@gobing-ai/spur 0.3.94 → 0.3.96

package/plugins/sp/skills/spur-dev/references/dev-operations.md

@@ -68,13 +68,13 @@ each would be scope creep for one-liner procedures.
 | #   | Operation  | Command             | Backing           | Skill / Verb                                                                       | Arg-hint                                                                                                                                                                                               |
 | --- | ---------- | ------------------- | ----------------- | ---------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | 1   | unit       | `dev-unit`          | `Skill()`         | `sp:code-testing`                                                                  | `<target> [--coverage <pct>] [--agent <inline\|auto\|name>] [--auto]`                                                                                                                                  |
-| 2   | review     | `dev-review`        | `Skill()`         | `sp:code-verification` (`review`) + `sp:functional-review` + `sp:code-improvement` | `[<wbs\|path>] [--agent <inline\|auto\|name>] [--focus <dims>] [--triage] [--worktree [<name>]]`                                                                                                       |
+| 2   | review     | `dev-review`        | `Skill()`         | `sp:code-verification` (`review`) + `sp:functional-review` + `sp:code-improvement` | `[--tasks <selector> \| --feature <id>[,<id>] \| --scope <path>[,<path>]] [--agent <inline\|auto\|name>] [--focus <dims>] [--triage] [--worktree [<name>]] [--auto]`                                                                                              |
 | 3   | verify     | `dev-verify`        | `Skill()`         | `sp:code-verification` (`verify`)                                                  | `<wbs> [--agent <inline\|auto\|name>] [--fix <none\|blockers-first\|all>] [--focus <lens>] [--bdd] [--auto] [--force] [--next] [--skip-shippable]`                                                     |
 | 3a  | verifyall  | `dev-verifyall`     | `Skill()` → agent | `sp:spur-dev` (`verifyall`)                                                        | `--tasks <selector> [--feature <id>] [--agent <inline\|auto\|name>] [--fix <none\|blockers-first\|all>] [--focus <lens>] [--bdd] [--auto] [--force] [--next] [--json] [--skip-shippable] [--worktree [<name>]]` |
 | 4   | run        | `dev-run`           | `Skill()`         | `sp:spur-dev` (`run` / `implement`)                                                | `<wbs> [--mode <full\|implement>] [--agent <inline\|auto\|name>] [--auto] [--next] [--wrap] [--continue] [--worktree [<name>]]`                                                                                              |
 | 5   | refine     | `dev-refine`        | `Skill()`         | `sp:spur-dev` (`refine`)                                                           | `<wbs> [--focus <mode>] [--description <text>] [--depth <standard\|ready>] [--agent <inline\|auto\|name>] [--auto] [--next]`                                                                           |
 | 5a  | refineall  | `dev-refineall`     | `Skill()`         | `sp:spur-dev` (`refineall`)                                                        | `--feature <id> \| --tasks <selector> [--focus <mode>] [--description <text>] [--depth <standard\|ready>] [--agent <inline\|auto\|name>] [--auto] [--keep-going] [--status <s>] [--json] [--worktree [<name>]]` |
-| 6   | plan       | `dev-plan`          | `Skill()`         | inline driver (`idea-pipeline`) or async workflow                                  | `"<description>" [--feature <id>] [--parent <feature-id>] [--agent <inline\|auto\|name>] [--skip-design] [--auto] [--approve-taste]`                                                                   |
+| 6   | plan       | `dev-plan`          | `Skill()`         | inline driver (`idea-pipeline`) or async workflow                                  | `"<description>" [--feature <id>] [--parent <feature-id>] [--skip-design] [--agent <inline\|auto\|name>] [--auto]`                                                                   |
 | 7   | docs       | _(no thin wrapper)_ | `Skill()`         | `sp:doc-evolve`                                                                    | `"<change description>"`                                                                                                                                                                               |
 | 8   | changelog  | `dev-changelog`     | `inline`          | git log + conventional-commit grouping                                             | `[--since <ref>] [--until <ref>] [--version <ver>]`                                                                                                                                                    |
 | 9   | gitmsg     | `dev-gitmsg`        | `inline`          | bounded diff capture → concern grouping → conventional commit                      | `[--commit] [--squash] [--all] [--scope <path>]`                                                                                                                            |
@@ -85,7 +85,7 @@ each would be scope creep for one-liner procedures.
 | 13a | parallel   | `dev-parallel`      | `Skill()`         | `sp:parallel-execution`                                                            | `--tasks <selector> [--feature <id>] [--mode <fan-out\|review-panel\|investigation>] [--agent <inline\|auto\|name>] [--json]`                                                                          |
 | 14  | wrap       | `dev-wrap`          | `Skill()`         | `spur workflow run` (wrapup-pipeline)                                              | `<wbs> [--agent <inline\|auto\|name>] [--auto] [--merge] [--dry-run]`                                                                                                                                 |
 | 15  | wrapall    | `dev-wrapall`       | `Skill()`         | `spur workflow run` (wrapup-pipeline)                                              | `[--since <iso>] [--feature <id>] [--status <s>] [--agent <inline\|auto\|name>] [--auto] [--merge] [--dry-run]`                                                                                        |
-| 16  | idea       | `dev-idea`          | `Skill()`         | inline driver (`idea-pipeline`) or async workflow                                  | `"<idea>" [--from-file <path>] [--auto] [--skip-design] [--approve-taste] [--agent <inline\|auto\|name>]`                                                                                                                              |
+| 16  | idea       | `dev-idea`          | `Skill()`         | inline driver (`idea-pipeline`) or async workflow                                  | `"<idea>" \| --from-file <path> [--skip-design] [--agent <inline\|auto\|name>] [--auto]`                                                                                                                              |
 | 17  | refactor   | `dev-refactor`      | `Skill()`         | `sp:code-refactoring` skill (thin wrapper, ADR-032)                                | `[<description>] [--scope <path>] [--focus <api\|architect\|tests\|ui\|auto>] [--fix <none\|blockers-first\|all>] [--check <cmd>] [--agent <inline\|auto\|name>] [--auto]`                                                                                          |
 
