@gobing-ai/spur 0.4.1 → 0.4.2

package/plugins/sp/scripts/task-diffstat.ts

@@ -7,11 +7,11 @@
  * `precheck`, F96 R1) and the current working tree, then writes:
  *   `.spur/run/<wbs>-diffstat.json`  `{ files, insertions, deletions, paths[], sensitive }`
  *
- * Counts come from `git diff --numstat <base>` (tracked changes; binary rows count the
- * path but no lines) plus untracked files (`git ls-files --others --exclude-standard`,
- * newline-counted — # ponytail: untracked line counts are a newline scan, numstat-grade
- * binary detection is unnecessary for a lane heuristic; switch to `--numstat --no-index`
- * if a miscount ever flips a lane).
+ * Counts come from `git diff --numstat -z <base>` (tracked changes; binary rows count the path
+ * but no lines; NUL records carry RAW paths, so a non-ASCII or newline-bearing path reaches the
+ * sensitive matchers intact) plus untracked files (`git ls-files --others --exclude-standard -z`,
+ * newline-counted — # ponytail: untracked line counts are a newline scan, numstat-grade binary
+ * detection is unnecessary here; switch to `--numstat --no-index` if a miscount flips a lane).
  *
  * `sensitive` is true when ANY changed path matches the exported SENSITIVE list (0943 R2c);
  * the workflow's pre-decide guard maps sensitive (or >400 changed lines) to the safety lane
@@ -85,7 +85,7 @@ function globToRegex(glob: string): RegExp {
         .replaceAll('*', '[^/]*')
         .replaceAll('\u0000', '(?:.*/)?')
         .replaceAll('\u0001', '.*');
-    return new RegExp(`^${escaped}$`);
+    return new RegExp(`^${escaped}$`, 's');
 }
 
 const SENSITIVE_MATCHERS: Array<{ label: string; test: (path: string) => boolean }> = [
@@ -125,26 +125,10 @@ function countNewlines(path: string, cwd?: string): number {
     return lines;
 }
 
-/**
- * git renders renames in --numstat paths as `old => new` (full) or `head{old => new}tail`
- * (partial). The sensitive matchers anchor on single paths, so both rename halves must be
- * surfaced — otherwise a rename INTO a sensitive path (review 0943 P3#1) classified clean.
- */
-export function expandDiffPath(raw: string): string[] {
-    const arrow = raw.indexOf(' => ');
-    if (arrow === -1) return [raw];
-    const open = raw.indexOf('{');
-    const close = raw.lastIndexOf('}');
-    if (open !== -1 && close > open && open < arrow && arrow < close) {
-        const inner = raw.slice(open + 1, close);
-        const innerArrow = inner.indexOf(' => ');
-        if (innerArrow !== -1) {
-            const head = raw.slice(0, open);
-            const tail = raw.slice(close + 1);
-            return [head + inner.slice(0, innerArrow) + tail, head + inner.slice(innerArrow + 4) + tail];
-        }
-    }
-    return [raw.slice(0, arrow), raw.slice(arrow + 4)];
+function addCounts(add: string, del: string): [number, number] | null {
+    for (const count of [add, del]) if (count !== '-' && !/^\d+$/.test(count)) return null;
+    const [a, d] = [add === '-' ? 0 : Number(add), del === '-' ? 0 : Number(del)];
+    return Number.isSafeInteger(a) && Number.isSafeInteger(d) ? [a, d] : null;
 }
 
 /**
@@ -190,18 +174,34 @@ export function runDiffstat(
     }
     if (!/^[0-9a-f]{7,40}$/i.test(base)) return failSafe('run base .spur/run/<wbs>-base.sha missing or malformed');
 
-    const numstat = git(['diff', '--numstat', base]);
+    const numstat = git(['diff', '--numstat', '-z', base]);
     if (numstat.status !== 0) return failSafe(`git diff --numstat failed (status=${numstat.status})`);
+    if (numstat.stdout.length > 0 && !numstat.stdout.endsWith('\u0000'))
+        return failSafe('git diff --numstat -z output is not NUL-terminated (malformed framing)');
     const paths = new Set<string>();
     let insertions = 0;
     let deletions = 0;
-    for (const line of numstat.stdout.split('\n')) {
-        // Binary rows report `-` for both counts; the path still counts as changed.
-        const row = /^(\d+|-)\t(\d+|-)\t(.+)$/.exec(line);
-        if (!row) continue;
-        for (const p of expandDiffPath(row[3] ?? '')) paths.add(p);
-        if (row[1] !== '-') insertions += Number(row[1]);
-        if (row[2] !== '-') deletions += Number(row[2]);
+    const records = numstat.stdout.split('\u0000').slice(0, -1); // drop the terminating NUL tail
+    for (let i = 0; i < records.length; i++) {
+        const header = records[i] ?? '';
+        const first = header.indexOf('\t'); // first two tabs only
+        const second = header.indexOf('\t', first + 1); // a raw path may itself hold more tabs
+        if (first < 1 || second < first + 2) return failSafe('git diff --numstat -z record is missing counts or path');
+        const counts = addCounts(header.slice(0, first), header.slice(first + 1, second));
+        if (counts === null) return failSafe('git diff --numstat -z record has a malformed count');
+        insertions += counts[0];
+        deletions += counts[1]; // once per count header, never once per rename half
+        const path = header.slice(second + 1);
+        if (path !== '') {
+            paths.add(path);
+            continue;
+        }
+        // An empty path field is Git's rename/copy form: the next two records are old and new.
+        const oldPath = records[++i];
+        const newPath = records[++i];
+        if (!oldPath || !newPath) return failSafe('git diff --numstat -z rename record has incomplete paths');
+        paths.add(oldPath);
+        paths.add(newPath);
     }
     const others = git(['ls-files', '--others', '--exclude-standard', '-z']);
     if (others.status !== 0) return failSafe(`git ls-files failed (status=${others.status})`);

