +64,11 @@ Verdict: <READY / NEEDS FIXES>
 
 ## Behavior trace (always on)
 
-`../_shared/phases/trace.md` (`core`, at run start; `orc lane phases` names
-the file and the layers). Lane token `verify`, tier **Single-dispatch** —
-exactly ONE end-of-run packet, dispatched solo before `.current` is deleted.
-At run start write `log_dir/.current` = `run-verify-<slug>-<DDMMYY>-<HHMMSS>.txt` AND
-`touch the trace file` of that name in the SAME step.
-Nothing else about the protocol is restated here; a phase that ends with
-`zero new trace lines is a protocol violation`.
+`../_shared/phases/trace.md` (`core`, at run start; `orc lane phases orc-verify --json` →
+`trace_grammar` gives the verbs). Lane token `verify`, tier
+**Single-dispatch**. At run start write `log_dir/.current` =
+`run-verify-<slug>-<DDMMYY>-<HHMMSS>.txt` AND `touch the trace file` of that name
+in the SAME step. A phase that ends with `zero new trace lines is a protocol violation`.
 
 ## Boundaries
 
@@ -80,33 +78,17 @@ Nothing else about the protocol is restated here; a phase that ends with
 - Reminder: to see usage limits, tell the user to run `/usage` (never invoke it
   programmatically).
 
-## Config
+## Lane contract (`../_shared/lane-contract.md` — read it ONLY when a call exits ≠ 0)
 
-Resolve with `orc lane config orc-verify --json` and obey `effective`. Never merge
-`.claude/orc.config.yaml` yourself, and never re-derive a precedence. Exit ≠ 0 →
-say so and use `../_shared/config-precedence.md`'s documented defaults, out
-loud. Nothing this lane reads is contested, gated or a stop, so it owes no
-preflight line and has no gate to honour.
+- **Calls:** `orc lane calls orc-verify --json` names every call and its exit codes.
+  **An exit code is an ANSWER where it says so, not a failure.** Make no other call.
+- **Config:** `orc lane config orc-verify --json`. Obey `effective`. Never merge
+  `.claude/orc.config.yaml` yourself (`../_shared/config-precedence.md`). Nothing
+  here is contested, gated or a stop: no preflight line, no gate to honour.
+- **Rules:** `orc rules slice --lane orc-verify --json` is the ONLY assembler
+  (`../_shared/phases/rules.md`). Its `line` prints VERBATIM at preflight.
 
-## Calls
-
-**ONE catalogue, and it is not you:** `orc lane calls orc-verify --json` names every
-CLI call this lane makes, each with its exit-code contract, its cost, when to run
-it, and what an EMPTY answer means. Never invent a spelling, never re-word an
-exit code, and never re-derive a state word — the CLI's state words are the only
-state words, and **an exit code is an ANSWER wherever that contract says so, not
-a failure**. A call the answer does not name is a call this lane does not make.
-Exit ≠ 0 from the catalogue itself → say the CLI is unavailable and name the
-command you are about to run, out loud, before running it.
-
-## Rules — the anti-slop card (`../_shared/phases/rules.md`)
-
-`orc rules slice --lane orc-verify --json` is the ONLY assembler; never build
-the card here. It rides under the house rules and above the task —
-**house rules > your project's rules > ORC's own packs** — and its `line` prints
-VERBATIM at preflight. Returns gain `rules_applied[]`, `rules_conflicts[]` (a gap,
-never a silent choice) and `rules_overridden[]`.
 ## Waiting mid-run (`/orc-wait`)
 
 Canonical: `../_shared/wait.md`. **`a lane that waits without a hand-back` has broken this contract.**
-Checkpoint **none** · safe point **single dispatch**. Nothing here to checkpoint, so all three modes behave identically — say so rather than asking. Never begin a wait between a dispatch and its validated return, or before the smoke gate has reported.
+Checkpoint **none** · safe point **single dispatch**.

