@gobing-ai/spur 0.3.91 → 0.3.93

package/config/workflows/wayfinder-resolution.yaml

@@ -209,6 +209,7 @@ transitions:
         command: 'test "$(cat .spur/run/$__runId-wayfinder-precheck.status 2>/dev/null)" = PASS'
   - from: precheck
     to: failed
+    terminalReason: failed-check
     description: "Precheck FAIL — stop before delegation."
     guard:
       kind: always
@@ -221,6 +222,7 @@ transitions:
         command: 'test -s .spur/run/$__runId-wayfinder-answer.md'
   - from: investigate
     to: failed
+    terminalReason: failed-agent
     description: "Empty answer capture — investigate produced nothing to verify; stop rather than certify hollow evidence."
     guard:
       kind: shell
@@ -254,6 +256,7 @@ transitions:
         command: 'test "$__hitlAnswer" = yes'
   - from: approve
     to: cancelled
+    terminalReason: cancelled
     description: "Operator cancelled the research resolution."
     guard:
       kind: shell
@@ -261,6 +264,7 @@ transitions:
         command: 'test "$__hitlAnswer" = cancel'
   - from: approve
     to: failed
+    terminalReason: cancelled
     description: "Operator rejected the research resolution."
     guard:
       kind: shell
@@ -275,6 +279,7 @@ transitions:
         command: 'test "$(cat .spur/run/$__runId-wayfinder-final.status 2>/dev/null)" = PASS && test "$(cat .spur/run/$__runId-wayfinder-status.txt 2>/dev/null)" = done'
   - from: record
     to: failed
+    terminalReason: failed-check
     description: "Recording failed, was denied, or the task never reached done — stop without claiming completion."
     guard:
       kind: always