package/plugins/sp/skills/indexed-context/SKILL.md

@@ -144,14 +144,21 @@ an explicit allowlist entry.
 env dumps. Token estimates for Bash/Grep/Glob use response size **after a 4 KiB cap** and secret
 scrub; omit `tokens` when unknown (never `0`).
 
+**Session lifecycle:** `.spur/context/.session.json` is a private pointer to the in-flight session.
+It records the creating host's owner identity (`{host, sessionId}` — Claude's hook `session_id`, Pi's
+session-manager id) and only that owner's `SessionEnd` / `session_shutdown` may write the rollup and
+remove the pointer. A nested run reuses the parent's ledger for tool recording but cannot finalize
+or delete it; an ownerless (legacy) pointer is never finalized and expires under the existing
+idle-start window instead.
+
 ```jsonl
-{"ts":"2026-07-09T14:23:01Z","session":"session-2026-07-09-1423","type":"session_start"}
-{"ts":"2026-07-09T14:23:15Z","session":"session-2026-07-09-1423","type":"read","file":"src/dao.ts","tokens":648}
-{"ts":"2026-07-09T14:24:00Z","session":"session-2026-07-09-1423","type":"write","file":"src/dao.ts","tokens":222,"action":"edit"}
-{"ts":"2026-07-12T15:00:00Z","session":"session-2026-07-12-1500","type":"bash","summary":"ls -la","tokens":12}
-{"ts":"2026-07-12T15:00:01Z","session":"session-2026-07-12-1500","type":"grep","summary":"/TODO/ src"}
-{"ts":"2026-07-12T15:00:02Z","session":"session-2026-07-12-1500","type":"glob","summary":"**/*.test.ts"}
-{"ts":"2026-07-09T14:30:00Z","session":"session-2026-07-09-1423","type":"session_end","totals":{"reads":5,"writes":19,"tokens":2783}}
+{"ts":"2026-07-09T14:23:01Z","session":"session-2026-07-09-142318-a1b2c3d4","type":"session_start"}
+{"ts":"2026-07-09T14:23:15Z","session":"session-2026-07-09-142318-a1b2c3d4","type":"read","file":"src/dao.ts","tokens":648}
+{"ts":"2026-07-09T14:24:00Z","session":"session-2026-07-09-142318-a1b2c3d4","type":"write","file":"src/dao.ts","tokens":222,"action":"edit"}
+{"ts":"2026-07-12T15:00:00Z","session":"session-2026-07-12-150007-e5f6a7b8","type":"bash","summary":"ls -la","tokens":12}
+{"ts":"2026-07-12T15:00:01Z","session":"session-2026-07-12-150007-e5f6a7b8","type":"grep","summary":"/TODO/ src"}
+{"ts":"2026-07-12T15:00:02Z","session":"session-2026-07-12-150007-e5f6a7b8","type":"glob","summary":"**/*.test.ts"}
+{"ts":"2026-07-09T14:30:00Z","session":"session-2026-07-09-142318-a1b2c3d4","type":"session_end","totals":{"reads":5,"writes":19,"tokens":2783}}
 ```
 
 **Never edit `token-ledger.jsonl` by hand.** It feeds the Board **Observability → Tool Using** tab.

package/plugins/sp/skills/parallel-execution/SKILL.md

@@ -104,7 +104,7 @@ was meant to avoid. Let the reviewer reach its own conclusion.
 
 - **`sp:spur-dev`** owns task selection and lifecycle. When a batch contains independent tasks, the spine consults this skill for the fan-out pattern.
 - **`sp:super-planner`** is the orchestrator that executes the fan-out. Its parallel mode (documented in its agent definition) applies the patterns from this skill.
-- **`/sp:dev-parallel`** is the thin slash-command entry point that delegates to this skill.
+- **`/sp:dev-runall --mode parallel|auto`** is the task-batch entry point; its `batch-plan.mjs order` schedule applies this skill's dependency and file-overlap rows deterministically.
 
 ## When to use
 
@@ -135,7 +135,7 @@ Do **not** use this skill for:
 
 - **`sp:spur-dev`** — the orchestration spine that consults this skill for fan-out decisions.
 - **`sp:super-planner`** — the batch orchestrator that executes fan-out patterns.
-- **`/sp:dev-parallel`** — the slash command entry point for parallel execution.
+- **`/sp:dev-runall --mode parallel|auto`** — the slash command entry point for parallel task batches.
 
