@dpeek/codeless 0.1.3 → 0.1.5

package/README.md

@@ -100,16 +100,20 @@ Review and commit those local prompt edits in the invoking checkout, then bring
 that commit onto the configured integration branch before creating streams.
 Required prompts and directions must exist for stream creation and opening.
 
-The package-owned planner extension activates every planner session. Before its
-first project prompt, it requires the exact `<slug>-planner` Pi name and verifies
-the `<slug>_planner` Herdr identity, managed interactive readiness, foreground
-worktree, and matching native session reference from Herdr's Pi lifecycle
-integration. It confirms `approve_stream_change`,
-`dispatch_stream_implementer`, `rework_stream_implementer`, `finish_stream_implementer`, and `next_stream_change` are active. Missing or
-incompatible activation, identity mismatch, or inactive tools stops before
-`/change`. During session replacement, activation allows a brief bounded wait for
-an otherwise-valid Herdr identity to publish the current native Pi reference;
-it never waits on a wrong name, process, lifecycle source, or worktree. Global
+The package-owned planner extension admits each newly launched planner using
+its exact `<slug>-planner` Pi name, `<slug>_planner` Herdr identity, managed
+readiness, canonical worktree, and official Pi lifecycle integration. It checks
+that all five planner tools are active before sending `/change` and binds the
+admitted process, pane, worktree, name, and live session ID.
+
+After landing, replacement activation uses a one-use ticket held in that Pi
+process, bound to the new conversation's session ID. It verifies the local
+identity, effective model/thinking selection, and tools without querying Herdr's
+asynchronous status. Saved session entries cannot replay a handoff. Codeless
+requires activation acknowledgement before submitting `/change` exactly once;
+failed or cancelled handoffs never retry automatically. After a failed
+replacement, exit Pi and reopen the stream from another Herdr shell. Herdr's
+integration still supplies monitoring and external agent control. Global
 installation of Codeless's extension is unnecessary.
 The approval tool has no arguments. Its extension derives the active
 `<slug>-planner` Pi session and passes it to the backing CLI, which requires it
@@ -131,7 +135,13 @@ replaces the Pi session in the same pane. It preserves the planner name, applies
 the planner selection read and validated after the stream fast-forwards to the
 captured integration commit, then activates and verifies the replacement before
 sending `/change` after resources reload. The previous conversation is not copied; the
-journal and project files carry context.
+journal and project files carry context. The fresh planner reads repository guidance,
+its journal, and current direction first. It stops on wholly gated work, uses the
+latest numbered change only for active or ambiguous recovery, and reads older changes
+only for journal-linked unresolved decisions. After selecting an ungated candidate it
+reads relevant contracts and implementation; after a fast-forward it also rereads
+current direction and files affected by incoming commits, without mining deleted or
+historical documents for work.
 
 This uses Pi's `newSession({ setup, withSession })` command API, verified with
 Pi 0.85.1. Only the replacement context activates the selection and sends the
@@ -228,8 +238,10 @@ only when absent, and uses `herdr agent start` for named, readiness-checked Pi
 startup. It verifies the result before sending activation. An occupied or
 mismatched pane, unmanaged agent, ambiguous layout, or failed startup stops;
 Codeless never takes over an existing agent. Pi's display name is separate from
-Herdr's managed agent name. Activation verifies names and native session binding;
-it never renames an unmanaged process. There is no direct `planner` command.
+Herdr's managed agent name. Launch admission verifies both names, lifecycle
+authority, and worktree; subsequent conversation replacements use the local
+handoff described above. Codeless never renames an unmanaged process. There is
+no direct `planner` command.
 
 Dispatch validates the implementer selection before touching the planner's
 right-hand pane, starts a fresh ephemeral implementer with Codeless's reporting
@@ -276,10 +288,11 @@ the integration checkout. Success releases the lock. Other branches and
 checkouts are untouched; no push is performed.
 
 Another lock owner causes a stop, without queuing or polling. Rebase conflicts
-or failed checks retain ownership. Resolve the existing failure, then rerun
-`land`; it verifies the recorded integration commit has not changed. To abandon
-a landing, inspect the owner/base and Git state before manually removing the
-lock. There is no automatic stale-lock removal or retry.
+or failed checks retain ownership. During conflict resolution, run focused checks
+when useful; rerun `land` for the configured full check, which it alone owns.
+It verifies the recorded integration commit has not changed. To abandon a landing,
+inspect the owner/base and Git state before manually removing the lock. There is
+no automatic stale-lock removal or retry.
 
