@event4u/agent-config 14.6.0 → 14.8.0

package/dist/agent-src/contexts/execution/roadmap-execution-contract.md

@@ -4,8 +4,8 @@ Loaded by [`roadmap-process-loop § 3`](roadmap-process-loop.md) when the run's
 **derived** mode is `autonomous` or `phase-checkpoints`. The mode comes from the
 § 3a ladder — explicit invocation suffix, then frontmatter `execution.mode`,
 then the invocation form — so an ABSENT frontmatter field no longer keeps this
-context unloaded: under `process-full` / `/roadmap:next` it derives
-`autonomous`, under `process-phase` it derives `phase-checkpoints`. Only a
+context unloaded: under `process-full` it derives `autonomous`, and under
+`/roadmap:next` or `process-phase` it derives `phase-checkpoints`. Only a
 *derived* `interactive` (asked for explicitly, declared in frontmatter, or
 `process-step`) leaves this context unloaded and falls back to the legacy
 commit-step scan. Defines the run-start pre-scan,
@@ -23,6 +23,21 @@ declared mode into this-turn grants **cached for this run only**
 (same mechanism as the commit pre-scan it extends). Stale frontmatter
 is harmless: no confirmation, no grants.
 
+**`/roadmap:process-full` is the exception, per
+[ADR-237](../../../docs/decisions/ADR-237-end-to-end-execution-authority.md):
+the invocation IS the confirmation.** There is no separate acceptance round
+and no contract screen to wait on — the user asked for the finished PR, and
+the grants in § 3 activate on the invocation itself, whatever
+`execution.mode` says or fails to say. **A missing `execution:` block does
+not reduce the grant** under this wrapper; it only means the roadmap's author
+declared nothing, which was never the authorization anyway. Waiting for an
+acceptance the user already gave is the mid-run interruption
+`process-full § Final-PR-only` forbids.
+
+For `process-step` and `process-phase` the confirmation round stays: their
+scope is narrow enough that a contract screen costs one line, and neither
+carries ADR-237's end-to-end delegation.
+
 ## 1. Pre-scan — four detection classes
 
 Scan every open step (text + inline notes) for:
@@ -63,6 +78,8 @@ Artifacts: <N> planned (skills/rules/commands/guidelines) —
 Open questions: <N> → decision sheet below (<M> rows); the rest via AI
      council (<members | "none configured — will halt on ambiguity">)
 Quality: <cadence> · Dashboard: <cadence>
+Late artifacts: <halt | auto-research> (default halt; cap 3 then halt)
+Deferred items: <wait | spawn-follow-up-draft | cancel-with-memo> (default wait)
 
 <decision sheet, per contract-decision-sheet — omitted entirely when M = 0>
 
@@ -82,6 +99,66 @@ re-ask inside the run. Adjust → apply, re-show once. The contract is
 re-derived on every invocation — it always reflects the roadmap's and
 repo's current state.
 