package/config/workflows/wrapup-pipeline.yaml

@@ -15,6 +15,7 @@
 #
 # Shape: start -> task-resolve -> doc-sync -> learnings-append -> metrics-record
 #          -> feature-transition (conditional: if vars.feature set)
+#          -> feature-verify (post-transition feature check gate, 0915 F1)
 #          -> branch-cleanup (conditional: if vars.merge=true)
 #          -> done
 #        doc-sync routes a contract violation to `repair` (cheap, no
@@ -74,7 +75,7 @@
 "$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
 kind: state-machine
 name: wrapup-pipeline
-version: "4"
+version: "5"
 description: "Post-execution wrap-up: doc-sync (doc drift + learning capture), metrics, feature-transition, branch-cleanup"
 iterationBound: 10
 initialState: start
@@ -127,7 +128,10 @@ states:
       missing or corrupted capture refuses progression. A validated empty list
       -> skipped; length > 0 && mode == fast -> fast-path (metrics-record,
       bypassing doc-sync); missing/unknown/conflict -> doc-sync (safety-path).
-      Writes bounded machine-readable reason to reasonFile.
+      Writes bounded machine-readable reason to reasonFile. When the caller leaves
+      mode empty, a deterministic drift probe (0944) projects mode=fast only when
+      no changed path matches a doc-owned surface and every task's Solution
+      change map parsed — any doubt stays on the safety path.
     onEnter:
       - kind: note
         options:
@@ -147,21 +151,53 @@ states:
               echo "wrapup-steps failed closed — script not found — run 'superskill install sp'" >&2;
               printf 'FAIL\n' > ".spur/run/$__runId-wrapup-resolve.status";
             fi
-      # (e) route-reason writer: one jq table lookup over the mode var over the
-      # validated capture; workflow-local routing glue (0824). Runs AFTER validation
-      # and reads ONLY .spur/run/<runId>-wrapup-tasks.json — never raw vars.tasks
-      # (0783 R2/R5). A FAIL resolve exits without writing: the failed reason written
-      # by validation stands, and the skip reason can never mask it. A missing or
-      # corrupted capture fails the jq lookup (no skipped claim can be invented);
-      # the failed defense edge owns the run.
+      # (0944 R1-R3) deterministic drift probe — runs ONLY when the caller left mode
+      # empty (a caller-set mode is projected verbatim and the probe never runs). It
+      # writes <runId>-drift-probe.json {clean,reasons,paths} and projects the wrapup
+      # mode by writing <runId>-mode.txt: caller mode verbatim, `fast` when the probe
+      # is clean, empty when dirty (the probe script fails safe on any lookup or parse
+      # problem; a missing script writes a dirty probe + empty mode here). The next
+      # action reads the mode file into vars.mode via file.read.into-var.
       - kind: shell
         options:
           command: >-
-            mkdir -p .spur/run .spur/memory; RUN_ID="$__runId"; case "$RUN_ID" in '') echo "task-resolve: __runId is empty — refusing to write a route reason" >&2; exit 1 ;; esac;
-            REASON_FILE=".spur/run/$RUN_ID-route-reason.txt"; case "$(cat ".spur/run/$RUN_ID-wrapup-resolve.status" 2>/dev/null)" in FAIL) exit 0 ;; esac;
-            N=$(jq length ".spur/run/$RUN_ID-wrapup-tasks.json" 2>/dev/null);
-            jq -rn --arg m "$mode" --arg n "$N" 'if $n == "0" then "skipped:empty task list" else {"fast":"fast:evidence complete+consistent","":"safety:missing evidence (mode empty)","unknown":"safety:unknown evidence quality","conflict":"safety:conflicting evidence"}[$m] // "safety:unrecognized evidence (mode=\($m))" end' > "$REASON_FILE";
-            printf '%s %s\n' "$RUN_ID" "$(cat "$REASON_FILE")" >> .spur/memory/wrapup-routes.log
+            if [ -n "$mode" ]; then
+              printf '%s\n' "$mode" > ".spur/run/$__runId-mode.txt";
+            elif [ -f plugins/sp/scripts/wrapup-drift-probe.ts ]; then
+              bun plugins/sp/scripts/wrapup-drift-probe.ts;
+            elif W="$(superskill script path sp wrapup-drift-probe.mjs 2>/dev/null)" && [ -f "$W" ]; then
+              node "$W";
+            else
+              printf '{"clean":false,"reasons":["probe script not found"],"paths":[]}' > ".spur/run/$__runId-drift-probe.json";
+              printf '\n' > ".spur/run/$__runId-mode.txt";
+            fi
+      - kind: file.read.into-var
+        options:
+          path: .spur/run/${vars.__runId}-mode.txt
+          var: mode
+      # (e) route-reason writer: one table lookup over the projected mode var over
+      # the validated capture and the drift probe verdict; workflow-local routing
+      # glue (0824, moved behind the wrapup-steps locator in 0944 to stay inside the
+      # ADR-115 shell caps). Runs AFTER the probe/projection so the reason reflects
+      # the projected mode. Reads ONLY .spur/run/<runId>-wrapup-tasks.json and the
+      # probe verdict — never raw vars.tasks (0783 R2/R5). A FAIL resolve exits
+      # without writing: the failed reason written by validation stands, and the
+      # skip reason can never mask it. A clean probe yields `fast:drift-probe-clean`
+      # (0944); mode `safety` claims `safety:operator-forced doc-sync`; a missing or
+      # corrupted capture fails the lookup (no skipped or clean claim can be
+      # invented); the failed defense edge owns the run.
+      - kind: shell
+        options:
+          command: >-
+            mkdir -p .spur/run .spur/memory &&
+            if [ -f plugins/sp/scripts/wrapup-steps.ts ]; then
+              bun plugins/sp/scripts/wrapup-steps.ts route-reason;
+            elif W="$(superskill script path sp wrapup-steps.mjs 2>/dev/null)" && [ -f "$W" ]; then
+              node "$W" route-reason;
+            else
+              echo "wrapup-steps failed closed — script not found — run 'superskill install sp'" >&2;
+              printf 'FAIL\n' > ".spur/run/$__runId-wrapup-resolve.status";
+            fi
 
   - id: doc-sync
     description: >
@@ -295,6 +331,30 @@ states:
               printf 'FAIL\n' > ".spur/run/$__runId-wrapup-sync.status";
             fi
 