 ## Skill-backed operations
@@ -112,17 +112,19 @@ must not be changed without updating the backing skill.
 
 ### 2. review
 
-- **Purpose:** Multi-dimensional code review of a task or path — (1) functional requirements traceability (WBS mode only), (2) SECUA framework (Security, Efficiency, Correctness, Usability, Architecture), (3) architecture depth.
+- **Purpose:** Multi-dimensional code review of a task, a task set, or paths — (1) functional requirements traceability (per task target), (2) SECUA framework (Security, Efficiency, Correctness, Usability, Architecture), (3) architecture depth.
 - **Modes:**
-  - **WBS mode (`<wbs>`)**: Runs functional requirements traceability (`sp:functional-review`), SECUA framework (`sp:code-verification`), and architectural depth (`sp:code-improvement`). The three skills return review fragments; the coordinator writes the combined `## Review` (F92 0593 R1).
-  - **Path mode (`<path>`)**: Runs advisory SECUA framework (`sp:code-verification`) and architectural depth (`sp:code-improvement`). Performs no task mutation.
-- **Inputs:** `<wbs|path>` (required). Review executes inline (in-session) by default. `--agent <inline|auto|name>` selector accepted (see [SSOT](cross-cutting.md#inline-default-execution-surface)). `--focus <lens>` narrows to one SECUA dimension. `--triage` opts into bounded remediation after the report (below). `--worktree [<name>]` isolates the triage writes (below; requires `--triage`). Note: `--fix` and `--next` are **deprecated** (no-op with warning; route remediation to `--triage` or `/sp:dev-verify --fix` and progression to `/sp:dev-next`). The task pipeline's review stage never passes `--triage` or `--worktree`.
+  - **Task-set mode (`--tasks <selector>` / `--feature <id>[,<id>]`)**: resolves the set once with the batch selector grammar ([execution-batch.md § Step 1](execution-batch.md#step-1--selector-resolution-r1)) — comma WBS list or `feature:<id>` (the `--feature` comma list is union sugar); status pseudo-lists and `ready` are rejected for review. One WBS-mode review per implemented task, each writing its own merged `## Review` (F92 0593 R1); tasks in `backlog`/`todo`/`blocked` are reported NOT-STARTED and skipped (§ 3a vocabulary); a per-task failure does not stop the remaining tasks; the run ends with a combined summary table (WBS, verdict, P1/P2 counts).
+  - **WBS mode (`<wbs>`, the per-task recipe)**: Runs functional requirements traceability (`sp:functional-review`), SECUA framework (`sp:code-verification`), and architectural depth (`sp:code-improvement`). The three skills return review fragments; the coordinator writes the combined `## Review` (F92 0593 R1).
+  - **Path mode (`<path>`, the per-path recipe)**: Runs advisory SECUA framework (`sp:code-verification`) and architectural depth (`sp:code-improvement`). Performs no task mutation.
+  - **Path-set mode (`--scope <path>[,<path>]`)**: paths must exist (exit 2 otherwise), are normalized, duplicates dropped and nested paths collapse to the ancestor (`--scope apps,apps/cli` → `apps`); one advisory sub-review per surviving path (Step 3p path scope, eligible for native-subagent dispatch per [dispatch-surface.md](../../parallel-execution/references/dispatch-surface.md)); the coordinator merges the sub-reviews, runs one cross-path architecture pass (`sp:code-improvement` over the inter-path imports), and emits one merged advisory report. No task mutation.
+- **Inputs:** exactly one of `--tasks <selector>`, `--feature <id>[,<id>]`, or `--scope <path>[,<path>]` (deprecated positional alias, below) — more than one exits 2 naming the conflict; none exits 2 with usage (no implicit `cwd` target). Review executes inline (in-session) by default. `--agent <inline|auto|name>` selector accepted (see [SSOT](cross-cutting.md#inline-default-execution-surface)). `--focus <dims>` narrows the review dimensions — vocabulary SSOT: [code-verification/SKILL.md](../../code-verification/SKILL.md) review mode (`functional` → `sp:functional-review`; `architecture` → `sp:code-improvement` + SECUA-A; S/E/C/U → `sp:code-verification`). `--auto` skips objective HITL confirmations (the pipeline's review stage passes it). `--triage` opts into bounded remediation after the report (below). `--worktree [<name>]` isolates the triage writes (below; requires `--triage`). Note: the positional `<wbs\|path>` is a **deprecated alias** for one release — a `^\d{4}$` token with a resolvable task → `--tasks`; an existing path → `--scope`; otherwise exit 2, with a deprecation warning naming the replacement. `--fix` is **deprecated** (accepted no-op with warning; route remediation to `--triage` or `/sp:dev-verify --fix`); `--next` is **removed** (route progression to `/sp:dev-next`). The task pipeline's review stage never passes `--triage` or `--worktree`.
 - **Triage (`--triage`):** runs inline in the invoking session after the merged report — never inside `sp:super-reviewer` or the review skills, which stay report-only. With `--agent <name>`, only the review is delegated; triage still runs inline on the returned findings. Never fix straight from the raw findings list:
   1. **Bucket every finding exactly once.** **Direct fix** — local, low-risk, obvious root cause: no design choice, no public-surface / schema / dependency change, not a shared write path, verifiable by a targeted check (docs, a guard, a missing throw, a wrong path helper, a stale comment). **Task** — real and actionable but needs design, crosses modules, touches a public surface, or is not verifiable locally; skip it when an existing task already owns it (cite that WBS). **Note** — pre-existing, environmental, or ownerless; report only.
   2. **Apply direct fixes** — smallest surgical diff in project style, then re-verify each with its targeted check (focused test, lint, or the exact command that exhibited the defect). A fix that grows beyond the bar or fails its check moves to the Task bucket with what was learned; do not leave it half-applied.
-  3. **File the Task bucket as one or more tasks**, one per cohesive unit of work that one agent can implement and verify in one run — split unrelated fixes, merge findings that share a root cause or file set. File under the existing feature that owns the affected surface; if none fits, create a child feature under the closest existing parent — never a new root feature. Write through the CLI-gated corpus surface only (`spur task create --feature <id> --skip-ready`, then `spur task update <wbs> --section <s> --from-file`). Each task must meet the implement-ready bar ([§ 5. refine](#5-refine), `--depth ready`) so it cannot drift: per finding the evidence (`file:line`), the defect, the chosen fix direction with rejected alternatives, file targets, AC, and out-of-scope; promote `backlog → todo` only when `spur task check <wbs> --json` is clean. Name what the direct fixes already resolved in each task's Background.
+  3. **File the Task bucket as one or more tasks**, one per cohesive unit of work that one agent can implement and verify in one run — split unrelated fixes, merge findings that share a root cause or file set. File under the existing non-terminal feature that owns the affected surface (a `done` owner blocks `todo` promotion with `L4.feature-terminal` — reopen it with `spur feature update <id> active` when its goal still covers the work); if none fits, create a child feature under the closest existing parent — never a new root feature. Write through the CLI-gated corpus surface only (`spur task create --feature <id> --skip-ready`, then `spur task update <wbs> --section <s> --from-file`). Each task must meet the implement-ready bar ([§ 5. refine](#5-refine), `--depth ready`) so it cannot drift: per finding the evidence (`file:line`), the defect (a root cause not reproduced in this session is written as a labeled hypothesis with its confirming repro, never as the fix premise), the chosen fix direction with rejected alternatives, file targets, AC, and out-of-scope; promote `backlog → todo` only when `spur task check <wbs> --json` is clean. Name what the direct fixes already resolved in each task's Background.
   4. **Gate and report.** Run the project gate once after the direct fixes. Report a Triage section: each applied fix (path + one-line what + verification), each filed task (WBS + feature + scope), and the Notes. Never commit or create a branch outside `--worktree`.
-- **Worktree (`--worktree [<name>]`):** omitted → all writes land in the current working tree on the current branch; no branch creation, checkout, or commit (the operator commits). Given → the [execution-batch.md § Worktree isolation](execution-batch.md#worktree-isolation---worktree-name) lifecycle as a run of one: marker `command` = `dev-review`, `selector` = the review target, derived branch/directory slug = the WBS or the path's basename (`sp/review-<slug>-<short-id>`). Admission is "the target resolves" (a known WBS or an existing path) — no `quickReadiness` task-set check. Review and triage both run in the tree; WT-3b commits the fixes and filed tasks. The WT-4 success condition reads as "every direct fix passed its check and the project gate is green"; a failed check or gate takes the WT-5 retention path. Rejected without `--triage` (WT-7) — to review another worktree read-only, pass a path inside it.
+- **Worktree (`--worktree [<name>]`):** omitted → all writes land in the current working tree on the current branch; no branch creation, checkout, or commit (the operator commits). Given → the [execution-batch.md § Worktree isolation](execution-batch.md#worktree-isolation---worktree-name) lifecycle as a run of one: marker `command` = `dev-review`, `selector` = the full normalized target list, derived branch/directory slug = `sp/review-<first>-and-<N>-<short-id>` for a multi-target run (N = target count) or `sp/review-<slug>-<short-id>` for a single target (the WBS or the path's basename). Admission is "every target resolves" (each a known WBS or an existing path) — no `quickReadiness` task-set check. Review and triage both run in the tree; WT-3b commits the fixes and filed tasks, bucketed across all targets once (identical `file:line` findings deduped). The WT-4 success condition reads as "every direct fix passed its check and the project gate is green"; a failed check or gate takes the WT-5 retention path. Rejected without `--triage` (WT-7) — to review another worktree read-only, pass a path inside it.
 - **Backing:** `sp:functional-review`, `sp:code-verification` (review mode), `sp:code-improvement`.
 - **Behavior:** WBS mode runs functional traceability + SECUA + architecture depth, ranking findings P1–P4, and hands the merged report to the review coordinator, which writes `## Review`. Component skills never write `## Review` in coordinated mode. Path mode runs advisory SECUA + architecture depth with no task mutation.
 - **Delegation:** WBS mode: `sp:functional-review` + `sp:code-verification` (review) + `sp:code-improvement`; Path mode: `sp:code-verification` (review) + `sp:code-improvement`.
@@ -322,7 +324,7 @@ must not be changed without updating the backing skill.
 - **Inputs:** `"<description>"` (required). `--feature <id>` links to an existing feature. `--parent <feature-id>` nests under a parent. Omitted/`inline` drives `idea-pipeline.yaml` in the host session; `auto` or a name launches the async workflow worker. **Design package flags (unified with `/sp:dev-idea`):**
   - **Default:** author task `design` on every batch item + feature satellite when the seam heuristic fires (**ties lean design**). There is **no** `--design` force flag.
   - `--skip-design` — skip feature satellite **and** omit task `design` fields (scaffold only; refine fills later). Sole design opt-out.
-  - `--approve-taste` — with `--auto`, pre-clear design-approval taste pause when that gate is used (`design_approved=true`). Alias: `--design-approved`.
+  - `--auto` — accept the recommendation at every operator gate, taste gates included (same contract as § 16 idea).
 - **Backing:** `sp:spur-dev` skill, `plan` operation. Stage floor: the `planner` role per [`roles.md`](../../../references/roles.md) — this file names roles, never tiers (0538 R4).
 - **Behavior:** Clarify scope → `spur feature create` → author BDD AC → `spur feature check` gate → decompose into task-batch JSON **including `design` (unless `--skip-design`)** → `spur task batch-create` gate. Design package details: [planning-workflow.md](planning-workflow.md) Step 5.5.
 - **Delegation:** `Skill(skill="sp:spur-dev", args="plan $ARGUMENTS")`
@@ -369,7 +371,7 @@ must not be changed without updating the backing skill.
 - **Purpose:** Wrap up a single completed task — capture learnings, record metrics, sync docs, and optionally advance the feature / clean up the branch.
 - **Inputs:** `<wbs>` (required, positional). `--agent <inline|auto|name>` names the wrap's model-bearing executor (default: `inline`, resolving identically when omitted; task 0687); wrap is workflow-backed (headless), so omit ≡ explicit `inline` (task 0687): tier substitution under objective trigger 3 (durable auditable run record required) plus one warning naming the substituted executor. `auto` tier-resolves an executor, and a name pins that executor into `vars.agent` (see [SSOT](cross-cutting.md#inline-default-execution-surface)). `--auto` skips objective confirmations (the branch-cleanup HITL gate still pauses — irreversible). `--merge` triggers branch cleanup (irreversible HITL gate).
 - **Backing:** `spur workflow run wrapup-pipeline.yaml` — direct workflow invocation (no backing skill; the pipeline IS the procedure).
-- **Behavior:** Resolves the executor (`agent.default` for omit/`inline`, tier-resolved for `auto`, unchanged for a name), emits a pre-dispatch notice naming the subprocess override — `execution surface: subprocess`, `reason: trigger 3 — durable auditable run record required`, `requested agent: <selector>`, `executor: <resolved>` — then builds `--vars '{"tasks":"[\"<wbs>\"]","agent":"<resolved>","profile":"interactive|auto","merge":"true|false"}'` and invokes the wrapup pipeline. The pipeline runs: task-resolve → doc-sync → learning-capture → metrics-record → (feature-transition) → (branch-cleanup) → done. Task statuses are NOT mutated. Branch cleanup is an irreversible HITL gate that always pauses, even under `--auto`.
+- **Behavior:** Resolves the executor (`agent.default` for omit/`inline`, tier-resolved for `auto`, unchanged for a name), emits a pre-dispatch notice naming the subprocess override — `execution surface: subprocess`, `reason: trigger 3 — durable auditable run record required`, `requested agent: <selector>`, `executor: <resolved>` — then builds `--vars '{"tasks":"[\"<wbs>\"]","agent":"<resolved>","profile":"interactive|auto","merge":"true|false"}'` and invokes the wrapup pipeline. The pipeline runs: task-resolve → doc-sync → learnings-validate → learnings-append → doc-tripwire → metrics-record → (feature-transition) → (branch-cleanup) → done. `doc-tripwire` (1037) runs the TRUSTED CONFIG ONLY `docTripwireCmd` over the still-uncommitted wrap diff after the doc-sync exits converge — the default runs `bun run test-repo-wide` only when `package.json` declares the script (a no-op in other projects); override it via `--vars`, and an empty string disables the check while still recording PASS; a FAIL fails the wrap with already-written learnings/docs preserved. Task statuses are NOT mutated. Branch cleanup is an irreversible HITL gate that always pauses, even under `--auto`.
 - **Vars string typing:** `tasks` is a JSON-encoded **string**, not a JSON array — `spur workflow run --vars` accepts only string values (`--vars values must be strings`); the pipeline's guards parse the string with `jq length`. `jq -nc` guarantees the shape:
 