+### 2a. `late_artifacts` — what happens to an artifact the plan did not name
+
+An artifact discovered **after** Accept was outside the batched overlap check,
+so the research the contract summary reported does not cover it. Two policies,
+and the field is on the screen because the choice changes what the run may do
+without asking:
+
+| Value | Behaviour |
+|---|---|
+| `halt` (**default**) | The run stops at the discovery with the scope-out-of-roadmap halt. The artifact is reported, not authored. |
+| `auto-research` | The run re-runs Phase B (Research) and the overlap pass mid-run against the *current* artifact state — the identical procedure already accepted as non-interactive at contract time, only later. An **extend** verdict extends silently; a **create** verdict derives its understand-answers from the step text and the sheet answers; only a genuine overlap conflict halts. Capped at **three** late artifacts per run, then halt regardless. |
+
+<!-- decision 2026-08-20: the shipped default is `halt`, not `auto-research`.
+     AI council 2/2 (anthropic + openai) on the `autonomy-defaults-sheet` fork
+     of road-to-user-out-of-the-loop, record
+     agents/evidence/council/drain-blocker-dispositions-a.md. Reasoning: the
+     roadmap's own Risk 7 is that auto-research drifts the run's scope, and its
+     stated mitigation is the cap — but a cap of three is a bound on how far the
+     drift goes, not a check on whether it should happen at all. `halt` is also
+     the behaviour the tree already had, so shipping it as the default means
+     this field is purely additive: nothing that worked before changes, and the
+     aggressive path becomes a thing a run declares rather than a thing it
+     inherits. Reversibility: flipping the default is one word in this table
+     plus one word in the mechanics guideline, with no dependent mechanism to
+     unwind, and the roadmap's own kill criterion (late-artifact revisit rate)
+     only becomes measurable once some runs declare `auto-research` — which an
+     opt-in still permits and a silent default would have made unattributable. -->
+
+The cap is not negotiable by the field: a run that keeps discovering artifacts
+has a planning problem, not an autonomy problem, and the third discovery is the
+signal to say so.
+
+### 2b. `deferred_policy` — the two autonomous exits for a `[~]` item
+
+[`roadmap-progress-sync`](../../rules/roadmap-progress-sync.md) Iron Law 3
+forbids a silent archive with unresolved deferred items. That gate is
+unchanged. What this field changes is which dispositions a run may reach
+**without a synchronous prompt**, and there are exactly two, because the
+preservation test in that rule already splits them the same way:
+
+| Value | Behaviour |
+|---|---|
+| `wait` (**default**) | The synchronous halt stands. Every disposition stays conversational. |
+| `spawn-follow-up-draft` | A roadmap closing with `[~]` items spawns the follow-up draft automatically, carrying each item **and** its blocker. The item stays alive in the active estate, which is what makes this council-decidable rather than owner-reserved. |
+| `cancel-with-memo` | An item the run can show is no longer wanted is recorded `[-]` with a reasoning memo naming what changed. This is a **drop**, so it is owner-reserved by the preservation test: the run WRITES the memo and the recommendation, and the archive still waits for the user on that item. |
+
+<!-- decision 2026-08-20: the policy offers BOTH exits — a follow-up draft and
+     an explicit cancellation with a reasoning memo — not the follow-up draft
+     alone. AI council 2/2 (anthropic + openai), same record as above.
+     Reasoning: follow-up-draft-only means every deferred item must be carried,
+     and a carried item nobody wants becomes the parking lot the roadmap's own
+     Risk 5 describes for memos. Offering cancellation makes "this is no longer
+     wanted" a statable outcome with a written reason instead of an indefinite
+     deferral wearing a follow-up roadmap. Reversibility, and it is the load-
+     bearing half: the cancellation exit does NOT lower the gate, because a
+     drop stays owner-reserved — the run produces the memo, the user still
+     decides. Removing the value later removes an option nobody was obliged to
+     use; the default stays `wait` either way. -->
+
+
 ## 3. Grants activated by acceptance
 
 | Grant | Boundary |
@@ -93,6 +170,17 @@ repo's current state.
 | Batched artifact drafting | The drafting-protocol **Research/overlap pass runs NOW at contract time against current artifact state**; results cached; Understand/Draft phases run non-interactively during the run. Artifacts NOT in the batch still trigger the interactive protocol |
 | Council auto-enable | In-run open questions route to the AI council silently; `high_impact` / `user_required` classifications STILL escalate to the user per [`ask-when-uncertain`](../../rules/ask-when-uncertain.md). **No council configured** → the contract summary says so and in-run true ambiguity halts (never silent guessing) |
 
+**`process-full` only — added by ADR-237**, because a delegation that ends at
+the PR has to be able to reach one:
+
+| Grant | Boundary |
+|---|---|
+| Update the PR after opening it — title, body, further pushes to the same branch | Still never merge, close or retarget |
+| Reversible repository / branch settings the agent can change (branch protection included) | Only settings this run needs to reach a reviewable PR, and only reversible ones; a setting the agent changes it also restores if the run's need ends |
+| Start, re-run and fix CI; update the merge base; resolve conflicts | Standard git and CI operations on the run's own branch |
+| Install project-local dependencies | Inside the repo; never a global or system package manager without its own confirmation |
+| Any tool, CLI, API, model, council or external service the work needs | Cumulative **USD 25** per run of variable spend; over that, the owner is asked BEFORE crossing. Uncertainty is not a reason to ask. Marginal cost of an existing subscription is $0. Splitting spend across services, subagents or rounds to keep each item under the ceiling is a violation |
+
 These grants satisfy [`scope-control`](../../rules/scope-control.md)'s
 "standing instruction" clause for the run — see
 [`scope-mechanics § Roadmap execution contract`](../authority/scope-mechanics.md).
@@ -111,6 +199,11 @@ git grants are omitted from the contract (nothing to authorize —
 