+  - id: feature-verify
+    description: >
+      Post-feature-transition verification hop (D63 task 0915, review finding
+      F1): wrapup's doc-sync and the feature transition mutate the corpus AFTER
+      the feature-scoped verification pass ran. The proof digest deliberately
+      excludes docs/tasks*/docs/features* (shared evidence, concurrent writers),
+      so the bound receipt stays valid — but the feature's completion boundary
+      must still observe the post-wrapup state. This hop re-runs the feature
+      check gate (`featureGateCmd`). When the configured command is the done-
+      boundary variant (`feature check --as done`), it validates the bound
+      evidence receipt (feature identity, verifier definition digest, terminal
+      recording run, artifact registration, checked-input digest) against the
+      current feature contract; a plain gate command observes the post-wrapup
+      corpus state but does not enforce the receipt (0915 re-review P3). A FAIL
+      fails the wrapup loudly instead of letting a stale PASS ride; only a
+      verified gate writes PASS (0783 R4).
+    onEnter:
+      - kind: shell
+        options:
+          command: >-
+            sh -c "$featureGateCmd" &&
+            printf 'PASS\n' > ".spur/run/$__runId-wrapup-feature-verify.status" ||
+            printf 'FAIL\n' > ".spur/run/$__runId-wrapup-feature-verify.status"
+
   - id: branch-cleanup
     description: >
       Irreversible-operation HITL gate, consent-only (0770). If vars.merge=true,
@@ -342,6 +402,7 @@ transitions:
   # ── task-resolve: validation fail + proportional route table (0758 R1-R4, 0770) ──
   - from: task-resolve
     to: failed
+    terminalReason: failed-check
     description: >
       Validation FAIL (0770): malformed wrap input, a non-string/empty entry, an
       unresolved or non-completed task, or an empty __runId. Declared before the
@@ -377,6 +438,7 @@ transitions:
         command: 'test "$(jq length .spur/run/$__runId-wrapup-tasks.json 2>/dev/null || echo -1)" -gt 0 && test "$mode" != fast'
   - from: task-resolve
     to: failed
+    terminalReason: failed-check
     description: >
       Defense (0770) — no PASS/FAIL resolve status (shell crashed or never ran):
       route to `failed` rather than claiming a skip.
@@ -404,6 +466,7 @@ transitions:
       kind: action-ok
   - from: doc-sync
     to: failed
+    terminalReason: failed-check
     description: >
       Executor failure (non-zero exit, signal, or dispatch error) — keep the
       existing fail semantics; a contract violation never falls through here
@@ -433,6 +496,7 @@ transitions:
   # the metrics status PASS so a missing status can never claim success.
   - from: metrics-record
     to: failed
+    terminalReason: failed-check
     description: >
       Metrics capture failed for at least one task — a missing metrics row is
       recorded as failure, never silently omitted as success (0770).
@@ -465,6 +529,7 @@ transitions:
   # ── feature-transition: fail edge, then branch-cleanup (if merge) or done ──
   - from: feature-transition
     to: failed
+    terminalReason: failed-check
     description: >
       Required synchronization failed (0770): non-zero sync exit, an invalid
       sync result, or a failed feature gate. The failed status carries the
@@ -474,19 +539,37 @@ transitions:
       options:
         command: 'test "$(cat .spur/run/$__runId-wrapup-sync.status 2>/dev/null)" = FAIL'
   - from: feature-transition
+    to: feature-verify
+    description: Sync PASS — re-run the feature check gate against the post-wrapup state.
+    guard:
+      kind: shell
+      options:
+        command: 'test "$(cat .spur/run/$__runId-wrapup-sync.status 2>/dev/null)" = PASS'
+  - from: feature-verify
+    to: failed
+    terminalReason: failed-check
+    description: >
+      Post-wrapup feature check failed (0915 F1): the bound receipt no longer
+      validates against the current feature contract. Already-written
+      learnings/metrics stay on disk.
+    guard:
+      kind: shell
+      options:
+        command: 'test "$(cat .spur/run/$__runId-wrapup-feature-verify.status 2>/dev/null)" = FAIL'
+  - from: feature-verify
     to: branch-cleanup
-    description: Sync PASS — merge is requested.
+    description: Post-wrapup feature check PASS — merge is requested.
     guard:
       kind: shell
       options:
-        command: 'test "$(cat .spur/run/$__runId-wrapup-sync.status 2>/dev/null)" = PASS && test "$merge" = true'
-  - from: feature-transition
+        command: 'test "$(cat .spur/run/$__runId-wrapup-feature-verify.status 2>/dev/null)" = PASS && test "$merge" = true'
+  - from: feature-verify
     to: done
-    description: Sync PASS — no merge requested.
+    description: Post-wrapup feature check PASS — no merge requested.
     guard:
       kind: shell
       options:
-        command: 'test "$(cat .spur/run/$__runId-wrapup-sync.status 2>/dev/null)" = PASS && test "$merge" != true'
+        command: 'test "$(cat .spur/run/$__runId-wrapup-feature-verify.status 2>/dev/null)" = PASS && test "$merge" != true'
 
   # ── branch-cleanup: HITL exhaustive routing (yes / no / cancel → done) ──
   # No irreversible git op is wired yet; confirmation is recorded, then wrap