 ## Platform Notes
 

package/plugins/sp/skills/parallel-execution/references/dispatch-surface.md

@@ -70,7 +70,7 @@ own axis.
 Surface choice and model choice stay separate axes, but the invocation surface is where the
 cheap-model hint is applied. On hosts whose native subagent invocation accepts a per-call model
 override (Claude Code: the Agent tool's `model` parameter), dispatch read-only fan-out workers —
-`dev-parallel --mode investigation` and competency-lens review's read-only lenses — with the host's
+N-way investigation and competency-lens review's read-only lenses — with the host's
 cheapest capable model. The rule is owned by
 [fan-out-patterns.md § Cheap-model hint for read-only fan-out](fan-out-patterns.md#cheap-model-hint-for-read-only-fan-out)
 and carries two prohibitions and one exemption: invocation-side only, **never** a subagent

package/plugins/sp/skills/parallel-execution/references/fan-out-patterns.md

@@ -134,13 +134,13 @@ blocker** — never a permission-probing subsystem:
    [Keep a durable progress ledger](../SKILL.md#keep-a-durable-progress-ledger)).
 
 Read-only investigation fan-out avoids the write-permission class by construction:
-`dev-parallel --mode investigation` and competency-lens review's read-only lenses dispatch
+N-way investigation and competency-lens review's read-only lenses dispatch
 **read-only worker shapes** — search/read tools only, with no write surface declared.
 
 ## Cheap-model hint for read-only fan-out
 
 On hosts whose native subagent invocation accepts a per-call model override (Claude Code: the Agent
-tool's `model` parameter), dispatch read-only fan-out workers — `dev-parallel --mode investigation`
+tool's `model` parameter), dispatch read-only fan-out workers — N-way investigation
 and competency-lens review's read-only lenses — with the host's cheapest capable model. The rule is
 invocation-side, with two prohibitions and one exemption:
 

package/plugins/sp/skills/pr-reviewing/SKILL.md

@@ -112,9 +112,13 @@ unrelated uncommitted changes make safe editing or committing ambiguous.
 **Current-HEAD invariant.** Treat the PR's pushed `headRefOid` as the review identity. After every
 preflight, push, commit, and request, record the returned HEAD and require `wait`, `collect`, and
 the report to match that exact HEAD. A result for an older commit is stale; a result absent for the
-current HEAD is pending, not clean. Reject uncorrelated issue/conversation comments rather than
-using them to manufacture a current-HEAD result. In `fix` mode, discard the old result after the
-fix commit and judge only the forced re-review for the new pushed HEAD.
+current HEAD is pending, not clean. `wait` re-asserts this at two points, not one: at the start of
+every poll, and again immediately before it emits FOUND/CLEAN/TIMEOUT — a head that moved while the
+review was being fetched, or between polls, fails the wait (exit 2) instead of accepting an old-head
+result. The pinned identity is the PR number AND the expected head, so a different PR appearing on
+the branch is also a failure, never a silent retarget. Reject uncorrelated issue/conversation
+comments rather than using them to manufacture a current-HEAD result. In `fix` mode, discard the old
+result after the fix commit and judge only the forced re-review for the new pushed HEAD.
 
 **Reviewer authority.** Codex is an independent reviewer, not an authority. For every finding that
 may lead to a code change: inspect the referenced code, verify reachability and intended behavior,

package/plugins/sp/skills/session-review/SKILL.md

@@ -101,9 +101,11 @@ issues with its evidence. Notes stay report-only.
    refresh it with `superskill install sp` before reporting numbers; report `n/a` until then.
    The transcript resolves from `--transcript`, else `CLAUDE_CODE_SESSION_ID`, else `PI_SESSION_FILE`
    (the pi host sets it and no Claude session id); with none of them the measurement reports
-   `available:false` with a reason and the table renders `n/a` instead of guessing. A
-   skill-injected body (`<skill name="…">`) is counted as activity in `injectedPrompts`, never as a
-   segment — only the operator's own prompts segment the session.
+   `available:false` with a reason and the table renders `n/a` instead of guessing. A pi
+   `<skill name="…">` wrapper row is the OPERATOR'S own `/skill` invocation, not an injected body:
+   it opens a segment rendered `/<name> <args>` (or `/<name>` when no arguments follow the closing
+   tag), and the wrapper body never appears in the prompt excerpt. Only the operator's prompts
+   segment the session.
 2. **Inventory outcomes.** List requested outcomes and classify each as completed, partial, blocked,
    or not attempted. Collapse repeated attempts into one outcome.
 3. **Classify issues.** For every material issue, distinguish resolved, open, or attempted. Record

package/plugins/sp/skills/spur-cli/references/decision.md

@@ -1,6 +1,6 @@
 ---
 name: spur-cli-decision
-description: "spur-cli noun reference: operate `spur decision` as the read/serve surface over the decision catalog - list registered decisions, show one served contract (parameters, criteria vocabulary, effective maker), run a decision to a served outcome (never writes a workflow resultFile), and status the catalog layers. Backed by @gobing-ai/ts-ai-decision 0.5.16 hub; offline by default via the built-in `typesafe` maker. Introduced by task 1093."
+description: "spur-cli noun reference: operate `spur decision` as the read/serve surface over the decision catalog - list registered decisions, show one served contract (parameters, criteria vocabulary, effective maker), run a decision to a served outcome (never writes a workflow resultFile), and status the catalog layers. Backed by @gobing-ai/ts-ai-decision 0.5.22 hub; offline by default via the built-in `typesafe` maker. Introduced by task 1093."
 see_also:
   - spur-cli
 ---
@@ -79,6 +79,13 @@ exist there). The final `catalog-default` maker is the hub built-in `typesafe`
 without a configured backend still produce deterministic closed-vocabulary outcomes, which is why
 `run` is usable in tests and scripts with no model access.
 