 ## 5. What acceptance can NEVER cover
 
+**ADR-237 widens § 3 and leaves this section untouched — deliberately.** An
+end-to-end delegation is tolerable precisely because a PR is reviewable before
+it merges, so the boundary that keeps merging out is the one that makes the rest
+safe. Nothing below is reachable by any invocation.
+
 - Any [`non-destructive-by-default`](../../rules/non-destructive-by-default.md)
   trigger beyond the two named grants (own-branch push, PR-open):
   prod-trunk anything, deploys, bulk deletions, infra commits.

package/dist/agent-src/contexts/execution/roadmap-process-loop.md

@@ -112,7 +112,8 @@ Rung 3, by wrapper:
 
 | Wrapper | Derived mode | Contract |
 |---|---|---|
-| `/roadmap:process-full`, `/roadmap:next` | `autonomous`, **preselected** | offered |
+| `/roadmap:process-full` | `autonomous`, **preselected** | offered |
+| `/roadmap:next` | `phase-checkpoints`, **preselected** | offered |
 | `/roadmap:process-phase` | `phase-checkpoints` | offered |
 | `/roadmap:process-step` | — | none (one step needs no run contract) |
 
@@ -122,6 +123,25 @@ screen's `3. Run interactive instead` option
 ([`roadmap-execution-contract § 2`](roadmap-execution-contract.md)) stays on it
 in every case, so a derived mode is always one keystroke from being refused.
 
+<!-- decision 2026-08-20: /roadmap:next preselects `phase-checkpoints`, not
+     `autonomous`. AI council 2/2 (anthropic + openai) on the
+     `autonomy-defaults-sheet` fork of road-to-user-out-of-the-loop, record
+     agents/evidence/council/drain-blocker-dispositions-a.md. Reasoning: the two
+     wrappers differ in what the user has actually seen at Accept time.
+     `process-full` names one roadmap the user chose, so `autonomous` is a
+     preselection over a scope they read. `/roadmap:next` SELECTS the roadmap
+     itself, so `autonomous` there preselects full autonomy over a target the
+     user has not seen — the one rung where the derivation picks the object and
+     the scope in the same keystroke. Reversibility: this is a preselected
+     option on a screen that still offers `1. Go — start processing
+     autonomously`, so the aggressive path costs one keystroke and no rebuild;
+     flipping the row back is a one-line edit with no dependent mechanism.
+     Deliberately scoped to `/roadmap:next` only — the blocker's question named
+     that wrapper, and Phase 1 Step 1 of the parent roadmap landed with
+     `process-full` → `autonomous` explicitly, so widening the change would
+     silently reverse an already-shipped step nobody asked to revisit. -->
+
+
 **Why the old fallback was a defect and not a conservative default.** Absent
 `execution.mode` used to mean the legacy commit-step scan, which derives no
 contract at all — no batched artifact drafting, no council auto-enable, no
@@ -132,6 +152,23 @@ path *under the wrapper built for the opposite*, and silently — the user saw a
 A default that contradicts the wrapper the user just typed is a wrong answer,
 not a safe one.
 
+**Kill criteria — carried here, at the flip, not only in the roadmap that
+made it.** A default flip whose reversal condition lives in a roadmap is a
+flip nobody can reverse once that roadmap is archived, which is why both
+conditions below sit next to the table they govern:
+
+- **The ladder itself** (absent `execution.mode` derives a mode instead of
+  falling back to interactive): `3. Run interactive instead` chosen at the
+  contract screen in **more than 40 % of 20 runs** reverts rung 3, leaving
+  the ladder at explicit-suffix-then-frontmatter only. **No instrument
+  today** — nothing records which contract option was chosen, so the rate is
+  unmeasured rather than low. Stated so the gap is visible at the flip.
+- **The `/roadmap:next` row** (`phase-checkpoints` rather than
+  `autonomous`): reverted if checkpoint-mode runs on that wrapper are
+  observed to stop at a phase boundary the user then waves through without
+  a change — that is a contact the preselection bought nothing for. Same
+  missing instrument, same honesty: this is a condition, not a reading.
+
 **What this does NOT change.** A derived mode grants nothing on its own:
 authorization is still the single Accept on the contract screen, per
 [`roadmap-execution-contract § Principle`](roadmap-execution-contract.md). The
@@ -180,82 +217,168 @@ change in § 3a.
   `commit-policy` § NEVER ask about committing holds regardless of
   autonomy).
 