 `next` is the session handoff's preparation command. It requires the stream's
 own clean worktree and latest numbered change, a full commit hash present in its

package/extension/planner.js

@@ -1,11 +1,10 @@
 import { fileURLToPath } from "node:url";
-import { resolve } from "node:path";
+import { realpathSync } from "node:fs";
+import { randomUUID } from "node:crypto";
 import { validAttempt } from "../src/attempt.ts";
 
 const codeless = fileURLToPath(new URL("../bin/codeless", import.meta.url));
 const thinkingLevels = new Set(["off", "minimal", "low", "medium", "high", "xhigh", "max"]);
-const nativeSessionAttempts = 20;
-const nativeSessionRetryDelayMs = 50;
 const requiredTools = [
   "approve_stream_change",
   "dispatch_stream_implementer",
@@ -30,32 +29,66 @@ function selection(value) {
   return { provider: value.provider, model: value.model, thinking: value.thinking };
 }
 
+// Pi reloads extension modules when replacing a session. Keep only in-flight
+// tickets on the process global; neither persisted entries nor a module cache
+// can establish handoff provenance. Every ticket is removed on consume/finally.
+const handoffKey = Symbol.for("@dpeek/codeless/planner-handoffs");
+const handoffs = (globalThis[handoffKey] ??= new Map());
+
+function worktree(cwd) {
+  try {
+    return realpathSync(cwd);
+  } catch {
+    throw new Error("Codeless could not resolve the planner worktree");
+  }
+}
+
 export default function plannerExtension(pi) {
   let registered = false;
   let pending;
+  let admitted;
 