+**Available makers:** the three upstream built-ins (`typesafe`, `fm-local`, `laya-local`) plus
+Spur's hosted `clef` (Cloudflare Workers AI via `@gobing-ai/ts-decision-clef`). `clef` registers
+only when both `CLOUDFLARE_ACCOUNT_ID` and `CLOUDFLARE_AUTH_TOKEN` are set in the environment;
+without them it is absent from `registeredMakers`, so naming it in config or `--maker` is a config
+error, never a silent fallback. Its model defaults to `clef-flash` (a catalog `model` selects
+`clef`).
+
 ## Examples
 
 ```bash
@@ -93,6 +100,6 @@ spur decision status --json | jq '.loadErrors'      # audit catalog health
 ## References
 
 - Design: `docs/design/decision-catalog.md` (§2 catalog authoring, §3.4 CLI surface)
-- Hub: `@gobing-ai/ts-ai-decision` 0.5.16 (`DecisionService`, catalog schema, maker registry)
+- Hub: `@gobing-ai/ts-ai-decision` 0.5.22 (`DecisionService`, catalog schema, maker registry)
 - App service: `packages/app/src/decision/decision-service.ts`
 - Shipped catalogs: `config/decisions/*.yaml`

package/plugins/sp/skills/spur-cli/references/projects.md

@@ -22,7 +22,7 @@ shapes live in `apps/cli/src/commands/projects.ts`.
 | `clean` | Purge missing project folders and terminate lingering processes (alias: `refresh`) | `--no-terminate-processes` `--json` |
 | `list` | List entries with live running status | `--json` `--fleet` |
 | `start <target>` | Start or reuse a detached project server | `--port <n>` `--json` |
-| `stop <target>` | Best-effort stop the listener and clear its recorded port | `--json` |
+| `stop <target>` | Ownership-verified stop of the listener and clear its recorded port | `--json` |
 
 Every verb also advertises `--json-envelope`; use the facade's machine-output contract. Success is
 exit `0`; validation, registry, spawn, health, or lookup failure is exit `1`.
@@ -36,8 +36,8 @@ exit `0`; validation, registry, spawn, health, or lookup failure is exit `1`.
 - `add` requires an existing path, resolves a relative path from the current working directory, and
   defaults the display name to its basename. It upserts; it does not start a server. The current
   source does not enforce a `.spur/` marker or directory type.
-- `list` automatically heals tilde paths, verifies project directories exist on disk (purging missing entries and terminating lingering processes), and heals stale entries to `port: 0` before reporting `running`.
-- `clean` (alias `refresh`) explicitly purges non-existent project directories from `projects.json`, probes live ports for removed entries, and cleanly terminates orphaned listening processes (SIGTERM with bounded wait and SIGKILL escalation). Supports `--no-terminate-processes` to skip process kills.
+- `list` automatically heals tilde paths, verifies project directories exist on disk (purging missing entries and terminating only ownership-verified lingering processes), and heals stale entries to `port: 0` before reporting `running`.
+- `clean` (alias `refresh`) explicitly purges non-existent project directories from `projects.json`, probes live ports for removed entries, and terminates orphaned listeners only after ownership verification (SIGTERM with bounded wait and SIGKILL escalation, each signal gated on `service:spur` identity plus exact project path and a stable PID; foreign or unverified listeners are never signaled). Supports `--no-terminate-processes` to skip process kills.
 - `list --fleet` (0835/0858) additionally resolves each project's `agent.fleet` section from that
   project's `.spur/config.yaml` under the existing verb (no new noun). Per project it prints one line
   per member: instance id (the spec id / mailbox identity), `role`, resolved `executor`,
@@ -76,8 +76,10 @@ port is returned idempotently; otherwise the service allocates a port (3000–39
 set), spawns `spur serve --host 127.0.0.1 --no-open` detached in the project root, waits for the port,
 then persists it.
 
-`stop` finds processes bound to the recorded port, sends `SIGTERM` best-effort while excluding the
-CLI and its parent, and clears the registry port. It is not a persistent supervisor contract.
+`stop` signals only a listener that proves `service:spur` identity plus the exact registered project
+path with a stable rediscovered PID; it refuses foreign or unverified listeners with exit 1 and
+preserves the port, treats an absent listener as idempotent success, and excludes the CLI and its
+parent. It is not a persistent supervisor contract.
 `remove` only removes the registry entry; stop a running project first when process cleanup matters.
 
 Raw JSON success payloads are verb-specific (`project`, `projects`, `removed`, `stopped`, or start

package/plugins/sp/skills/spur-dev/SKILL.md

@@ -110,6 +110,8 @@ Read this `SKILL.md` plus your mode's files below before the first dispatch; eve
 - --worktree: `references/execution-batch.md`, `references/execution-worktree-setup.md`
 - --mode parallel: `references/execution-batch.md`, `references/execution-parallel-isolation.md`
 
+`--mode auto` reads as sequential-inline until § 2.4a resolves it.
+
 Byte budgets for these sums live in `plugins/sp/tests/bootstrap-budget.test.ts`
 (`BOOTSTRAP_BUDGETS_BYTES`, task 1128); the test fails the build when a mode's bootstrap grows.
 

package/plugins/sp/skills/spur-dev/references/ac-style-guide.md