-### 3c. Runnable-work precondition — refuse a run with nothing to do
+### 3c. Capability screen — can the agent do this at all?
 
 ```
-A RUN WITH NO RUNNABLE OPEN STEP DOES NOT START.
-NAME THE BLOCKERS. CREATE NO BRANCH. WRITE NOTHING.
-THIS IS A PRECONDITION, NEVER A HALT — IT CANNOT FIRE MID-RUN.
+A RUN ALWAYS STARTS. THERE IS NO PREFLIGHT REFUSAL.
+PER OPEN STEP, ASK ONE QUESTION: CAN THE AGENT EXECUTE THIS AT ALL?
+YES → IT IS WORK. NO → IT IS THE ONLY KIND OF BLOCKER LEFT.
+WHO CONVENTIONALLY DOES A THING IS NOT A PROPERTY OF THE THING.
 ```
 
-Run once, at the end of the pre-scan, before any grant is exercised.
-
-**Runnable** is decided from the roadmap's own `## Blockers` section and nothing
-else. An open step is **not** runnable when a blocker satisfies all four:
-
-1. it exists in `## Blockers` **before this run started** — a blocker the run
-   itself authored does not count (see the gaming note below);
-2. its `Class:` is `2` (consent-once) or `3` (human-only) — classes `0` and `1`
-   are agent-runnable by construction and carry a `Run:` the agent executes,
-   per [`templates/roadmaps.md`](../../templates/roadmaps.md);
-3. its `Blocks:` field names this step, by phase-and-step identifier or by a
-   phase whose scope contains it;
-4. it names what would clear it.
-
-Every other open step is runnable. **No blocker citation → runnable**, and the
-default direction is deliberate: the failure this precondition must not have is
-refusing work an agent could have done.
-
-- **At least one runnable open step** → the run proceeds. It does *not* matter
-  how many steps are blocked; the blocked ones are skipped in place (never
-  flipped — see the terminal-outcomes section), and the run works the rest.
-- **Zero runnable open steps** → `blocked-preflight`. Report the roadmap, the
-  open-step count, and each blocker with its class and its clearing action.
-  Create no branch, write no state, take no grant.
-
-**A step this precondition judges non-runnable carries a `blocked-by:` marker on
-its own line.** The obligation is here because two mechanisms read blockedness
-from two different places and only one of them reads this section: `run-continuation`,
-the stop-slot concern that re-engages an autonomous run, decides open-vs-blocked
-from the inline `<!-- blocked-by: <id> -->` marker and never parses `## Blockers`
-at all. Without the marker a step that IS blocked per the four conditions above
-still counts as open work to the concern, which re-engages the agent into it every
-stop fire until the stall rung fires — the mechanism whose job is to detect a
-stall manufacturing one, which is the failure shape this file already records once
-for the roadmap-root split.
-
-Round 8 finding 7 caught the two predicates as disjoint. The fix is this coupling
-sentence rather than teaching the concern to parse `## Blockers`: a second
-implementation of the four conditions is a second thing to keep in step, and the
-one-line marker is checkable by eye at the step it belongs to. **The residual is
-real and is not papered over:** nothing enforces the pairing, so a `## Blockers`
-entry authored without its marker is caught by review or not at all.
-
-**Why a precondition and not a sixth halt.** The five halt conditions interrupt
-work that is still runnable; this decides whether any runnable work exists at
-all. Keeping them structurally separate is what preserves the forbidden-list's
-authority over mid-run stopping — an agent that may not stop for "this phase is
-large" also may not stop for "this feels human-gated". AI council 2026-08-19,
-2/2 convergent, explicitly on this point: *"keep this structurally separate from
-'five, and only five': the five are exceptional halts; `blocked` is an
-exhaustion-of-runnable-work terminal outcome."*
-
-**The gaming vector, named because it is the one thing that would make this
-worse than the gap it closes.** An agent meets a hard step, writes a `## Blockers`
-entry claiming Class 3, cites it, and stops — a comfort-stop wearing a citation.
-Condition 1 is the whole defence: a blocker must pre-date the run, which is
-checkable from git rather than from the agent's word. A blocker discovered
-mid-run is recorded (that is honest and useful) and does **not** make the step
-non-runnable in this run.
-
-**One imprecision, recorded rather than smoothed over.** The class taxonomy has
-four rows and none of them says *"waiting on time"* or *"waiting on another
-roadmap"*. A soak window and a cross-roadmap dependency are authored as `3`
-today, because absence of `Class:` already means `3` — so they are decidable but
-mislabelled as human-only. A fifth class is a taxonomy change with a linter