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.3.91",
+    "version": "0.3.93",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",
@@ -53,14 +53,14 @@
     },
     "devDependencies": {
         "@commander-js/extra-typings": "^14.0.0",
-        "@gobing-ai/ts-db": "^0.5.2",
-        "@gobing-ai/ts-ai-runner": "^0.5.2",
-        "@gobing-ai/ts-dual-workflow-engine": "^0.5.2",
-        "@gobing-ai/ts-infra": "^0.5.2",
-        "@gobing-ai/ts-llm-jsonl-importer": "^0.5.2",
-        "@gobing-ai/ts-rule-engine": "^0.5.2",
-        "@gobing-ai/ts-runtime": "^0.5.2",
-        "@gobing-ai/ts-utils": "^0.5.2",
+        "@gobing-ai/ts-db": "^0.5.7",
+        "@gobing-ai/ts-ai-runner": "^0.5.7",
+        "@gobing-ai/ts-dual-workflow-engine": "^0.5.7",
+        "@gobing-ai/ts-infra": "^0.5.7",
+        "@gobing-ai/ts-llm-jsonl-importer": "^0.5.7",
+        "@gobing-ai/ts-rule-engine": "^0.5.7",
+        "@gobing-ai/ts-runtime": "^0.5.7",
+        "@gobing-ai/ts-utils": "^0.5.7",
         "@types/bun": "1.3.14",
         "@types/figlet": "^1.7.0",
         "@types/node-notifier": "8.0.5",

package/plugins/sp/README.md

@@ -186,7 +186,7 @@ pipeline step.
 
 ```
 plugins/sp/
-├── skills/                          # Domain knowledge + workflow docs (38 skills)
+├── skills/                          # Domain knowledge + workflow docs (39 skills)
 │   ├── brainstorm/                  # Structured ideation workflow
 │   │   ├── agents/openai.yaml
 │   │   ├── examples/ideation-example.md
@@ -342,6 +342,7 @@ surface or run one workflow. All skills target the same five core platforms: `cl
 | `session-review`            | 1.1   | Inline review of the active coding-agent session — compact outcomes, evidence-backed resolved/open issue classification, proposal-only improvements, and next actions; no workflow, import, delegation, or mutation                                                                                           |
 | `spur-composer`             | 1.0   | Cross-noun composition — workflow catalog selection, the ephemeral→project→shared ladder, ADR-115 budgets, trace-driven rule tuning; applies accepted `spur-doctor` proposals through `spur` verbs; never judges its own output and never runs a recurring loop                                              |
 | `spur-doctor`               | 1.0   | Cross-noun evaluation — read-only CLI evidence per noun (task/feature/rule/workflow/agent spec), reflection over `history-anatomy` findings through a closed action-class map, and a proposal table; writes nothing; diagnoses artifacts, not runtime environments (`spur agent doctor`'s job)                |
+| `spur-check`                | 1.0   | Two-tier check primitive (ADR-124) — light changed-scope checks during development, the full `bun run spur-check` chain at the quality boundary, and the fingerprint-bound `<wbs>-check-receipt.json` with the `status` reuse rule; composes with `/sp:dev-fixall --gate-log`                                  |
 | `redesign-web-ui`           | 1.0   | Existing-UI visual upgrade — audit generic AI fingerprints, apply in-stack polish against `DESIGN.md` / live tokens, verify behavior and viewports; does not migrate frameworks                                                                                                                            |
 | `taste-refactoring-api`     | 1.0   | API design and refactoring for REST/HTTP, RPC/gRPC, GraphQL, event contracts, and CLI surfaces; compatibility, security, and migration review |
 | `taste-refactoring-ui`      | 1.0   | UI design and refactoring with visual hierarchy, typography, spacing, color, and interaction review |
@@ -512,6 +513,7 @@ hold `SKILL.md` and prompt-side companions only.
 | `scripts/feature-sync-bounded.ts`                    | Bounded retry-suppression wrapper for `spur feature sync` during batch/wrap-up runs — suppresses identical L4-blocked repeats                                                                                                              |
 | `scripts/stage-registry-adapter.ts`                  | dev-next golden-path adapter over the canonical stage registry — TABLE A/B/C resolution bridge for the status-aware facade                                                                                                                |
 | `scripts/task-size-precheck.ts`                      | Pipeline size precheck guard (R2) — evaluates R-item/Plan-count limits to PASS/FAIL                                                                                                              |
+| `scripts/task-diffstat.ts`                           | 0943 triage-lane diffstat producer — numstat + untracked scan vs the run base; writes `<wbs>-diffstat.json` with the sensitive-path flag; fails safe (sensitive)                                                       |
 | `scripts/validate-flag-contracts.ts`                 | Mechanical consistency gate — compares flag claims across command files, flag-glossary, cross-cutting, dev-operations, and ADR; reports disagreements                                                                                    |
 | `*.test.ts`                                          | Unit suites — in `hooks/` for guards, in `tests/<skill>/` per ADR-031 pairing                                                                                                                                                                                                                     |
 
@@ -629,7 +631,10 @@ pipeline owns one lifecycle phase:
 | `idea-pipeline.yaml`        | Idea/planning → feature + tasks   | `/sp:dev-idea`, `/sp:dev-plan`    |
 | `wrapup-pipeline.yaml`      | Post-execution wrap-up            | `/sp:dev-wrap`, `/sp:dev-wrapall` |
 | `wayfinder-resolution.yaml` | Wayfinder ticket resolution loop  | `spur workflow run` (free-form)   |
-| `decision-routing-example.yaml` | DecisionMaker routing example (never / evidence / omitted modes, defer → operator pause) | `spur workflow run` (authoring sample) |
+
+> 0946 (D64): the `decision-routing-example.yaml` authoring sample was retired from the catalogue
+> (zero runs, example-only — `docs/design/workflow-catalogue-refactor.md` §10); the pattern lives on
+> as a test fixture (`packages/app/tests/services/fixtures/decision-routing-example.yaml`).
 
 ### Lifecycle operations
 

package/plugins/sp/agents/super-planner.md

@@ -86,7 +86,10 @@ You own the spaces **between** task runs:
 - **Parallelize only when requested** by applying `sp:parallel-execution` to a proven-independent
   subset (Step 3 optional path). Serialize when dependency, file-overlap, or budget checks fail.
   Preflight still runs per WBS before fan-out; recovery stays sequential.
-- **Inspect** each terminal state + `.spur/run/<wbs>-verdict.json` (Step 3.3).
+- **Inspect** each terminal state via `spur workflow trace "$RUN" --follow --timeout 600000` (a
+  timeout prints one checkpoint and exits 1; the run continues, never cancelled or relaunched) plus
+  `.spur/run/<wbs>-verdict.json`, accepted only when the trace's `.run.runId` equals the dispatched
+  run and the verdict's mtime ≥ the trace's `.run.startedAt` — otherwise `stale-evidence` (Step 3.3).
 - **One-shot recovery (optional)** - on non-PASS / stuck status, consult next-router **once** for that
   WBS (`recoveryHint` / dry-run plan): print the child command, or dispatch once only when the batch
   was started with `--auto` and cardinality is 1. Never self-loop until done.
@@ -264,7 +267,10 @@ Report using the batch-report template from execution-batch.md §5:
 **Next:** <one-line action>
 ```
 