   ```bash
@@ -385,7 +387,7 @@ must not be changed without updating the backing skill.
 - **Purpose:** Wrap up a batch of completed tasks — capture learnings, record metrics, sync docs, advance a feature through legal lifecycle edges, and optionally clean up branches.
 - **Inputs:** `--since <iso-date>` filters done tasks by frontmatter `updated_at >= date` (v1 approximation). `--feature <id>` selects all tasks under a feature AND advances the feature through legal lifecycle edges (`backlog → active → verifying → done`, guards honored). `--status <s>` (default: `done`) filters by task status. `--agent <inline|auto|name>` names the wrap's model-bearing executor (default: `inline`, resolving identically when omitted; task 0687); wrap is workflow-backed (headless), so omit ≡ explicit `inline` (task 0687): tier substitution under objective trigger 3 (durable auditable run record required) plus one warning naming the substituted executor. `auto` tier-resolves an executor, and a name pins that executor into `vars.agent` (see [SSOT](cross-cutting.md#inline-default-execution-surface)). `--auto` skips objective confirmations. `--merge` triggers branch cleanup (irreversible HITL gate).
 - **Backing:** `spur workflow run wrapup-pipeline.yaml` — direct workflow invocation.
-- **Behavior:** Resolves the task list via `spur task list --json` (filtered by `--feature`, `--since`, `--status`), resolves the executor (omission and explicit `--agent inline` tier-substitute identically with a warning per task 0687, `auto` tier-resolves, a name pins), emits a pre-dispatch notice naming the subprocess override — `execution surface: subprocess`, `reason: trigger 3 — durable auditable run record required`, `requested agent: <selector>`, `executor: <resolved>` — then builds `--vars '{"tasks":"[...]","feature":"<id>","agent":"<resolved>","profile":"interactive|auto","merge":"true|false"}'` and invokes the wrapup pipeline. The pipeline runs the same states as `wrap` but with the full task list and optional feature transition. Task statuses are NOT mutated. Feature transitions go through `spur feature update` so lifecycle guards apply. Branch cleanup is an irreversible HITL gate.
+- **Behavior:** Resolves the task list via `spur task list --json` (filtered by `--feature`, `--since`, `--status`), resolves the executor (omission and explicit `--agent inline` tier-substitute identically with a warning per task 0687, `auto` tier-resolves, a name pins), emits a pre-dispatch notice naming the subprocess override — `execution surface: subprocess`, `reason: trigger 3 — durable auditable run record required`, `requested agent: <selector>`, `executor: <resolved>` — then builds `--vars '{"tasks":"[...]","feature":"<id>","agent":"<resolved>","profile":"interactive|auto","merge":"true|false"}'` and invokes the wrapup pipeline. The pipeline runs the same states as `wrap` — including the `doc-tripwire` hop (1037), whose TRUSTED CONFIG ONLY `docTripwireCmd` runs the repo-wide tripwires over the still-uncommitted wrap diff and can be overridden or disabled (empty string) via `--vars` — but with the full task list and optional feature transition. Task statuses are NOT mutated. Feature transitions go through `spur feature update` so lifecycle guards apply. Branch cleanup is an irreversible HITL gate.
 - **Vars string typing:** `tasks` is a JSON-encoded **string**, not a JSON array — `--vars` values must be strings (the CLI rejects raw arrays); `jq -nc` passes the array text through as a string value:
 
   ```bash
@@ -400,11 +402,14 @@ must not be changed without updating the backing skill.
 