-behind it (`lint_roadmap_blockers`) and is not made here.
-*Revisit-if:* a run is refused on a blocker whose real content is "wait", and
-the report reads wrong to the person holding it.
+**Rewritten by [ADR-237](../../../docs/decisions/ADR-237-end-to-end-execution-authority.md),
+which supersedes ADR-235.** This section used to be a *preflight refusal*: a run
+with no "runnable" open step created no branch and wrote nothing. That is gone.
+The invocation is a delegation, so the question is no longer *is this step
+runnable under current governance* but *is this step possible for the agent at
+all.*
+
+Run once at the end of the pre-scan, and again immediately before any `blocked`
+report.
+
+**The screen, in order:**
+
+1. **Can the agent execute it?** Through the filesystem, git, `gh`, an API, a
+   CLI, a tool, a model, a council — anything machine-executable. If yes, the
+   step is **work**. Stop here; no blocker citation changes that.
+2. **Is the authority already implied by the invocation?** For a `process-full`
+   run: branches, chunked commits, pushing that branch, opening and updating the
+   PR, reversible repository/branch settings, CI runs and re-runs, merge-base
+   updates, conflict resolution, project-local dependencies, and paid calls
+   inside the cumulative USD 25 ceiling. If yes → **run it**.
+3. **Is it on the EXCLUDED list?** Merging to a production trunk, deploying,
+   production data / secrets / IAM / DNS, bulk deletion outside the roadmap's
+   scope, an irreversible external action beyond the PR itself. Those keep their
+   own this-turn confirmation ([`non-destructive-by-default`](../../rules/non-destructive-by-default.md))
+   and are a **halt**, not a blocker.
+4. **Otherwise it is externally impossible**, and only then is it a blocker: a
+   credential that does not exist and cannot be created · a purchase beyond the
+   budget · physical hardware access · another person or organisation must act ·
+   a wait that is factually mandatory and unverifiable.
+
+**A `## Blockers` entry is evidence, never a verdict.** A `Class: 3` label on an
+action the agent can perform is a **defect in the roadmap**, and the run repairs
+the label rather than obeying it — recording what it did and why. Class `0`/`1`
+entries carry a `Run:` the agent executes, exactly as before. Class `2`
+(consent-once) is pre-cleared for the duration of a `process-full` run when the
+consent it wants is one the invocation already gave; a `2` asking for something
+the invocation did NOT give (an EXCLUDED action, a spend crossing) still reaches
+the owner.
+
+**No citation → work**, and the default direction is unchanged: the failure this
+screen must not have is declining work an agent could have done.
+
+**A step this screen judges externally impossible carries a `blocked-by:` marker
+on its own line.** The obligation is unchanged and its reason is unchanged: two
+mechanisms read blockedness from two different places and only one reads this
+section — `run-continuation`, the stop-slot concern that re-engages an autonomous
+run, decides open-vs-blocked from the inline `<!-- blocked-by: <id> -->` marker
+and never parses `## Blockers`. Without the marker a step that IS impossible
+still counts as open work to the concern, which re-engages the agent into it
+every stop fire until the stall rung fires — the mechanism whose job is to detect
+a stall manufacturing one. **The residual is real and is not papered over:**
+nothing enforces the pairing, so a `## Blockers` entry authored without its
+marker is caught by review or not at all.
+
+**The gaming vector inverted, and both directions are now named.** Under ADR-235
+the vector was an agent writing itself a Class-3 blocker to stop early; the
+defence was that a qualifying blocker must **pre-date the run**, checkable from
+git. That defence is kept for the narrow blocker set that remains. ADR-237 adds
+the opposite vector — an agent that keeps going past a spend ceiling or into an
+EXCLUDED action under cover of "the roadmap needed it" — and its defences are
+step 3 above being an enumerated list rather than a characterisation, and the
+ceiling being cumulative per run rather than per action.
+
+**One imprecision, inherited and now given a test.** The class taxonomy has no
+row for *"waiting on time"* or *"waiting on another roadmap"*; both are authored
+as `3` today because an absent `Class:` already means `3`. Under step 4 a wait is
+a blocker only when it is factually mandatory and unverifiable — a soak window a
+run can simply outlast, or a cross-roadmap dependency the run can satisfy itself,
+is work. The taxonomy still lacks the row; the mislabel now has a stated test
+instead of a default.
+