-Per-task outcome vocabulary: `done` | `failed` | `blocked` | `skipped` | `not-attempted`.
+Per-task outcome vocabulary: `done` | `failed` | `blocked` | `skipped` | `paused` (0933: parked on
+an operator question — escalate hop — or an approval gate; non-terminal, never `done`) |
+`not-attempted`, plus the parallel-only `integration-conflict`
+([execution-batch.md § Parallel isolation](../skills/spur-dev/references/execution-batch.md#parallel-isolation---mode-parallel)).
 Batch verdict: `clean` (all attempted tasks `done`) | `halted` (a failure stopped the batch) |
 `aborted` (cycle or selector error before any run).
 
@@ -272,9 +278,12 @@ With `--json`, emit the same shape as a JSON object for machine consumption.
 
 ## Out of scope (deferred)
 
-- **Parallel execution** - needs git-worktree isolation; v1 is sequential.
-- **Interactive within-step escalation** - waits for the workspace module + inbox module +
-  `spur agent` team mode. You surface blockers only at the batch boundary.
+- **Parallel execution** - `--mode parallel` isolates each task in its own worktree with
+  rebase-and-FF integration; see [execution-batch.md § Parallel isolation](../skills/spur-dev/references/execution-batch.md#parallel-isolation---mode-parallel).
+- **Interactive within-step escalation** — implemented (0933): the pipeline's `escalate` hop
+  pauses on the implement agent's operator question; the operator answers via
+  `spur workflow continue --answer-text` and the run resumes implement with the Q/A transcript
+  (bounded by `maxEscalations`). See [execution-batch.md Step 3](../skills/spur-dev/references/execution-batch.md#step-3--the-driver-loop-r3-r4).
 