 - **Purpose:** Turn a vague idea into a feature with AC and a decomposed task batch — the unified entry point for the planning half.
 - **Inputs:** `"<idea>"` (quoted) or `--from-file <path>` — exactly one; the two are mutually
-  exclusive (0887 R7). Three everyday axes:
-  - `--auto` — skip **objective** HITL (feature-check, batch-create); taste gates still pause.
-  - `--skip-design` — design package off (system-design + task Design).
-  - `--approve-taste` — with `--auto`, skip **all** remaining taste pauses this run (idea-eval + design-approval). Sets `idea_approved=true` and `design_approved=true`.
-    Aliases (prefer `--approve-taste`): `--idea-approved` → `idea_approved`; `--design-approved` → `design_approved`. There is **no** `--design` force flag.
+  exclusive (0887 R7). Two everyday axes:
+  - `--auto` — accept the recommendation at **every** operator gate (objective and taste):
+    sets `profile=auto`, `idea_approved=true`, `design_approved=true`. idea-eval follows the
+    report's `## Recommendation` (`proceed`/`reshape` continue, `drop` cancels, missing still
+    asks); design-approval approves only on a PASS design check (FAIL still asks).
+  - `--skip-design` — design package off (system-design + task Design). There is **no** `--design` force flag.
+  - Removed: `--approve-taste`, `--idea-approved`, `--design-approved` (folded into `--auto`;
+    ignored with a one-line notice if passed).
   - `--from-file <path>` — read the idea text from a file instead of the positional argument
     (verbatim; long/multiline asks). Mutually exclusive with `"<idea>"`.
 - **Verbatim idea artifact:** before `start` executes, the driver persists the idea argument (or
@@ -414,7 +419,7 @@ must not be changed without updating the backing skill.
 - **Backing:** `idea-pipeline.yaml` through the inline driver for omitted/`inline`, or `spur workflow run idea-pipeline.yaml --async` for `auto`/name.
 - **Behavior:** Builds vars from the table above and drives the idea pipeline. Flow: discovery → **idea-eval** (taste; reject → cancelled) → feature-create → ac-generate → feature-check → system-design (conditional) → design-approval (taste) → decompose → batch-create (`--skip-ready`) → ready-prepare (ready checklist per created task + ready-evidence sidecar, 0788) → handoff. STOPS at handoff — no task execution, no pipeline nesting. Headless runs use one `trace --follow`; cancellation is reported stopped only when `workflow cancel --json` returns `killed: true`.
 - **Delegation:** Host-session inline driver by default; explicit executor selection uses the async workflow worker.
-- **Idea-evaluation gate:** After discovery, operator reviews `.spur/run/idea-eval-report.md` ([idea-evaluation.md](idea-evaluation.md)). Approve continues; reject/cancel → no feature. Under `--auto`, still pauses unless taste pre-cleared (`--approve-taste` / alias). Enhanced idea is a sidecar — `vars.idea` is not overwritten.
+- **Idea-evaluation gate:** After discovery, operator reviews `.spur/run/idea-eval-report.md` ([idea-evaluation.md](idea-evaluation.md)). Approve continues; reject/cancel → no feature. Under `--auto`, follows the report's recommendation (`drop` → cancelled; missing recommendation → pauses). Enhanced idea is a sidecar — `vars.idea` is not overwritten.
 - **Design package (`--skip-design` only):**
 
   | Flags           | Feature satellite (`system-design`) | Task `### Design` in batch                |
@@ -425,7 +430,7 @@ must not be changed without updating the backing skill.
   Ties lean design — when the signal is ambiguous, `system-design` runs. Task Design defaults on
   unless `--skip-design`. Plan path uses the same package contract (no `--design` force flag).
 
-- **Taste pre-clear (`--approve-taste`):** owned with design-approval var semantics in [cross-cutting.md](cross-cutting.md) § "Design Approval Gate"; idea-eval uses the parallel `idea_approved` var. One CLI flag sets both.
+- **Operator gates:** every pause is one `AskUserQuestion` [decision brief](decision-brief.md) — recommended option first; see the gate table in `commands/dev-idea.md` and the `hitl.confirm` rule in [inline-pipeline-driver.md](inline-pipeline-driver.md).
 
 ### 17. refactor
 
@@ -460,73 +465,84 @@ is the procedure. The backing is a combination of git CLI, `spur` CLI, and agent
 
 ### 9. gitmsg
 
-- **Purpose:** Generate conventional commit message(s) for the current change set — one bounded diff capture → concern grouping → one message per concern; optionally commit.
+- **Purpose:** Generate conventional commit message(s) for the current change set — one gather call → concern grouping → one message per concern; optionally commit. Git + POSIX shell only; no helper script.
 - **Inputs:** `--scope <path>` (default: the whole change set) — path filter; an explicit `--scope` always wins over change-set auto-discovery. `--all` (default: off) — widen the change set past the index to every change in the tree: unstaged **and untracked** files. Omitted, the change set is the index only, which keeps pre-commit semantics stable. `--commit` (default: off) — commit the change set, one commit per concern. `--squash` (default: off) — collapse every concern into one message and one commit; implies `--commit`.
-- **Backing:** `inline` — bounded diff capture + concern grouping + conventional commit formatting.
+- **Backing:** `inline` — one bounded gather call + concern grouping + conventional commit formatting.
 - **Behavior:**
 
-  1. **Gather once — a single shell round trip.** No temp file, no second read, no follow-up `git` call for context:
+  1. **Gather — exactly one Bash call.** Set the three variables from the flags and run the block
+     verbatim. It resolves the change set, applies the empty-index rule, and prints everything the
+     message needs; the guards run in shell, not in the model:
 