   pi.registerCommand("streams-activate", {
     description: "Verify this planner session before starting its project prompt",
     handler: async (args, ctx) => {
-      let prompt;
+      let input;
       try {
-        prompt = JSON.parse(args);
+        input = JSON.parse(args);
       } catch {
-        throw new Error("Codeless activation requires one JSON-quoted project prompt");
+        throw new Error("Codeless activation requires a JSON prompt or handoff ticket");
       }
-      if (typeof prompt !== "string" || !prompt.startsWith("/change ")) {
+      const replacement = typeof input === "object" && input !== null;
+      const ticket = replacement ? handoffs.get(input.handoff) : undefined;
+      if (replacement) {
+        handoffs.delete(input.handoff);
+        if (!ticket) throw new Error("Codeless handoff is missing, expired, or already consumed");
+      } else if (typeof input !== "string" || !input.startsWith("/change ")) {
         throw new Error("Codeless activation requires a /change project prompt");
       }
-      const activation = ctx.sessionManager
-        .getEntries()
-        .findLast(
-          (entry) =>
-            entry.type === "custom" &&
-            entry.customType === "streams-role-selection" &&
-            entry.data?.role === "planner",
-        );
-      if (activation) {
-        const requested = selection(activation.data.selection);
+      if (admitted) throw new Error("Codeless planner session is already activated");
+      const sessionName = pi.getSessionName();
+      const match = /^([a-z][a-z0-9-]{0,23})-planner$/.exec(sessionName ?? "");
+      if (!match)
+        throw new Error("Codeless activation requires an exact <slug>-planner Pi session name");
+      const expectedPlanner = `${match[1].replaceAll("-", "_")}_planner`;
+      const pane = process.env.HERDR_PANE_ID;
+      if (!pane) throw new Error("Codeless activation requires a Herdr-managed planner pane");
+      const cwd = worktree(ctx.cwd);
+      const sessionId = ctx.sessionManager.getSessionId();
+      if (replacement) {
+        if (
+          ticket.binding.pid !== process.pid ||
+          ticket.binding.pane !== pane ||
+          ticket.binding.cwd !== cwd ||
+          ticket.binding.sessionName !== sessionName ||
+          ticket.sessionId !== sessionId ||
+          ticket.binding.sessionId === sessionId
+        ) {
+          throw new Error(
+            "Codeless handoff does not match this planner process, pane, worktree, or session",
+          );
+        }
+        const requested = ticket.selection;
         const reference = `${requested.provider}/${requested.model}`;
         const model = ctx.modelRegistry.find(requested.provider, requested.model);
         if (!model) throw new Error(`Planner requested ${reference}, but Pi could not find it`);
@@ -68,36 +101,26 @@ export default function plannerExtension(pi) {
           ctx.model.id !== requested.model ||
           pi.getThinkingLevel() !== requested.thinking
         ) {
-          const effective = ctx.model ? `${ctx.model.provider}/${ctx.model.id}` : "no model";
           throw new Error(
-            `Planner requested ${reference} at thinking level ${requested.thinking}, but Pi applied ${effective} at ${pi.getThinkingLevel()}`,
+            `Codeless planner could not apply ${reference} at thinking level ${requested.thinking}`,
           );
         }
-      }
-      const sessionName = pi.getSessionName();
-      const match = /^([a-z][a-z0-9-]{0,23})-planner$/.exec(sessionName ?? "");
-      if (!match)
-        throw new Error("Codeless activation requires an exact <slug>-planner Pi session name");
-      const expectedPlanner = `${match[1].replaceAll("-", "_")}_planner`;
-      const pane = process.env.HERDR_PANE_ID;
-      if (!pane) throw new Error("Codeless activation requires a Herdr-managed planner pane");
-      const plannerIdentity = async () => {
-        const identity = await pi.exec("herdr", ["agent", "get", pane], { timeout: 30_000 });
-        if (identity.code !== 0) {
-          throw new Error(
-            identity.stderr.trim() ||
-              identity.stdout.trim() ||
-              "Codeless could not verify Herdr planner identity",
-          );
-        }
-        try {
-          return JSON.parse(identity.stdout).result?.agent;
-        } catch {
-          throw new Error("Herdr returned an invalid planner identity response");
-        }
-      };
-      const attempts = activation ? nativeSessionAttempts : 1;
-      for (let attempt = 0; attempt < attempts; attempt += 1) {
+      } else {
+        const plannerIdentity = async () => {
+          const identity = await pi.exec("herdr", ["agent", "get", pane], { timeout: 30_000 });
+          if (identity.code !== 0) {
+            throw new Error(
+              identity.stderr.trim() ||
+                identity.stdout.trim() ||
+                "Codeless could not verify Herdr planner identity",
+            );
+          }
+          try {
+            return JSON.parse(identity.stdout).result?.agent;
+          } catch {
+            throw new Error("Herdr returned an invalid planner identity response");
+          }
+        };
         const agent = await plannerIdentity();
         if (agent?.name !== expectedPlanner) {
           throw new Error(
@@ -107,36 +130,17 @@ export default function plannerExtension(pi) {
         if (agent.agent !== "pi" || agent.interactive_ready !== true) {
           throw new Error("Codeless requires a Herdr-managed Pi planner started by codeless open");
         }
-        if (
-          typeof agent.foreground_cwd !== "string" ||
-          resolve(agent.foreground_cwd) !== resolve(ctx.cwd)
-        ) {
+        if (typeof agent.foreground_cwd !== "string" || worktree(agent.foreground_cwd) !== cwd) {
           throw new Error("Codeless planner worktree does not match Herdr's foreground cwd");
         }
         const session = agent.agent_session;
-        const expectedSession =
-          session?.kind === "path"
-            ? ctx.sessionManager.getSessionFile()
-            : session?.kind === "id"
-              ? ctx.sessionManager.getSessionId()
-              : undefined;
         if (
           agent.screen_detection_skipped !== true ||
           session?.source !== "herdr:pi" ||
-          session.agent !== "pi" ||
-          !expectedSession
+          session.agent !== "pi"
         ) {
-          throw new Error(
-            "Codeless planner native session does not match Herdr's Pi lifecycle integration",
-          );
+          throw new Error("Codeless planner requires Herdr's Pi lifecycle integration");
         }
-        if (session.value === expectedSession) break;
-        if (attempt === attempts - 1) {
-          throw new Error(
-            "Codeless planner native session does not match Herdr's Pi lifecycle integration",
-          );
-        }
-        await new Promise((resolveDelay) => setTimeout(resolveDelay, nativeSessionRetryDelayMs));
       }
       const activeTools = ctx.getSystemPromptOptions().selectedTools ?? [];
       const missing = requiredTools.filter((tool) => !activeTools.includes(tool));
@@ -145,8 +149,10 @@ export default function plannerExtension(pi) {
           `Codeless planner activation is missing required tools: ${missing.join(", ")}`,
         );
       }
+      admitted = { pid: process.pid, pane, cwd, sessionName, sessionId };
       ctx.ui.notify(`Planner activated: ${sessionName} / ${expectedPlanner}`, "info");
-      pi.sendUserMessage(prompt, { expandPromptTemplates: true });
+      if (ticket) ticket.activated = true;
+      else pi.sendUserMessage(input, { expandPromptTemplates: true });
     },
   });
 