 ## Platform Notes
 

package/plugins/sp/commands/dev-dogfood.md

@@ -14,11 +14,11 @@ Wraps the **sp:dogfood-testing** skill.
 | Flag | Description | Default |
 | --- | --- | --- |
 | `<testee>` | Skill / command / CLI to exercise end-to-end. | required |
-| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing dogfood work. | omit |
-| `--max-retry` `<n>` | Max auto-fix retries per stage. | 3 |
+| `--agent` `<inline\|auto\|name>` | **Testee-scoped** agent the testee runs under — forwarded into the testee invocation; the dogfood driver always runs in the current session. | omit (forward nothing) |
+| `--max-retry` `<n>` | Max auto-fix retries per step. `0` = observe-only. Mandatory (as `0` or `N`) for pipeline-driving testees and testees with a mutating `--fix` mode. | 2 |
 | `--save` | Compatibility no-op; saving is now default. Retained until evidenced retirement. | off |
-| `--task` | Record outcomes against a task. | omitted |
-| `--chain-follow` | Follow the testee's chained follow-ups. | off |
+| `--task` | **Creates** a new review-template task for the findings (`spur task create --template review`) — it does not attach to or update the task under test. | off |
+| `--chain-follow` | **Reads existing chained-leg evidence** (verdict artifacts, task-file diffs, review tables) after a chained leg completes, for attribution — it never executes the chained leg itself. Without it the driver stops at the testing boundary. | off |
 | `--full` | Full report verbosity (all sections). | off |
 
 For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag-glossary.md).

package/plugins/sp/commands/dev-fixall.md

@@ -27,9 +27,12 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 
 ## Implementation
 
-Under the pipeline, the `test-recheck` state runs the full gate immediately after this hop — that is
-the deciding run. When `--gate-log` is set (the pipeline signal), fixall runs **no full gate at
-all**: targeted probes (`bun test <file> --test-name-pattern <test>`) during fix loops, then one
-`bun run lint` before returning. Invoked standalone, it keeps the single confirming run (R4, task
-0483). `qualityGateCmd` itself is unchanged so `test-recheck` still runs the full gate.
+Follow the inline procedure in [dev-operations.md](../skills/spur-dev/references/dev-operations.md#10-fixall) (fixall). Pipeline signal: when `--gate-log` is set (the `test-fix` hop), run no full gate — the `test-recheck` state immediately after is the deciding run (R4, task 0483).
+
+When dispatched from the pipeline's test-fix stage (F96, task 0950), the gate log carries a
+`residual artifact` block (`<wbs>-residuals.json`) and the findings file already
+contains the merged residual anchors: treat those items as fix targets, in order,
+alongside gate anchors. The fixer may write `.spur/run/<wbs>-residual-deferrals.json`
+— one `{id, reason}` entry per item — but only for P3 findings or diff markers it
+cannot fix inside the task; the done stage settles deferrals into follow-up tasks.
 

package/plugins/sp/commands/dev-run.md

@@ -15,7 +15,7 @@ Wraps the **sp:spur-dev** and **sp:code-implementation** skills.
 | --- | --- | --- |
 | `<wbs>` | Task WBS to run. | required |
 | `--mode` `<full\|implement>` | Full pipeline or single implement step. | full |
-| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing stages. omit and explicit `--agent inline` resolve identically (task 0687): eligible stages dispatch once to a native subagent with host-session fallback (0508 eligibility); otherwise every stage executes in the invoking session. `auto` or a name keeps subprocess dispatch.. | omit |
+| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing stages. omit and explicit `--agent inline` resolve identically (task 0687): eligible stages dispatch once to a native subagent with host-session fallback (0508 eligibility); otherwise every stage executes in the invoking session. `auto` or a name keeps subprocess dispatch.. The opt-in `fleet` selector (0942) maps the run to `executor: 'fleet'` so `agent.run` stages dispatch through the fleet control plane (ADR-126) instead of a subprocess. | omit |
 | `--auto` | Skip objective HITL confirmations. | off |
 | `--next` | Chain-to-completion via the next-router. | off |
 | `--wrap` | Run the wrap hop after the main step. The `--agent` selector is preserved into the `/sp:dev-wrap <wbs>` handoff when supplied; omission remains omission. The wrap hop is workflow-backed and reports its trigger-3 subprocess override. | off |
@@ -40,7 +40,13 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 
 **Flags:**
 