package/templates/skills/orc-wait/SKILL.md

@@ -1,163 +1,156 @@
----
-name: orc-wait
-description: >
-  Wait for wall-clock time to pass without losing the run you are in. Use for
-  "/orc-wait", "/orc-wait 30", "/orc-wait 2h hard", "wait for my quota to
-  reset", "pause this until the window resets". You watched the statusline, you
-  saw the window was almost full, and you decided to stop — this carries that
-  decision out: it writes the hand-back, waits in short detached hops that cost
-  ZERO tokens, and picks the run back up where it left it. Three modes decide
-  how much finishes before it stops: safe (finish the wave), soft (stop now, but
-  force the checkpoint first), hard (stop now, RESUME.md only, can lose work).
-  Also carries the veto — "/orc-wait block <reason>" tells ORC not to stop you
-  at all. It never dispatches an agent, never runs another lane, and never
-  writes your config.
----
-
-# ORC — the wait
-
-Canonical contract: **`_shared/wait.md`**. Load it before you do anything here.
-This spine is the entry point; that file is the rule.
-
-> **`a lane that waits without a hand-back` has broken this contract.**
-
-A wait is a stop. Every stop writes its hand-back BEFORE it ends, because the
-thing that resumes the run may not be this session.
-
-## What this lane never does
-
-- It never dispatches an agent to do the waiting. An agent runs on the same
-  account and burns the window the wait exists to protect.
-- It never runs another lane, and never changes the work: same tasks, same
-  slice, same agent resolve after the wait as before it.
-- It never writes the user's config.
-- It never computes hops itself. `orc wait plan` does that.
-- It is **command-entry only.** No lane invokes `/orc-wait` for itself.
-
-## W1 — parse (silent)
-
-Run `orc wait plan <spec> --json`. Never do this arithmetic in your head.
-
-| exit | meaning | what you do |
-|---|---|---|
-| 0 | planned | go to W2 |
-| 1 | unparsable | show the `hint` verbatim and STOP. Do not guess a duration. |
-| 2 | no reading | show the `hint` verbatim and STOP. `reset` needs a usage reading; ask for a time instead. |
-
-`block` / `unblock` skip W1 entirely — see **The veto** below.
-
-## W2 — resolve the mode
-
-A named mode always wins. With none, read `wait_default_mode`:
-
-- `ask` (the default) → ask, in ONE turn, with the cost of each spelled out:
-
-  ```
-  Which mode?
-    1. safe — finish the current wave first, then wait. Loses nothing.
-    2. soft — stop at the next turn. Forces the checkpoint first.
-    3. hard — stop at the next turn. No checkpoint. Can lose the wave.
-  ```
-- `safe` | `soft` | `hard` → use it, and say which one you used and why.
-
-If `orc wait lanes --json` reports `modes_differ: false` for the lane in flight
-(nothing to checkpoint), SAY SO and do not ask — the three modes are identical
-there, and asking a question with one real answer wastes a turn.
-
-## W3 — reach the stop point
-
-Answer the user IMMEDIATELY, before you reach it. A queued command that looks
-ignored reads as a broken command.
-
-```
-⏸ I got your wait. 30 minutes, soft.
-   Wave 3 is running. I do not stop a dispatch in the middle.
-   I stop as soon as wave 3's returns are validated.
-```
-
-| mode | stop at |
-|---|---|
-| `safe` | the next SAFE POINT — see the table in `_shared/wait.md` |
-| `soft` | the next model turn |
-| `hard` | the next model turn |
-
-**Never begin a wait** between a dispatch and its validated return, inside the
-stop sequence, during a file write, or before the smoke gate has reported. That
-holds in every mode, `hard` included.
-
-Never write "immediately". `hard` stops at the first moment ORC can act.
-
-## W4 — hand back (the step that is never skipped)
-
-| mode | what you write |
-|---|---|
-| `safe`, `soft` | the FULL stop sequence — `_shared/phases/stop-resume.md`, steps 2–3b |
-| `hard` | `RESUME.md` ONLY, with your own hand, never a dispatched agent |
-
-**`soft` is FORCED.** If the checkpoint write fails, **do not stop**. Report the
-failure and stay in the run. Stopping without a good checkpoint is the one thing
-that loses work.
-
-`hard` is the dispatch-free stop: it writes only what ORC can write itself, and