@@ -156,8 +162,18 @@ export default function plannerExtension(pi) {
       if (!pending || pending.running) throw new Error("No pending Codeless handoff");
       const request = pending;
       request.running = true;
+      let token;
       try {
         await ctx.waitForIdle();
+        if (
+          !admitted ||
+          admitted.pid !== process.pid ||
+          admitted.pane !== process.env.HERDR_PANE_ID ||
+          admitted.cwd !== worktree(ctx.cwd) ||
+          admitted.sessionId !== ctx.sessionManager.getSessionId() ||
+          admitted.sessionName !== pi.getSessionName()
+        )
+          throw new Error("Codeless handoff requires the activated planner session");
         const execution = await pi.exec(
           "bun",
           [codeless, "next", request.changePath, request.landedCommit],
@@ -181,23 +197,39 @@ export default function plannerExtension(pi) {
           throw new Error("Codeless returned an invalid planner handoff");
         }
         const requested = selection(requestedValue);
+        token = randomUUID();
+        const ticket = {
+          binding: admitted,
+          selection: requested,
+          sessionId: undefined,
+          activated: false,
+        };
+        handoffs.set(token, ticket);
         const result = await ctx.newSession({
           setup: async (sm) => {
             sm.appendSessionInfo(sessionName);
-            sm.appendCustomEntry("streams-role-selection", {
-              role: "planner",
-              selection: requested,
-            });
+            ticket.sessionId = sm.getSessionId();
           },
           withSession: async (replacement) => {
-            await replacement.sendUserMessage(`/streams-activate ${JSON.stringify(prompt)}`, {
-              expandPromptTemplates: true,
-            });
+            await replacement.sendUserMessage(
+              `/streams-activate ${JSON.stringify({ handoff: token })}`,
+              {
+                expandPromptTemplates: true,
+              },
+            );
+            // Pi displays command errors instead of rejecting sendUserMessage.
+            // Require an explicit receipt before submitting the project prompt.
+            if (!ticket.activated)
+              throw new Error(
+                "Codeless replacement activation failed; exit Pi and reopen the stream",
+              );
+            await replacement.sendUserMessage(prompt, { expandPromptTemplates: true });
           },
         });
         if (result.cancelled)
           throw new Error("Codeless handoff cancelled; the current session was retained");
       } finally {
+        if (token) handoffs.delete(token);
         pending = undefined;
       }
     },
@@ -233,6 +265,7 @@ export default function plannerExtension(pi) {
         additionalProperties: false,
       },
       async execute(_toolCallId, params) {
+        if (!admitted) throw new Error("Codeless handoff requires an activated planner");
         if (pending) throw new Error("A Codeless handoff is already pending");
         pending = {
           changePath: params.changePath.replace(/^@/, ""),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dpeek/codeless",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "An attended planner and implementer workflow for parallel capability development",
   "homepage": "https://github.com/dpeek/codeless#readme",
   "bugs": {

package/prompts/change.md

@@ -5,11 +5,11 @@ argument-hint: "<stream-directory> <direction-file>"
 
 You are the planner for the stream at `$1`. The current working directory is the stream's repository worktree.
 
-Read the repository guidance, `.codeless/config.json`, `$1/planner.md`, every numbered Markdown file in `$1/changes/`, `$2`, its related contracts, and the current implementation relevant to the stream. Resolve the integration branch from that configuration.
+First read the repository guidance, `$1/planner.md`, and `$2`. Read `.codeless/config.json` to resolve the integration branch. Current direction is authoritative for candidate discovery: do not mine deleted or historical documents for work when it is clear. If `planner.md` shows no active work and current direction has no ungated worthwhile candidate, stop rather than reading more context.
 