-- `--auto` | `--agent <inline|auto|name>` — Skip objective HITL confirmations (taste/irreversible gates still pause). `--agent` names who does the model-bearing work. Interactive omit/`inline` keeps the controller and implement-only stages in this session; full mode reads `task-pipeline.yaml` as the SSOT and interprets its actions/guards through the inline driver, whose eligible `agent.run` stages dispatch once to a native subagent and otherwise run in the host (0508 eligibility — task 0687 resolved-inline) It records `stage <id> executed inline in session <session-id>` or `stage <id> executed via subagent <agent-id> (host session <session-id>)` in the run log. `auto` or a name is merged into `vars.agent` and `vars.implementAgent` and keeps the existing subprocess workflow. Headless `spur workflow run` / `spur agent run` is unchanged. See the [execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
+- `--auto` | `--agent <inline|auto|name>` — Skip objective HITL confirmations (taste/irreversible gates still pause). `--agent` names who does the model-bearing work. Interactive omit/`inline` keeps the controller and implement-only stages in this session; full mode reads `task-pipeline.yaml` as the SSOT and interprets its actions/guards through the inline driver, whose eligible `agent.run` stages dispatch once to a native subagent and otherwise run in the host (0508 eligibility — task 0687 resolved-inline) It records `stage <id> executed inline in session <session-id>` or `stage <id> executed via subagent <agent-id> (host session <session-id>)` in the run log. `auto` or a name is merged into `vars.agent` and `vars.implementAgent` and keeps the existing subprocess workflow; `--agent fleet` maps the run to `vars.executor: 'fleet'` instead (fleet dispatch, 0942). Headless `spur workflow run` / `spur agent run` is unchanged. See the [execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
+- `--escalation-file <path>` (implement step only, 0933) — names the Q/A escalation transcript
+  (default `.spur/run/<wbs>-escalation.md`). Absent on a first attempt means "no prior
+  escalations". When the implement agent needs an operator decision it appends its question to
+  `.spur/run/<wbs>-question.md` and exits 0 — the pipeline's `escalate` hop surfaces the question,
+  the operator answers via `spur workflow continue --answer-text`, and the guard appends the Q/A
+  pair to this transcript before re-entering implement, where the agent reads it and resumes.
 
 `--worktree` `[<name>]` (run the task's pipeline in an isolated git worktree — FF-merge onto the
 base ref on full success, retain intact on any failure/halt/non-FF; bare form creates a fresh tree,

package/plugins/sp/commands/dev-runall.md

@@ -18,12 +18,13 @@ Wraps the **sp:spur-dev** skill.
 | `--mode` `<sequential\|parallel>` | Batch execution order. | sequential |
 | `--keep-going` | Continue past per-task failures. | off |
 | `--auto` | Skip objective HITL gates. | off |
-| `--agent` `<inline\|auto\|name>` | Who runs each task's pipeline stages. Interactive sequential omit/`inline` uses the host-session driver with unified inline semantics (task 0687 — see below)). `auto`, a name, parallel mode, and headless invocation use subprocesses. | omit |
+| `--agent` `<inline\|auto\|name>` | Who runs each task's pipeline stages. Interactive sequential omit/`inline` uses the host-session driver with unified inline semantics (task 0687 — see below)). `auto`, a name, parallel mode, and headless invocation use subprocesses. The opt-in `fleet` selector (0942) maps each task run to `executor: 'fleet'` so `agent.run` stages dispatch through the fleet control plane (ADR-126) instead of a subprocess. | omit |
 | `--json` | Emit structured JSON. | off |
-| `--wrap` | Run the wrap hop per task. The `--agent` selector is preserved into each `/sp:dev-wrap <wbs>` handoff when supplied; omission remains omission. | off |
+| `--wrap` | Run the wrap hop **once for the batch** over the `done` subset only (Step 6 of execution-batch.md): `vars.feature` is passed only when every frozen task is `done`/`cancelled`; an empty done subset skips the wrap with a reason. The `--agent` selector is preserved into the `/sp:dev-wrap` handoff when supplied; omission remains omission. | off |
 | `--next` | Chain-to-completion via the next-router. | off |
 | `--continue` | Resume an interrupted batch. | off |
 | `--worktree` `[<name>]` | Run the batch in an isolated git worktree; FF-merge on success, retain on failure. Bare `--worktree` creates a fresh tree; `--worktree <name>` adopts an existing worktree by name/path/branch. | off |
+| `--concurrency` `<n>` | Parallel-mode worker bound: at most `<n>` task pipelines run at once (task 0931); a dependent starts only after its in-set dependencies are integrated onto the base ref. No-op in sequential mode (ignored). | 2 |
 
 For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag-glossary.md).
 