@@ -88,6 +88,33 @@ DD-06 permissive start: treat only the core tier as must-ship initially; promote
 prove important in a later iteration. (When tiered gating lands in `spur feature check`, these tags
 become the gate input — the CLI stays the validator; this guide stays the convention.)
 
+### Home-node tier (structural, exempt from the orphan sweep)
+
+A **home node** carries one structural or placement scenario that states *where the work lives*
+(e.g. "work on the kk workflow-run ledger has a home node"). No task can cover that statement — it
+describes planning placement, not behaviour — so tag it `@home-node` to remove it from the
+feature-side DD-09 orphan sweep (`L4.uncovered-feature-scenario`):
+
+```gherkin
+@home-node
+Scenario: R1 — Work on the kk workflow run ledger has a home node
+  Given a change that targets the kk workflow run ledger workflow
+  When the change is planned as a feature
+  Then it is feature G7 or a child feature of G7
+```
+
+Rules:
+
+- **Scenario-level tag only.** A `Feature:`-level `@home-node` exempts nothing; the tag is read per
+  scenario.
+- **Exempts the orphan sweep only.** Scenario satisfaction (0340), verdict-row matching, and the
+  known-issues ratchet are unchanged — a tagged scenario a task actually covers is classified
+  exactly as before.
+- **Never a hiding place.** Use it only for a scenario no task can own. A deliberately uncoverable
+  *capability* scenario belongs to `@core`/`@edge` and must stay in the sweep: tagging it
+  `@home-node` hides a real gap. Wording is never the signal.
+- A feature with **no linked task** is still flagged as `L4.orphan-scenarios`, tagged or not.
+
 ## Scenario-title stability
 
 The scenario title is the **identity key** for traceability. When a task references a

package/plugins/sp/skills/spur-dev/references/dev-operations.md

@@ -23,7 +23,7 @@ The `Skill()` commands back onto six skills: `sp:spur-dev` (planning + execution
 `sp:code-verification` (SECUA review + traceability), `sp:parallel-execution` (fan-out / parallel batch),
 and `sp:brainstorm` (structured ideation). The `runall` operation (#13) is `sp:spur-dev`'s batch entry — it delegates the driver loop to the
 `sp:super-planner` agent (the batch orchestrator) per [execution-batch.md](execution-batch.md).
-`dev-parallel` (#13a) is the parallel counterpart. `dev-brainstorm` carries the two artifact exits — `--task` (one task) and `--feature` (validated
+Parallel task batches are `dev-runall --mode parallel|auto` (`dev-parallel` retired 2026-10-10). `dev-brainstorm` carries the two artifact exits — `--task` (one task) and `--feature` (validated
 feature with BDD AC; the front-half entry that hands off to `dev-plan`). The 4 `inline` commands
 cover git tooling and operational utilities that have no natural skill home — creating a skill for
 each would be scope creep for one-liner procedures.
@@ -86,8 +86,7 @@ each would be scope creep for one-liner procedures.
 | 11b | job-resume | `dev-job-resume`    | `Skill()`         | `sp:spur-dev` (`job-resume`) | `--file <path>` |
 | 12  | brainstorm | `dev-brainstorm`    | `Skill()`         | `sp:brainstorm` (`dev-brainstorm`)                                                 | `<topic> [--depth <basic\|detailed\|comprehensive>] [--options <n>] [--agent <inline\|auto\|name>] [--skip-discovery] [--task [<feature-id>]] [--feature [<parent-id>]] [--next]`          |
 | 12a | find-way   | `dev-find-way`      | `Skill()`         | `sp:wayfinder` (worktree-isolated)                                                 | `<idea> \| <feature-id> [<wbs>] [--agent <inline\|auto\|name>] [--auto] [--worktree [<name>]] [--wrap]` |
-| 13  | runall     | `dev-runall`        | `Skill()` → agent | `sp:spur-dev` (`runall`) → `sp:super-planner`                                      | `--tasks <selector> [--feature <id>] [--mode <sequential\|parallel>] [--keep-going] [--auto] [--agent <inline\|auto\|name>] [--json] [--wrap] [--next] [--continue] [--worktree [<name>]] [--no-summary] [--defer-gate]`                      |
-| 13a | parallel   | `dev-parallel`      | `Skill()`         | `sp:parallel-execution`                                                            | `--tasks <selector> [--feature <id>] [--mode <fan-out\|review-panel\|investigation>] [--agent <inline\|auto\|name>] [--json] [--defer-gate]`                                                                          |
+| 13  | runall     | `dev-runall`        | `Skill()` → agent | `sp:spur-dev` (`runall`) → `sp:super-planner`                                      | `--tasks <selector> [--feature <id>] [--mode <sequential\|parallel\|auto>] [--concurrency <n>] [--keep-going] [--auto] [--agent <inline\|auto\|name>] [--json] [--wrap] [--next] [--continue] [--worktree [<name>]] [--no-summary] [--defer-gate]`                      |
 | 14  | wrap       | `dev-wrap`          | `Skill()`         | `spur workflow run` (wrapup-pipeline)                                              | `<wbs> [--agent <inline\|auto\|name>] [--auto] [--merge] [--dry-run]`                                                                                                                                 |