+### 3d. Set contract — one contract over an enumerated set
+
+A **set contract** is the ordinary contract screen rendered over a closed,
+ordered list of roadmaps instead of one. It grants
+[`autonomy-mechanics § Task-scope`](autonomy-mechanics.md)'s **set-scoped**
+shape, whose four conditions (enumerated before Accept · closed · ordered with
+independence declared · one Accept) are the authorization contract — this
+section is only the loop's side of it.
+
+**What the screen must print, per member.** Roadmap path, derived branch name,
+open-step count, artifact count from the pre-scan, and its dependency edges.
+One decision sheet spans the whole set: a question that applies to several
+members appears once, and its answer applies to all of them.
+
+**Dependency edges come from two sources, unioned.**
+
+| Source | Shape | Trust |
+|---|---|---|
+| Declared | `depends:` in the dependent roadmap's frontmatter — a list of roadmap slugs | authoritative; a declared edge is never overridden by the heuristic |
+| Inferred | **file overlap**: the intersection of the owned-path sets the two pre-scans derived | advisory; an inferred edge orders the members and marks them non-parallelizable, and is printed as inferred so the user can see why |
+
+The union feeds exactly two decisions and nothing else: **ordering** (a
+dependent member runs after its parent) and **parallelizability** (only members
+with no edge between them and disjoint owned paths are lane candidates). An
+inferred edge is deliberately allowed to be wrong in the conservative
+direction — a false edge costs serial execution, a missed edge costs a
+collision, so overlap resolves toward *serial*.
+
+#### Auto-continuity — the next member needs no new contact
+
+Under an accepted set contract, when a member closes **green** the loop pulls
+the next member whose dependencies are all satisfied and starts it without a
+new contact. Green means: its own final report ran, its quality cadence passed,
+and no halt class fired. Anything else is not green and does not continue —
+see failure isolation below.
+
+The default stays **this one only**: auto-continuity applies to
+`/roadmap:next` and to any wrapper reaching this section **only when the set
+option was chosen on the sheet**. A single-roadmap invocation is never widened
+into a set because more roadmaps happened to be open, which is condition 4 of
+the set-scoped shape read from the loop's side.
+
+#### Failure isolation — a regression halts its own member, not the set
+
+A quality regression, a failed verify probe, or a halt class firing inside one
+member terminates **that member** and leaves the rest of the set running:
+
+1. Record the member's outcome as halted, with the halt class and the evidence.
+2. Skip every member that declares a dependency on it — transitively. A
+   dependent member of a halted parent is *blocked*, not failed, and is
+   reported as such.
+3. Continue with the next independent member.
+4. Report every member's outcome in one final report at the end of the set.
+
+Two carve-outs, and they are the reason this is isolation rather than
+tolerance. A **Hard-Floor** stop and a **locked decision class** stop the whole
+set, not one member: both are about the user's authority rather than about the
+member's code, and continuing past them under a set contract would be exactly
+the "several authorizations from one Accept" failure the enumeration guards
+against. Likewise the **N=3 validation budget** is per validation target and is
+not reset by moving to the next member.
+
+#### Parallel lanes — the shape, and why they are not on yet
+
+Lanes are **staged**, not shipped: the gate is ten clean serial set runs, and
+that gate has not been reached because no set run has happened. Recorded here
+so the shape is settled before the runs rather than designed under pressure:
+
+- **Cap: two lanes** in the first iteration — a recorded decision
+  (`decision 2026-08-20`, AI council 2/2 on the `autonomy-defaults-sheet`
+  fork), chosen over the configured `subagents.max_parallel` because a
+  collision at two lanes is diagnosable and one at N is not. Reversible: the
+  cap is one number in the set contract, and raising it after the first ten
+  clean parallel runs is strictly cheaper than recovering from a lost branch.
+- **Candidate test:** no dependency edge in either direction, and disjoint
+  owned paths.
+- **Isolation:** the existing worktree scope lock
+  ([`worktree-lifecycle`](../../skills/worktree-lifecycle/SKILL.md)).
+- **Coordination:** session-register branch claims, so two sessions never share
+  a branch.
+- **Delivery:** one branch and one PR per lane.
+- **Immediate removal:** a single scope-lock collision with data loss.
 