-Before proposing, inspect the branch, recent commits, and worktree. If changes are not explained as an active approved change in `planner.md`, stop and show the operator the evidence. Never discard work automatically.
+Before proposing, inspect the branch, recent commits, and worktree. If changes are not explained as an active approved change in `planner.md`, stop and show the operator the evidence. Never discard work automatically. Read the latest numbered change only when active or ambiguous work needs recovery. Read an older numbered change only when `planner.md` identifies its unresolved decision as still relevant.
 
-If the latest numbered change is approved but uncommitted, resume it. If it is committed but unlanded on the configured integration branch, resume review or landing. Otherwise require a clean worktree with no commits outside the configured integration branch, fast-forward to that branch, and reread the direction and affected contracts. Stop on divergence. Once planning begins, keep that stream commit as the proposal's base; do not resynchronize merely because integration advances while the proposal awaits approval. Locked landing owns the later rebase.
+If the latest numbered change is approved but uncommitted, resume it. If it is committed but unlanded on the configured integration branch, resume review or landing. Otherwise select an ungated candidate from current direction, require a clean worktree with no commits outside the configured integration branch, and fast-forward to that branch. After fast-forwarding, reread `$2`, every file affected by incoming commits, and the affected contracts and implementation; do not mine deleted or historical documents. Stop on divergence. Once planning begins, keep that stream commit as the proposal's base; do not resynchronize merely because integration advances while the proposal awaits approval. Locked landing owns the later rebase.
 
 Propose exactly one small, complete change and write it to `$1/change.md`:
 

package/prompts/commit.md

@@ -32,6 +32,6 @@ The next planner proposes one change and waits for the operator's `go`; this han
 There are two expected landing stops:
 
 - If another stream owns the integration slot, leave this stream committed where it is, report the owner, and wait. Do not poll, queue, or retry automatically.
-- If this stream owns the slot and the rebase conflicts, keep the slot. Resolve the conflicts in this worktree so both the current configured integration branch and the approved change are preserved, stage the resolutions, and continue the rebase with `GIT_EDITOR=true git rebase --continue`. Repeat until the rebase completes, run the relevant checks, then run `codeless land <slug>` again to finish. The slot prevents another automated landing from moving the integration branch while you resolve it.
+- If this stream owns the slot and the rebase conflicts, keep the slot. Resolve the conflicts in this worktree so both the current configured integration branch and the approved change are preserved, stage the resolutions, and continue the rebase with `GIT_EDITOR=true git rebase --continue`. Repeat until the rebase completes. Run focused checks when useful to validate a resolution, then run `codeless land <slug>` again to finish; `land` alone runs the configured full check. The slot prevents another automated landing from moving the integration branch while you resolve it.
 
 For any other failure while this stream owns the slot, report the exact state and wait for the operator. The slot remains held for deliberate recovery; never remove the workspace's landing lock automatically or on guesswork.

package/spec/workflow.md

@@ -137,26 +137,39 @@ the stream worktree; occupied, mismatched, or ambiguous layouts stop unchanged.
 The operator must invoke opening from outside those target panes. Reopening an
 existing managed planner focuses it without installation or another prompt.
 