 | 15  | wrapall    | `dev-wrapall`       | `Skill()`         | `spur workflow run` (wrapup-pipeline)                                              | `[--since <iso>] [--feature <id>] [--status <s>] [--agent <inline\|auto\|name>] [--auto] [--merge] [--dry-run]`                                                                                        |
 | 16  | idea       | `dev-idea`          | `Skill()`         | inline driver (`idea-pipeline`) or async workflow                                  | `"<idea>" \| --from-file <path> [--skip-design] [--agent <inline\|auto\|name>] [--auto]`                                                                                                                              |

package/plugins/sp/skills/spur-dev/references/execution-batch-report.md

@@ -178,6 +178,11 @@ the wrap's refusal of non-done tasks remains the hard invariant.
 
 **Close-out commit (1129 R2/R5).** In sequential mode the wrap's writes (learnings, metrics,
 doc-sync) land in the invoking tree and are committed as ONE close-out commit after the wrap exits.
+**Under `--worktree` they land in the EXECUTION tree instead** and ride the branch as its own commit
+on `$BRANCH`: Step 6 runs before WT-4, so a close-out commit on the base ref would advance it and
+make the batch's own FF-merge impossible (the fresh base tip would no longer be an ancestor of the
+batch tip — the step that makes the close-out the report's own contradiction). The close-out commit
+is never a point on the base ref.
 Stage them through the guard — never a free-form `git add` — so a concurrent writer's file cannot
 ride into the close-out commit (incident `36f274590`). `$RUN_ID` is the id Step 3 fixed before
 `commit-guard start` (execution-batch.md § Step 3); an unset id makes the guard exit 1 — fail closed:

package/plugins/sp/skills/spur-dev/references/execution-batch.md

@@ -204,7 +204,18 @@ For each dependency edge to a task **outside** the frozen set, resolve its curre
 
 ### 2.4 Topological sort
 
-Topological-sort the remaining in-set, non-blocked tasks using Kahn's algorithm:
+Do not hand-run the sort — compute it. Write the remaining in-set, non-blocked tasks to a temp file
+as a JSON array of `{wbs, dependencies, files?}` (`dependencies` from `spur task show <wbs> --json`
+frontmatter; `files` = repo paths the task's Design/Plan names, omit when it names none) and run:
+
+```bash
+node "$(superskill script path sp batch-plan.mjs)" order --tasks <tasks.json> [--concurrency <n>]
+# → {"order":[…],"waves":[[…],…],"cycle":null|[…],"overlaps":[…],"mode":"sequential|parallel","reason":"…"}
+```
+
+`order` is the execution plan; a non-null `cycle` is the abort below. `waves`, `overlaps`, `mode`
+and `reason` feed `--mode auto` (§ 2.4a) and the batch report. The script implements Kahn's
+algorithm (ADR-130 glue over `scheduleBatch` in `packages/app/src/workflow/plan-projection.ts`):
 
 1. Seed the queue with zero-indegree nodes, **sorted WBS-ascending** (deterministic tie-break).
 2. Repeatedly dequeue the lowest-WBS zero-indegree node, emit it, decrement its successors'
@@ -214,7 +225,35 @@ Topological-sort the remaining in-set, non-blocked tasks using Kahn's algorithm:
 **Cycle handling (R2.3):** a cycle aborts the **entire batch** before any task runs. Reconstruct a
 representative cycle path via DFS over the remaining unsorted nodes and report it (e.g.
 `0040 → 0042 → 0040`). Do not run any task in a cyclic batch — running a prefix would partially
-execute work whose ordering is undefined.
+execute work whose ordering is undefined. The script reports it as `cycle` (e.g.
+`["0040","0042","0040"]`) with an empty `order`.
+
+**File overlap.** Two tasks that declare the same file get a serialization edge oriented by their
+dependency order (`overlaps[]` records each), so overlap never creates a cycle and never puts
+overlapping tasks in the same wave (`sp:parallel-execution` row 3). It only matters under parallel
+execution; sequential order stays a valid topological order either way.
+
+### 2.4a `--mode auto` resolution
+
+`--mode auto` is decided **once, here, by the active orchestrator** (the host session, or
+`sp:super-planner` when an explicit executor is set), after freeze, Step 2.3 blocking and
+the § 2.4 schedule, and before any task runs:
+
+| Condition (first match wins) | Resolved mode |
+| --- | --- |
+| `--worktree` present | `sequential` (parallel rejects `--worktree`) |
+| `--agent inline` explicitly passed | `sequential` (inline is the host-session driver) |
+| script `mode` is `sequential` (fewer than 2 tasks, `--concurrency 1`, or every wave holds one task) | `sequential` |
+| script `mode` is `parallel` | `parallel` |
+
+- **Sequential resolution** continues the Step 3 loop with the frozen `order` (host-inline, or
+  subprocess per task under an explicit executor).
+- **Parallel resolution** hands off to the explicit/parallel path as
+  `runall --tasks <order as comma WBS list> --mode parallel` plus the operator's other flags. The
+  explicit list carries the frozen membership, so the feature preflight (Step 1) is not re-run.
+- `--defer-gate` survives only a parallel resolution; a sequential one drops it.
+- The batch report records `mode: auto → <resolved>` with the script's `reason`, the widest wave,
+  and any `overlaps`.
 
 ### 2.5 Result
 
@@ -321,8 +360,8 @@ emit batch report (per-task outcome + preflight skips + recovery hints + autoRep
 ```
 