 ## 4. Resolve cadences — read once, cache for the run
 
@@ -411,7 +534,39 @@ For each open step in the working set (scope-bound — see wrapper):
    Empty output → Iron Law 2 was violated this iteration: the step
    landed work but no checkbox flipped. **Halt loudly**, surface
    "step <N> landed without checkbox flip — flip then resume", and
-   stop the run. Do not auto-fix; the user resumes on the next turn.
+   stop the run. Outside an accepted contract: do not auto-fix; the user
+   resumes on the next turn. Inside one: exactly one self-fix attempt, under
+   the four preconditions below.
+
+   **One deterministic self-fix, contract mode only.** A forgotten flip is the
+   one halt class whose repair is mechanical — the work is on disk, the step is
+   named, and the glyph follows from the outcome. Halting a contract run on it
+   spends a user contact to retype something the run can derive. So inside an
+   accepted contract the run may attempt the flip **once**, and only when all
+   four hold:
+
+   1. **The work is citable.** The step's landed change is identifiable in this
+      iteration's own output — a diff, a file path, a command result. No
+      evidence, no flip: that is a genuine halt, not a forgotten one.
+   2. **The glyph is unambiguous.** `[x]` only for a step whose evidence is
+      present and, where the step carries a `verify:` field, whose fresh green
+      run is in this reply. Anything that would be `[~]` or `[-]` is a
+      *disposition*, never a repair — those halt exactly as before, because a
+      deferral and a cancellation are decisions.
+   3. **Exactly one attempt, per run.** Not per step. A second forgotten flip
+      in the same run halts: one is a slip, two is a broken loop, and the
+      difference is the whole justification for allowing the first.
+   4. **The attempt is verified, then re-guarded.** Re-run the
+      `git status --porcelain` probe above after the flip. Still empty → halt
+      loudly as before. A self-fix that cannot prove itself is
+      indistinguishable from the failure it was repairing.
+
+   The attempt is recorded as a decision memo (§ 4 handling), so an auto-flip is
+   reviewable after the fact rather than invisible. **Kill criterion, from the
+   originating roadmap and repeated here because a flip is a write to the source
+   of truth: one wrong auto-flip removes this allowance** and returns the guard
+   to halt-always. Reversibility is the deletion of this block — the guard
+   underneath it never changed.
 
    This guard is the deterministic counterpart to the rule's
    pre-send self-check — it catches a forgotten flip per step, not
@@ -507,51 +662,68 @@ artifact drafting, council enablement), not safety.
 
 On halt: stop, surface state, do **not** auto-fix outside the failing step.
 
-### Terminal outcomes — `complete`, `blocked`, or a halt
-
-The halt list above answers *"what interrupts runnable work"*. It does not answer
-*"what does the run report when there is no runnable work left and the roadmap is
-not finished"*, and until this section there was no answer: the wrapper's stop
-condition was `count_open == 0` or a halt, so a roadmap whose remaining steps all
-need a human had **no legal stopping point**.
-
-That is not a hypothetical. Measured 2026-08-19 across the twelve most nearly
-complete roadmaps in the estate: **zero** could reach `count_open == 0` in one
-PR. Every remaining open step needed a human action — flip branch protection,
-delete committed evidence, authorise paid spend, install an absent binary, wait
-out a soak window, use the maintainer's own machine, or edit a file an armed host
-hook denies.
+### Terminal outcomes — `complete`, or a genuine external impossibility
+
+The halt list above answers *"what interrupts runnable work"*. This answers
+*"what does the run report when the roadmap is not finished and the remaining
+work is not the agent's to do"* — and under
+[ADR-237](../../../docs/decisions/ADR-237-end-to-end-execution-authority.md) that
+second set is much smaller than it looks.
+
+**The measurement that motivated the old answer, and the reading that replaced
+it.** Measured 2026-08-19 across the twelve most nearly complete roadmaps:
+**zero** could reach `count_open == 0` in one PR, because every remaining step
+needed "a human action" — flip branch protection, authorise paid spend, install a
+binary, wait out a soak window, edit a file a hook denies. The census was sound.
+The reading was not: it counted actions a human *conventionally* performs,
+without asking per action whether a human was **necessary**. Flipping a branch
+setting, pushing, opening a PR, re-running CI, updating a merge base, fixing a
+test, spending inside a budget — the agent can do all of it. That is remediation
+work, and a `process-full` invocation grants it.
 
 Three outcomes, and only one of them is success:
 
 | Outcome | When | What it reports |
 |---|---|---|
-| `complete` | `count_open == 0` | the roadmap is finished; archival check runs (§ 6) |
-| `blocked` | `count_open > 0` **and** no open step is runnable | the work that DID close, plus every blocker with its clearing action |
+| `complete` | `count_open == 0` and the PR is open | the roadmap is finished; archival check runs (§ 6) |
+| `blocked` | every remaining open step is **externally impossible** for the agent | the work that DID close, plus the specific impossibility |
 | a halt | one of the five conditions above fired | the halt, its evidence, and what remains |
 