-that is exactly why it is fast. When you use it, name what may be lost:
-
-```
-⚠ hard: wave 3 had 2 dispatches in flight. Their file writes may still land,
-   but their returns are not validated. RESUME.md records this.
-```
-
-## W5 — hop
-
-Run each hop as a **detached** command so no model is running and no tokens are
-spent. One hop per entry in `hops[]` from W1.
-
-After every hop:
-
-1. `orc usage check --json` (exit 0 → the window recovered; go to W6)
-2. `orc wait status --json` — `cancel_requested: true` → stop hopping, go to W6
-3. otherwise, the next hop
-
-Print the END TIME every hop, not only the length: "hop 2 of 4, ends 19:14".
-A user who cannot see when a wait ends cannot tell it from a hang.
-
-## W6 — come back
-
-Read `context` from `orc usage check --json`.
-
-- **context small** → continue the run here, in one line.
-- **context large** → STOP. Offer both paths, and recommend the fresh session:
-
-  ```
-  The wait ended.  usage: 5h 9% (4h51m) · context: 81%
-
-    Context is large, and the prompt cache expired during the wait.
-      → new session, then:  orc resume <slug>
-    Or reply `continue` to go on here.
-  ```
-
-ORC cannot clear its own context — `/clear` is the user's action. Offer the
-swap; never claim to have performed it.
-
-## The veto — `block` and `unblock`
-
-`/orc-wait block <reason>` → `orc wait block <slug> --reason "<why>"`.
-
-- The CLI writes it. You never write `wait.json` yourself.
-- **The reason is required.** Exit 1 means you must ask for one — relay the
-  refusal, never invent a reason on the user's behalf.
-- It suppresses what ORC COMPUTES, never what the user TYPES. A typed
-  `/orc-wait 30 hard` still waits while a block is active.
-- Re-announce it, with its age, at EVERY gate it suppresses. There is no
-  auto-expiry.
-
-`orc wait cancel` is a DIFFERENT thing: it ends a wait already running. Block is
-before, cancel is during. Never present them as the same choice.
-
-## Trace
-
-The CLI writes the `WAIT` lines itself, into the trace already open. You do not
-narrate them and you do not repeat them.
-
-`/orc-wait` opens no run, so it is **not a lane** in the trace enum and writes
-no `run-<lane>-<slug>` pointer — the `/orc-explain` precedent. With no run in
-flight, a wait is simply a wait and nothing is traced.
+---
+name: orc-wait
+description: >
+  Wait for wall-clock time to pass without losing the run you are in. Use for
+  "/orc-wait", "/orc-wait 30", "/orc-wait 2h hard", "wait for my quota to
+  reset", "pause this until the window resets". It writes the hand-back, waits
+  in detached hops that cost ZERO tokens, and picks the run back up. Modes: safe
+  (finish the wave), soft (checkpoint, then stop), hard (stop now). "/orc-wait
+  block <reason>" is the veto.
+---
+
+# ORC — the wait
+
+Canonical contract: **`_shared/wait.md`**. Load it before you do anything here.
+This spine is the entry point; that file is the rule.
+
+> **`a lane that waits without a hand-back` has broken this contract.**
+
+A wait is a stop. Every stop writes its hand-back BEFORE it ends, because the
+thing that resumes the run may not be this session.
+
+## What this lane never does
+
+- It never dispatches an agent to do the waiting. An agent runs on the same
+  account and burns the window the wait exists to protect.
+- It never runs another lane, and never changes the work: same tasks, same
+  slice, same agent resolve after the wait as before it.
+- It never writes the user's config.
+- It never computes hops itself. `orc wait plan` does that.
+- It is **command-entry only.** No lane invokes `/orc-wait` for itself.
+
+## W1 — parse (silent)
+
+Run `orc wait plan <spec> --json`. Never do this arithmetic in your head.
+
+| exit | meaning | what you do |
+|---|---|---|
+| 0 | planned | go to W2 |
+| 1 | unparsable | show the `hint` verbatim and STOP. Do not guess a duration. |
+| 2 | no reading | show the `hint` verbatim and STOP. `reset` needs a usage reading; ask for a time instead. |
+
+`block` / `unblock` skip W1 entirely — see **The veto** below.
+
+## W2 — resolve the mode
+
+A named mode always wins. With none, read `wait_default_mode`:
+