 Parallel mode keeps the same lifecycle but swaps the inner loop for the per-task-worktree fan-out
-specified in [§ Parallel isolation](#parallel-isolation---mode-parallel): identify a zero-edge,
-non-overlapping subset; **preflight each** selected task; run each ready task's `task-pipeline.yaml`
+specified in [§ Parallel isolation](#parallel-isolation---mode-parallel): take the zero-edge,
+non-overlapping frontier from the § 2.4 schedule's waves; **preflight each** selected task; run each ready task's `task-pipeline.yaml`
 invocation in its own create-mode worktree; integrate by rebase + `--ff-only` as tasks finish;
 recovery stays **sequential** (one WBS). If any decision-framework check fails, serialize and
 record the reason.

package/plugins/sp/skills/spur-dev/references/execution-parallel-isolation.md

@@ -45,7 +45,10 @@ emit batch report (per-task outcomes + preflight skips + recovery hints + batch
 - **Eligibility (R2).** A task becomes eligible only when all of its in-set dependencies are
   **integrated** onto the base ref — pipeline-terminal is not enough, because its branch must
   rebase over theirs. Omitting `--mode` stays sequential; this loop is entered only via
-  `--mode parallel` on `/sp:dev-runall`.
+  `--mode parallel` on `/sp:dev-runall`, directly or as a `--mode auto` resolution
+  ([execution-batch.md § 2.4a](execution-batch.md#24a---mode-auto-resolution)).
+- **Fan-out set.** Run order and eligibility come from the § 2.4 `batch-plan.mjs order` schedule;
+  its file-overlap edges are in-set dependencies here, so overlapping tasks never run at once.
 - **Workdir.** `spur workflow run` records the launch workdir (0784 R1), so launch with `cwd` = the
   task worktree: resume and `.spur/run/` artifact paths resolve there. Read the verdict from
   `$WT/.spur/run/<wbs>-verdict.json` before integration; WT-4a persists it into the invoking tree.

package/plugins/sp/skills/spur-dev/references/flag-glossary.md

@@ -148,7 +148,7 @@ halt-on-first-failure. Never silently retried; the failure is still reported.
 
 ### `--defer-gate` — opt-in parallel-batch gate policy (task 1111 / H15)
 
-**Applies to:** `/sp-dev-runall --mode parallel`, `/sp-dev-parallel --mode fan-out`.
+**Applies to:** `/sp-dev-runall --mode parallel`, and `--mode auto` when it resolves to parallel.
 **Default:** off — every task pipeline runs its own FULL project gate inside its worktree.
 
 With `--defer-gate`, each task's `test` / `test-recheck` hop runs the **light tier** (changed-scope
@@ -167,9 +167,10 @@ Two properties are load-bearing and are asserted structurally:
   project gate; the per-task token is `DEFERRED`, and the `test → triage` /
   `test-recheck → triage` guards accept it only while `deferQualityGate = "true"`.
 
-`--defer-gate` without `--mode parallel` is rejected — the flag exists to move one full gate from N
-worktrees to the one place the integrated tree exists. Sequential and inline batches never set the
-var. ADR-124 carries the dated clarification.
+`--defer-gate` with `--mode sequential` (or omitted `--mode`) is rejected — the flag exists to move
+one full gate from N worktrees to the one place the integrated tree exists. Under `--mode auto` it
+applies only if the batch resolves to parallel; a sequential resolution drops it with a report note.
+Sequential and inline batches never set the var. ADR-124 carries the dated clarification.
 
 **Anchor:** `#flag-defer-gate`.
 
@@ -177,11 +178,11 @@ var. ADR-124 carries the dated clarification.
 
 **Anchor:** `#flag-concurrency`.
 
-`dev-runall` under `--mode parallel` (task 0931): at most `<n>` task pipelines run at once
+`dev-runall` under `--mode parallel` (task 0931), or `--mode auto` resolved to parallel: at most `<n>` task pipelines run at once
 (default 2, `n ≥ 1`). A dependent task starts only after every in-set dependency has been
 **integrated** onto the base ref — see
 [execution-batch.md § Parallel isolation](execution-batch.md#parallel-isolation---mode-parallel).
-Ignored in sequential mode. Each worker is one more concurrent quality gate; raise it only when
+Ignored in sequential mode; `--concurrency 1` pins `--mode auto` to sequential. Each worker is one more concurrent quality gate; raise it only when
 the host has the CPU for it.
 
 ### `--continue` — resume an interrupted batch from checkpoint
@@ -271,12 +272,12 @@ is the contract; divergence between `--dry-run` and the real run is a bug.
 
 **Anchor:** `#flag-tasks`.
 
-Batch operation (`dev-parallel`, `dev-refineall`, `dev-review`, `dev-runall`, `dev-verifyall`). An
+Batch operation (`dev-refineall`, `dev-review`, `dev-runall`, `dev-verifyall`). An
 explicit selector — WBS list, status pseudo-list (`todo`, `wip`), `feature:<id>`, or `ready` —
 resolving to the set the batch runs over. On `dev-review` the selector is restricted to the
 review-safe forms: comma WBS list and `feature:<id>` — status pseudo-lists and `ready` are
-rejected (they select work to do, not work to review). Required on `dev-parallel`, `dev-runall`,
-and `dev-verifyall`, where `--feature` is an optional restrictor. On `dev-refineall` it is instead
+rejected (they select work to do, not work to review). Required on `dev-runall` and
+`dev-verifyall`, where `--feature` is an optional restrictor. On `dev-refineall` it is instead
 one of a required pair — supply exactly one of `--feature` or `--tasks`.
 