+`blocked-preflight` **no longer exists** (ADR-237 § 4). A run always starts.
+
 ```
 `blocked` IS NEVER PRESENTED AS COMPLETION.
 count_open STAYS > 0. NO CHECKBOX IS FLIPPED TO [~] TO REACH IT.
 A PR OPENED ON A BLOCKED RUN IS LABELLED PARTIAL PROGRESS.
-REVALIDATE IMMEDIATELY BEFORE REPORTING IT — ONE RUNNABLE STEP LEFT REJECTS THE CLAIM.
+BEFORE REPORTING IT, ASK PER REMAINING STEP: CAN I DO THIS AT ALL?
+ONE STEP THE AGENT COULD HAVE EXECUTED REJECTS THE CLAIM.
 ```
 
+**Externally impossible — the whole list.** A required credential that does not
+exist and the agent cannot create · a purchase beyond the delegated budget ·
+physical hardware access · another person or organisation must act · a wait that
+is factually mandatory and cannot be simulated or verified.
+
+**Not externally impossible — every one of these is work.** An unprotected
+branch · a branch to create · a push · a PR to open · a repository or branch
+setting the agent can change · a workflow to start · CI to re-run · a merge base
+to update · conflicts · failing tests · local configuration · a paid call under
+the ceiling · "this could be risky" · "a maintainer should do this".
+
 The `[~]` prohibition is load-bearing and was the one point the council split on.
 Deferring a blocked step to `[~]` would let the run reach `count_open == 0` and
 report completion — laundering unfinished work through a glyph, which is exactly
 what Iron Law 3 of [`roadmap-progress-sync`](../../rules/roadmap-progress-sync.md)
 exists to catch on the archival side. So the boxes stay open and the outcome
-carries the truth instead.
-
-Revalidation is the second half of the same discipline: the runnable set is
-recomputed at the moment of reporting, because steps unblock during a run (a
-prerequisite closes, a `Run:` succeeds, a peer merges). If any open step is
-runnable, `blocked` is refused and the loop continues.
+carries the truth instead. **ADR-237 keeps this clause verbatim** — narrowing
+`blocked` makes it more important, not less, because a run with more authority
+has more ways to reach a clean-looking count.
 
-**Runnability is decided by the § 3c test**, unchanged — the same four conditions,
-including that a qualifying blocker must pre-date the run. A blocker the run
-authored is recorded and does not make a step non-runnable in that run.
+Revalidation is the second half of the same discipline: the set is recomputed at
+the moment of reporting, because steps unblock during a run (a prerequisite
+closes, a `Run:` succeeds, a peer merges, a setting the run itself changed). If
+any remaining step is one the agent could execute, `blocked` is refused and the
+loop continues.
 
 ### Forbidden non-halt reasons — agent-invented cautions
 
@@ -570,14 +742,25 @@ a violation of the command and the user's will:
   the stop-and-wait reading of `phase-checkpoints` applies only to
   `process-phase`.
 - **"this step looks human-gated"** — the `blocked` outcome above is reached by
-  the § 3c test over blockers that pre-date the run, never by a judgement about
-  how a step feels. A step with no qualifying blocker citation is runnable, and
-  writing the citation yourself does not make it one. This entry exists because
-  the terminal outcome is the single most abusable thing on this page.
+  the § 3c test, never by a judgement about how a step feels. A step with no
+  qualifying blocker citation is runnable, and writing the citation yourself does
+  not make it one. This entry exists because the terminal outcome is the single
+  most abusable thing on this page.
+- **"the branch is not protected" / "a branch must be created" / "a PR must be
+  opened" / "a GitHub setting must change" / "CI must be re-run" / "the merge
+  base needs updating" / "there are conflicts" / "tests fail"** — every one is
+  remediation work the invocation authorised (ADR-237 § 1). Do it.
+- **"a paid service is needed"** — authorised up to a cumulative USD 25 per run
+  (§ Spend in the wrapper). Uncertainty about the exact cost is explicitly NOT a
+  reason to ask.
+- **"a maintainer should do this"** when the agent can perform the same action
+  through git, `gh`, an API or a CLI. **Capability before role**: the role of the
+  person who conventionally does a thing is not a property of the thing.
 
 If the work genuinely cannot continue, it will be because one of the five real
-halt conditions fired, or because the runnable set is empty by the § 3c test —
-surface THAT, with the blockers named, not a manufactured caution.
+halt conditions fired, or because every remaining step is externally impossible
+by the § 3c test — surface THAT, with the specific impossibility named, not a
+manufactured caution and not a convention mistaken for a constraint.
 
 ### Non-halt — gating notes, "optional" tags