      ```bash
-     # default:  RANGE=--cached        (the index)
-     # --all:    RANGE=HEAD            (plus untracked, listed below)
-     git rev-parse --abbrev-ref HEAD --git-dir --git-common-dir
-     git diff $RANGE --stat $PATHSPEC
-     git diff $RANGE --name-status $PATHSPEC
-     git diff $RANGE -U0 $PATHSPEC ':(exclude)*.lock' ':(exclude)*lock.json' ':(exclude)*.lockb' | head -c 60000
-     # --all only:
-     git ls-files --others --exclude-standard $PATHSPEC
+     bash <<'EOF'
+     ALL=0 COMMIT=0 SCOPE=':/'   # --all → ALL=1 · --commit/--squash → COMMIT=1 · --scope <p> → SCOPE=<p>
+     EX=(':!*.lock' ':!*lock.json' ':!*.lockb')
+     untracked() { git ls-files -o --exclude-standard -- "$SCOPE" "${EX[@]}"; }
+     if [ "$ALL" = 0 ] && git diff --cached --quiet -- "$SCOPE"; then
+       t=$(git diff --name-only HEAD -- "$SCOPE" | wc -l | tr -d ' '); u=$(untracked | wc -l | tr -d ' ')
+       [ "$COMMIT" = 1 ] && { echo "STOP index empty ($t tracked, $u untracked changed) — re-run with --all"; exit; }
+       echo "NOTE index empty — reading the whole tree instead"; ALL=1
+     fi
+     [ "$ALL" = 1 ] && R=HEAD || R=--cached
+     stream() {
+       git diff $R -U0 --diff-filter=d -- "$SCOPE" "${EX[@]}"
+       [ "$ALL" = 1 ] && untracked | while IFS= read -r f; do git diff --no-index -U0 -- /dev/null "$f"; done
+     }
+     [ -z "$(stream | head -c1)" ] && { echo "STOP no changes in $SCOPE"; exit; }
+     echo "## context"; git rev-parse --abbrev-ref HEAD --git-dir --git-common-dir --show-superproject-working-tree
+     echo "## recent subjects"; git log -12 --format=%s
+     echo "## stat"; git diff $R --stat=100 --compact-summary -- "$SCOPE"
+     [ "$ALL" = 1 ] && untracked | sed 's/^/ (untracked) /'
+     [ "$ALL" = 0 ] && { echo "## partially staged"; comm -12 <(git diff --cached --name-only | sort) <(git diff --name-only | sort); }
+     echo "## secret hits"
+     stream | awk '/^\+\+\+ /{f=substr($0,7)} /^\+[^+]/{print f": "$0}' \
+       | grep -E '(password|passwd|secret|api[_-]?key|access[_-]?token|auth[_-]?token)["'"'"']?[[:space:]]*[:=][[:space:]]*["'"'"'][^"'"'"'[:space:]]{12,}|BEGIN [A-Z ]*PRIVATE KEY|(ghp_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{40,}|sk-[A-Za-z0-9_-]{20,}|AKIA[0-9A-Z]{16})' | head -5
+     echo "## diff (-U0, ≤80 lines/file, ≤40 KB)"
+     stream | awk '/^diff --git/{n=0} n++<80' | head -c 40000
+     EOF
      ```
 
-     `$PATHSPEC` is `-- <path>` when `--scope` is given, empty otherwise.
+     What the block guarantees:
+     - **Untracked files are read, not just named** — under `--all` each one is diffed against `/dev/null`, so a new file (often the main change) shapes the message.
+     - **Every file gets a share** — the per-file 80-line cap runs before the 40 KB total cap, so one large file cannot starve the rest. Deleted files contribute only their `(gone)` stat line; lockfiles are excluded.
+     - **Empty index, no `--all`:** a message-only run widens to the whole tree and says so (`NOTE`); a committing run prints `STOP` with the counts — re-print the exact re-run line (`/sp:dev-gitmsg <same flags> --all`) and stop. Committing untracked files is never inferred.
+     - **`STOP no changes`** → report it and stop.
 
-     **Empty index, no `--all`** — the dead-end this command used to hand back. Reading is
-     not a mutation, so the two cases split there:
-     - **No committing flag** → re-gather once with `--all` semantics and say so
-       (`index empty — read the whole tree instead`). A message-only run has nothing to lose by
-       looking wider, and the operator gets an answer instead of an errand.
-     - **`--commit` / `--squash`** → stop. Print the worktree counts (`N tracked, M untracked`) and
-       the exact re-run line (`/sp:dev-gitmsg <the same flags> --all`). Committing
-       untracked files is never inferred from an empty index — that is the operator's call, and it
-       is now one paste away rather than a guess.
+  2. **Stay inside the budget.** The block's output is the whole input. Never run a second, wider `git diff`, `git show`, or file `Read` to "see more"; never paste hunks into the output. A truncated file is typed from its stat line and path.
 
-     Empty under `--all`, or still empty after the widen → report `no changes in <scope>` and stop.
+  3. **Group by concern.** A concern is one coherent change a reviewer would accept or revert as a unit:
+     - Tests, docs, and registry/index updates travel **with the code they cover** — not as separate `test`/`docs` groups. A standalone `test`/`docs` group exists only when nothing else in the change set motivates it.
+     - Behavior changes and pure formatting/refactor churn are **different** concerns.
+     - Prefer fewer groups; a single group is the common case. Order groups by dependency (refactor before the feature that uses it).
 
-  2. **Stay inside the budget.** `-U0` (no context lines) plus the lockfile exclusions plus the 60 KB cap is the token contract — never re-run the diff with context to "see more", never paste diff hunks into the output. If the cap truncated the diff, say so and derive the message from `--stat` + `--name-status` alone; a large mechanical change rarely needs hunk detail to be typed and scoped correctly.
+  4. **Write each message.**
+     - **Type** from the dominant change: `feat` · `fix` · `refactor` · `perf` · `docs` · `test` · `style` · `build` (deps, bundling) · `ci` (workflows, pipelines) · `chore` (other tooling/config) · `revert`.
+     - **Scope** — reuse a scope that appears in `## recent subjects` for the same area (the repo's own vocabulary beats a guessed one); `--scope <path>` overrides. Omit the scope rather than invent one.
+     - **Summary** — imperative, ≤72 chars, lowercase first word, no period; says what changed in user/maintainer terms, not which files.
+     - **Body** — only when the *why* is not obvious from the summary: intent and consequence in 1–3 lines, never a restated diff or file list. `--squash` → one combined message (dominant type/scope, one body bullet per concern).
 
-  3. **Summarize only what shapes the message.** One sentence — what changed and _why_, not a line count — for each file whose change is not obvious from its path and status. Skip the obvious ones (generated files, lockfiles, pure renames, `docs/**` under a `docs` group). Past ~12 interesting files, summarize per directory instead of per file.
+  5. **Report.** Print: one context line (branch; `linked worktree` when `--git-dir` ≠ `--git-common-dir` and the superproject line is empty), then each message in a fenced block. No per-file summaries, no restated diff. With neither `--commit` nor `--squash`, add one copy-paste `git commit` line per message and stop.
 
-  4. **Group by concern**, and for each group derive type, scope, message:
-     - Type from the dominant change — `feat` (new functionality) · `fix` (bug fix) · `refactor` (restructuring, no behavior change) · `docs` (documentation only) · `chore` (build/config/tooling) · `perf` · `test` · `style`.
-     - Scope from the affected module/package (`cli`, `domain`, `server`, `web`, `app`, …); `--scope` overrides.
-     - Message:
+  6. **Commit (`--commit` / `--squash`) — one more Bash call.** `--squash` implies `--commit`, so both together is just `--squash`. Refuse before touching the index when:
+     - `## secret hits` is non-empty → print each `file: line`, commit nothing;
+     - `--commit` would split (more than one group) and `## partially staged` is non-empty → splitting would widen those `git add -p` stagings to whole files; print the paths and commit nothing (`--squash` is allowed — it commits the index as staged).
 
-       ```
-       <type>(<scope>): <summary>
+     Otherwise run the commits in one heredoc — `--all` first stages the scope (`git add -A -- "$SCOPE"`); a single group or `--squash` is one `git commit -F -`; multiple groups commit in dependency order:
 
-       <body — why, only when the why is not obvious>
-       ```
-
-       Summary: imperative mood, ≤72 chars, lowercase first word, no period. Body explains intent and consequence; it never restates the diff. Behavior changes and pure formatting/refactor churn are **different concerns** — never one group.
-
-  5. **Resolve the message shape without a round trip to the operator.** `--squash` → one combined
-     message (dominant type/scope, one body bullet per group). Otherwise one message per group, in
-     dependency order (refactor before the feature that uses it); a single group is that same rule
-     with one group.
-
-  6. **Report, then commit if asked.** Print the resolved message(s), a copy-paste `git commit` line per message, and a one-line context header: current branch, and `linked worktree` when `--git-dir` differs from `--git-common-dir` and `git rev-parse --show-superproject-working-tree` is empty (a non-empty result means submodule, not worktree). With neither `--commit` nor `--squash`, stop here — the operator commits.
-
-  7. **Committing (`--commit` / `--squash`).** The two flags name outcomes, not dimensions: `--commit`
-     commits **by concern**, `--squash` commits **everything as one**. `--squash` implies `--commit`,
-     so `--commit --squash` is just `--squash`, never an error.
+     ```bash
+     bash <<'EOF'
+     git reset -q -- :/ && git add -A -- <group-1 paths> && git commit -q -F - <<'MSG'
+     <group-1 message>
+     MSG
+     # …repeat per group…
+     git log --oneline -<n>; git status --short
+     EOF
+     ```
 