@@ -41,12 +42,14 @@ structured findings, before any task pipeline action, task 0510 R2; scoped: `L4.
 (the expected pre-run state of any not-yet-run feature) is reported verbatim but does not abort —
 any other strict error aborts), `--mode`
 `<sequential|parallel>` (default `sequential`; `parallel` fans out a proven-independent subset —
-see `execution-batch.md` § Parallel Execution), `--keep-going`
+see `execution-batch.md` § Parallel isolation), `--concurrency <n>`
+(parallel-mode worker bound — at most <n> task pipelines at once, default 2; a dependent task starts
+only after its in-set dependencies are **integrated** onto the base ref), `--keep-going`
 (batch failure policy — skip a failed task's in-batch dependents, continue independents; default
 halts on first failure), `--auto`
 (sets `profile=auto` on each per-task run, skipping the HITL approve gate), `--agent <inline|auto|name>`
 (names who runs the pipeline's stages — interactive sequential omit/`inline` uses the host driver;
-`auto` or a name is merged into each per-task `vars.agent` and `vars.implementAgent`; parallel mode
+`auto` or a name is merged into each per-task `vars.agent` and `vars.implementAgent`; `fleet` maps each task run to `executor: 'fleet'` instead (fleet dispatch, 0942); parallel mode
 retains isolated subprocesses, ADR-047), `--json` (emit the
 report as JSON), `--wrap` (trigger
 `wrapup-pipeline.yaml` after the batch completes), `--next`
@@ -56,9 +59,10 @@ FF-merge onto the base ref on full success, retain intact on any failure/halt/no
 creates a fresh tree, `<name>` form adopts an existing worktree by name/path/branch; see
 `execution-batch.md` § Worktree isolation).
 
-**`--worktree` is sequential-only.** `--worktree --mode parallel` is **rejected**. This flag gives
-the batch *one* worktree for the whole run; per-task worktrees and parallel isolation remain task
-0142 Slice A. Run parallel batches without `--worktree`, or run them sequentially with it.
+**`--worktree` and parallel mode.** `--worktree --mode parallel` is **rejected** — parallel mode
+already isolates each task in its own worktree (see `execution-batch.md` § Parallel isolation), and
+reuse mode (`--worktree <name>`) has no per-task meaning. Run parallel batches without
+`--worktree`, or run them sequentially with it.
 
 **`--worktree` corpus visibility.** While the batch runs in a worktree, corpus writes (task
 statuses, kanban) land in the worktree copy; your main tree still shows pre-run statuses until the
@@ -75,7 +79,9 @@ advancing the feature lifecycle). **was: `--next` deliberately omitted; the old
 **Three orthogonal axes** (do not confuse): `--keep-going`
 = batch failure policy (does a failure halt the batch or skip dependents?);
 `--continue` = resume from
-checkpoint (pick up an interrupted batch); `--next`
+checkpoint against the batch's original frozen identity — persisted plan membership, worktree
+marker, identity-filtered checkpoints as hints (execution-batch.md § Batch continuation, task
+0919); `--next`
 = chain each task to terminal status + batch-once wrap. See `dev-operations.md` § runall for the
 full distinction.
 

package/plugins/sp/commands/dev-verify.md

@@ -40,6 +40,15 @@ See `sp:code-verification` § Shippable readiness gate.
 
 - Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
 - `Skill(skill="sp:code-verification", args="verify $ARGUMENTS")`
+- **Residual sweep (F96 R1):** after the verify answer is written and `task verdict` derives
+  `.spur/run/<wbs>-verdict.json`, run `residual-scan scan` + `fold` (observe-only; folds the
+  verdict's `residual-sweep` check, PASS → PARTIAL when a blocking residual exists) — under every
+  `--fix` mode — before `spur task record`. Resolve the script via `superskill script path sp
+  residual-scan.mjs`; never reference `plugins/sp/scripts/` in shipped surfaces
+  (script-contract-check rule 4). When the task reaches `done` through `--next`, run
+  `residual-scan settle` (best-effort). On a folded PARTIAL: the bounded remediation loop has
+  already run — a residual-failed task is routed to router C6 (HITL STOP), never another
+  automatic fix loop.
 
 **Flags:**
 

package/plugins/sp/commands/dev-verifyall.md

@@ -72,3 +72,8 @@ Without `--fix all`, shippable is not evaluated (optional note: use `--fix all`
 - Batch orchestration: `Skill(skill="sp:spur-dev", args="verifyall $ARGUMENTS")`
 - Per-task verification (inner): `Skill(skill="sp:code-verification", args="verify <wbs> $SHARED_FLAGS")`
 - Shippable gate: once after the batch (same skill § Shippable readiness gate)
+- **Residual sweep (F96 R1, per task):** same contract as `/sp:dev-verify` — after each task's
+  verdict artifact is derived, run `residual-scan scan` + `fold` (under every `--fix` mode) before
+  `spur task record`; on reaching `done` via `--next`, run `settle`. Script resolution:
+  `superskill script path sp residual-scan.mjs` (never `plugins/sp/scripts/` —
+  script-contract-check rule 4).