+- `ask` (the default) → ask, in ONE turn, with the cost of each spelled out:
+
+  ```
+  Which mode?
+    1. safe — finish the current wave first, then wait. Loses nothing.
+    2. soft — stop at the next turn. Forces the checkpoint first.
+    3. hard — stop at the next turn. No checkpoint. Can lose the wave.
+  ```
+- `safe` | `soft` | `hard` → use it, and say which one you used and why.
+
+If `orc wait lanes --json` reports `modes_differ: false` for the lane in flight
+(nothing to checkpoint), SAY SO and do not ask — the three modes are identical
+there, and asking a question with one real answer wastes a turn.
+
+## W3 — reach the stop point
+
+Answer the user IMMEDIATELY, before you reach it. A queued command that looks
+ignored reads as a broken command.
+
+```
+⏸ I got your wait. 30 minutes, soft.
+   Wave 3 is running. I do not stop a dispatch in the middle.
+   I stop as soon as wave 3's returns are validated.
+```
+
+| mode | stop at |
+|---|---|
+| `safe` | the next SAFE POINT — see the table in `_shared/wait.md` |
+| `soft` | the next model turn |
+| `hard` | the next model turn |
+
+**Never begin a wait** between a dispatch and its validated return, inside the
+stop sequence, during a file write, or before the smoke gate has reported. That
+holds in every mode, `hard` included.
+
+## W4 — hand back (the step that is never skipped)
+
+| mode | what you write |
+|---|---|
+| `safe`, `soft` | the FULL stop sequence — `_shared/phases/stop-resume.md`, steps 2–3b |
+| `hard` | `RESUME.md` ONLY, with your own hand, never a dispatched agent |
+
+**`soft` is FORCED.** If the checkpoint write fails, **do not stop**. Report the
+failure and stay in the run. Stopping without a good checkpoint is the one thing
+that loses work.
+
+`hard` is the dispatch-free stop: it writes only what ORC can write itself, and
+that is exactly why it is fast. When you use it, name what may be lost:
+
+```
+⚠ hard: wave 3 had 2 dispatches in flight. Their file writes may still land,
+   but their returns are not validated. RESUME.md records this.
+```
+
+## W5 — hop
+
+Run each hop as a **detached** command so no model is running and no tokens are
+spent. One hop per entry in `hops[]` from W1.
+
+After every hop:
+
+1. `orc usage check --json` (exit 0 → the window recovered; go to W6)
+2. `orc wait status --json` — `cancel_requested: true` → stop hopping, go to W6
+3. otherwise, the next hop
+
+Print the END TIME every hop, not only the length: "hop 2 of 4, ends 19:14".
+A user who cannot see when a wait ends cannot tell it from a hang.
+
+## W6 — come back
+
+Read `context` from `orc usage check --json`.
+
+- **context small** → continue the run here, in one line.
+- **context large** → STOP. Offer both paths (H `any.stop.where`), and recommend the fresh session:
+
+  ```
+  The wait ended.  usage: 5h 9% (4h51m) · context: 81%
+
+    Context is large, and the prompt cache expired during the wait.
+      → new session, then:  orc resume <slug>
+    Or reply `continue` to go on here.
+  ```
+
+**Habits:** the run in flight had `habits{}` in its config answer → read
+`../_shared/habits.md`; its next packet takes the `ASK`. No `habits{}` → ignore `(H …)`.
+
+## The veto — `block` and `unblock`
+
+`/orc-wait block <reason>` → `orc wait block <slug> --reason "<why>"`.
+
+- The CLI writes it. You never write `wait.json` yourself.
+- **The reason is required.** Exit 1 means you must ask for one — relay the
+  refusal, never invent a reason on the user's behalf.
+- It suppresses what ORC COMPUTES, never what the user TYPES. A typed
+  `/orc-wait 30 hard` still waits while a block is active.
+- Re-announce it, with its age, at EVERY gate it suppresses. There is no
+  auto-expiry.
+
+`orc wait cancel` is a DIFFERENT thing: it ends a wait already running. Block is
+before, cancel is during. Never present them as the same choice.
+
+## Trace
+
+The CLI writes the `WAIT` lines itself, into the trace already open. You do not
+narrate them and you do not repeat them.
+
+`/orc-wait` opens no run, so it is **not a lane** in the trace enum and writes
+no `run-<lane>-<slug>` pointer — the `/orc-explain` precedent. With no run in
+flight, a wait is simply a wait and nothing is traced.