-     First scan the captured diff's added lines for credentials (`password`, `secret`, `api[_-]?key`, `token`, `BEGIN [A-Z ]*PRIVATE KEY`, long base64-looking literals). On a hit: print the offending `file:line`, commit nothing, stop. Otherwise:
-     - `--all` → `git add -A $PATHSPEC` first (this is what stages the untracked files).
-     - `--squash`, or `--commit` on a single group → `git commit -m "$MESSAGE"`.
-     - `--commit` on multiple groups → **commit each group in sequence**: record the full staged file list once, then per group `git reset -q -- <all staged paths>` → `git add -- <that group's paths>` → `git commit -m "<that group's message>"`. This is the split; it needs no re-run and no re-staging by the operator.
-     - **Partial-staging guard:** if any path appears in _both_ `git diff --cached --name-only` and `git diff --name-only` (a `git add -p` staging), the sequence above would silently widen those commits to the whole file. Do not split — report the affected paths and commit nothing unless `--squash` was given.
+     Hooks stay enabled; a failing hook stops the run with its output — never `--no-verify`.
 
-- **Invariants:** With neither `--commit` nor `--squash`, never runs `git commit` — message only. Neither flag commits across a credential hit, and `--commit` never splits across a partial staging. Without `--all` the change set is the index, so plain `/sp:dev-gitmsg` keeps pre-commit semantics; only `--all` reaches unstaged and untracked files, and only a committing run (`--commit` / `--squash`) stages them. The empty-index widen is read-only and always announced — a committing run never widens its own scope. An explicit `--scope <path>` always bounds the change set, with or without `--all`. One diff capture per run, bounded and context-free — never a second, wider read.
+- **Invariants:** Git and POSIX shell only — no helper script, no temp file. At most two Bash calls: gather, then (only when committing) commit. With neither `--commit` nor `--squash`, never runs `git commit` — message only. Neither flag commits across a secret hit, and `--commit` never splits across a partial staging. Without `--all` the change set is the index, so plain `/sp:dev-gitmsg` keeps pre-commit semantics; only `--all` reaches unstaged and untracked files, and only a committing run stages them. The empty-index widen is read-only and always announced — a committing run never widens its own scope. An explicit `--scope <path>` always bounds the change set, with or without `--all`. One bounded, context-free capture per run — never a second, wider read.
 
 ### 10. fixall
 

package/plugins/sp/skills/spur-dev/references/done-housekeeping.md

@@ -34,7 +34,7 @@ If you hand-walk lifecycle statuses (manual `spur task update <wbs> <status>` wi
 pipeline), you MUST state so explicitly in your final message and name the gate you verified:
 
 ```
-Transitioned manually. Gate verified: spur task check <wbs> --strict-core -> PASS
+Transitioned manually. Gate verified: spur task check <wbs> --as done -> PASS
 ```
 
 Silent manual transitions are the anti-pattern to forbid. Either the pipeline ran (name the
@@ -128,7 +128,7 @@ silently incomplete (H6 shipped at 23/48 that way, with one verdict carrying an
 `acceptanceCriteria` array and still reading PASS). See `ac-style-guide.md` §
 "Verdict AC ↔ feature scenario linkage" for the id forms and evidence vocabulary.
 
-**Parser contract (verify-answer-lint + `task verdict`, 0817 re-verify findings):**
+**Parser contract (`spur task verdict` answer lint, 0817 re-verify findings):**
 
 1. The requirement id cell must be the **bare** id — `| R1 | MET | … |`. Suffixes (`R1 (AC1)`) or
    decoration (`**R1**`) fail the exact-match completeness check (`missing requirement row`).
@@ -160,7 +160,7 @@ command printing `0`.
 | # | Check | Command to run (literal - paste the output) | Pass condition |
 |---|-------|----------------------------------------------|----------------|
 | 1 | F1 - no unchecked boxes anywhere | `grep -c '^\s*- \[ \]' <task-file>` | output is exactly `0` (whole file, not just Plan) |
-| 2 | F2 - honest transition | (state it) | named a pipeline run-id, OR "manual + `spur task check <wbs> --strict-core` PASS" |
+| 2 | F2 - honest transition | (state it) | named a pipeline run-id, OR "manual + `spur task check <wbs> --as done` PASS" |
 | 3 | F4 - gate evidence | (recall change type) | raw gate tails pasted if code/test/infra touched; one-liner only if pure-doc |
 | 4 | F5 - no `/tmp` residue | `ls /tmp/<wbs>-* 2>/dev/null \| wc -l` | output is `0` |
 | 5 | Dogfood (only if in dogfood mode) | `rg -c '^### 3\. Monitor Ledger' <report> && rg -c '── Dogfood Summary ──' <report> && rg -c '^status: (complete\|aborted)' <report>` | all three counts are `>= 1` (report exists under `docs/dogfood/` AND carries the mandatory ledger section AND the mandatory summary footer AND terminal frontmatter status - not just any file matching the slug) |

package/plugins/sp/skills/spur-dev/references/execution-batch.md

@@ -64,6 +64,10 @@ function normalizeArgs(raw: Args): Args {
 
 - If `--feature FOO` is present and `--tasks` is absent, treat the effective selector as `feature:FOO`.
 - If both are present, `--tasks` wins (with a one-line note in the batch report).
+- **Per-command admission filters (I33 1023).** Step 1 is the shared baseline; commands may layer
+  stricter grammar on top — e.g. `/sp:dev-review` rejects `ready`/status pseudo-lists and the mixed
+  `--tasks` + `--feature` combination (exit 2), and accepts multi-id `--feature <id>,<id>` as
+  caller-level sugar expanded by the command layer before the resolver.
 
 **Feature-derived strict preflight (R2, task 0510).** After normalization, if the **effective
 selector** is `feature:<id>` (whether via `--tasks feature:<id>` or the `--feature <id>` sugar),
@@ -291,8 +295,8 @@ Each pipeline run ends in one of two terminal states:
 `.spur/run/<wbs>-verify-answer.txt` AC table is exactly four columns:
 `| AC | Status | Evidence Type | Evidence |`. The evidence-type token
 (`test`, `command`, `static-ref`, `manual-review`, `llm-judge`, `n/a`, or a `+`
-compound) is isolated in cell 3. A token merged into the evidence cell fails
-`verify-answer-lint`.
+compound) is isolated in cell 3. A token merged into the evidence cell fails the
+`spur task verdict` answer lint.
 
 **Driver acceptance (0930 R3).** The trace row and `.spur/run/<wbs>-verdict.json` are accepted as
 terminal evidence only if BOTH hold:
@@ -328,40 +332,35 @@ node "$(superskill script path sp batch-preflight.mjs)" --wbs <wbs> --status <st
 Helper: `recoveryHint(status, wbs)` in `plugins/sp/scripts/batch-preflight.ts`. Tables remain SSOT
 in next-router; this only maps status → primary TABLE A hop for recovery.
 
-### 3.3c Bounded feature-sync retry suppression (task 0411)
+### 3.3c Feature-sync retry suppression (task 0411; 1004 R3 moved it into the sync service)
 
 During a batch, the per-task `record` step and the wrap-up `feature-transition` step each invoke
 feature status sync. When a feature is L4-gate-blocked (e.g. not all linked tasks are `done`), the
 identical blocked proposal repeats on every call with no intervening input change — in the H9
-dogfood, 4 redundant sync calls produced the same blocked result. The orchestration seam fixes
-this, not the engine.
+dogfood, 4 redundant sync calls produced the same blocked result. The service fixes this, not the
+engine.
 