-The package-owned extension activates creation, reopening, and post-landing
-replacement. Before the first project prompt it requires the exact
-`<slug>-planner` Pi name, `<slug-with-hyphens-replaced>_planner` Herdr name,
-managed interactive readiness, matching foreground worktree, and the current
-native Pi session ID/file reported by Herdr's official Pi lifecycle integration.
-It verifies `approve_stream_change`, `dispatch_stream_implementer`,
-`rework_stream_implementer`, `finish_stream_implementer`, and `next_stream_change`
-are active. During replacement, an otherwise-valid previous native session
-reference receives a brief bounded synchronization wait; a wrong name, process,
-lifecycle source, or worktree fails immediately. Any binding that remains missing
-or incompatible stops visibly before `/change`. Activation never repairs names.
-The direct `planner` command is removed;
-recovery exits Pi deliberately and reopens from another Herdr shell.
-
-Pi session replacement keeps the managed process and Herdr name while changing
-its native conversation reference. Codeless revalidates that new binding before
-prompting the replacement. Implementers use the corresponding `_impl` and
-`-impl` names. Codeless loads its own extension explicitly; Herdr's official Pi
-integration supplies lifecycle and native-session reporting. This boundary was
-verified against Herdr 0.8.2 and Pi 0.85.1.
+The package-owned extension admits a newly launched planner after checking its
+exact `<slug>-planner` Pi name, `<slug-with-hyphens-replaced>_planner` Herdr
+name, managed interactive readiness, canonical foreground worktree, official Pi
+lifecycle authority and reporter, and active planner tools. Admission binds the
+process ID, pane, canonical worktree, planner name, and native Pi session ID.
+Activation never repairs names or submits the initial prompt twice. The direct
+`planner` command is removed; recovery exits Pi deliberately and reopens from
+another Herdr shell.
+
+Post-landing conversation replacement uses that admission, without querying
+Herdr. After idle and workflow validation, Codeless creates a one-use in-memory
+handoff ticket for the admitted parent and requested model/thinking selection.
+Pi's `newSession` setup binds it to the newly allocated native session ID;
+`withSession` invokes activation in the fresh extension. Activation consumes the
+ticket before checking the same process, pane, canonical worktree and planner
+name, a distinct matching replacement session, effective selection, and active
+tools. Saved session entries cannot authorize a handoff. The ticket registry
+survives Pi's extension module reload within the process, but no ticket survives
+consumption, cancellation, failure, or process exit.
+
+Pi displays extension-command errors without rejecting the command submission.
+Codeless therefore requires an explicit activation acknowledgement before
+`withSession` submits the project prompt exactly once through the replacement
+context. Missing acknowledgement stops visibly. Neither old Pi contexts nor
+Herdr's asynchronous lifecycle or native-session snapshots participate in
+replacement activation. Delayed, missing, or rejected lifecycle reports cannot
+block this local handoff. Cancellation retains the old conversation; failed
+replacement requires deliberate exit and reopen, with no automatic retry.
+
+Herdr's official Pi integration remains responsible for lifecycle monitoring,
+external agent control, and native-session restore reporting. Implementers use
+the corresponding `_impl` and `-impl` names. Codeless loads its own extension
+explicitly. This boundary was checked against Herdr 0.8.2 and Pi 0.85.1.
 
 ## Dispatch and review
 
@@ -213,7 +226,8 @@ integration commit.
 If the integration branch advanced, landing rebases the single stream commit. It then
 rereads and runs the configured project check in the stream worktree, requires checks to
 leave the worktree clean, and fast-forwards the dedicated integration checkout. Only
-successful completion releases the lock.
+successful completion releases the lock. Conflict recovery may run focused checks to
+validate resolutions, but only `land` runs the configured full check after rebase.
 
 A lock owned by another stream stops landing without polling. A rebase conflict, failed
 check, or other error after acquisition retains this stream's lock for deliberate
@@ -234,7 +248,13 @@ validates the updated direction, prompts, and planner selection, and returns the
 session name and `/change` prompt. The extension replaces the Pi session in the same
 pane, preserves its name, activates the validated selection and planner identity, and
 only then sends the project prompt. Conversation history is not copied; the journal and
-project files carry durable context.
+project files carry durable context. The prompt first reads repository guidance, the
+journal, and current direction; it stops when work is wholly gated. It reads the latest
+numbered change only for active or ambiguous recovery and older changes only for
+journal-identified unresolved decisions. Current direction selects candidates before
+relevant contracts and implementation are inspected. After a baseline fast-forward, it
+rereads current direction plus files affected by incoming commits, affected contracts,
+and code, without mining deleted or historical documents for work.
 
 A cancelled or failed replacement stops for operator attention. Landing remains
 complete, and any successful preparation fast-forward remains applied. There is no
@@ -267,10 +287,8 @@ an approval source, or a recovery mechanism.
 ## Limits
 
 Codeless is attended and intentionally has no supervisor, project registry, queue,
-automatic landing retry, stale-lock recovery, or unattended approval. Planner startup
-reads every numbered change, and conflict recovery currently causes the configured
-landing check to run twice. Because the default state is ignored, `git clean -fdx` can
-delete it.
+automatic landing retry, stale-lock recovery, or unattended approval. Because the
+default state is ignored, `git clean -fdx` can delete it.
 
 The single-active-change rule and the requirement to dispatch only approved input still
 partly depend on planner instructions. Approval reconciles records and hashes but does