 ### `--mode <kind>` — select an execution mode
@@ -284,8 +285,9 @@ one of a required pair — supply exactly one of `--feature` or `--tasks`.
 **Anchor:** `#flag-mode`.
 
 Select an execution mode: `full|implement` on `dev-run` (full pipeline vs implement-only),
-`sequential|parallel` on `dev-runall` (serial vs fanned-out-independent-subset),
-`fan-out|review-panel|investigation` on `dev-parallel`, the reconstruction depth
+`sequential|parallel|auto` on `dev-runall` (serial, fanned-out independent subset, or chosen from the
+frozen batch's dependency waves — see [execution-batch.md § 2.4](execution-batch.md#24-topological-sort)),
+the reconstruction depth
 `briefing|structure|architecture|design|full` on `dev-reverse`, and `daily|ad-hoc` on
 `dev-find-issue` (the history-anatomy report mode). Mode selection is explicit and orthogonal
 to `--next`.

package/plugins/sp/skills/spur-dev/references/inline-pipeline-driver.md

@@ -86,7 +86,9 @@ fallback) — labels are display addresses only, never an execution key.
 1. Resolve the command inputs, `--auto`, and any explicit `--vars` — **without reading the selected
    YAML yet**. An explicit non-inline executor selection chooses the subprocess workflow path.
 2. Allocate a collision-resistant inline run id (`uuidgen`, with a timestamp/pid fallback), create
-   `.spur/run/` for attempt staging and `.spur/memory/runs/` for retained records, and use the two-file run record (task 0927) — append lines to
+   `.spur/run/` and the run's scratch subdirectory `.spur/run/<run-id>/` for attempt staging (action
+   batches, captured stage output, temporary status/answer files) plus `.spur/memory/runs/` for
+   retained records, and use the two-file run record (task 0927) — append lines to
    `.spur/memory/runs/<run-id>.md` and read machine state from `.spur/memory/runs/<run-id>.state.json`.
    The run id lives in those two files and the persisted run row — never stage it in an ad-hoc
    `*.env` file: the `no-env-files` gate rule flags any `.env` name, so run-scoped staging files
@@ -606,7 +608,7 @@ prompt the host cannot see is invisible until join. Record one run-log line per
 stage <id> permission precheck: ok | <missing capability>
 ```
 
-Read-only investigation fan-out (`/sp:dev-parallel --mode investigation`) dispatches read-only
+Read-only investigation fan-out (N-way investigation) dispatches read-only
 worker shapes by construction — see the [pre-dispatch permission
 rule](../../parallel-execution/references/fan-out-patterns.md).
 
@@ -761,21 +763,14 @@ grading its own work defeats the stage. A continuation stage also dispatches fre
 same-task subagent exists (the earlier stage ran host-inline or below the dispatch floor), when a
 host-owned gate sat between the stages, or when the platform cannot address completed subagents.
 
-**Implement and test-fix workers never run the full gate (task 1127 R8 / task 1142 R3).** Since 1127 the full gate
-takes a host-wide lock (`SPUR_GATE_LOCK_DIR`, default `~/.config/spur/run/full-gate.lock`):
-concurrent full-gate runs serialize, and a manual `spur-check` (wrapped via
-`scripts/commands/gate-lock.ts`) holds the same lock. A dispatched **implement** or `test-fix` child
-that re-ran the full gate would queue behind every other gate on the host and burn its dispatch
-timeout waiting instead of working. Workers use the light tier as their iteration check (task 1142 R3) in exact order:
+**Implement and test-fix workers never run the full gate (task 1142 R3).** Workers use the light tier as their iteration check (task 1142 R3) in exact order:
 1. the **changed-path matrix** (`code-implementation/SKILL.md` § Changed-path targeted checks) over the paths they touched;
 2. the resolved `quality-gate` script in `light` mode (source-repo probe, else the installed twin) (biome, per-workspace typecheck, rule presets, related tests).
 Neither step takes the full-gate lock. The pipeline's `test` and `test-recheck` hops remain the only full gate. Carry
 `--gate-log <path>` through to the child **verbatim**: never paraphrase it into "re-run the named
-gate command". That paraphrase is not cosmetic — it dropped this rule in the H15 run (task
-Background, seq 232) and sent a worker into the locked gate. The pipeline's next `test` (recheck)
-stage re-acquires the lock and delivers the deciding verdict; that deciding run may wait for a live
-holder, so a queued worker's effective budget is dispatch timeout minus observed lock queue wait,
-not the timeout alone.
+gate command". That paraphrase is not cosmetic — it sent a worker into a full gate run instead of
+targeted iteration checks. The pipeline's next `test` (recheck)
+stage delivers the deciding verdict.
 
 **Null or timed-out dispatch (task 1134 R9).** The dispatch bound stays the existing YAML
 `timeoutMs` (`implementTimeoutMs` / `stepTimeoutMs`), passed to the host dispatch as today — R9 adds