 Both `task-pipeline.yaml` (`record` step) and `wrapup-pipeline.yaml` (`feature-transition` step)
-invoke the bounded wrapper instead of raw `feature sync`:
-
-```bash
-node "$(superskill script path sp feature-sync-bounded.mjs)" <feature-id> --spur-bin "<spurBin>" --json
-```
-
-The wrapper:
-
-1. Reads an input fingerprint (feature file content hash, linked task statuses, verdict artifact
-   mtimes) **before** invoking `feature sync`.
-2. Classifies the structured result — `gateBlocked` checked first (a partial hop can have
-   `applied: true` while still gate-blocked), then `applied`, then `no-op`.
-3. On a **blocked** result, persists `.spur/run/feature-sync-blocked-<id>.json` and, on the next
-   call with an **identical fingerprint**, suppresses the redundant sync and replays the prior
-   blocked result.
-4. On **applied** or **no-op** results, passes through unchanged (no suppression).
-5. When the fingerprint **changes** (a task completed, a verdict file updated), suppression is
+invoke `spur feature sync <feature-id> --json` directly — retry suppression lives inside the
+`FeatureService.syncFeature` implementation:
+
+1. On a **blocked** result (`gateBlocked` checked first — a partial hop can have `applied: true`
+   while still gate-blocked — then an unapplied from≠to deferral), the service persists
+   `.spur/run/feature-sync-blocked-<id>.json` keyed by an input fingerprint (feature file content
+   hash, linked task statuses, verdict artifact mtimes).
+2. On the next call with an **identical fingerprint**, the service suppresses the redundant sync
+   and replays the prior blocked result (`suppressed: true`) without re-deriving hops.
+3. On **applied** or **no-op** results, the state file is cleared (no suppression).
+4. When the fingerprint **changes** (a task completed, a verdict file updated), suppression is
    invalidated and a fresh sync runs.
+5. `--force` (and an explicit confirm re-attempt) bypass the replay and re-derive live; dry-run
+   never reads or writes the state.
 
-**Batch driver contract:** the orchestrator does **nothing extra** — the wrapper lives inside the
-pipeline's `record` step and the wrap-up's `feature-transition` step. The driver still launches
-`task-pipeline.yaml` verbatim (R4.1). Suppression is transparent: the wrapper emits the same
-`FeatureSyncResult` JSON shape as `feature sync --json`, so downstream report logic is unchanged.
-The only observable difference is fewer redundant `feature sync` invocations and a one-line
-`feature-sync-bounded:` annotation on stderr when a duplicate is suppressed.
+**Batch driver contract:** the orchestrator does **nothing extra** — the suppression lives inside
+the pipeline's `record` step and the wrap-up's `feature-transition` step. The driver still
+launches `task-pipeline.yaml` verbatim (R4.1). Suppression is transparent: the sync emits the same
+`FeatureSyncResult` JSON shape (`suppressed: true` added on replay), so downstream report logic is
+unchanged. The only observable difference is fewer redundant `feature sync` derivations.
 
 ### 3.4 Metadata-only host controller (R5, task 0510)
 
@@ -492,7 +491,8 @@ batch can never destroy its own evidence. Reuse mode retains its operator-owned
 persists the Step 5 report under the invoking tree; the reused tree's `.spur/run/` remains the live
 copy while that tree lives on. The per-run provenance — the worktree DB's run/action rows and the
 `.spur/run/<runId>.md` + `.state.json` records — is persisted mechanically by WT-4a's
-`inline-run-setup.ts --persist-out --from <worktree>` call, not by hand.
+`inline-run-setup.ts --persist-out --from <worktree> [--task-file <merged-task>]...` call,
+not by hand.
 
 **Stage records are worktree-local too (0948 R9, E7 Finding 5; persisted by 0975 R1).** Each task's
 own per-stage run record (`.spur/run/<runId>.md` + `.state.json`) and the worktree DB's run rows are
@@ -500,10 +500,38 @@ written inside the worktree and **are removed with it** in create mode — the E
 this evidence. Copying them out is no longer a manual audit-time duty: WT-4a (create-mode block
 below) runs `inline-run-setup.ts --persist-out --from "$WT_PATH"` **before** WT-4b holder cleanup,
 which copies the run/action/phase/transition/workflow-state rows and both record files into the
-invoking tree. The shapes are pinned (task 0975 R1): idempotent on re-persist; success exits 0
-printing `{"ok":true,"persisted":<n>,"skipped":[{"id":<run-id>,"reason":"id-exists"|"external-key-conflict"|"record-conflict:<file>"}]}`
+invoking tree.
+
+**Cited evidence rides the same call (0984 R1/R2).** The driver forwards each merged task file with
+repeatable `--task-file <path>` (paths resolved in the invoking tree after the FF merge, e.g.
+`spur task show <wbs> --json` → `.filePath`), and persist-out then copies/verifies every literal
+`.spur/run/<file>` that file cites — WBS verdicts, check receipts, test-gate logs, run-ID records —
+so a merged task file never anchors a path that died with the tree. Abbreviated references
+(`fadca099-…`, `run-*-ac87.log`, `{batch-report.md,…}`) are not literal files and carry no
+obligation; neither do root-qualified paths (`knowledge-kit/.spur/run/…`, `/abs/.spur/run/…`),
+which cite another project's evidence — cite foreign run artifacts that way, never bare. A citation missing in BOTH trees, a divergent cited file (never overwritten — reconcile
+by hand), an unreadable task file, or more than 64 distinct cited files fails the pass → WT-5.
+
+**Owned evidence rides it too (1012).** With at least one `--task-file`, persist-out also treats as
+copy obligations the worktree's `.spur/run/` direct children named `<wbs>-…` (the WBS is each
+forwarded task file's leading four digits before `_`) or `<runId>-…` (every run row in the worktree
+DB, whichever task it ran) — `<wbs>-verdict.json`, check receipts, route reasons — whether or not
+the task file cites them. They join the cited set: same copy / byte-identical no-op /
+divergent-refuse handling. The 64-file cap bounds citations alone; owned names are bounded per
+owner (each `<wbs>-` / `<runId>-` prefix gets its own 64-file budget, task 1034), so the bound
+scales with the batch and one runaway owner refuses by name before any write. `<runId>.md` /
+`<runId>.state.json` stay with the record copy (a conflict there is a reported skip). Files
+matching neither a citation nor an ownership prefix are left behind. An absent worktree `.spur/run/`
+means nothing is owned; any other listing failure (not a directory, permission denied) fails the
+pass before the invoking tree is written → WT-5. Without `--task-file` nothing is enumerated.
+
+The shapes are pinned (task 0975 R1; `record-missing` and citation behavior per 0984): idempotent on re-persist;
+success exits 0 printing
+`{"ok":true,"persisted":<n>,"skipped":[{"id":<run-id>,"reason":"id-exists"|"external-key-conflict"|"record-conflict:<file>"|"record-missing:<file>"|"cited-directory:<name>"|"cited-symlink:<name>"|"cited-non-file:<name>"}]}`
 — an `id-exists` / `external-key-conflict` skip never modifies the pre-existing target rows, a
-`record-conflict:<file>` skip never overwrites a divergent invoking-tree record — and any failure
+`record-conflict:<file>` skip never overwrites a divergent invoking-tree record, and a
+`record-missing:<file>` skip is a known `task-lifecycle`/`feature-lifecycle` row with no record file
+at all (its inserted DB row still counts in `persisted` — 0984 R5). Any failure
 exits 1 printing `{"ok":false,"error":<message>}` (a worktree DB run id that is not a single safe
 filename component is rejected before any target write). Any persist-out failure
 routes to **WT-5** — worktree and branch retained — the same copy-out-first contract as the
@@ -528,6 +556,15 @@ The wrap receives only what it would accept:
 3. When the done subset is **empty**, skip the wrap entirely with the reason (e.g. `batch wrap
    skipped: no done tasks`) instead of invoking wrapup-pipeline on an empty set.
 
+**Repo-wide tripwire (1037).** After the doc-sync exits converge, the pipeline's `doc-tripwire` hop
+runs the TRUSTED CONFIG ONLY `docTripwireCmd` over the still-uncommitted wrap diff before
+metrics-record. The default probes `package.json` for a `test-repo-wide` script and runs
+`bun run test-repo-wide` only when it is declared (a no-op in other projects), so the batch driver
+passes no extra vars. Batch callers override it like any wrap var (`docTripwireCmd` in `--vars`);
+an empty string disables the check while still recording PASS. A FAIL routes the wrap to `failed`
+with already-written learnings/docs preserved — fix the flagged working-diff violation and re-run
+the wrap.
+
 Filtering lives here, in the batch driver — no change to wrapup-pipeline.yaml or wrapup-steps.ts;
 the wrap's refusal of non-done tasks remains the hard invariant.
 
@@ -566,11 +603,14 @@ non-PASS verify verdict, or a HITL pause that ends the run take the WT-5 retenti
 full pipeline is eligible — `--worktree --mode implement` is rejected (WT-7), because that mode is
 the pipeline's implement stage and already runs in the driver's tree.
 
-**Review triage `dev-review` (run of one).** `/sp:dev-review <target> --triage --worktree [<name>]`
+**Review triage `dev-review` (run of one).** `/sp:dev-review [--tasks <selector> | --feature <id>[,<id>] | --scope <path>[,<path>]] --triage --worktree [<name>]`
 runs this lifecycle around one review-plus-triage pass: WT-1…WT-6 apply unchanged, the marker's
-`command` is `dev-review` and its `selector` is the review target, and the slug is the WBS or the
-path's basename (`sp/review-<slug>-<short-id>`). It skips `quickReadiness` (there is no task set;
-admission is "the target resolves"). WT-4 success reads as "every direct fix passed its check and the
+`command` is `dev-review` and its `selector` records the full normalized target list, and the slug
+is `sp/review-<first>-and-<N>-<short-id>` for a multi-target run (N = target count) or
+`sp/review-<slug>-<short-id>` for a single target (the WBS or the path's basename). It skips
+`quickReadiness` (there is no task set; admission is "every target resolves" — each WBS/path must
+resolve before the tree is cut). Under `--triage` the findings are bucketed across all targets once
+(identical `file:line` findings deduped). WT-4 success reads as "every direct fix passed its check and the
 project gate is green"; anything else takes WT-5. Contract: [dev-operations.md § 2. review](dev-operations.md#2-review).
 
 One flag, two modes (see the glossary entry for the ownership rule). Bare `--worktree` is **create
@@ -828,12 +868,16 @@ git merge --ff-only "$BRANCH"          # FF-only: never rebase, merge-commit, or
 WT_PATH="$(cd "../<worktree-dir>" && pwd)"   # hoisted: needed by WT-4a AND WT-4b below
 # WT-4a provenance persist-out (task 0975 R1): copy the worktree DB's run rows plus
 # the .spur/run/<runId>.md + .state.json records into THIS tree. Run from the main
-# tree (cwd = the invoking tree). Idempotent; conflicts are reported, never
-# overwritten. A non-zero exit — including a half-readable worktree — must NOT
-# proceed to WT-4b removal:
-SETUP_SCRIPT="plugins/sp/scripts/inline-run-setup.ts"
-[ -f "$SETUP_SCRIPT" ] || SETUP_SCRIPT="$(superskill script path sp inline-run-setup.mjs 2>/dev/null)"
-bun "$SETUP_SCRIPT" --persist-out --from "$WT_PATH" \
+# tree (cwd = the invoking tree). --task-file (0984 R2) forwards each merged task
+# file (post-merge path) so the cited .spur/run/<file> evidence is copied/verified
+# too. Resolve the merged path(s) BEFORE this block — an empty value exits 2:
+#   TASK_FILE="$(spur task show <wbs> --json | jq -r .filePath)"   # per done task;
+#   build TASK_FILE_ARGS=(--task-file "$TASK_FILE")                # one flag each
+# Idempotent; conflicts are reported, never overwritten. A non-zero exit —
+# including an unresolved or divergent citation, or a half-readable worktree — must
+# NOT proceed to WT-4b removal:
+SETUP_SCRIPT=plugins/sp/scripts/inline-run-setup.ts; [ -f config/plugin-scripts.json -a -f "$SETUP_SCRIPT" ] || SETUP_SCRIPT="$(superskill script path sp inline-run-setup.mjs 2>/dev/null)"
+bun "$SETUP_SCRIPT" --persist-out --from "$WT_PATH" "${TASK_FILE_ARGS[@]}" \
   || { echo "halt: worktree run-record persist-out failed - worktree retained (WT-5)" >&2; exit 1; }
 #
 # WT-4b — bounded CWD-holder cleanup (task 0720 R1). $WT_PATH above is the EXACT
@@ -959,6 +1003,25 @@ Resume, merge, or discard:
   discard: git worktree remove <worktree-path> && git branch -D <branch> && spur projects remove <worktree-path>
 ```
 
+When the halt cause is `non-FF base ref`, the report replaces the one-line `merge:` hint with this
+ordered divergence recipe, run by the operator — the driver never merges, rebases, or resolves
+conflicts itself. Other halt causes (task failure, HITL pause) keep the hint as printed:
+
+```
+# 1. integrate as a merge commit — never a rebase; task evidence cites the branch's commit SHAs
+git checkout <base-ref> && git merge --no-ff --no-commit <branch>
+# 2. resolve source conflicts by hand; generated files are then regenerated with the project's
+#    generator, never hand-merged
+#    (this repo: bun run build:plugin-lib && bun run --filter @gobing-ai/spur build:bundle)
+# 3. stage every resolved path and regenerated bundle (git add …) — an unmerged or
+#    unstaged path makes step 5 abort
+# 4. run qualityGateCmd once, after ALL conflicts are resolved
+# 5. commit the merge with the prepared message file
+git commit -F <message-file>
+# 6. persist evidence out (WT-4a), then WT-4b/4c cleanup, and set the marker to merged
+inline-run-setup --persist-out --from <worktree> --task-file …
+```
+
 The report reuses the [`--next` chain contract](flag-glossary.md#--next-chain-contract) halt-report
 shape (halt cause + where + why), not new vocabulary. Retention is the right default: these batches
 are long and already resumable via `--continue`; auto-deleting is data loss, auto-merging is a
@@ -1136,11 +1199,11 @@ per-task with `/sp:dev-run <wbs> --worktree <branch>`.
 ### Generated regions — defer the sync, regenerate once (R5)
 
 The only per-task writer of feature files is the `record` step's post-record feature sync
-(`task-pipeline.yaml`, the `feature-sync-bounded` wrapper). Parallel launches set
+(`task-pipeline.yaml`). Parallel launches set
 the pipeline var `deferFeatureSync: "true"` (default `"false"`): the record step appends
 `feature sync deferred to batch integration` to the task report and skips the sync, so task
 branches never touch feature files or `docs/features/INDEX.md`. After the last integration, on the
-base ref, the orchestrator runs the same bounded wrapper plus `spur feature refresh --feature <f>`
+base ref, the orchestrator runs `spur feature sync <f> --json` (service-level suppression) plus `spur feature refresh --feature <f>`
 once per touched feature and commits the result as one `chore(corpus)` commit. Sequential and
 inline runs keep the default `"false"` and are unchanged. Any rebase conflict — on a generated
 path or any other — is an R4 `integration-conflict`; there is no path-based exception.